STE WILLIAMS

As organizations increasingly shift focus to threat detection and response, there’s one issue that seems to get worse over time: alert triage. Prioritizing security alerts has been a critical function for security teams since the early 1990s — so why does it remain such a challenge decades later?

Security teams are overwhelmed by daily alerts from security information and event management (SIEM), endpoint detection and response (EDR), and other detection tools, mostly due to the sheer volume of alerts generated, which is growing all the time, along with a rise in low-quality alerts and false positives. Many teams find they can only analyze a fraction of the thousands of alerts that come in each day, leaving threats that often go unnoticed for months.

This problem is believed to have played a part in Target’s massive data breach in 2013. The company’s security team reportedly failed to take action after detecting potentially malicious activity. Experts speculated that Target had been receiving hundreds of alerts every day that were mistakenly dismissed as false. 

Alert triaging has become even more challenging over the past decade as the attack surface has grown. While Windows and Linux server threats were once the main focus of attackers, cloud, mobile and Internet of Things technologies have given rise to their own threat detection needs, leading to new massive piles of alerts. Alert triaging is foundational, yet almost every organization struggles to manage it efficiently. 

What’s standing in the way? Here are four issues:

Issue 1: Today’s environments are more diverse.
In the past, when everyone used the same server operating system, one firm could create a flowchart for its alert response, target, and history, and it could apply to other organizations with the same system. This made it easier for security teams to address the volume of alerts that were similar. 

But these days, security tools and IT environments can range from advanced deception tools and machine learning, to traditional IT, cloud and industrial IoT technologies. One organization may still use on-premises mainframes, while another may be cloud-native, which makes having a unified approach impossible. 

Issue 2: Many advanced threats don’t appear in alerts.
Even when you can successfully identify, analyze, and act on an alert, you must also account for the threats that you can’t see. Ransomware, for example, clearly announces itself, but the process for other crimeware (and especially for stealthy state-sponsored threats) isn’t as obvious. 

Sophisticated threat actors who can easily go undetected are on the rise. According to the Council on Foreign Relations (CFR), state-sponsored attacks have increased 122% from 2014 to 2018, and attackers have found ways to evade detection by hiding in encrypted traffic, which the Electronic Frontier Foundation now says comprises more than half of total traffic on the Web. These cybercriminals leverage SSL tunnels to sneak malware into the corporate network, hide commands, control traffic, and exfiltrate data. 

Even achieving alert triage perfection won’t make detection and response capabilities truly world-class because attackers will always find ways to adapt to new detection tools and methods. This is forcing security teams to actively hunt for threats, rather than merely gathering (and then clearing) alerts.

Issue 3: Automation and machine learning tools have limits.
To create alert playbooks, some security teams lean on security orchestration, automation, and response (SOAR) technology. But too often, they buy these tools without understanding the prerequisites or even the reasoning behind their implementation. I’ve seen a security leader authorize the purchase of a SOAR tool to avoid coding a playbook, only to discover that the first task after implementation was to define his playbook in the tool via Python.

Furthermore, many detection technologies produce a litany of false positives and fail to completely cover monitored assets. I’ve worked with several security professionals who have grown frustrated with new anomaly-based systems that produce vague and untraceable warnings. In some cases, machine learning (ML)-based systems have actually produced more false positives than legacy tools do.

While security teams increasingly rely on ML technology to solve alert problems, I’ve also seen many reports that ML-produced alerts can be more difficult to confirm in real security operations, as they often lack transparency and context. For instance, an ML tool may spot a behavioral outlier, but it’s unclear what the client should do next, where it should look, or who it should ask.  

Issue 4: If not robots, then what? 
“Security is a process, not a product.” This quote from Bruce Schneier still stands. In theory, the solution is simple: Hire a small but skilled security team to define, refine, and implement mature alert response processes and customize tools and workflows to address alert overload. But in practice, the cost of assembling an expert team makes this option less feasible for many organizations. What we need is a combination of human brains confirming the alerts that are prepared by the machines in a way that’s optimal for human decision.

