Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Comments
Rethinking Security With A System Of 'Checks & Balances'
Newest First  |  Oldest First  |  Threaded View
RyanSepe
50%
50%
RyanSepe,
User Rank: Ninja
11/20/2014 | 10:01:47 AM
Re: Prevention is ideal but detection is a must!
@andregironda

The comments referred to were not arguments, they were statements stressing the need for what you call the "fusion center". They were a reiteration of the fact that all facets need to be acknowledged not just one and the loop needs to be constant and refined on a regular basis.
BrianFoster
50%
50%
BrianFoster,
User Rank: Author
11/18/2014 | 4:52:46 PM
It's all about the feedback loop
Andre Gironda is spot on (see his comment below). It's not enough to just implement prevention, detection and response in silos. In order to truly get ahead of these threats, and stop feeling like you're on a hamster wheel, you must share intelligence in a feedback loop across these technologies, so you don't continue to leave the same vulnerabilities open. We'll try to go even more in-depth on some of these examples in future posts. 
andregironda
50%
50%
andregironda,
User Rank: Strategist
11/18/2014 | 4:06:10 PM
Re: Prevention is ideal but detection is a must!
Prevention is not ideal and detection, like prevention are, of course, must-haves.

I don't understand the arguments in the comments. What the author was trying to convey is that we need feedback loops between the protect, detect, and respond capabilities of a cyber risk program. I call this the "fusion center".
GonzSTL
50%
50%
GonzSTL,
User Rank: Ninja
11/18/2014 | 3:34:00 PM
Re: Prevention is ideal but detection is a must!
I agree that detection is a must. At the same time, incident response is also critical. The malware responsible for the Target breach WAS detected early on. Unfortunately, their incident response strategy failed, and they got breached. End of story.
RyanSepe
50%
50%
RyanSepe,
User Rank: Ninja
11/18/2014 | 1:59:44 PM
Re: Prevention is ideal but detection is a must!
Good analogy. I think a layered approach is definitely a powerful security approach. It also may be a good idea to keep these layers inconsistent. By this I mean the mechanisms that are used between Prevention, Detection, and Remediation in correlation to IDS/IPS, Firewall, Anti-virus, and baseline cannot have similar mechanisms for deterrence. An article was done on Dark Reading earlier this year from Blackhat states that a consistency would make the layers easier to compromise. If one layer was compromised, another layer with similar mechanisms would also be in danger. It sounds counter intuitive but a layered-consistent approach riddled with inconsistency is best.

Consistency of Process

Inconsistency of Mechanisms
Robert McDougal
50%
50%
Robert McDougal,
User Rank: Ninja
11/17/2014 | 1:50:36 PM
Re: Prevention is ideal but detection is a must!
In today's security landscape I see prevention, detection, and response being treated as a layered filtering approach. Think of prevention like a piece of fine screen door, it will prevent the majority of bugs that attempt to get through. However, this layer has a problem in that it is only able to block those bugs that it is aware of, if a bug is small enough it can slip through undetected. This is where detection comes into play, monitoring everything inside the house for anything out of the normal. Why is Uncle Henry sneezing? We should take a look at that. Finally, you get to response which is after realizing Uncle Henry has a cold, you have to get him well and find and fix the hole in the screen door that let the bug inside in the first place.


Or Henry could have brought the bug in with him....
RyanSepe
100%
0%
RyanSepe,
User Rank: Ninja
11/17/2014 | 7:26:31 AM
Prevention is ideal but detection is a must!
As the saying above goes, it is mission critical to ensure that if anything has infiltrated your network that you have the ability to detect and mitigate the risk. Prevention is just one piece of the puzzle as stated in the article and definitely has failed in the past due to a myriad of reasons. Same with the other two pieces but our faith in prevention has clouded us in some ways to the fact that its probably one of the less crucial of the branches. Prevention is ideal for any network however I believe that this ideal notion is riddled with inconsistency. Most if not all networks have been infiltrated in one way or another I believe. Whether this has been detrimental or not to this point is irrelevant, its our job to ensure that we are able to find these threats and eliminate them quickly and efficiently. For that we need to place more weight on the other two branches just as this article denotes. Tools such as IDS, anti-virus, and baseline analyzers can help in this regard. Other thoughts on how to put more emphasis on the other two branches.


COVID-19: Latest Security News & Commentary
Dark Reading Staff 7/13/2020
Omdia Research Launches Page on Dark Reading
Tim Wilson, Editor in Chief, Dark Reading 7/9/2020
Russian Cyber Gang 'Cosmic Lynx' Focuses on Email Fraud
Kelly Sheridan, Staff Editor, Dark Reading,  7/7/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Special Report: Computing's New Normal, a Dark Reading Perspective
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
The Threat from the Internetand What Your Organization Can Do About It
The Threat from the Internetand What Your Organization Can Do About It
This report describes some of the latest attacks and threats emanating from the Internet, as well as advice and tips on how your organization can mitigate those threats before they affect your business. Download it today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-20907
PUBLISHED: 2020-07-13
In Lib/tarfile.py in Python through 3.8.3, an attacker is able to craft a TAR archive leading to an infinite loop when opened by tarfile.open, because _proc_pax lacks header validation.
CVE-2020-14174
PUBLISHED: 2020-07-13
Affected versions of Atlassian Jira Server and Data Center allow remote attackers to view titles of a private project via an Insecure Direct Object References (IDOR) vulnerability in the Administration Permission Helper. The affected versions are before version 7.13.6, from version 8.0.0 before 8.5....
CVE-2019-20901
PUBLISHED: 2020-07-13
The login.jsp resource in Jira before version 8.5.2, and from version 8.6.0 before version 8.6.1 allows remote attackers to redirect users to a different website which they may use as part of performing a phishing attack via an open redirect in the os_destination parameter.
CVE-2019-20898
PUBLISHED: 2020-07-13
Affected versions of Atlassian Jira Server and Data Center allow remote attackers to access sensitive information without being authenticated in the Global permissions screen. The affected versions are before version 8.8.0.
CVE-2019-20899
PUBLISHED: 2020-07-13
The Gadget API in Atlassian Jira Server and Data Center in affected versions allows remote attackers to make Jira unresponsive via repeated requests to a certain endpoint in the Gadget API. The affected versions are before version 8.5.4, and from version 8.6.0 before 8.6.1.