Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

11/15/2013
08:00 AM
Venky Ganesan
Venky Ganesan
Commentary
100%
0%

Secure Your Network From Modern Hazards

Traditional security measures don't stand a chance in a data-centric world. But within the crisis lie opportunities for IT security pros.

Rather than focusing on the containers, CISOs and IT pros must take a more data-centric approach with an emphasis on data encryption, both at rest and in transit. To achieve security in a world of mobile and dynamic data, encryption must be ubiquitous, automatic, and on by default. Ubiquitous encryption at scale is hard to do, but it can be done. And if done well, it can render data irrelevant if breached. One way to attain broad data encryption is to institute corporate-wide policies that say data can never be in the clear when it is in rest or in motion and to standardize on a commercial key management system.

Fingerprint scanners, like the one in Apple's iPhone 5s, do nothing to protect the data stored on a mobile device.
Fingerprint scanners, like the one in Apple's iPhone 5s, do nothing to protect the data stored on a mobile device.

3. Third parties: The weakest link might not be yours
As data moves between devices and users and finally comes to rest, it might not end up on your own infrastructure. Rather, the data might end up in a cloud server or in an online backup service, file share, collaboration software, workgroup server, or partner database. Most likely it's in all of the above.

CISOs increasingly rely on partners for data processing and data storage, whether in the form of cloud providers or more traditional data processors and colocation facilities. Few companies operate without some footprint on Amazon's Cloud, Salesforce's CRM, or smaller SaaS players. Third parties represent a risk vector and companies must evaluate the risk of offloading data to a third party. There are new services available from vendors such as BitSight, Mandiant, and Terremark that offer independent metrics and scoring services for third-party risk.

You can prepare for the risks of moving data or processes to third parties by cataloguing all the third parties that store your data, requesting a security audit, and implementing encryption algorithms so that the data is not stored in the clear.

The information security market is in a perfect storm, but I see tremendous opportunity in this crisis. After all, every cloud has a silver lining.

Having a wealth of data is a good thing -- if you can make sense of it. Most companies are challenged with aggregating and analyzing the plethora of data being generated by their security applications and devices. The How Existing Security Data Can Help Identify Potential Attacks report recommends how to effectively leverage security data in order to make informed decisions and spot areas of vulnerability. (Free registration required.)

Previous
2 of 2
Next
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Lorna Garey
50%
50%
Lorna Garey,
User Rank: Ninja
11/19/2013 | 8:36:43 AM
Re: Encryption
I hope so. We plan to run a survey on encryption use in Q1, and trend it back to one we did in 2011. I will be very interested to see movement. What are some of the companies that you find interesting?
venkyganesan
50%
50%
venkyganesan,
User Rank: Apprentice
11/19/2013 | 1:18:45 AM
Re: Encryption
There are distributed key management solutions coming along so you are not dependent on a root key.  True security woudl require you not to be exposed to a single point of failure with a root key.
venkyganesan
50%
50%
venkyganesan,
User Rank: Apprentice
11/19/2013 | 1:16:19 AM
Re: Encryption
Lorna - you are right! Encryption currently has very low usage - key management is an issue so is latency and performance.  However there are solutions emerging that address all elements of this.  The security discussion is now in the boardroom and the downside of data leakage is so high that I believe top down mandates are coming to push encryption to the data level.  We will see.

Venky
Li Tan
50%
50%
Li Tan,
User Rank: Apprentice
11/17/2013 | 10:17:27 PM
Re: Encryption
@Lorna, very good question - in my opinion the data encryption is always a kind of paradox. Without encryption, the data will not be secure and you are exposed to security breach. If you try to encrypt everything, then what about if you lose your encryption key? The modern key management mechanism helped to give some relief on this issue. But the problem is not completly solved - there is still the trouble to renew the certificate in case it's lost. Another more severe question is that, how can we fully trust the root CA itself?
Kim Davis
50%
50%
Kim Davis,
User Rank: Apprentice
11/15/2013 | 4:37:36 PM
The Perimeter is Less Important
I think your general approach is right.  We can't ignore the perimeter, but defending it is no longer the be all and end all of security.  What's required is constant, real-time (and therefore automated) monitoring of data within the perimeter.
Susan Fogarty
50%
50%
Susan Fogarty,
User Rank: Apprentice
11/15/2013 | 12:33:44 PM
Security evolution
I agree that security needs to focus on the data, rather than the devices, systems and locations where we keep it. Those other elements are changing so quickly we can't possibly keep up. Another transition for security pros is to learn how to respond and recover after a breach or attack, and to put as much effort into that as into prevention. If your company is singled out and targeted, the best you may be able to do is cut your losses.
Lorna Garey
50%
50%
Lorna Garey,
User Rank: Ninja
11/15/2013 | 12:32:47 PM
Encryption
Your comment "one way to attain broad data encryption is to institute corporate-wide policies that say data can never be in the clear when it is in rest or in motion and to standardize on a commercial key management system." makes a huge amount of sense. However, actual use of encryption is in the single-digits in many surveys. Best case, databases at rest are encrypted. End user devices? Forget it. The usual excuse is key management -- that  these systems are still too complex and expensive.

What's your advice to IT pros who want to expand encryption but are running scared of losing keys?
Edge-DRsplash-10-edge-articles
7 Old IT Things Every New InfoSec Pro Should Know
Joan Goodchild, Staff Editor,  4/20/2021
News
Cloud-Native Businesses Struggle With Security
Robert Lemos, Contributing Writer,  5/6/2021
Commentary
Defending Against Web Scraping Attacks
Rob Simon, Principal Security Consultant at TrustedSec,  5/7/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-31922
PUBLISHED: 2021-05-14
An HTTP Request Smuggling vulnerability in Pulse Secure Virtual Traffic Manager before 21.1 could allow an attacker to smuggle an HTTP request through an HTTP/2 Header. This vulnerability is resolved in 21.1, 20.3R1, 20.2R1, 20.1R2, 19.2R4, and 18.2R3.
CVE-2021-32051
PUBLISHED: 2021-05-14
Hexagon G!nius Auskunftsportal before 5.0.0.0 allows SQL injection via the GiPWorkflow/Service/DownloadPublicFile id parameter.
CVE-2021-32615
PUBLISHED: 2021-05-13
Piwigo 11.4.0 allows admin/user_list_backend.php order[0][dir] SQL Injection.
CVE-2021-33026
PUBLISHED: 2021-05-13
The Flask-Caching extension through 1.10.1 for Flask relies on Pickle for serialization, which may lead to remote code execution or local privilege escalation. If an attacker gains access to cache storage (e.g., filesystem, Memcached, Redis, etc.), they can construct a crafted payload, poison the ca...
CVE-2021-31876
PUBLISHED: 2021-05-13
Bitcoin Core 0.12.0 through 0.21.1 does not properly implement the replacement policy specified in BIP125, which makes it easier for attackers to trigger a loss of funds, or a denial of service attack against downstream projects such as Lightning network nodes. An unconfirmed child transaction with ...