Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Database Security
Authentication
Mobile
Privacy
Compliance
Careers and People
Identity & Access Management
Security Monitoring
Advanced Threats
Insider Threats
Vulnerability Management
Comments
A New Approach to Endpoint Security: Think ‘Positive’
Newest First  |  Oldest First  |  Threaded View
JasonSachowski
JasonSachowski,
 User Rank: Author
5/16/2014 | 7:17:36 AM
Re: A New Approach to Endpoint Security: Think 'Positive'
Defense-in-depth involves a series of administrative, technical, and physical security controls that function at different operating layers; such as 0-DATA, 1-APPS, 2-USERS, 3-HOST, 4-INTRANET, 5-INTERNET.  Traditionally, this strategy has followed the assumption that all devices are – and will always be – connected to, trusted by, and managed from your organization.

Through an assessment, it would most likely be noted that the majority of these security controls are enforced within two layers: 3-HOST and 4-INTRANET.  Focusing on layer 3-HOST, there are any number of security controls that currently contribute - in varying percentages – to the endpoint protection; to which some can be surprisingly higher or lower than expected.  And for the most part, security controls operating at layer 3-HOST also have counterparts that operate at layer 4-INTRANET. 

"Postive security" for endpoint protection changes the perceived need for functional threat management into more attack surface reduction.  As you've stated that by "putting the securtiy emphasis on the data itself, and then bolstering the endpoints, APIs, devices, etc. through which it's shared and stored", we are better positioned to be attack-agnostic and gain such benefits as I've outlined previously.

By implementing "positive security" controls at layer 3-HOST while enhancing security controls within the reminaing layers, future endpoint protection will focus on reducing attack surface risk and further enable data access from anywhere, at any time, and on any-device.
IMjustinkern
IMjustinkern,
 User Rank: Strategist
5/14/2014 | 10:30:35 AM
Layers and new endpoints
This sounds like a good approach and the people using endpoint tools probably adapt to a more positive, enablement approach rather than FUD & "NO!" all of the time. Something Gartner has also been push a lot of late is endpoint security as just one layer. Specifically, putting the securtiy emphasis on the data itself, and then bolstering the endpoints, APIs, devices, etc. through which it's shared and stored. How do you see this positivity approach fitting in with a layered perspective?
JasonSachowski
JasonSachowski,
 User Rank: Author
5/13/2014 | 3:31:20 PM
Re: A New Approach to Endpoint Security: Think ‘Positive’
The biggest challenge with "positive security" is the technical InfoSec professionals.  For the most part, these are the people who are down in the weeds every day and are focused on threat mitigation.  The idea here is that instead of being concerned with managing threats, through signatures or functionalities we should focus on reducing the risk surfaces through attack-agnostic approaches; this can be challenging to change their point of view.  An example of this could be if we are to limit administrative access on a system, we inherently reduce the risk of unauthorized applications being installed and lessen the reliance on reactive mitigation.

The biggest success from implementing "positive security" would be in the operational cost savings/avoidance.  Some examples of where these benefits could be realized include:
1) displacement of several signature-based technologies that are no longer required;
2) improved system performance from lower resource utilization;
3) fewer incidents as a result of misconfigured signatures;
4) re-prioritization of staff from maintaining infrastructure functionality to enhancing business capabilities
Doug Finley
Doug Finley,
 User Rank: Apprentice
5/13/2014 | 11:48:49 AM
Re: Excellent article! And here is a product that operates on those principles...
"You cannot have a whitelist approach if you allow your users access to the internet, because even known good websites, such as Yahoo!, can be compromised by malicious ads that only need a user to click."

You haven't seen Security Assistant. This paper describes it - be sure to see the remarks about infected web sites on page 6.

It works, and can lock a system down as tight (or not) as desired.
Marilyn Cohodas
Marilyn Cohodas,
 User Rank: Strategist
5/13/2014 | 9:26:23 AM
Re: A New Approach to Endpoint Security: Think ‘Positive’
Jason, wondering if you can share some of your experiences transitioning to a positive security model in your workplace. What have been your biggest challenges and successes? 
JasonSachowski
JasonSachowski,
 User Rank: Author
5/12/2014 | 9:10:02 PM
Re: A New Approach to Endpoint Security: Think ‘Positive’
For "positive security" to truly work after becoming exposed to "negative security" for so long, we have to make small changes over time and eventually we will reach the end goal.  This strategy does not have to be intrusive if we follow an plan that involves socializing the concepts with users/business, learning what is "known-good" behavior within our organization, and gradually implementing controls.

