Black Hat: The Problems Don't Change, But The Solutions Have

An increase in attacker capabilities has drawn an innovative response from industry, and emerging research promises more to come

Mike Rothman, Analyst & President, Securosis

August 9, 2013

4 Min Read
Dark Reading logo in a gray background | Dark Reading

Bill Brenner figures there is nothing new in security. But it seems he's looking at it only from the perspective of the problem space. I agree that the problems we face as security professionals remain consistent. Bad folks want to steal our stuff. Employees and senior management don't care about security. And these same employees get very pissed when you tell them they can't do something, like watch adult movies on their iPads while connected to the VPN looking at next quarter's financials. Go figure.

But here's the deal: For the first time in a long time, there is real innovation happening in security. And we need that kind of innovation because the adversaries continue to up their games -- big time. They game applications, they blow up business processes, and they seem to have inside information about how your defenses work. So to think that your signature-based controls and traditional PCI-approved security products will stop these adversaries is naive. And, of course, you aren't naive, right?

Combine that with some pretty good outcomes for investors, like Sourcefire's multibillion-dollar deal with Cisco and FireEye's projected IPO, and you have a Internet bubble-style feeding frenzy on all things cybersecurity. And with new business models and technology architectures (yes, cloud, I'm looking at you), the attack surface is getting bigger and the risk continues to skyrocket. The only thing constant in security is change. So if you thought you were getting into a nice, cushy gig when you studied for that CISSP, forget about it.

Having just returned from a month at Black Hat (well, three days in Vegas seems like a month), there is a lot of stuff to talk about. Remember that Black Hat (and DEF CON, as well) are about emerging research. The stuff I talk about in the Vulnerabilities and Threats section now -- that will be covered in Dark Reading's Attacks and Breaches section in 12 to 18 months. The research at Black Hat was split among a number of pretty timely areas, including malware detection and evading those detections, security monitoring, and mobility.

The most active for research (and innovation) continues to be advanced malware detection. I mentioned a little of what's happening in Controlling the Big 7 a few weeks ago. These new endpoint-centric controls are the tip of the iceberg. Expect to see significant innovation coming to market relative to endpoint forensics and network-based malware detection. Is it perfect yet? No. Will these new tools promise to block every attack? Of course not. The reality is, today's traditional controls can't even block script kiddies using attack kits they bought on Craigslist with Bitcoins. These new offerings will fair better, although they'll be far from perfect.

The tactics to detect malware continue to advance as well. A few years ago, doing malware analysis required a significant investment (think millions of dollars) for both highly skilled people and gear to figure out what malware was doing and to profile it. Now we're seeing folks offering up Web-based services to do the same thing, and open-source initiatives to leverage Big Data analytics to decipher patterns across large data sets to isolate bad behaviors. I guess Big Data can be useful for more than figuring out how to make you pay the most for your airplane ticket or hotel room, and figuring out what should be on the shelves of your local Wal-Mart.

We also saw a bunch of research that can be useful to improve your protection against these malware attacks. But the sessions weren't pitched like that. You saw talk after talk about evasion, and there's a reason for that. Researchers don't really find protection that compelling. But getting around existing protections? Yeah, that's cool. So that means you (as a defender) need to figure out how these new evasion tactics obviate your preventive controls. Then you need to respond and evolve your defenses. Given the sexiness of sandboxes (on both the endpoint and network), it wasn't surprising to see a lot of research focused on bypassing these sandboxes. I hope the vendors were listening, since by the time research is shown at Black Hat, it's well on its way to being weaponized by the adversaries.

There was also Black Hat research on timely issues, like denial-of-service (DoS) attacks and attacking mobile devices. Actually, I was surprised by the modest number of sessions on mobile. Mobility was all over Black Hat last year, so either the topic is not as interesting (unlikely) or the selection committee has mobile exhaustion (more likely). And with the preponderance of DoS attacks, it's not surprising that research is going into figuring out how to evade the scrubbing services and other mitigation techniques.

I understand that Bill may be frustrated that the industry continues to have the same discussions about the same problems year after year without seeming to make any progress. But when you look under the covers both on the attack front and the defense front -- there is plenty of innovation happening. You just need to know where to look.

Mike Rothman is President of Securosis and author of The Pragmatic CSO

Read more about:

Black Hat News

About the Author

Mike Rothman

Analyst & President, Securosis

Mike's bold perspectives and irreverent style are invaluable as companies determine effective strategies to grapple with the dynamic security threatscape. Mike specializes in the sexy aspects of security, like protecting networks and endpoints, security management, and compliance. Mike is one of the most sought after speakers and commentators in the security business and brings a deep background in information security. After 20 years in and around security, he's one of the guys who "knows where the bodies are buried" in the space.

Starting his career as a programmer and a networking consultant, Mike joined META Group in 1993 and spearheaded META's initial foray into information security research. Mike left META in 1998 to found SHYM Technology, a pioneer in the PKI software market, and then held VP Marketing roles at CipherTrust and TruSecure - providing experience in marketing, business development, and channel operations for both product and services companies.

After getting fed up with vendor life, he started Security Incite in 2006 to provide the voice of reason in an over-hyped yet underwhelming security industry. After taking a short detour as Senior VP, Strategy and CMO at eIQnetworks to chase shiny objects in security and compliance management, Mike joins Securosis with a rejuvenated cynicism about the state of security and what it takes to survive as a security professional.Mike published "The Pragmatic CSO" in 2007 to introduce technically oriented security professionals to the nuances of what is required to be a senior security professional. He also possesses a very expensive engineering degree in Operations Research and Industrial Engineering from Cornell University. His folks are overjoyed that he uses literally zero percent of his education on a daily basis.

He can be reached at [email protected]. Follow him on Twitter @securityincite

Keep up with the latest cybersecurity threats, newly discovered vulnerabilities, data breach information, and emerging trends. Delivered daily or weekly right to your email inbox.

You May Also Like


More Insights