Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Database Security
Authentication
Mobile
Privacy
Compliance
Careers and People
Identity & Access Management
Security Monitoring
Advanced Threats
Insider Threats
Vulnerability Management
Comments
A New Approach to Endpoint Security: Think ‘Positive’
Newest First  |  Oldest First  |  Threaded View
JasonSachowski
JasonSachowski,
 User Rank: Author
5/16/2014 | 7:17:36 AM
Re: A New Approach to Endpoint Security: Think 'Positive'
Defense-in-depth involves a series of administrative, technical, and physical security controls that function at different operating layers; such as 0-DATA, 1-APPS, 2-USERS, 3-HOST, 4-INTRANET, 5-INTERNET.  Traditionally, this strategy has followed the assumption that all devices are – and will always be – connected to, trusted by, and managed from your organization.

Through an assessment, it would most likely be noted that the majority of these security controls are enforced within two layers: 3-HOST and 4-INTRANET.  Focusing on layer 3-HOST, there are any number of security controls that currently contribute - in varying percentages – to the endpoint protection; to which some can be surprisingly higher or lower than expected.  And for the most part, security controls operating at layer 3-HOST also have counterparts that operate at layer 4-INTRANET. 

"Postive security" for endpoint protection changes the perceived need for functional threat management into more attack surface reduction.  As you've stated that by "putting the securtiy emphasis on the data itself, and then bolstering the endpoints, APIs, devices, etc. through which it's shared and stored", we are better positioned to be attack-agnostic and gain such benefits as I've outlined previously.

By implementing "positive security" controls at layer 3-HOST while enhancing security controls within the reminaing layers, future endpoint protection will focus on reducing attack surface risk and further enable data access from anywhere, at any time, and on any-device.
IMjustinkern
IMjustinkern,
 User Rank: Strategist
5/14/2014 | 10:30:35 AM
Layers and new endpoints
This sounds like a good approach and the people using endpoint tools probably adapt to a more positive, enablement approach rather than FUD & "NO!" all of the time. Something Gartner has also been push a lot of late is endpoint security as just one layer. Specifically, putting the securtiy emphasis on the data itself, and then bolstering the endpoints, APIs, devices, etc. through which it's shared and stored. How do you see this positivity approach fitting in with a layered perspective?
JasonSachowski
JasonSachowski,
 User Rank: Author
5/13/2014 | 3:31:20 PM
Re: A New Approach to Endpoint Security: Think ‘Positive’
The biggest challenge with "positive security" is the technical InfoSec professionals.  For the most part, these are the people who are down in the weeds every day and are focused on threat mitigation.  The idea here is that instead of being concerned with managing threats, through signatures or functionalities we should focus on reducing the risk surfaces through attack-agnostic approaches; this can be challenging to change their point of view.  An example of this could be if we are to limit administrative access on a system, we inherently reduce the risk of unauthorized applications being installed and lessen the reliance on reactive mitigation.

The biggest success from implementing "positive security" would be in the operational cost savings/avoidance.  Some examples of where these benefits could be realized include:
1) displacement of several signature-based technologies that are no longer required;
2) improved system performance from lower resource utilization;
3) fewer incidents as a result of misconfigured signatures;
4) re-prioritization of staff from maintaining infrastructure functionality to enhancing business capabilities
Doug Finley
Doug Finley,
 User Rank: Apprentice
5/13/2014 | 11:48:49 AM
Re: Excellent article! And here is a product that operates on those principles...
"You cannot have a whitelist approach if you allow your users access to the internet, because even known good websites, such as Yahoo!, can be compromised by malicious ads that only need a user to click."

You haven't seen Security Assistant. This paper describes it - be sure to see the remarks about infected web sites on page 6.

It works, and can lock a system down as tight (or not) as desired.
Marilyn Cohodas
Marilyn Cohodas,
 User Rank: Strategist
5/13/2014 | 9:26:23 AM
Re: A New Approach to Endpoint Security: Think ‘Positive’
Jason, wondering if you can share some of your experiences transitioning to a positive security model in your workplace. What have been your biggest challenges and successes? 
JasonSachowski
JasonSachowski,
 User Rank: Author
5/12/2014 | 9:10:02 PM
Re: A New Approach to Endpoint Security: Think ‘Positive’
For "positive security" to truly work after becoming exposed to "negative security" for so long, we have to make small changes over time and eventually we will reach the end goal.  This strategy does not have to be intrusive if we follow an plan that involves socializing the concepts with users/business, learning what is "known-good" behavior within our organization, and gradually implementing controls.

