Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Perimeter

5/18/2010
11:54 AM
Adrian Lane
Adrian Lane
Commentary
50%
50%

Goldman Sachs Lawsuit Shows Need For DAM

When Goldman Sachs was hit with a lawsuit by Ipreo Networks, I got a call from Dark Reading contributor Ericka Chickowski to talk about the alleged misuse of the "BigDough" database. Specific details on this case remain scarce, but threats to Customer Relationship Management (CRM) systems and SaaS based data services are well known.

When Goldman Sachs was hit with a lawsuit by Ipreo Networks, I got a call from Dark Reading contributor Ericka Chickowski to talk about the alleged misuse of the "BigDough" database. Specific details on this case remain scarce, but threats to Customer Relationship Management (CRM) systems and SaaS based data services are well known.As is typical in these cases, the access control system validated the user. Ipreo suspects misuse because the logins were conducted via an Internet connection from and address owned by Goldman. The question is, what does Ipreo really know? If someone at Goldman was doing something wrong, why did it take Ipreo two years to detect the issue?

CRM system misuse is difficult to detect with standard security measures, but this is a textbook example of why database activity monitoring systems were invented.

I began writing homegrown activity monitoring tools in 1998, specifically to detect misuse of the brokerage CRM systems I managed. Through a combination of database triggers and network monitoring, the specific use cases I needed to address were brokers looking at a number of records that were "owned" by other brokers, or when a broker looked to be downloading a large percentage of the database. Our brokers commonly served multiple products and multiple geographic locations, so the trick was differentiating between normal behavior and suspect behavior. The commercial intrusion detection systems (IDS)lacked any of the business context to differentiate between normal and suspicious business transactions. CRM misuse is, to me, the very genesis of the database monitoring market.

Since that time, DAM platforms have undergone several generations of maturity, offering much better performance and analysis capabilities. But use of DAM products for SaaS services remains rare. Service providers still rely upon access controls, looking at the IP address in association with the users account during login in order to detect compromised credentials. And this approach remains effective at catching shared credentials used in different locations -- provided you only permit your customer to be in one location. But this is an outdated assumption with salespeople likely to be on the road, using any wireless hotspot they can connect with. That means a different IP address every day. Reliance on network-based detection is speculative at best.

The problem of sharing credentials is really common. You want to help a friend, so you give them a login to help solve a problem. But odds are that they use the account the next time they need a quick answer. Few people go to the hassle of changing their password to stop a friend from using the account again. Password rotation helps block the causal mis-user who was provided credentials and merely wants to view information to help them make business decisions. But odds are pretty good their friends and family will give them the new passwords as well.

Password policies do not address account hijacking, cases where data is altered, or detect a user downloading an entire copy of the database. Unless Ipreo was monitoring usage, their claim for damages will be sketchy at best. Their access control system saw valid credentials, their gateways see an IP address, but unless they engineered their applications to record data queries, they may not be able to prove data was actually viewed.

If a database contains valuable enough data, it's a safe bet it will attract the purely malicious attacker. Downloading credit card numbers to be sold or used in a fraudulent manner, altering accounts for financial gain, or monitoring inside information for stock trades are all malicious acts that go undetected by access controls, intrusion detection and most auditing systems. With more firms offering services over the Internet, or even in the cloud, we cannot differentiate between insiders and outsiders.

With SaaS, all of your users are outsiders. IP addresses can be faked, so the association of appropriate IP addresses in conjunction with a specific accounts is no longer a viable method to detect account hijacking. If Ipreo is serious about misuse detection for their database and doesn't want to allow shared account usage to go on for years, then they need to look at monitoring database activity.

If the database is how you generate most of your revenue, don't you think you should watch over it?

Adrian Lane is an analyst/CTO with Securosis LLC, an independent security consulting practice. Special to Dark Reading. Adrian Lane is a Security Strategist and brings over 25 years of industry experience to the Securosis team, much of it at the executive level. Adrian specializes in database security, data security, and secure software development. With experience at Ingres, Oracle, and ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
I 'Hacked' My Accounts Using My Mobile Number: Here's What I Learned
Nicole Sette, Director in the Cyber Risk practice of Kroll, a division of Duff & Phelps,  11/19/2019
6 Top Nontechnical Degrees for Cybersecurity
Curtis Franklin Jr., Senior Editor at Dark Reading,  11/21/2019
TPM-Fail: What It Means & What to Do About It
Ari Singer, CTO at TrustPhi,  11/19/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Navigating the Deluge of Security Data
In this Tech Digest, Dark Reading shares the experiences of some top security practitioners as they navigate volumes of security data. We examine some examples of how enterprises can cull this data to find the clues they need.
Flash Poll
Rethinking Enterprise Data Defense
Rethinking Enterprise Data Defense
Frustrated with recurring intrusions and breaches, cybersecurity professionals are questioning some of the industrys conventional wisdom. Heres a look at what theyre thinking about.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-19013
PUBLISHED: 2019-11-22
A CSRF vulnerability in Pagekit 1.0.17 allows an attacker to upload an arbitrary file by removing the CSRF token from a request.
CVE-2019-3427
PUBLISHED: 2019-11-22
The version V6.01.03.01 of ZTE ZXCDN IAMWEB product is impacted by a code injection vulnerability. An attacker could exploit the vulnerability to inject malicious code into the management page, resulting in users� information leakage.
CVE-2019-3428
PUBLISHED: 2019-11-22
The version V6.01.03.01 of ZTE ZXCDN IAMWEB product is impacted by a configuration error vulnerability. An attacker could directly access the management portal in HTTP, resulting in users� information leakage.
CVE-2019-4214
PUBLISHED: 2019-11-22
IBM SmartCloud Analytics 1.3.1 through 1.3.5 does not set the secure attribute on authorization tokens or session cookies. This could allow an attacker to obtain sensitive information using man in the middle techniques. IBM X-Force ID: 159185.
CVE-2019-4215
PUBLISHED: 2019-11-22
IBM SmartCloud Analytics 1.3.1 through 1.3.5 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and possibly launch further attacks ag...