Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

7/7/2013
11:51 AM
Mike Rothman
Mike Rothman
Commentary
50%
50%

Controlling The Big 7

With limited resources, funding, and expertise, focusing on protecting the Big 7 applications will enable security professionals to reduce a large portion of their attack surface

I'm fascinated with more effective prioritization of security team activities. It's logical that given the constraints security folks face daily, figuring out how to maximize the impact of any activity is an important place to spend time. As legendary investor Warren Buffett has indicated, his most important responsibility is to effectively allocate the capital of Berkshire Hathaway. Your job is to most effectively allocate the resources, funding, and expertise of your security team.

As I discussed in my last Vulns and Threats post, understanding attack paths is one means of prioritizing your efforts. Reducing your applicable attack surface by locking down devices and aggressively segmenting networks is another way to control risk. You can also reduce attack surface by specifically protecting the select few applications frequently targeted by attackers. I call these the Big 7.

These are the applications that everyone has and uses every day -- you know, the apps that you cannot lock down or otherwise control. The ones that if they don't work, your employees cannot do their jobs. As such, they make the best targets for attackers since you can't just turn them off or lock them down. I'm talking about the browser, Java, Acrobat Reader, and Microsoft Office (Outlook, Word, Excel, PowerPoint). If you can control those applications, then you can probably eliminate a significant portion of the attacks that compromise your machines.

So how do you protect these applications? By granularly profiling them to understand how the applications interact with the device and then watching for activities that don't fit the profile. Does that sound familiar? Of course it does: It's how HIPS (host intrusion prevention) was supposed to work. The problem was that old HIPS tried to cover too much of the opening system (basically, everything) and, as a result, threw a bunch of false positives. Customers got pissed and stopped using it.

By focusing efforts specifically on the Big 7, it's a manageable task to build and maintain those profiles. You can tune the rules to find and block anomalous behavior in those applications and stop malicious activity. Conceptually, if you could prevent the Big 7 from being compromised and ensure that even when your employees do stupid things (and they will) it won't result in a pwned device -- that dramatically reduces your attack surface.

Notice I said "conceptually" above because the controls that implement these concepts are still maturing. It's complicated and requires significant ongoing research to keep the application profiles current. You need to pay attention to user experience and walk the tightrope between protecting the users from themselves and breaking their applications. Finally, these tools need better enterprise management, reporting, and policy capabilities to scale to protect thousands of users and devices. None of these issues are showstoppers; rather, they indicate the early stage of development for a promising technology.

These capabilities are being implemented in a number of different ways. Whether it's another "agent" that runs on the device watching for those non-normal behaviors, a microvisor that isolates processes within the operating systems, or an application isolation technology that runs the applications in protected enclaves, the approach is the same. These new defenses focus much of their efforts on the Big 7, and this will have a big impact on how devices are protected during the next few years.

Mike Rothman is President of Securosis and author of The Pragmatic CSO Mike's bold perspectives and irreverent style are invaluable as companies determine effective strategies to grapple with the dynamic security threatscape. Mike specializes in the sexy aspects of security, like protecting networks and endpoints, security management, and ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Zero-Factor Authentication: Owning Our Data
Nick Selby, Chief Security Officer at Paxos Trust Company,  2/19/2020
44% of Security Threats Start in the Cloud
Kelly Sheridan, Staff Editor, Dark Reading,  2/19/2020
Ransomware Damage Hit $11.5B in 2019
Dark Reading Staff 2/20/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
6 Emerging Cyber Threats That Enterprises Face in 2020
This Tech Digest gives an in-depth look at six emerging cyber threats that enterprises could face in 2020. Download your copy today!
Flash Poll
How Enterprises Are Developing and Maintaining Secure Applications
How Enterprises Are Developing and Maintaining Secure Applications
The concept of application security is well known, but application security testing and remediation processes remain unbalanced. Most organizations are confident in their approach to AppSec, although others seem to have no approach at all. Read this report to find out more.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2012-0828
PUBLISHED: 2020-02-21
Heap-based buffer overflow in Xchat-WDK before 1499-4 (2012-01-18) xchat 2.8.6 on Maemo architecture could allow remote attackers to cause a denial of service (xchat client crash) or execute arbitrary code via a UTF-8 line from server containing characters outside of the Basic Multilingual Plane (BM...
CVE-2012-0844
PUBLISHED: 2020-02-21
Information-disclosure vulnerability in Netsurf through 2.8 due to a world-readable cookie jar.
CVE-2013-3587
PUBLISHED: 2020-02-21
The HTTPS protocol, as used in unspecified web applications, can encrypt compressed data without properly obfuscating the length of the unencrypted data, which makes it easier for man-in-the-middle attackers to obtain plaintext secret values by observing length differences during a series of guesses...
CVE-2012-6277
PUBLISHED: 2020-02-21
Multiple unspecified vulnerabilities in Autonomy KeyView IDOL before 10.16, as used in Symantec Mail Security for Microsoft Exchange before 6.5.8, Symantec Mail Security for Domino before 8.1.1, Symantec Messaging Gateway before 10.0.1, Symantec Data Loss Prevention (DLP) before 11.6.1, IBM Notes 8....
CVE-2012-0063
PUBLISHED: 2020-02-21
Insecure plugin update mechanism in tucan through 0.3.10 could allow remote attackers to perform man-in-the-middle attacks and execute arbitrary code ith the permissions of the user running tucan.