Brent Huston shares his thoughts on the upcoming iOS5 and Apple’s iCloud.
Click here to listen
Audio Blog Post: What Apple’s iCloud Means For The Enterprise
Reply
Category Archives: General InfoSec
Meet Our New Information Security Account Exec: Chris Lay
Chris talks about MicroSolved, Inc. and shares his excitement about our ability to help companies create a threat-centric information security strategy.
Welcome, Chris!
MicroSolved’s Strategies & Tactics Talk: #3 APT: Less Advanced Than You May Think
So how “advanced” is APT?
Listen in as our tech team discusses various aspects of APT such as:
- How it has been portrayed.
- Why it often isn’t an advanced threat
- Where do they originate?
- What can companies do about APT?
Panelists:
Brent Huston, CEO and Security Evangelist, MicroSolved, Inc.
Adam Hostetler, Network Engineer and Security Analyst
Phil Grimes, Security Analyst
Mary Rose Maguire, Moderator, Marketing Communication Specialist, MicroSolved, Inc.
Click the embedded player to listen. Or click this link to access downloads. Stay safe!
MSI HoneyPoint Featured on Virtualization Security Podcast
Brent Huston, CEO and Security Evangelist of MicroSolved, Inc., was recently a guest for the popular podcast, “Virtualization Security Podcast.”
Brent talked about HoneyPoint Wasp and discussed with other panelists how honeypot technology can help an organization detect real attacks and also the legal ramifications of stealth monitoring.
The Virtualization Practice also featured HoneyPoint in their recent post, “New Virtualization Security Products Available.”
The podcast panelists include;
- Edward L. Haletky, Author of VMware vSphere and Virtual Infrastructure Security: Securing the Virtual Environment and virtualization security analyst, as Moderator.
- Michael Berman, CTO of Catbird Security
- Iben Rodriguez, Independent Virtualization and Security Consultant and Maintainer of the ESX Hardening Guidance from CISecurity
Click on the player below to listen. To listen on iTunes or download the MP3, go here. Enjoy!
Audio Blog: Brent Huston – HoneyPoint Security Server Manifesto
Brent Huston answers a few questions about HoneyPoint Security Server, how it began, what is happening with it today, and the creative ways other techs are using it. Click the link to listen or right-click to download it.
Powerless No More! Making Your Threat-Centric Penetration Testing Work for You
By now, even small organizations should know that they need periodic penetration testing focused on their critical processes if they hope to secure and protect their data. The question is, when this testing is being performed, are they getting something of value or just another checkbox on a compliance form? At MicroSolved, we believe in the first and we think you should get the latter naturally from the exercise. The problem is, the effort is NOT vice-versa.
Compliance-centric penetration testing is when the simulated attacker really takes the eye of an auditor. They focus only on testing the surfaces, elements and data sources absolutely required by the standard you are being tested against. These “penetration tests” are usually little more than a vulnerability scan and a run through by an engineer who “validates” that you are vulnerable. Little attention is paid to impact of compromise, how compromised systems and their information could be leveraged to get to the critical information or data and vulnerability chains (complex failures that cascade) are often ignored or completely unidentified. You can tell if the assessment is compliance-centric if the assessment doesn’t include items like testing multi-stage attacks, simulated malware and simulated social engineering failures. In many cases, for example, in the MicroSolved testing methodology, these attack surfaces are exercised, monitored, modeled and then regardless of outcome, emulated as if they failed during internal assessments to ensure reliable, real-world impacts are measured.
Threat-centric penetration testing, which by now, you probably know, is what MicroSolved is famous for. Our process doesn’t focus on compliance. It focuses on protecting your assets against the real world threats. We perform like an attacker, NOT like an auditor. We map attack surfaces, compare them to the real world, real-time data streams we get from the HoneyPoint Internet Threat Monitoring Environment (HITME) every day. We take our knowledge of what attackers do and how they work and apply it to your organization. We test the attack surfaces and note how they respond. We model what would happen if your controls succeed and what happens when they fail. Our testing takes a little while longer, and in some cases is a bit more expensive than the “scan and verify” providers, because our penetration team measures your systems against complex, multi-stage leveraged attacks just like you should expect from a real-world attacker targeting your data. We crack passwords, steal documents, social engineer your team, root through your electronic trash (and sometimes even the physical trash) and tear into your internal networks just as if we were a bot-herder, a malware author or a bad guy who got a job in customer service or the mailroom. We work with you to establish the scope and bounds of the exercise, but in the end, you get a real, true and holistic look at your defenses and the ways you can improve. You also get the capability to check that compliance box with the full knowledge and confidence that you tested not just their limited scope or with blinders on approach, but against a real-world, bleeding edge group of attackers focused on getting YOUR data.
