BreachBytes

In case you missed it, Google has their own browser called Google Chrome. You can read about it in plenty of places but I am specifically addressing the security aspects of the browser. There a two key security benefits provided by Chrome that Google calls Safe Browsing: sandboxing and malware/phising URL detection.

Read the rest of this entry »

Robert Vamosi has a nice overview of two recent reports on his Defense in Depth blog, the first on data breaches and the second on identity theft. The interesting figures from both reports: 9/10 breaches could have been prevented by following best practices and 57% of identity thieves use the information to open new lines of credit (not too surprising).

A summary of the Verizon report on data breaches is available here while the entire report can be found here as a PDF. Likewise, a summary of the identity theft report can be found here and the full version here as a PDF.

Net/FSE has received coverage from IT Network World Canada posting it to their available downloads.  And in regard to our not returning their call, yes we have returned their call (albeit a little late).

An article written by my partner Ben Uphoff has been published by (IN)SECURE Magazine. Scroll down to page 68 for the full text of the article.

Ben has done a great job of outlining what it takes to perform effective incident investigation using Net/FSE for in-depth alert analysis. I’d like to outline some of the snippets from the article that support the point that network intrusions, breaches and incidents are inevitable and the only way to perform proper incident investigation is to “keep it all.”

A core belief at Packet Analytics is that despite the best efforts of security vendors and practitioners, incidents are inevitable. There are simply too many threats and too many angles of attack. Technology on enterprise networks evolves so quickly that it is nearly impossible to keep up with the ever-changing threat landscape. For this reason, network breaches and security incidents must be seen as part of doing business in a connected world. Enterprises can mitigate the risk of a breach by following best practices and preparing a comprehensive incident response and recovery plan.

One challenge with working with network event data is that you can never be sure what event information is relevant until after the fact. For example, enterprises did not see value in storing DNS logs until DNS exfiltration attacks started appearing. With no historical log of DNS activity, those that fell victim to such attacks had no way of definitively knowing the extent of the data leakage resulting from the breach.

Contrary to the “keep it all” approach, SIMs try to reduce data volume at the collection points by aggregating similar events into statistical summaries that are then fed into the correlation engine, losing potentially valuable information in the process. Summaries are useful for the correlation engine but not for deep analysis of network events

We look forward to starting a dialog on the “keep it all” strategy and how we can improve the effectiveness of security and network operations in performing Network Event Analysis. Please post a comment.

There is a lot of talk right now about security for virtual machines. My post from last week was about a company generating NetFlow data from virtual switches. Now at least two significant efforts are being announced at RSA. First, Solera Networks is releasing a free beta of a virtual network tap. Their premise is that buying virtual equivalents of IDS, IPS, etc is wasteful and expensive to enterprises. The virtual tap interfaces with Solera’s line of packet capture devices and closes the gap in network visibility in virtual environments. This approach seems stronger than Montego’s approach (NetFlow only). Solera provides the entire packet stream allowing you to do pretty much anything.

The second big announcement is from IBM, who is announcing “Phantom”, a hypervisor security layer.  This layer will let admins in virtual environments lock down the virtualized environment outside the VM instances allowing a single point of configuration to lock down a host of virtualized servers or clients. This will be a technology to keep an eye on in the coming months.

As usual, the security industry is catching up with a technology (this time around VM) that has been around for a considerable amount of time. This attention to virtual environment security is welcome but as usual a bit late in the game. The securtiy industry  is still not keeping pace with technology advances. I don’t expect it to catch up anytime soon.