Category Archives: Ask the Security Experts

Ask The Information Security Experts: Management and Rational Decisions About Security

Posted on by
2

We’re starting a new series: “Ask the Security Experts.” We’ll pose an information security question and our panel of experts will do their best to answer.

 

Our panel:

  • Adam Hostetler, Network Engineer, Security Analyst
  • Phil Grimes, Security Analyst
  • John Davis, Risk Management Engineer

Our Question

How can organizations (whose management may be concerned about hyped-up zero day exploits) make rational decisions about what and how to protect their assets? 

John Davis:

I think you should start to bring management perspective by reiterating to them that there is no such thing as 100% security. You cannot be entirely sure of your network or information protection mechanisms. Tell them yes, zero day exploits are probably going to get past traditional AV, IDS and IPS. But emphasize that there are security measures that are effective in zero day situations. These include such controls as anomaly based detection mechanisms, system user security training, and incident response programs. If you can detect these attacks early and respond to them quickly and correctly, you can effectively limit the damage from zero day attacks.

Phil Grimes:

Read the available data in the 2012 Verizon Data Breach Investigations Report. This will help to show that zero day fears are mostly unwarranted. While the threat exists, statistics show that most events occur because of “low hanging fruit”, or issues attackers leverage that don’t need super elite skills and can often be mitigated easily on the victim’s side. The best things to do in this regard are to focus on being fundamentally secure (do the basics), and realize that detection and response are going to be the best tools to help recover from a zero day attack scenario. 

Adam Hostetler:

With the data we have (Verizon report, etc), it shows that zero day threats are not as dangerous as one might think. Explain to them that the threat exists, but is somewhat exaggerated due to some high profile cases. And if they have controls that could help combat any zero day threats, it would likely ease management’s fears.

“Ask the Information Security Experts” Series

Posted on by
2

We’re starting a new series: “Ask the Security Experts.” We’ll pose an information security question and our panel of experts will do their best to answer.

 

Our panel:

  • Adam Hostetler, Network Engineer, Security Analyst
  • Phil Grimes, Security Analyst

Our question:

There’s been a lot of attention lately about the leaking of passwords from sites like LinkedIn, Yahoo, Match.com, last.fm and others. What is the ONE THING that users of a site should do when these kinds of leaks happen? Each of you has such a wide variety of skills and focus, so what would you tell your Mom to do if she asked about this?

Adam: 
Figure out which sites you are using the same password on. Go to these sites and change them, use a unique password for each site. Keep these passwords in a password vault, such as KeePass or LastPass, with a strong master password.

Phil: 
Well, since NONE of our users should be reusing passwords, they should use their password vault tool to generate a new, strong password for the site(s) in question, change the password in their password manager, then change the password in the site itself. Also, take advantage of the password aging features of the password vault to remind you to change passwords on a regular basis. But changing the password of the affected site is the most critical thing, closely followed by NOT reusing passwords on multiple sites. 

There you have it! The bad guys will always try to find ways to cause trouble. Don’t make it easy for them. Use the tools mentioned and keep your data safe!