At MicroSolved, we think that if you’re going to spend money on penetration testing, you should get what you pay for. You should get a real measurement against real threats and a real idea of what needs to be improved. If all you want is a checkbox, you can find plenty of folks to “scan and forget” with prices starting at FREE and ending at hundreds of thousands of dollars. Their cookie-cutter processes should let you check the box on your next set of forms, but maybe not sleep at night while you wonder if the data is really OK. On the other hand, working with a real-world emulating, threat-centric team, might cost a little more in the short run, but just of the money you’ll be saving in fines, legal fees and forensics costs for each attack vector mitigated in the event of a compromise. Give us a call. We’ll be happy to tell you more or work with you to set up a project to help you evaluate other penetration testing teams where MSI might not be a perfect fit.
Horrible Ideas, Modeled & Profiled
Just a quick note this time about the HITME (HoneyPoint Internet Threat Monitoring Environment). One of the best uses for having the kind of global honeynet that we have deployed in the incarnation of the software is that you can create actual working models for a mistake or a horrible security idea.
Want to know what happens if you accidentally expose an internal system to the public Internet for 24 hours? We can quickly (in less than 30 mins) build an emulation for it and use a decoy dropped into place on your network to measure and model that risk over a period of time. You can get a real life set of metrics for how many probes it receives, from where and for what the attackers are looking. You can find out how long the average time is before the issue is identified by an attacker. You can even work up a profile of what sources, their locale and their capability to add to your risk assessments. These kinds of metrics, tied to a strong mathematical model (like FAIR) make for fantastic real world analysis.
You can do the same with web applications. Want to know what kind of attacks you can expect if you put in a new VPN portal at your managed hosting provider? No problem. We create an emulation and drop a decoy into their ESX(i) infrastrcuture, monitor it for 30 days and work up the data into a report for you. Now you can take that data and feed into a risk assessment, work out compensating controls and even get a budget idea for what it will take to secure such an infrastructure. We can also do this in multiple places and then work with the reporting you get from several vendors, using this mock up as a bake off data point to help you determine if your exposures and risks are higher from one hosting provider to another, what kinds of reporting you get from each, how effective their prevention and detection programs are, etc. We’ve even had a couple of organizations drop in temporary HoneyPoint decoys while being audited or undergoing penetration testing to get a third party view of how effective and capable their assessment and testing process has been.
The coolest thing to me about HoneyPoint is not the bleeding-edge attacks you can capture, nor the insights into attacker behavior it brings. Instead it’s the wide array of business problems that it can lend real world insight to inside the security world. It truly makes it easy to model and measure some of the most horrible ideas that an admin or developer can have. Wanna know more about the mistakes you make or might make in the future? Wanna measure attack interactions or generate metrics to feed a better risk assessment? Give us a call, we’ll be glad to discuss how you can take the next step in threat-centric information security with HoneyPoint!
Think You Can’t Afford Code/App Testing? Think Again!
According to this article, most companies skimp on third-party code checks.
Over the years, in our application testing services, we have found a variety of reasons why people skip code review and even application testing from a blackbox standpoint. The main objection we hear is cost. The cost of code review is often quite a bit higher than they expect. In some cases, we have seen where code review quotes from some vendors have been as much as 40% of the total development costs!
Now, that said, things are shifting. Today, you have a plethora of code review automation tools and source code scanners. These tools make an easy way to pick the low hanging (and sometimes higher, depending on language/complexity & tool variables) vulnerabilities out of your code long before it is exposed to malicious outsider/insider contact. (You do have a DEV and QA environment, now, right? Hint, Hint!) A quick list of code scanning tools is here. Even more are available.
For example our favorite PHP scanner, SandCat Hybrid is not on the list yet, but is widely available and used today. Pricing for some of these tools varies from FREE (like beer AND like speech) to hundreds of thousands of dollars per year. With a little research work, you can likely find a tool to meet your needs. Need help picking a tool? Just drop us a line, we would be happy to help.
Having a tool is one thing, using it and applying what you learn is another. You will need to create processes to make use of the tool. You will need to define where in your development and product purchasing processes the assessments should take place. You will need someone to run the tool and analyze the results. You will need someone to help work with the developers to make sure that any identified weaknesses are mitigated or that compensating controls are employed appropriately to minimize any defects not cost effectively fixed. This takes time, skill, knowledge and talent. However, if you want this skill ad-hoc or via a subscription, both are available from MicroSolved. Just drop us a line or give us a call and we can work together to design a toolset and skill set appropriate to your needs.
Using this approach, you don’t have to be one of the firms ignoring code review and application testing. You CAN afford to perform testing prior to product launch, deployment or upgrades. We can help you design a solution that fits your business needs and your risk tolerance. Rise above your competitors (who are likely in that 65% of companies NOT doing testing) and began offering software and products that have been assured to protect their privacy. We can help and together, we can make it safer for all of us online.
Calling Central Ohio CIOs, CTOs, and IT Warriors: InfoSec Summit Next Week!
We’re getting excited about the upcoming Central Ohio InfoSec Summit, held at the Hyatt Regency in Columbus next week on Thursday, May 12 and Friday, May 13.
Our CEO, Brent Huston will be speaking and also Phil Grimes, Security Analyst.
I’ll be floating around, helping Constance Matthews, our Account Executive, with registration and other fun activities, which you’ll learn about during Brent’s presentation, so don’t miss out!
If you’re not registered yet, here’s the link. Each year this summit gets better and better. The speakers are top notch, and incredibly generous with their expertise. And the food is fabulous, as well as the reception Thursday evening.
We hope to see you there!
The Holy Grail of Information Security
Have you ever heard of the list of most needed inventions?
These are the sorts of inventions that, if realized, would overcome technological hurdles that are preventing mankind from reaching our most cherished dreams. Room temperature super conductors, advanced nanotechnology and practical fusion power are just a few. There are a number of inventions like this that are needed to make information security a reliable, efficient and low cost process. And chief among them is the Holy Grail of information security: an un-spoofable identity authentication mechanism.
Just think of it! A way for people and machines to know with a certainty that it is you and only you that they are communicating with. No more worries that someone will steal your identity and empty your bank accounts. No problems with cyber criminals impersonating IT personnel and stealing information or crashing systems. Think of the money and time you could save on complex intrusion detection and prevention systems and complicated processes. It is fun to contemplate. But, unfortunately, it is all just wishful thinking. Despite years of concentrated thought and effort, nobody has a clue how to make it work!
There are just three ways known to authenticate identity:
- Using something you know
- Using something you have or
- Using something you are
When talking about authenticating yourself to a computer system, something you know is typically a user name, a password or an encryption key. I think all of us know that despite all efforts to keep these mechanisms secret and secure, it doesn’t prevent intruders from getting them. The problem is that people have to know them, they need to store them and they need to use them, and that makes them vulnerable. So something you know isn’t the answer.
Let’s go to the second mechanism: something you have. In the computer world this is usually a smart card, token or the like. Combined with a user name and password, this mechanism provides another layer of security that can be very effective. But it is far from perfect. Smart cards and tokens can be stolen or misplaced. Perhaps a certificate authority or token provider’s servers are compromised. Some mechanisms can be reverse engineered. So, the upshot is, you can add something you have, to something you know and get better, albeit far from perfect, identity authentication. But the cost you pay in dollars and personnel hours has just gone way up.
So let’s go to the final possible authentication mechanism: something you are. For computer systems this is presently typically finger prints or retinal scans, although other possible mechanisms include facial recognition, voice recognition, heuristics (behavior matching) and DNA matching. This mechanism, once again, provides added security to the identity authentication process, but still is not perfect. For one thing, this kind of authentication mechanism works best in person. If a fingerprint, for example, is transmitted it really travels as a series of electromagnetic signals and these can be spoofed. But even in person, this type of mechanism can possibly be spoofed. So adding something you are to something you have and something you know once again makes it much more difficult to spoof identity, but still doesn’t render it impossible. And imagine the added burden in money and inconvenience using all three mechanisms would mean to your organization! Seems like way too much just to protect some financial data or health information, huh?
So, please, let’s all of us spend some thought trying to find the perfect identity authentication mechanism. It may be like trying to come up with perpetual motion, but if you do manage it, I guarantee you the rewards will keep you and yours in clover for the rest of your lives!