Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Database Security
Authentication
Mobile
Privacy
Compliance
Careers and People
Identity & Access Management
Security Monitoring
Advanced Threats
Insider Threats
Vulnerability Management
Comments
A New Approach to Endpoint Security: Think ‘Positive’
Newest First  |  Oldest First  |  Threaded View
JasonSachowski
50%
50%
JasonSachowski,
 User Rank: Author
5/16/2014 | 7:17:36 AM
Re: A New Approach to Endpoint Security: Think 'Positive'
Defense-in-depth involves a series of administrative, technical, and physical security controls that function at different operating layers; such as 0-DATA, 1-APPS, 2-USERS, 3-HOST, 4-INTRANET, 5-INTERNET.  Traditionally, this strategy has followed the assumption that all devices are – and will always be – connected to, trusted by, and managed from your organization.

Through an assessment, it would most likely be noted that the majority of these security controls are enforced within two layers: 3-HOST and 4-INTRANET.  Focusing on layer 3-HOST, there are any number of security controls that currently contribute - in varying percentages – to the endpoint protection; to which some can be surprisingly higher or lower than expected.  And for the most part, security controls operating at layer 3-HOST also have counterparts that operate at layer 4-INTRANET. 

"Postive security" for endpoint protection changes the perceived need for functional threat management into more attack surface reduction.  As you've stated that by "putting the securtiy emphasis on the data itself, and then bolstering the endpoints, APIs, devices, etc. through which it's shared and stored", we are better positioned to be attack-agnostic and gain such benefits as I've outlined previously.

By implementing "positive security" controls at layer 3-HOST while enhancing security controls within the reminaing layers, future endpoint protection will focus on reducing attack surface risk and further enable data access from anywhere, at any time, and on any-device.
IMjustinkern
50%
50%
IMjustinkern,
 User Rank: Strategist
5/14/2014 | 10:30:35 AM
Layers and new endpoints
This sounds like a good approach and the people using endpoint tools probably adapt to a more positive, enablement approach rather than FUD & "NO!" all of the time. Something Gartner has also been push a lot of late is endpoint security as just one layer. Specifically, putting the securtiy emphasis on the data itself, and then bolstering the endpoints, APIs, devices, etc. through which it's shared and stored. How do you see this positivity approach fitting in with a layered perspective?
JasonSachowski
100%
0%
JasonSachowski,
 User Rank: Author
5/13/2014 | 3:31:20 PM
Re: A New Approach to Endpoint Security: Think ‘Positive’
The biggest challenge with "positive security" is the technical InfoSec professionals.  For the most part, these are the people who are down in the weeds every day and are focused on threat mitigation.  The idea here is that instead of being concerned with managing threats, through signatures or functionalities we should focus on reducing the risk surfaces through attack-agnostic approaches; this can be challenging to change their point of view.  An example of this could be if we are to limit administrative access on a system, we inherently reduce the risk of unauthorized applications being installed and lessen the reliance on reactive mitigation.

The biggest success from implementing "positive security" would be in the operational cost savings/avoidance.  Some examples of where these benefits could be realized include:
1) displacement of several signature-based technologies that are no longer required;
2) improved system performance from lower resource utilization;
3) fewer incidents as a result of misconfigured signatures;
4) re-prioritization of staff from maintaining infrastructure functionality to enhancing business capabilities
Doug Finley
50%
50%
Doug Finley,
 User Rank: Apprentice
5/13/2014 | 11:48:49 AM
Re: Excellent article! And here is a product that operates on those principles...
"You cannot have a whitelist approach if you allow your users access to the internet, because even known good websites, such as Yahoo!, can be compromised by malicious ads that only need a user to click."

You haven't seen Security Assistant. This paper describes it - be sure to see the remarks about infected web sites on page 6.

It works, and can lock a system down as tight (or not) as desired.
Marilyn Cohodas
50%
50%
Marilyn Cohodas,
 User Rank: Strategist
5/13/2014 | 9:26:23 AM
Re: A New Approach to Endpoint Security: Think ‘Positive’
Jason, wondering if you can share some of your experiences transitioning to a positive security model in your workplace. What have been your biggest challenges and successes? 
JasonSachowski
50%
50%
JasonSachowski,
 User Rank: Author
5/12/2014 | 9:10:02 PM
Re: A New Approach to Endpoint Security: Think ‘Positive’
For "positive security" to truly work after becoming exposed to "negative security" for so long, we have to make small changes over time and eventually we will reach the end goal.  This strategy does not have to be intrusive if we follow an plan that involves socializing the concepts with users/business, learning what is "known-good" behavior within our organization, and gradually implementing controls.