Going a step further, even though the focus was on shifting technologies I am not saying that this is the one and only silver bullet to making this "positive security" strategy work.  What we tend to forget with InfoSec challenges is that there are three pillars involved; people first, followed by process, and supported through technology.  In order for any InfoSec strategy to be truly effective, I think that all three must coexist and complement each other.
Stus
Stus,
 User Rank: Apprentice
5/12/2014 | 12:48:14 PM
Re: Excellent article! And here is a product that operates on those principles...
@Robert - the combination of a whitelist for executables which block malware instantly, and a whitelist for websites where a user has the option to create a personal whitelist for websites (which -does- get scanned after the fact for malware) is a great way to solve that problem. Both shields reinforce each other and malware cannot call home to its command & control server.

Warm regards, Stu 
Robert McDougal
Robert McDougal,
 User Rank: Ninja
5/12/2014 | 11:52:23 AM
Re: Excellent article! And here is a product that operates on those principles...
While I agree that this is the direction endpoint security must proceed in order to stay ahead of today's threats, it is currently an operational headache.

Allow me to explain.  By eliminating a blacklist (blocking known bads) and moving to a whitelist (only allow known good) you can accomplish better security but only if you implement it completely.  You cannot have a whitelist approach if you allow your users access to the internet, because even known good websites, such as Yahoo!, can be compromised by malicious ads that only need a user to click.  Therefore, this approach requires you to block all internet sites except for those needed for business, all emails except from known senders, etc.  Now, if business needs to visit a new site, it first must be evaluated and vetted before being added to the whitelist.  All of this takes time and could stand in the way of making the business money.

I have yet to run across an effective whitelisting program or policy that doesn't inhibit the flow of business.  Once someone (smarter than me) comes up with a solution that can move at the speed of business then I will be ready to sign on.
MichaelD063
MichaelD063,
 User Rank: Apprentice
5/11/2014 | 8:53:30 AM
Re: Excellent article! And here is a product that operates on those principles...
You cant rely on lists be it black, white, gray etc etc etc. It doesnt work and is easily bypassed.   you must reduce (even eliminate) the attack surface as the article states and raise the cost of the bad guy.  Make it infinitly more difficult to attack the desktop and network.   
Stus
Stus,
 User Rank: Apprentice
5/10/2014 | 7:50:03 AM
Excellent article! And here is a product that operates on those principles...
This article is reflecting exactly what I have been thinking and operating off these last few years. 


Edge-DRsplash-10-edge-articles
I Smell a RAT! New Cybersecurity Threats for the Crypto Industry
David Trepp, Partner, IT Assurance with accounting and advisory firm BPM LLP,  7/9/2021
News
Attacks on Kaseya Servers Led to Ransomware in Less Than 2 Hours
Robert Lemos, Contributing Writer,  7/7/2021
Commentary
It's in the Game (but It Shouldn't Be)
Tal Memran, Cybersecurity Expert, CYE,  7/9/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Everything You Need to Know About DNS Attacks
It's important to understand DNS, potential attacks against it, and the tools and techniques required to defend DNS infrastructure. This report answers all the questions you were afraid to ask. Domain Name Service (DNS) is a critical part of any organization's digital infrastructure, but it's also one of the least understood. DNS is designed to be invisible to business professionals, IT stakeholders, and many security professionals, but DNS's threat surface is large and widely targeted. Attackers are causing a great deal of damage with an array of attacks such as denial of service, DNS cache poisoning, DNS hijackin, DNS tunneling, and DNS dangling. They are using DNS infrastructure to take control of inbound and outbound communications and preventing users from accessing the applications they are looking for. To stop attacks on DNS, security teams need to shore up the organization's security hygiene around DNS infrastructure, implement controls such as DNSSEC, and monitor DNS traffic
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2023-33196
PUBLISHED: 2023-05-26
Craft is a CMS for creating custom digital experiences. Cross site scripting (XSS) can be triggered by review volumes. This issue has been fixed in version 4.4.7.
CVE-2023-33185
PUBLISHED: 2023-05-26
Django-SES is a drop-in mail backend for Django. The django_ses library implements a mail backend for Django using AWS Simple Email Service. The library exports the `SESEventWebhookView class` intended to receive signed requests from AWS to handle email bounces, subscriptions, etc. These requests ar...
CVE-2023-33187
PUBLISHED: 2023-05-26
Highlight is an open source, full-stack monitoring platform. Highlight may record passwords on customer deployments when a password html input is switched to `type="text"` via a javascript "Show Password" button. This differs from the expected behavior which always obfuscates `ty...
CVE-2023-33194
PUBLISHED: 2023-05-26
Craft is a CMS for creating custom digital experiences on the web.The platform does not filter input and encode output in Quick Post validation error message, which can deliver an XSS payload. Old CVE fixed the XSS in label HTML but didn’t fix it when clicking save. This issue was...
CVE-2023-2879
PUBLISHED: 2023-05-26
GDSDB infinite loop in Wireshark 4.0.0 to 4.0.5 and 3.6.0 to 3.6.13 allows denial of service via packet injection or crafted capture file