Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Can We Talk? Finding A Common Security Language
Newest First  |  Oldest First  |  Threaded View
<<   <   Page 2 / 2
User Rank: Author
9/29/2014 | 4:58:39 PM
Re: Other Side Of The Coin
Drew,the short answer is yes.there are plenty of approches that can achieve what you describe via the buildout of the model.

creating the core, shared data model as ive described above (and storing data in it, analyzing it) is just the beginning. it isnt even necesary to look outside for a formal framework. in fact, just adding key fields and relationships to related data sets can be even more effective in an in-house solution that, for example, groups types of malware with simple, high-level incident reponse and triage procedures to serve as first-pass recipe system for moving out quickly when new malware beomes active malware.

we have seen big successes where organizations begin to track types of as-yet-unseen malware in and aorund them be able to react more quicky with mitigation by also tracking (simply, of course) what has been done in the past for similar problems. we use a simple "Polarity" metric attached to all our Actor-Target-Effect-Practice tuples, if you will, that map positive, negative or neutral to things like "security research" or "security solution" (as seen here).

this allows for quick sorting and filtering data to isolate things that may be not be active yet or may be the solution side of a problem you didnt yet know you have. what's more, it makes it easy to matrix these items into exploit knowledge bases or in-house incident respone recipes too. it's also great for surfacing to management in a way that tells them what may be out there too and show quantitatively what portion of your strategy these kinds of things occupy. simple data models can be very powerful when extended the right way and when data is collected diligently. not always a need to look outside for a solution either.


Marilyn Cohodas
Marilyn Cohodas,
User Rank: Strategist
9/29/2014 | 3:16:59 PM
Re: Other Side Of The Coin
I agree that this is a really interesting approach to a very entrenched tech problem that goes beyond infosec. My question, however, is whether Jason has used this in practice and how long did it take for people to really start understanding each other?
Drew Conry-Murray
Drew Conry-Murray,
User Rank: Ninja
9/29/2014 | 2:57:54 PM
Other Side Of The Coin
This is an interesting idea with concrete examples. You've focused on the impact of breaches, which is a good place to start. Is there a similar concept for measuring things that didn't happen (i.e. intrusions or attacks repelled) or to measure potential risk and steps to take to mitigate it?

For instance, if you know there's malware floating around that's attacking PoS systems, but you don't yet have data to measure its impact, is there a framework to talk about mitigation (i.e. Hey, maybe we should check our PoS software and see if we're vulnerable)?
<<   <   Page 2 / 2

I Smell a RAT! New Cybersecurity Threats for the Crypto Industry
David Trepp, Partner, IT Assurance with accounting and advisory firm BPM LLP,  7/9/2021
Attacks on Kaseya Servers Led to Ransomware in Less Than 2 Hours
Robert Lemos, Contributing Writer,  7/7/2021
It's in the Game (but It Shouldn't Be)
Tal Memran, Cybersecurity Expert, CYE,  7/9/2021
Register for Dark Reading Newsletters
White Papers
Current Issue
Creating an Effective Incident Response Plan
Security teams are realizing their organizations will experience a cyber incident at some point. An effective incident response plan that takes into account their specific requirements and has been tested is critical. This issue of Tech Insights also includes: -a look at the newly signed cyber-incident law, -how organizations can apply behavioral psychology to incident response, -and an overview of the Open Cybersecurity Schema Framework.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2022-12-01
A cross-site scripting (XSS) vulnerability exists in all current versions of Digital Alert Systems DASDEC software via the Host Header in undisclosed pages after login.
PUBLISHED: 2022-11-30
discourse-bbcode is the official BBCode plugin for Discourse. Prior to commit 91478f5, CSS injection can occur when rendering content generated with the discourse-bccode plugin. This vulnerability only affects sites which have the discourse-bbcode plugin installed and enabled. This issue is patched ...
PUBLISHED: 2022-11-30
Digital Alert Systems&acirc;&euro;&trade; DASDEC software prior to version 4.1 contains a cross-site scripting (XSS) vulnerability that allows remote attackers to inject arbitrary web script or HTML via the SSH username, username field of the login page, or via the HTTP host header. The injected con...
PUBLISHED: 2022-11-30
The Synthetic Monitoring Agent for Grafana's Synthetic Monitoring application provides probe functionality and executes network checks for monitoring remote targets. Users running the Synthetic Monitoring agent prior to version 0.12.0 in their local network are impacted. The authentication token use...
PUBLISHED: 2022-11-30
The IPsec VPN blade has a dedicated portal for downloading and connecting through SSL Network Extender (SNX). If the portal is configured for username/password authentication, it is vulnerable to a brute-force attack on usernames and passwords.