Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

10/28/2013
01:46 PM
50%
50%

Failure To Deploy: Aided And Abetted By Shelfware

It takes more than technology acquisition to protect against the insider threat -- just ask the NSA

Recent news reports indicate the NSA had acquired technologies to help prevent the leakage of classified data, but failed to deploy them before contractor Edward Snowden began working there. The technologies in question were purchased in the wake of the 2010 WikiLeaks scandal, but went uninstalled at NSA's Hawaii facility due to what was described as "bandwidth issues."

The path that allowed Snowden to pilfer large quantities of classified information was paved by the NSA's failure to deploy the technologies the agency had already acquired and presumably deployed at other facilities. As the technologies sat unused by the Hawaii facility, Snowden was, in essence, aided and abetted by shelfware.

This calls to mind an all-too-common story in many of today's enterprises when acquired technology is simply not deployed, but sits on the shelf where it may look good -- but doesn't do jack squat. With some technologies, the impact of not having these technologies in place is minimal. But when it comes to safeguarding sensitive data and protecting against inside threats, you could be playing a very high stakes game of chicken. And the consequences of losing the game? Simply disastrous. Just ask the NSA.

But lest I get too dramatic in my oversimplification, shelfware does not always represent a simple failure to deploy. In terms of the inside threat, there are varying levels on the fail scale, each of which we have likely encountered in our own experience. It's one thing to stick your head in the sand and pretend the threat does not exist. It's another to courageously acknowledge the threat -- but take no action. And it's something else entirely to face the threat head on, acquire technologies to protect against that threat, and then fail to put the technologies to their most beneficial use.

That said, we all know efforts made in good faith sometimes go awry. The overall initiative to protect against the insider threat may be carefully planned over months or even years, with meaningful requirements established, budgets approved, RFPs released, products evaluated, and, ultimately, dollars spent. But if organizations fail to put the technologies to their most effective use, budget is wasted and, worse yet, sensitive data is put at risk.

While we may not often see instances of blatant shelfware in our own organizations, where acquired products never even see the light of day, most organizations are guilty to some degree of lesser offenses when acquired technologies are not used to their full potential. Failure to make the most of a technology purchase may sound trivial or, at worst, just a sin of omission, but as demonstrated by the NSA's recent experience, the results can have very serious consequences. Jared is president of DLP Experts, a value-added reseller dedicated exclusively to data loss prevention (DLP) and other data protection technologies and services. For over twenty years Jared has held executive level positions with technology firms, with the last six years ... View Full Bio

 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
James McCabe
50%
50%
James McCabe,
User Rank: Apprentice
10/29/2013 | 8:49:25 PM
re: Failure To Deploy: Aided And Abetted By Shelfware
In some instances it becomes a requirements check box rather than a full implementation. Sad state of affairs.
COVID-19: Latest Security News & Commentary
Dark Reading Staff 7/9/2020
Omdia Research Launches Page on Dark Reading
Tim Wilson, Editor in Chief, Dark Reading 7/9/2020
4 Security Tips as the July 15 Tax-Day Extension Draws Near
Shane Buckley, President & Chief Operating Officer, Gigamon,  7/10/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Special Report: Computing's New Normal, a Dark Reading Perspective
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
The Threat from the Internetand What Your Organization Can Do About It
The Threat from the Internetand What Your Organization Can Do About It
This report describes some of the latest attacks and threats emanating from the Internet, as well as advice and tips on how your organization can mitigate those threats before they affect your business. Download it today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-15105
PUBLISHED: 2020-07-10
Django Two-Factor Authentication before 1.12, stores the user's password in clear text in the user session (base64-encoded). The password is stored in the session when the user submits their username and password, and is removed once they complete authentication by entering a two-factor authenticati...
CVE-2020-11061
PUBLISHED: 2020-07-10
In Bareos Director less than or equal to 16.2.10, 17.2.9, 18.2.8, and 19.2.7, a heap overflow allows a malicious client to corrupt the director's memory via oversized digest strings sent during initialization of a verify job. Disabling verify jobs mitigates the problem. This issue is also patched in...
CVE-2020-4042
PUBLISHED: 2020-07-10
Bareos before version 19.2.8 and earlier allows a malicious client to communicate with the director without knowledge of the shared secret if the director allows client initiated connection and connects to the client itself. The malicious client can replay the Bareos director's cram-md5 challenge to...
CVE-2020-11081
PUBLISHED: 2020-07-10
osquery before version 4.4.0 enables a priviledge escalation vulnerability. If a Window system is configured with a PATH that contains a user-writable directory then a local user may write a zlib1.dll DLL, which osquery will attempt to load. Since osquery runs with elevated privileges this enables l...
CVE-2020-6114
PUBLISHED: 2020-07-10
An exploitable SQL injection vulnerability exists in the Admin Reports functionality of Glacies IceHRM v26.6.0.OS (Commit bb274de1751ffb9d09482fd2538f9950a94c510a) . A specially crafted HTTP request can cause SQL injection. An attacker can make an authenticated HTTP request to trigger this vulnerabi...