Going a step further, even though the focus was on shifting technologies I am not saying that this is the one and only silver bullet to making this "positive security" strategy work.  What we tend to forget with InfoSec challenges is that there are three pillars involved; people first, followed by process, and supported through technology.  In order for any InfoSec strategy to be truly effective, I think that all three must coexist and complement each other.
Stus
Stus,
 User Rank: Apprentice
5/12/2014 | 12:48:14 PM
Re: Excellent article! And here is a product that operates on those principles...
@Robert - the combination of a whitelist for executables which block malware instantly, and a whitelist for websites where a user has the option to create a personal whitelist for websites (which -does- get scanned after the fact for malware) is a great way to solve that problem. Both shields reinforce each other and malware cannot call home to its command & control server.

Warm regards, Stu 
Robert McDougal
Robert McDougal,
 User Rank: Ninja
5/12/2014 | 11:52:23 AM
Re: Excellent article! And here is a product that operates on those principles...
While I agree that this is the direction endpoint security must proceed in order to stay ahead of today's threats, it is currently an operational headache.

Allow me to explain.  By eliminating a blacklist (blocking known bads) and moving to a whitelist (only allow known good) you can accomplish better security but only if you implement it completely.  You cannot have a whitelist approach if you allow your users access to the internet, because even known good websites, such as Yahoo!, can be compromised by malicious ads that only need a user to click.  Therefore, this approach requires you to block all internet sites except for those needed for business, all emails except from known senders, etc.  Now, if business needs to visit a new site, it first must be evaluated and vetted before being added to the whitelist.  All of this takes time and could stand in the way of making the business money.

I have yet to run across an effective whitelisting program or policy that doesn't inhibit the flow of business.  Once someone (smarter than me) comes up with a solution that can move at the speed of business then I will be ready to sign on.
MichaelD063
MichaelD063,
 User Rank: Apprentice
5/11/2014 | 8:53:30 AM
Re: Excellent article! And here is a product that operates on those principles...
You cant rely on lists be it black, white, gray etc etc etc. It doesnt work and is easily bypassed.   you must reduce (even eliminate) the attack surface as the article states and raise the cost of the bad guy.  Make it infinitly more difficult to attack the desktop and network.   
Stus
Stus,
 User Rank: Apprentice
5/10/2014 | 7:50:03 AM
Excellent article! And here is a product that operates on those principles...
This article is reflecting exactly what I have been thinking and operating off these last few years. 


Edge-DRsplash-10-edge-articles
I Smell a RAT! New Cybersecurity Threats for the Crypto Industry
David Trepp, Partner, IT Assurance with accounting and advisory firm BPM LLP,  7/9/2021
News
Attacks on Kaseya Servers Led to Ransomware in Less Than 2 Hours
Robert Lemos, Contributing Writer,  7/7/2021
Commentary
It's in the Game (but It Shouldn't Be)
Tal Memran, Cybersecurity Expert, CYE,  7/9/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Improving Enterprise Cybersecurity With XDR
Enterprises are looking at eXtended Detection and Response technologies to improve their abilities to detect, and respond to, threats. While endpoint detection and response is not new to enterprise security, organizations have to improve network visibility, expand data collection and expand threat hunting capabilites if they want their XDR deployments to succeed. This issue of Tech Insights also includes: a market overview for XDR from Omdia, questions to ask before deploying XDR, and an XDR primer.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2022-31081
PUBLISHED: 2022-06-27
HTTP::Daemon is a simple http server class written in perl. Versions prior to 6.15 are subject to a vulnerability which could potentially be exploited to gain privileged access to APIs or poison intermediate caches. It is uncertain how large the risks are, most Perl based applications are served on ...
CVE-2022-31082
PUBLISHED: 2022-06-27
GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. glpi-inventory-plugin is a plugin for GLPI to handle inventory management. In affected versions a SQL injection can be made using package deployment tasks. Thi...
CVE-2022-31084
PUBLISHED: 2022-06-27
LDAP Account Manager (LAM) is a webfrontend for managing entries (e.g. users, groups, DHCP settings) stored in an LDAP directory. In versions prior to 8.0 There are cases where LAM instantiates objects from arbitrary classes. An attacker can inject the first constructor argument. This can lead to co...
CVE-2022-31085
PUBLISHED: 2022-06-27
LDAP Account Manager (LAM) is a webfrontend for managing entries (e.g. users, groups, DHCP settings) stored in an LDAP directory. In versions prior to 8.0 the session files include the LDAP user name and password in clear text if the PHP OpenSSL extension is not installed or encryption is disabled b...
CVE-2022-31086
PUBLISHED: 2022-06-27
LDAP Account Manager (LAM) is a webfrontend for managing entries (e.g. users, groups, DHCP settings) stored in an LDAP directory. In versions prior to 8.0 incorrect regular expressions allow to upload PHP scripts to config/templates/pdf. This vulnerability could lead to a Remote Code Execution if th...