Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Perimeter

6/7/2012
01:06 PM
Wendy Nather
Wendy Nather
Commentary
50%
50%

When Is A Breach Not A Breach?

Monitoring: It's not just for breaches anymore -- and actually it never was. Here are some of the other uses for security monitoring

When most people think of security monitoring, they think of external attackers breaking into systems, or they think of insider fraud. But there's a whole spectrum of monitoring cases that security groups have to deal with, and they're not all Threat Level Orange.

Sometimes the team is asked to investigate a suspicion of a suspicion -- to determine whether it’s worth anyone’s time to dig further. Sometimes the "breach" is actually a turf war between departments, branch offices, or system administrators, when someone uses a root password that they weren’t supposed to have. And sometimes the monitoring is just for distasteful behavior that, strictly speaking, isn’t security-related.

One of the most difficult tasks to do well with any kind of monitoring system is to support an HR investigation. Let’s take the classic example of an employee being suspected of visiting inappropriate websites using company systems. Most Web filtering reporting systems will list every single URL that the user’s browser accesses, and that’s a lot of them. Just think of how many ads, graphics, and frames are displayed on any given page, and throw in any automatic authentication processes behind the scenes.

The first task is to sort out which main site the user was actually visiting; the second is to determine which sites the user accessed on purpose. Determining intent in browsing behavior is not something that comes easily to a SIEM, but it’s crucial for any potential disciplinary action. Did the user just visit the Exotic Singles Club site, or did he log in there, indicating that this was more than a one-time thing?

Other "breach" incidents that monitoring can pick up include unscheduled code changes, strategic alteration of a legal document, employee naps at the keyboard, leaks to a reporter, accidental publication, magically appearing and disappearing servers (and I’m not even talking about virtual machines), and one person calling another a doodyhead on instant messaging.

Security monitoring can be supportive of the business as well. It can be used to prove to an auditor that actions were taken by a required deadline. I saw it used once in a grievance case to show that the company assumed an important email was successfully delivered by a certain time because it tracked all email bounces and didn’t get one for that recipient’s address. The right kind of security monitoring can help troubleshoot operational issues and collect information at a certain point in time that is no longer available anywhere else.

So when you’re designing your security monitoring system, make sure it supports more use cases than just "catching APTs." Gather requirements from your business areas, HR, legal, audit, and your colleagues in IT, because it can potentially be useful to all of them. Of course, you also need to be sure that your monitoring doesn’t clash with any data or privacy laws, but in all other ways, think bigger than "breach."

Wendy Nather is Research Director of the Enterprise Security Practice at the independent analyst firm 451 Research. You can find her on Twitter as @451wendy.

Wendy Nather is Research Director of the Enterprise Security Practice at independent analyst firm 451 Research. With over 30 years of IT experience, she has worked both in financial services and in the public sector, both in the US and in Europe. Wendy's coverage areas ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 9/25/2020
Hacking Yourself: Marie Moe and Pacemaker Security
Gary McGraw Ph.D., Co-founder Berryville Institute of Machine Learning,  9/21/2020
Startup Aims to Map and Track All the IT and Security Things
Kelly Jackson Higgins, Executive Editor at Dark Reading,  9/22/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Special Report: Computing's New Normal
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
How IT Security Organizations are Attacking the Cybersecurity Problem
How IT Security Organizations are Attacking the Cybersecurity Problem
The COVID-19 pandemic turned the world -- and enterprise computing -- on end. Here's a look at how cybersecurity teams are retrenching their defense strategies, rebuilding their teams, and selecting new technologies to stop the oncoming rise of online attacks.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-15208
PUBLISHED: 2020-09-25
In tensorflow-lite before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, when determining the common dimension size of two tensors, TFLite uses a `DCHECK` which is no-op outside of debug compilation modes. Since the function always returns the dimension of the first tensor, malicious attackers can ...
CVE-2020-15209
PUBLISHED: 2020-09-25
In tensorflow-lite before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, a crafted TFLite model can force a node to have as input a tensor backed by a `nullptr` buffer. This can be achieved by changing a buffer index in the flatbuffer serialization to convert a read-only tensor to a read-write one....
CVE-2020-15210
PUBLISHED: 2020-09-25
In tensorflow-lite before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, if a TFLite saved model uses the same tensor as both input and output of an operator, then, depending on the operator, we can observe a segmentation fault or just memory corruption. We have patched the issue in d58c96946b and ...
CVE-2020-15211
PUBLISHED: 2020-09-25
In TensorFlow Lite before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, saved models in the flatbuffer format use a double indexing scheme: a model has a set of subgraphs, each subgraph has a set of operators and each operator has a set of input/output tensors. The flatbuffer format uses indices f...
CVE-2020-15212
PUBLISHED: 2020-09-25
In TensorFlow Lite before versions 2.2.1 and 2.3.1, models using segment sum can trigger writes outside of bounds of heap allocated buffers by inserting negative elements in the segment ids tensor. Users having access to `segment_ids_data` can alter `output_index` and then write to outside of `outpu...