To put this into practice, security teams should apply business context to alerts (such as the implications of an alert’s severity), conduct alert triage steps outside of IT, and address the alerts presented by the system. Otherwise, you run the risk of missing important alerts and becoming the next massive data breach to dominate headlines. 

Related Content:

• Surviving Security Alert Fatigue: 7 Tools and Techniques
• 8 Ways Businesses Unknowingly Help Hackers
• How Much Security Is Enough? Practitioners Weigh In

Check out The Edge, Dark Reading’s new section for features, threat data, and in-depth perspectives. Today’s top story: “Is Voting by Mobile App a Better Security Option or Just ‘A Bad Idea’?“

Anton is a recognized security expert in the field of log management, SIEM and PCI DSS compliance. He is the author of several books and serves on advisory boards of several security startups. Before joining Chronicle, Anton was a research vice president and Distinguished … View Full Bio

Article source: https://www.darkreading.com/threat-intelligence/the-uphill-battle-of-triaging-alerts-/a/d-id/1336233?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

CrowdStrike has announced a series of updates to the Falcon Platform and the CrowdStrike Store, introducing Falcon for AWS and Falcon Firewall management while also adding third-party applications to the CrowdStrike Store.

The announcements, made at the company’s annual user conference, Fal.Con UNITE 2019, began with Falcon for AWS, which lets customers optimize their purchase for elastic workloads and deploy it with integrated metering and billing.

Falcon Firewall Management is a new module that provides centralized host firewall management for customers; the company says it’s intended to be of special use to those organizations making the transition from traditional on-premises firewalls to cloud implementations.

The CrowdStrike Store has added a number of third-party applications, including apps from Acalvio, Dragos, and RiskIQ as part of a stated intent to become a unified security cloud ecosystem of trusted applications.

For more, read here.

This free, all-day online conference offers a look at the latest tools, strategies, and best practices for protecting your organization’s most sensitive data. Click for more information and, to register, here.

Dark Reading’s Quick Hits delivers a brief synopsis and summary of the significance of breaking news events. For more information from the original source of the news item, please follow the link provided in this article. View Full Bio

Article source: https://www.darkreading.com/cloud/crowdstrike-adds-new-products-and-web-store-apps/d/d-id/1336276?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

An undocumented access feature in some newer models of Siemens programmable logic controllers (PLCs) can be used as both a weapon by attackers as well as a forensic tool for defenders, researchers have discovered.

Researchers at Ruhr University Bochum in Germany stumbled across the hardware-based special access feature in Siemens’ S7-1200 PLCs while studying its bootloader, which, among other things, handles software updates and verifies the integrity of the PLC’s firmware when the device starts up.

They found that an attacker using the special access feature could bypass the bootloader’s firmware integrity check within a half-second window when the PLC starts up and load malicious code to wrest control of the PLC’s processes.

Just why the special access feature resides in the PLCs remains a mystery. There have been cases of embedded devices found harboring hidden maintenance ports left behind by vendors, for example, but the researchers were baffled by the existence of this one in the Siemens PLCs.

“We don’t know why [Siemens has] this functionality,” says Ali Abbasi, a research scholar at Ruhr-University Bochum, who, along with PhD student Tobias Scharnowski and professor Thorsten Holz, worked on the research. “Security-wise, it’s wrong to have such a thing because you can also read and write to memory and dump the content of memory from the RAM.”

The researchers shared their findings with Siemens, which says it’s working on a fix for the vulnerability.

“Siemens is aware of the research from Ruhr University Bochum concerning hardware-based special access in SIMATIC S7-1200 CPUs. Siemens experts are working on a solution to resolve the issue. Siemens plans to publish further information regarding the vulnerability with a security advisory,” the company said in a statement provided to Dark Reading. “Customers will be informed using the usual Siemens ProductCERT communication channels.” 

