Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Perimeter

5/6/2010
05:55 PM
50%
50%

The Idiot Threat

It's been interesting to see how the failed bombing in New York's Times Square has been sifted for "lessons."

It's been interesting to see how the failed bombing in New York's Times Square has been sifted for "lessons."The big "Times Square Lesson" in the news cycle right now is that there's something wrong with the "No-Fly" list. Of course, there's more than one way to interpret that...and so far, the media takeaway seems to be that the government and the airlines should spend even more money on it. This is preposterous.

As far as broad lessons for risk evaluation and mitigation that we might carry back to the IT security world with us, I think there are a couple lurking in the story.

First, big investments in sophisticated technologies won't catch amateur-hour attacks. It's possible that the propane tanks could have exploded and that would have been pretty serious. The current spin in the media seems to be that this was so boneheaded an attempt that it wouldn't have been likely to hurt anyone. Consensus view is that the guy was an idiot. I'm willing to believe that and I'm glad if he was too much of a rube to pull off the attack. But even goofballs can kill you. And I don't think any of the talking heads saying his bomb was never a real threat will volunteer to sit next to a smoldering car filled with propane tanks. If the propane tanks do blow, it's going to be pretty hot. So, there was danger there, but at the same time it was not the sophisticated sort of attack that we tend to focus on.

Most attacks are in fact low-tech, both in the world of home-rigged explosives and in the confines of the enterprise network. The comparatively cheap investments that give you options for finding or mitigating low-grade attacks are the investments to concentrate on. There are lots of options for sophisticated detection systems that will try to make the extended, real-time correlations that enable you to detect hackers who are trying to fly under the radar. Since this isn't most hackers, you've really got to keep these kinds of investments in perspective.

In Times Square, the low-cost investments had been made and they delivered brilliantly. There were plenty of cops on the street in the normal line of duty. There were lots of cameras to provide after-the-fact forensics (I'm not particularly espousing cameras, mind you -- my point is simply that they cost less than radiation sniffers). And the really straightforward measure of building in cement-block obstacles to prevent someone from driving a car bomb into at least some of the more sensitive buildings was in place (though, as I think about walking though the square, it occurs to me that there's probably opportunity to improve the protection of storefronts and subway entrances--if we're going to react directly to the attack with security investments, this is surely the best bang for the buck).

Another lesson: fast, old-school detective work creates fast results in catching culprits, thereby creating at least some measure of deterrence. The police closed in on the alleged attacker quickly and snatched him up before he could flee the country. This business about the no-fly list is a red herring. The point is they new how to do the basics, like track the VIN number on the Pathfinder. Basic "create the timeline using filestamps and log files" sort of work remains a skillset that every IT security team should have.

There are still plenty of sophisticated attacks and attackers, probably a lot more-so in the computer world than in the physical security environment. You can't ignore them, but you probably can't stop them during the attack, pretty much no matter what any vendor tells you about automated response. But what you can do is assemble better monitoring tools and better analysis tools and watch for anomalies that would signal that something was up. This is where we should spend the money in anti-terrorism, I'd wager, but I know less about that. I'm quite sure it's where investments are warranted in network environments, because normal parameters are easier to spell out and easier to check and recheck for exceptions.

Robert Richardson directs content and programs at the Computer Security Institute -- gocsi.com.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Why Cyber-Risk Is a C-Suite Issue
Marc Wilczek, Digital Strategist & CIO Advisor,  11/12/2019
DevSecOps: The Answer to the Cloud Security Skills Gap
Lamont Orange, Chief Information Security Officer at Netskope,  11/15/2019
Unreasonable Security Best Practices vs. Good Risk Management
Jack Freund, Director, Risk Science at RiskLens,  11/13/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Navigating the Deluge of Security Data
In this Tech Digest, Dark Reading shares the experiences of some top security practitioners as they navigate volumes of security data. We examine some examples of how enterprises can cull this data to find the clues they need.
Flash Poll
Rethinking Enterprise Data Defense
Rethinking Enterprise Data Defense
Frustrated with recurring intrusions and breaches, cybersecurity professionals are questioning some of the industrys conventional wisdom. Heres a look at what theyre thinking about.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-19010
PUBLISHED: 2019-11-16
Eval injection in the Math plugin of Limnoria (before 2019.11.09) and Supybot (through 2018-05-09) allows remote unprivileged attackers to disclose information or possibly have unspecified other impact via the calc and icalc IRC commands.
CVE-2019-16761
PUBLISHED: 2019-11-15
A specially crafted Bitcoin script can cause a discrepancy between the specified SLP consensus rules and the validation result of the [email protected] npm package. An attacker could create a specially crafted Bitcoin script in order to cause a hard-fork from the SLP consensus. All versions >1.0...
CVE-2019-16762
PUBLISHED: 2019-11-15
A specially crafted Bitcoin script can cause a discrepancy between the specified SLP consensus rules and the validation result of the slpjs npm package. An attacker could create a specially crafted Bitcoin script in order to cause a hard-fork from the SLP consensus. Affected users can upgrade to any...
CVE-2019-13581
PUBLISHED: 2019-11-15
An issue was discovered in Marvell 88W8688 Wi-Fi firmware before version p52, as used on Tesla Model S/X vehicles manufactured before March 2018, via the Parrot Faurecia Automotive FC6050W module. A heap-based buffer overflow allows remote attackers to cause a denial of service or execute arbitrary ...
CVE-2019-13582
PUBLISHED: 2019-11-15
An issue was discovered in Marvell 88W8688 Wi-Fi firmware before version p52, as used on Tesla Model S/X vehicles manufactured before March 2018, via the Parrot Faurecia Automotive FC6050W module. A stack overflow could lead to denial of service or arbitrary code execution.