Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Perimeter

2/19/2013
11:19 AM
Wendy Nather
Wendy Nather
Commentary
50%
50%

Rashōmonitoring

When you don’t know who to believe

There’s something to be said for pure, unprocessed data: You know it doesn’t come with any assumptions.

Here’s a simple example: Logs show use of an application from an executive’s phone in Maryland. They also show some failed login attempts from an unknown device in Tokyo, within two hours of the other events. Now, some analytics would assume that the second set of logs was an attack from Asia, and the APT ALARM would go off, with "hacking-back" teams, energy drinks, and virtual chest bumps all around.

But suppose the executive really was in Tokyo and had left her phone at home, where her 6-year-old picked it up and started playing with it. And because she’d left the phone at home, she was borrowing someone else’s iPad -- and, it being late at night after a liquid dinner, the login process just wasn’t working as well as it usually does.

Security products are featuring more analytics these days to help automate and speed the interpretation and response process -- and that’s good because humans are both (relatively speaking) slow and expensive. But any rules, algorithms, or interpretations of the data can also reflect the perspective and assumptions of whoever created them.

These perspectives can clash, as shown in Akira Kurosawa’s classic film "Rashōmon," in which the main characters all relate their versions of the same story. In the same way, analysts can put their own interpretations on security events, depending on their own states of knowledge and even the order in which they see the data. Here are some assumptions that you may want to take into account when using automated or manual analysis:

  • Anything that appears to originate from an IP address in Eastern Europe or China is Bad.
  • Traffic from a proxy means that someone is up to No Good.
  • Nobody ever shares an account.
  • Anything that overloads a system is a denial-of-service attack. Or it’s never a denial-of-service attack; it’s just a runaway process or memory leak.
  • All systems are using dependable time sources that have not been tampered with. (For some scary scenarios that contradict this assumption, see Joe Klein’s "Time Lord" presentation at ShmooCon last weekend.)
  • Deviations from a baseline are always Bad. (If that were the case, then online sales events would be something to avoid.)
  • A policy violation is always unauthorized. (See my post on the need for exceptions.)
  • An attack pattern or specific piece of malware that has been seen before is coming from the same threat actor.
  • The more sources of data you have that are saying the same thing, the more confidence you should have that it’s accurate.
  • In order to avoid falling victim to unconscious (or undocumented) assumptions, make sure you know the models behind your analytics. Are you using a product from a company that started in the defense sector? Is the statistical analysis intended to detect fraud in financial transactions, not overdue library books? Are you using statistical baselines that are out of date and don’t reflect your current application traffic? How are historical events weighted in analyzing new ones?

    I’m not saying that you should distrust your SIEM. But I am saying that you shouldn’t stop questioning it, or yourself. Once in a while, take a fresh look at your unfiltered data sources, shake up your reporting, and have a different person interpret the alerts in your SOC. Make sure that you haven’t become complacent in your everyday monitoring because what you see tends to become what you expect to see.

    (I would like to thank Sandy "Mouse" Clark at the University of Pennsylvania for her discussions on this topic; she’ll be coming out soon with new research around how assumptions affect security.)

    Wendy Nather is Research Director of the Enterprise Security Practice at the independent analyst firm 451 Research. You can find her on Twitter as @451wendy.

    Wendy Nather is Research Director of the Enterprise Security Practice at independent analyst firm 451 Research. With over 30 years of IT experience, she has worked both in financial services and in the public sector, both in the US and in Europe. Wendy's coverage areas ... View Full Bio

    Comment  | 
    Print  | 
    More Insights
    Comments
    Newest First  |  Oldest First  |  Threaded View
    Commentary
    Ransomware Is Not the Problem
    Adam Shostack, Consultant, Entrepreneur, Technologist, Game Designer,  6/9/2021
    Edge-DRsplash-11-edge-ask-the-experts
    How Can I Test the Security of My Home-Office Employees' Routers?
    John Bock, Senior Research Scientist,  6/7/2021
    News
    New Ransomware Group Claiming Connection to REvil Gang Surfaces
    Jai Vijayan, Contributing Writer,  6/10/2021
    Register for Dark Reading Newsletters
    White Papers
    Video
    Cartoon Contest
    Write a Caption, Win an Amazon Gift Card! Click Here
    Latest Comment: Google's new See No Evil policy......
    Current Issue
    The State of Cybersecurity Incident Response
    In this report learn how enterprises are building their incident response teams and processes, how they research potential compromises, how they respond to new breaches, and what tools and processes they use to remediate problems and improve their cyber defenses for the future.
    Flash Poll
    How Enterprises are Developing Secure Applications
    How Enterprises are Developing Secure Applications
    Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
    Twitter Feed
    Dark Reading - Bug Report
    Bug Report
    Enterprise Vulnerabilities
    From DHS/US-CERT's National Vulnerability Database
    CVE-2021-24368
    PUBLISHED: 2021-06-20
    The Quiz And Survey Master – Best Quiz, Exam and Survey Plugin WordPress plugin before 7.1.18 did not sanitise or escape its result_id parameter when displaying an existing quiz result page, leading to a reflected Cross-Site Scripting issue. This c...
    CVE-2021-31664
    PUBLISHED: 2021-06-18
    RIOT-OS 2021.01 before commit 44741ff99f7a71df45420635b238b9c22093647a contains a buffer overflow which could allow attackers to obtain sensitive information.
    CVE-2021-33185
    PUBLISHED: 2021-06-18
    SerenityOS contains a buffer overflow in the set_range test in TestBitmap which could allow attackers to obtain sensitive information.
    CVE-2021-33186
    PUBLISHED: 2021-06-18
    SerenityOS in test-crypto.cpp contains a stack buffer overflow which could allow attackers to obtain sensitive information.
    CVE-2021-31272
    PUBLISHED: 2021-06-18
    SerenityOS before commit 3844e8569689dd476064a0759d704bc64fb3ca2c contains a directory traversal vulnerability in tar/unzip that may lead to command execution or privilege escalation.