A key question is whether the fix requires a hardware replacement rather than a software update. When asked whether the PLC fix would be a software or hardware update, Siemens said its “experts are evaluating the alternatives.”

But it turns out there is a silver lining with the Siemens PLC special access feature: “It’s also useful for people like us who protect these devices. It provides for memory forensics of the PLC,” Abbasi says.

The researchers were able to use the special access feature to view the content of the PLC memory, which means a plant operator could spot malicious code that may have been planted on his or her device. “Siemens doesn’t let you see the content of the [PLC] memory, but you can do that with this special access feature,” Abbasi says.

The researchers built a tool that performs this forensic memory dump, which they will release at Black Hat Europe next month in London when they will present their research findings

What They Did
The researchers were able to write their own code to the PLC’s flash chip via its firmware update feature without the bootloader’s checksum feature detecting it. The question, they say, is how to mitigate this type of attack since malicious code would be embedded into the flash memory of the bootloader.

“It really depends if Siemens can fix it via a software update or not. If they can with software, it also means the attacker can override the contents of the bootloader, which means there’s no way to fix it,” Abbasi says.

That’s one reason the researchers wanted to release their tool for dumping contents of the firmware. “That then means an attacker can’t hide his existence” in the PLC, Abbasi says.

An attacker with physical access to the port, or by rigging the PLC while it’s being manufactured in the supply chain, could use this technique to read and write to the memory of the hardware. That would allow him or her to manipulate the operation of the PLC, providing phony measurements or other instrumentation data, for example.

“One of the main issues is there’s this notion of trust in a newly delivered PLC,” Scharnowski says.

He notes that it’s not the special access feature itself that allows you to read and write to the flash. “It’s a combination of features that if you put them together in a clever way, you can use them to get your own code execution on it,” Scharnowski says. “If you can do that, then you can control the PLC fully.”

Props for Siemens Security
The researchers say they chose to study Siemens’ PLCs because it’s one of the market leaders and also because there’s little known publicly about the PLC’s operating system, Adonis.

While many embedded systems today remain poorly secured, they say Siemens has done more with security than some other vendors.

“Honestly, if you compare them to other PLCs, they are doing very well. They keep adding features and security features that we have to bypass,” Abbasi says. “They are doing a lot of good things that place them ahead of others in the embedded security domain.”

Even so, the researchers maintain there’s a lot more work to do in protecting plant operators from attackers or supply chain corruption of their PLCs. If there’s a special feature like the one in Siemens PLCs, they say, the vendor should inform their customers. “Customers deserve to know so in their risk calculation they can consider this risk as well,” Abbasi says.

The Ruhr University Bochum team’s work is the latest in a string of PLC research projects. This summer another team of security researchers built a phony engineering workstation that was able to dupe and alter operations of the Siemens S7 programmable logic controller (PLC) after discovering that modern S7 PLC families running the same firmware also share the same public cryptographic key. 

And in 2016, Abbasi, then a Ph.D. candidate at University of Twente, Netherlands, and Majid Hashemi, a system programmer and independent security researcher at the time of their research, created a PLC rootkit that could operate on any brand of PLC.

Related Content:

• Siemens S7 PLCs Share Same Crypto Key Pair, Researchers Find
• PLCs Possessed: Researchers Create ‘Undetectable’ Rootkit
• Stealthy New PLC Hack Jumps the Air Gap
• 8 Trends in Vulnerability and Patch Management 

This free, all-day online conference offers a look at the latest tools, strategies, and best practices for protecting your organization’s most sensitive data. Click for more information and, to register, here.

