Top 5 Network Security Technologies

The threats to your network are constantly evolving, so trying to defend your company is like trying to hit a moving target. Not only are new threats coming from external players, but having to protect yourself from malicious insiders is also part of keeping the business secure. Here are the “Top 5” technologies, in my opinion, that should be implemented within an organization from a networking perspective to limit risk. This doesn’t mean you’re secure, but applying these systems to your defense along with the proper monitoring and policy is a step in the right direction.

Vulnerability Management

There are many forms of vulnerability management, but knowing where your vulnerable is a good place to start your security program. Having an understanding of where you’re vulnerable in your systems, applications and networks before some with malicious intent does is highly valuable.

Data Loss Prevention (DLP)

Protecting your company from data leakage or loss is important. Many of these systems are designed to protect malicious intent from coming into the network, but what happens if someone’s on the inside? Using DLP to monitor and block protected information from leaving the network or being touched by those who shouldn’t have access is another way to defend against risk.

Log Management

If you’re not logging your systems you’ll be flying blind when an attack happens. Notice I didn’t say “if” an attack happens. During incident response you’ll wish you had the history or time machine of logs to rely on and assist you with incident management. No one ever said, “I wish I didn’t have all these logs” during an incident. Logging everything you have is essential.

Security Incident and Event Management (SIEM)

Now that we spoke about logging let’s take it up a notch. Now that you have the logs what are you going to do with them? Establishing a way to correlate these logs to capture security attempts against your network in real time is the next logical step. Creating rules and alerts based off the data you’re collecting from your systems is essential for defense.

Next Generation Firewall/IPS

I’m lumping these two in the same category because this market is starting to merge. Either way having one or both of these systems in line with your network will assist with blocking/alerting on malicious and suspicious traffic that’s passing through them, normally on the perimeter or between networks. Now that these systems are able to look into the packet data and analyze through the stack their importance in your network is vital.

Interactive Map from Project Honeynet

Interactive map from Project Honeynet data and the MD5 hash of the threat fromVirusTotal.

http://map.honeycloud.net

Wi-Fi for your fridge? That's just bananas.

We haven't even scratched the surface on the implications of having devices like these attached to the internet. The more you expose, the vulnerable you'll be, and I doubt people are thinking about lasting security consequences when rushing products to market.

This is where the physical world meets the cyber security world. No longer are you looking at hacking to steal data, but in these instances you're able to do physical harm to another person or people with these compromises. The ability to hack the electronic system of cars and pacemakers is a perfect example of this.

Companies are rushing to attach their technology to the internet without thinking of the long term risks they might have. I sound like a crotchety old man here, but I think in the grand scheme of things this will end up causing more harm than good.  

What do you think?

Securing big data: Architecture tips for building security in

Since “big data” is a hot topic these days, there’s no question an increasing number of enterprise infosec teams are going to be asked about the security-related ramifications of big data projects. There are many issues to look into, but here are a few tips for making big data security efforts more secure during architecture and implementation phases:

1. Create data controls as close to the data as possible, since much of this data isn’t “owned” by the security team. The risk of having big data traversing your network is that you have large amounts of confidential data – such as credit card data, Social Security numbers, personally identifiable information (PII), etc. -- that’s residing in new places and being used in new ways. Also, you’re usually not going to see terabytes of data siphoned from an organization, but the search for patterns to find the content in these databases is something to be concerned about. Keep the security as close to the data as possible and don’t rely on firewalls, IPS, DLP or other systems to protect the data.
2. Verify that sensitive fields are indeed protected by using encryption so when the data is analyzed, manipulated or sent to other areas of the organization, you’re limiting risk of exposure. All sensitive information needs to be encrypted once you have control over it.

Read the rest of my article from searchsecurity.com here: http://searchsecurity.techtarget.com/answer/Securing-big-data-Architecture-tips-for-building-security-in

Truth Bomb

Antivirus alternatives: Evolving enterprise endpoint security strategy

It's easy to see why so many savvy information security professionals are skeptical about the effectiveness of enterprise antivirus systems. Today, most malware is dropped directly onto enterprise endpoints without much effort on the part of attackers. Studies have shown that a fully updated antivirus package is only about 50% effective at guarding against malware and is almost useless in preventing zero-day attacks, which are becoming increasingly common.

 Malware writers are getting smarter and their viruses more sophisticated. Criminals are using encryption in their malware, along with robust business models that include quality control checks, license keys, upgrades, support and marketing. The bad guys take beating antivirus programs very seriously, and so should we.

A standard antivirus package is no match for today's malware because it is based on signatures. Having to keep thousands of antivirus clients up to date with the latest signatures is also something that becomes an issue; as AV signatures age, their effectiveness declines. This is just a cat-and-mouse game we play with cybercriminals that they are winning. In fact, most attackers test their malware against common antivirus products before ever employing it to ensure that the malware can get through. Although antivirus is still a needed layer in the defense-in-depth paradigm and demanded by many regulations, any organization that relies on antivirus alone for its endpoint protection has cause for concern.

Consider the path a malicious file normally takes before it arrives at an endpoint: The file is sent from the malicious source and makes its way through the Internet, onto the network, through a company's systems, and eventually onto its endpoint. Along this path are multiple opportunities within the network to catch this traffic and stop it before it causes a breach or infection.

Throughout this article, we'll look at each one of these locations in the network and propose a few technologies that can assist with the process of implementing a new endpoint security strategy for stopping malware before it strikes.

Antivirus alternatives: The cloud layer

The cloud has a scary reputation when it comes to storing data, but cloud computing can be especially helpful from an antivirus perspective. Many antivirus vendors now offer services in which they combine intelligence from tens of thousands of customers, partners and even other vendors to better pinpoint potentially malicious activity. The knowledge enables a more predictive form of protection from malware before it even hits a company's network.

When attempting to stop malware from infecting an endpoint, it should be stopped as close to the source as possible; the fewer layers it penetrates, the less likely it will get anywhere near an endpoint. There are only so many new signatures, antivirus or otherwise, that can be pushed down to a multitude of endpoints. If malware can be stopped in a choke point once, it would free up these nodes. Using cloud-based systems as part of the antimalware infrastructure reduces the number of malware instances that make their way to the local network.

Services like those provided by FireEye and ValidEdge allow traffic to be scanned for malware before it hits the network. These providers' services rely on appliances that are in tune with similar systems and work together against known recent attacks. This allows for quicker and more comprehensive protection before potentially malicious traffic enters into the network. In essence, the cloud allows many systems to globally share intelligence to stop malware.

Read the rest of my article for SearchSecurity.com at: http://searchsecurity.techtarget.com/tip/Antivirus-alternatives-Evolving-enterprise-endpoint-security-strategy?utm_source=twitter&utm_medium=social&utm_campaign=searchsecurity_mpascucci_09042012_1PM_tip

Network Security Horror Stories: Router Misconfigurations

In our the last installment of our network security horror stories (part one was on Change Control and part 2 on Firewall Misconfigurations) and today we’re going to focus on router misconfigurations. Like firewalls, routers play an important part of your organization’s network, but unlike firewalls they are not a security appliance. Even though routers main purpose isn’t security focused, it doesn’t mean that you can’t secure them. Here are a few classic router misconfiguration examples that I’ve come across:

1.    HTTP Open on the Router

While reviewing security for a company from the perimeter I discovered that HTTP was enabled on their core Cisco routers. They were both running very old versions of the IOS and were using the default credentials to log into the device. After getting into the router I was able to escalate to “enable” mode and could in theory have changed routes or wiped the NVRAM. After speaking with the network owners we quickly removed the HTTP service from the core routers and dodged a bullet.

2.    Password Files Stored on Router

Everyone knows that if you’re going to store passwords you should do it in a secure manner as to not divulge your credentials. Well, in this instance an admin decided to store all of the company’s credentials in a Microsoft Word file on the router’s storage. This router was running SSHv1 and penetration testers were able to gain access to the system. After finding this file they were given complete access to the company without blinking an eye. When the admin was confronted about the file being stored his response was, “But you can’t open the .doc file on a Cisco router!!”. He obviously wasn’t getting it.

Read the rest of my article posted on Algosec's blog: http://blog.algosec.com/2012/09/network-security-horror-stories-router-misconfigurations.html