Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Database Security
Authentication
Mobile
Privacy
Compliance
Careers and People
Identity & Access Management
Security Monitoring
Advanced Threats
Insider Threats
Vulnerability Management
Comments
A New Approach to Endpoint Security: Think ‘Positive’
Newest First  |  Oldest First  |  Threaded View
JasonSachowski
JasonSachowski,
 User Rank: Author
5/16/2014 | 7:17:36 AM
Re: A New Approach to Endpoint Security: Think 'Positive'
Defense-in-depth involves a series of administrative, technical, and physical security controls that function at different operating layers; such as 0-DATA, 1-APPS, 2-USERS, 3-HOST, 4-INTRANET, 5-INTERNET.  Traditionally, this strategy has followed the assumption that all devices are – and will always be – connected to, trusted by, and managed from your organization.

Through an assessment, it would most likely be noted that the majority of these security controls are enforced within two layers: 3-HOST and 4-INTRANET.  Focusing on layer 3-HOST, there are any number of security controls that currently contribute - in varying percentages – to the endpoint protection; to which some can be surprisingly higher or lower than expected.  And for the most part, security controls operating at layer 3-HOST also have counterparts that operate at layer 4-INTRANET. 

"Postive security" for endpoint protection changes the perceived need for functional threat management into more attack surface reduction.  As you've stated that by "putting the securtiy emphasis on the data itself, and then bolstering the endpoints, APIs, devices, etc. through which it's shared and stored", we are better positioned to be attack-agnostic and gain such benefits as I've outlined previously.

By implementing "positive security" controls at layer 3-HOST while enhancing security controls within the reminaing layers, future endpoint protection will focus on reducing attack surface risk and further enable data access from anywhere, at any time, and on any-device.
IMjustinkern
IMjustinkern,
 User Rank: Strategist
5/14/2014 | 10:30:35 AM
Layers and new endpoints
This sounds like a good approach and the people using endpoint tools probably adapt to a more positive, enablement approach rather than FUD & "NO!" all of the time. Something Gartner has also been push a lot of late is endpoint security as just one layer. Specifically, putting the securtiy emphasis on the data itself, and then bolstering the endpoints, APIs, devices, etc. through which it's shared and stored. How do you see this positivity approach fitting in with a layered perspective?
JasonSachowski
JasonSachowski,
 User Rank: Author
5/13/2014 | 3:31:20 PM
Re: A New Approach to Endpoint Security: Think ‘Positive’
The biggest challenge with "positive security" is the technical InfoSec professionals.  For the most part, these are the people who are down in the weeds every day and are focused on threat mitigation.  The idea here is that instead of being concerned with managing threats, through signatures or functionalities we should focus on reducing the risk surfaces through attack-agnostic approaches; this can be challenging to change their point of view.  An example of this could be if we are to limit administrative access on a system, we inherently reduce the risk of unauthorized applications being installed and lessen the reliance on reactive mitigation.

The biggest success from implementing "positive security" would be in the operational cost savings/avoidance.  Some examples of where these benefits could be realized include:
1) displacement of several signature-based technologies that are no longer required;
2) improved system performance from lower resource utilization;
3) fewer incidents as a result of misconfigured signatures;
4) re-prioritization of staff from maintaining infrastructure functionality to enhancing business capabilities
Doug Finley
Doug Finley,
 User Rank: Apprentice
5/13/2014 | 11:48:49 AM
Re: Excellent article! And here is a product that operates on those principles...
"You cannot have a whitelist approach if you allow your users access to the internet, because even known good websites, such as Yahoo!, can be compromised by malicious ads that only need a user to click."

You haven't seen Security Assistant. This paper describes it - be sure to see the remarks about infected web sites on page 6.

It works, and can lock a system down as tight (or not) as desired.
Marilyn Cohodas
Marilyn Cohodas,
 User Rank: Strategist
5/13/2014 | 9:26:23 AM
Re: A New Approach to Endpoint Security: Think ‘Positive’
Jason, wondering if you can share some of your experiences transitioning to a positive security model in your workplace. What have been your biggest challenges and successes? 
JasonSachowski
JasonSachowski,
 User Rank: Author
5/12/2014 | 9:10:02 PM
Re: A New Approach to Endpoint Security: Think ‘Positive’
For "positive security" to truly work after becoming exposed to "negative security" for so long, we have to make small changes over time and eventually we will reach the end goal.  This strategy does not have to be intrusive if we follow an plan that involves socializing the concepts with users/business, learning what is "known-good" behavior within our organization, and gradually implementing controls.

Going a step further, even though the focus was on shifting technologies I am not saying that this is the one and only silver bullet to making this "positive security" strategy work.  What we tend to forget with InfoSec challenges is that there are three pillars involved; people first, followed by process, and supported through technology.  In order for any InfoSec strategy to be truly effective, I think that all three must coexist and complement each other.
Stus
Stus,
 User Rank: Apprentice
5/12/2014 | 12:48:14 PM
Re: Excellent article! And here is a product that operates on those principles...
@Robert - the combination of a whitelist for executables which block malware instantly, and a whitelist for websites where a user has the option to create a personal whitelist for websites (which -does- get scanned after the fact for malware) is a great way to solve that problem. Both shields reinforce each other and malware cannot call home to its command & control server.

Warm regards, Stu 
Robert McDougal
Robert McDougal,
 User Rank: Ninja
5/12/2014 | 11:52:23 AM
Re: Excellent article! And here is a product that operates on those principles...
While I agree that this is the direction endpoint security must proceed in order to stay ahead of today's threats, it is currently an operational headache.

Allow me to explain.  By eliminating a blacklist (blocking known bads) and moving to a whitelist (only allow known good) you can accomplish better security but only if you implement it completely.  You cannot have a whitelist approach if you allow your users access to the internet, because even known good websites, such as Yahoo!, can be compromised by malicious ads that only need a user to click.  Therefore, this approach requires you to block all internet sites except for those needed for business, all emails except from known senders, etc.  Now, if business needs to visit a new site, it first must be evaluated and vetted before being added to the whitelist.  All of this takes time and could stand in the way of making the business money.

I have yet to run across an effective whitelisting program or policy that doesn't inhibit the flow of business.  Once someone (smarter than me) comes up with a solution that can move at the speed of business then I will be ready to sign on.
MichaelD063
MichaelD063,
 User Rank: Apprentice
5/11/2014 | 8:53:30 AM
Re: Excellent article! And here is a product that operates on those principles...
You cant rely on lists be it black, white, gray etc etc etc. It doesnt work and is easily bypassed.   you must reduce (even eliminate) the attack surface as the article states and raise the cost of the bad guy.  Make it infinitly more difficult to attack the desktop and network.   
Stus
Stus,
 User Rank: Apprentice
5/10/2014 | 7:50:03 AM
Excellent article! And here is a product that operates on those principles...
This article is reflecting exactly what I have been thinking and operating off these last few years. 


Edge-DRsplash-10-edge-articles
I Smell a RAT! New Cybersecurity Threats for the Crypto Industry
David Trepp, Partner, IT Assurance with accounting and advisory firm BPM LLP,  7/9/2021
News
Attacks on Kaseya Servers Led to Ransomware in Less Than 2 Hours
Robert Lemos, Contributing Writer,  7/7/2021
Commentary
It's in the Game (but It Shouldn't Be)
Tal Memran, Cybersecurity Expert, CYE,  7/9/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Practical Network Security Approaches for a Multicloud, Hybrid IT World
The report covers areas enterprises should focus on for their multicloud/hybrid cloud security strategy: -increase visibility over the environment -learning cloud-specific skills -relying on established security frameworks -re-architecting the network
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2022-30333
PUBLISHED: 2022-05-09
RARLAB UnRAR before 6.12 on Linux and UNIX allows directory traversal to write to files during an extract (aka unpack) operation, as demonstrated by creating a ~/.ssh/authorized_keys file. NOTE: WinRAR and Android RAR are unaffected.
CVE-2022-23066
PUBLISHED: 2022-05-09
In Solana rBPF versions 0.2.26 and 0.2.27 are affected by Incorrect Calculation which is caused by improper implementation of sdiv instruction. This can lead to the wrong execution path, resulting in huge loss in specific cases. For example, the result of a sdiv instruction may decide whether to tra...
CVE-2022-28463
PUBLISHED: 2022-05-08
ImageMagick 7.1.0-27 is vulnerable to Buffer Overflow.
CVE-2022-28470
PUBLISHED: 2022-05-08
marcador package in PyPI 0.1 through 0.13 included a code-execution backdoor.
CVE-2022-1620
PUBLISHED: 2022-05-08
NULL Pointer Dereference in function vim_regexec_string at regexp.c:2729 in GitHub repository vim/vim prior to 8.2.4901. NULL Pointer Dereference in function vim_regexec_string at regexp.c:2729 allows attackers to cause a denial of service (application crash) via a crafted input.