Kelly Jackson Higgins is the Executive Editor of Dark Reading. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise … View Full Bio

Article source: https://www.darkreading.com/vulnerabilities---threats/siemens-plc-feature-can-be-exploited-for-evil---and-for-good/d/d-id/1336277?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Proofpoint today confirmed plans to acquire ObserveIT in a $225 million cash transaction. It plans to use the insider threat management platform to build out its data loss prevention (DLP) capabilities to respond to threats in cloud applications, email, and lightweight endpoint agents.

ObserveIT offers endpoint agent technology and data risk analytics. Proofpoint plans to expand its technology into a new DLP platform designed to join email, cloud access security brokers (CASB), and data at rest into one tool. Its idea is to improve teams’ real-time detections of suspicious activity across more data, people, devices, and applications as employees use more devices and services to do their jobs.

“More and more users are accessing corporate data from endpoint off the corporate network in both sanctioned and unsanctioned cloud apps,” wrote Ryan Kalember, Proofpoint’s executive vice president of cybersecurity strategy, in a blog post on the acquisition. As they do, companies demand new controls to understand where and how users interact with their data.

This new integrated tool will be part of the Proofpoint information protection suite and is predicted to be available in 2020. The acquisition is expected to close late in the fourth quarter of 2019, pending customary closing conditions and regulatory approvals.

As part of the deal, Proofpoint will also invest in ObserveIT’s insider threat management platform, which will continue to be available. Current users will have access to Proofpoint’s broader threat intelligence and RD resources as ObserveIT continues to work on the platform.

Read more details here.

Check out The Edge, Dark Reading’s new section for features, threat data, and in-depth perspectives. Today’s top story: “How HR and IT Can Partner to Improve Cybersecurity.”

Dark Reading’s Quick Hits delivers a brief synopsis and summary of the significance of breaking news events. For more information from the original source of the news item, please follow the link provided in this article. View Full Bio

Article source: https://www.darkreading.com/cloud/proofpoint-acquires-observeit-to-bolster-dlp-capabilities/d/d-id/1336270?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Email security continues to be top of mind for organizations as attackers become more devious in how they conduct their attacks. Companies face evolving threats, which are often extremely personalized and mimic common real-world emails they receive. To better understand the climate of email security, Barracuda surveyed 660 IT professionals across various industries and locations on the impact of phishing.

An Increased Sense of Confidence
Sixty-three percent of professionals report that their organization’s data and systems are more secure than they were one year prior. Among the three regions surveyed — America; Europe, the Middle East, and Africa (EMEA); and the Asia-Pacific region (APAC) — APAC reported the highest sense of security (70%), while EMEA reported the lowest (52%). Although this rise is likely caused by an increased security presence and education practices, if an organization lacks the tools to detect these threats, it may be superficial.

Despite an overall positive outlook, phishing and ransomware top the list of security risks that organizations are not fully prepared to deal with, along with spearphishing, malware, viruses, data loss, spam, smishing (that is, phishing via text message), email account takeover, and vishing (phishing via phone). Only 7% of organizations are not worried about any of these risks. In fact, email threats continue to proliferate and have a major impact. On average, 82% of organizations claim to have faced an attempted email-based security threat in the past year, although the figures differ slightly by global region.

Loss from a Breach Is More Than Financial
In addition to 74% of organizations reporting that email security attacks have had a direct business impact, they are also affecting the personal lives of IT security professionals, with nearly three-quarters experiencing higher stress levels, worrying outside the office, and being forced to work nights and weekends. APAC reports the highest levels of personal impact from email security attacks.

In addition, an overwhelming 78% of organizations say the cost of email breaches is increasing, with one-fifth saying they are increasing dramatically. Identifying and remediating threats, communicating with those affected, business interruptions, and IT productivity losses are all factors, as well as potential data loss, regulatory fines, and brand damage.

As a result, 66% of respondents claim that attacks have had a direct monetary cost on their organization in the last year. Nearly a quarter (23%) say attacks have cost their organization $100,000 or more.