Going a step further, even though the focus was on shifting technologies I am not saying that this is the one and only silver bullet to making this "positive security" strategy work.  What we tend to forget with InfoSec challenges is that there are three pillars involved; people first, followed by process, and supported through technology.  In order for any InfoSec strategy to be truly effective, I think that all three must coexist and complement each other.
Stus
50%
50%
Stus,
 User Rank: Apprentice
5/12/2014 | 12:48:14 PM
Re: Excellent article! And here is a product that operates on those principles...
@Robert - the combination of a whitelist for executables which block malware instantly, and a whitelist for websites where a user has the option to create a personal whitelist for websites (which -does- get scanned after the fact for malware) is a great way to solve that problem. Both shields reinforce each other and malware cannot call home to its command & control server.

Warm regards, Stu 
Robert McDougal
50%
50%
Robert McDougal,
 User Rank: Ninja
5/12/2014 | 11:52:23 AM
Re: Excellent article! And here is a product that operates on those principles...
While I agree that this is the direction endpoint security must proceed in order to stay ahead of today's threats, it is currently an operational headache.

Allow me to explain.  By eliminating a blacklist (blocking known bads) and moving to a whitelist (only allow known good) you can accomplish better security but only if you implement it completely.  You cannot have a whitelist approach if you allow your users access to the internet, because even known good websites, such as Yahoo!, can be compromised by malicious ads that only need a user to click.  Therefore, this approach requires you to block all internet sites except for those needed for business, all emails except from known senders, etc.  Now, if business needs to visit a new site, it first must be evaluated and vetted before being added to the whitelist.  All of this takes time and could stand in the way of making the business money.

I have yet to run across an effective whitelisting program or policy that doesn't inhibit the flow of business.  Once someone (smarter than me) comes up with a solution that can move at the speed of business then I will be ready to sign on.
MichaelD063
50%
50%
MichaelD063,
 User Rank: Apprentice
5/11/2014 | 8:53:30 AM
Re: Excellent article! And here is a product that operates on those principles...
You cant rely on lists be it black, white, gray etc etc etc. It doesnt work and is easily bypassed.   you must reduce (even eliminate) the attack surface as the article states and raise the cost of the bad guy.  Make it infinitly more difficult to attack the desktop and network.   
Stus
50%
50%
Stus,
 User Rank: Apprentice
5/10/2014 | 7:50:03 AM
Excellent article! And here is a product that operates on those principles...
This article is reflecting exactly what I have been thinking and operating off these last few years. 


Edge-DRsplash-10-edge-articles
I Smell a RAT! New Cybersecurity Threats for the Crypto Industry
David Trepp, Partner, IT Assurance with accounting and advisory firm BPM LLP,  7/9/2021
News
Attacks on Kaseya Servers Led to Ransomware in Less Than 2 Hours
Robert Lemos, Contributing Writer,  7/7/2021
Commentary
It's in the Game (but It Shouldn't Be)
Tal Memran, Cybersecurity Expert, CYE,  7/9/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
How Enterprises are Attacking the Cybersecurity Problem
Concerns over supply chain vulnerabilities and attack visibility drove some significant changes in enterprise cybersecurity strategies over the past year. Dark Reading's 2021 Strategic Security Survey showed that many organizations are staying the course regarding the use of a mix of attack prevention and threat detection technologies and practices for dealing with cyber threats.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-3746
PUBLISHED: 2021-10-19
A flaw was found in the libtpms code that may cause access beyond the boundary of internal buffers. The vulnerability is triggered by specially-crafted TPM2 command packets that then trigger the issue when the state of the TPM2's volatile state is written. The highest threat from this vulnerability ...
CVE-2011-1075
PUBLISHED: 2021-10-19
FreeBSD's crontab calculates the MD5 sum of the previous and new cronjob to determine if any changes have been made before copying the new version in. In particular, it uses the MD5File() function, which takes a pathname as an argument, and is called with euid 0. A race condition in this process may...
CVE-2021-26589
PUBLISHED: 2021-10-19
A potential security vulnerability has been identified in HPE Superdome Flex Servers. The vulnerability could be remotely exploited to allow Cross Site Scripting (XSS) because the Session Cookie is missing an HttpOnly Attribute. HPE has provided a firmware update to resolve the vulnerability in HPE ...
CVE-2021-27001
PUBLISHED: 2021-10-19
Clustered Data ONTAP versions 9.x prior to 9.5P18, 9.6P16, 9.7P16, 9.8P7 and 9.9.1P2 are susceptible to a vulnerability which could allow an authenticated privileged local attacker to arbitrarily modify Compliance-mode WORM data prior to the end of the retention period.
CVE-2021-36832
PUBLISHED: 2021-10-19
WordPress Popups, Welcome Bar, Optins and Lead Generation Plugin – Icegram (versions <= 2.0.2) vulnerable at "Headline" (&message_data[16][headline]) input.