Employee Education
In conjunction with the previously noted increase in a sense of security, employees continue to play an integral role in their company’s security. Ninety-four percent of organizations say employees are reporting suspicious emails to IT on a daily basis, but 58% say most emails reported to IT aren’t actually fraudulent. More than three-quarters (79%) of organizations say their employees aren’t good at spotting suspicious emails for a number of reasons, which shows a lack of readiness to spot email threats.

Only 21% say that the employees do a great job of alerting IT to suspicious emails only when needed. Additionally, 18% report that their employees were careless and did not recognize obviously suspicious emails.

These findings are concerning because phishing emails that prey on the poor security awareness of end users is one of the most common ways for attackers to download malware and steal data from organizations. Plus, reporting the wrong types of emails only wastes the time of already-stretched security teams. In addition to better awareness training, improved tools are needed to filter potentially dangerous emails and ensure they never make it into the inboxes of end users in the first place.

Phishing and Malware Are Common
Email security is a challenge because there are several types of threats that are commonly seen. With increased security technology, attackers are using more personalized methods to engage with victims, often bypassing traditional security systems.

Phishing remains top of mind, as 43% of organizations have been the victim of a spearphishing attack in the past 12 months. Seventy-five percent of security professionals have personally received training on phishing in the last year, which is much needed because 70% of organizations have experienced a variety of direct business impacts as the result of these attacks.

Furthermore, most IT professionals (79%) say they are worried about attacks and breaches stemming from inside the organization. Their fears are valid: A hacker could compromise an employee’s email account via spearphishing and use it to target other with business email compromise attacks or phishing emails that appear very authentic.

In addition to phishing threats, an overwhelming 90% of Office 365 users have security concerns. Eighty-six percent of organizations agree that third-party email security solutions are essential for keeping an Office 365 environment secure.

The Future of Email Security
Email threats will continue to evolve at the same time as protection methods become more advanced. Organizations must keep email security in the forefront of their efforts and ensure that employees are educated and aware.

Releated Content:

• 8 Ways Businesses Unknowingly Help Hackers
• The Minefield of Corporate Email
• Email Threats Continue to Grow as Attackers Evolve, Innovate
• Simulating Lateral Attacks Through Email

Check out The Edge, Dark Reading’s new section for features, threat data, and in-depth perspectives. Today’s top story: “How HR and IT Can Partner to Improve Cybersecurity.”

Mike Flouton is vice president for Barracuda’s email security business. In this role, he oversees product management for Barracuda’s portfolio of email security solutions: Barracuda Total Email Protection, Barracuda Essentials, Barracuda Sentinel, and Barracuda PhishLine. View Full Bio

Article source: https://www.darkreading.com/endpoint/the-state-of-email-security-and-protection/a/d-id/1336229?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Image Source: Adobe (blackboard)

Among the speakers at last week’s (ISC)2 Congress were a pair of security and compliance leaders who helped build out a major cloud project for Starbucks. Matt Wells and Scott Schwan, founders of compliance automation startup Shujinko, were called on by Starbucks several years back to build out the team and processes necessary to support Starbucks’ mobile app with fully PCI-compliant and secure cloud architecture measured against standards established by the Center for Internet Security (CIS).

“Basically, in about nine to 12 months, with 20 engineers, we were able to build a highly automated, scalable, repeatable environment that Starbucks could use to back everything they’d want to roll out, and they used that as a foundation to then start moving other applications to the public cloud,” explained Wells, who serves as CTO.

Wells and Schwan, CEO, delved into the details of their work at Starbucks to offer the crowd tips on how to bake compliance into their own cloud architecture and scale DevSecOps in the process. We offer the highlights from their insights, in their own words.

Ericka Chickowski specializes in coverage of information technology and business innovation. She has focused on information security for the better part of a decade and regularly writes about the security industry as a contributor to Dark Reading.  View Full Bio

Article source: https://www.darkreading.com/10-tips-for-building-compliance-by-design-into-cloud-architecture/d/d-id/1336240?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple