STE WILLIAMS

It seems earthshaking vulnerabilities are released weekly that leave vendors and system administrators scrambling to remediate. So, where are all these vulnerabilities coming from? A simple search on the National Vulnerability Database shows over 3,300 new vulnerabilities released in just the past three months. Granted that many of these vulnerabilities are esoteric and limited to specific niche applications. However, nearly every other month we see a release with a large-scale hole that affects millions. The most egregious example was Heartbleed, which affected nearly halfof all Internet web servers.

But, why so many and so often? The simple reason is that vulnerabilities are an emergent property of software, and there are three major causes: code quality, complexity, and trusted data inputs.

Code Quality 
This is where everyone points their finger first. But why? Sloppy programming? Not necessarily. More often than not, it’s a conscious choice. In most development teams, the highest priority is given to the features for which customers will pay. And outside of the security group, most people do not want to pay for security. I say most because there are those who will pay for it, most often for applications and systems that are not as useful or flexible as the mainstream, less secure products where they should be paying for security.

Another driving force working against code quality is the concept of minimum viable product, which means it has just enough features and value to gain traction with customers. Any other features are secondary and can be added later. The mantra is: never build a mansion when a tent will do. The problem is that we find ourselves living in a tent for years on end. We also know that fixing security programs down the road is more expensive, which also delays the addition of security features in the face of new customer (and market) demands. Often, it isn’t until after a series of security calamities occur that security is raised to a priority.

Complexity
Most modern applications are so complex that they are beyond the understanding of a single person. To the average user, all this complexity is hidden by the user interface and underlying infrastructure, but IT professionals know better. Consider the current version of the Firefox browser, which contains 16 million lines of code written by 5,094 developers over ten years.

If you consider all the moving parts, interdependencies, layers, libraries, interface modes, and backward compatibility built into these applications, it’s no wonder that there are serious gaps in security coverage. It is also widely known that dynamic and complex systems are hard to predict and can lead to unexpected outcomes. One thing is certain, though: large, complex software applications will contain bugs, and some of those bugs will be security vulnerabilities.

Overly Trusting Data Inputs
If you examine most security vulnerabilities, you will see that they occur where the program is accepting data input. Therefore, every data input into a system is an attack surface. These vulnerabilities exploit weak boundaries where input systems expect data but instead are breached to insert new commands. Look at where attacks such as buffer overflows, SQL injection, or cross-site scripting occur: data input channels that are subverted. This is not a new problem. Decades ago, programmers were taught to expect non-conformant input and filter accordingly. Given the complexity of software and the speed at which it is developed, it is not surprising that programmers do not have the resources or time to ensure robust filtering of every possible input stream.

Pulling It All Together
In “How Complex Systems Fail,” author Richard I. Cook notes that “catastrophic failure occurs when small, innocuous failures join to create a systemic problem.” These problems combine to create the chronic disease of security vulnerabilities pervading the entire software industry.  

How can security teams respond to these issues? For one, organizations can use these principles to roughly estimate the magnitude and frequency of potential vulnerabilities in a system, which can also assist in risk assessments. Since every input is a possible attack path, reduce your exposure to just the services you absolutely need to put on the Internet. If you do expose an input path, filter it and monitor it. Also, remember that security tools are software, so build for defense in depth, and test often.

Get the latest application threat intelligence from F5 Labs.

Raymond Pompon is a Principal Threat Researcher Evangelist with F5 labs. With over 20 years of experience in Internet security, he has worked closely with Federal law enforcement in cyber-crime investigations. He has recently written IT Security Risk Control Management: An … View Full Bio

Article source: https://www.darkreading.com/partner-perspectives/f5/where-do-security-vulnerabilities-come-from/a/d-id/1329951?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

The recent WannaCry and NotPetya cyber attacks should remove all doubts that organizations are safe from collateral damage when international cybercrime and perhaps even nation-state actors decide to attack. As reports of the attack surfaced, healthcare executives and CIOs especially understood that risks were not contained within the walls of their facility or even their data center, as supply chain partners like Nuance were affected. This seriously disrupted untold numbers of healthcare organizations and increased board interest to act.

One thing is clear: These new threats require new investments not only in technology but process and people. Healthcare organizations need a good strategy to find talent or get left behind. That strategy starts with countering five misconceptions.

Misconception 1: Just hire one Swiss army knife.
In reality, there are as many different cybersecurity specialties as there are different physician specialties. It is not possible to hire one physician to treat all patients, so healthcare executives should not expect to hire one specialist to meet all cybersecurity needs. For example, cybersecurity managers are needed for strategic leadership, to manage the risk analysis process, educate the workforce, and develop programs. Security architects and engineers will design solutions and implement new technology. Other security professionals operate the technical systems, manage vendors, or audit/monitor results. All of the professionals above require different training, certifications, skills, and experience.

Misconception 2: Assign all cybersecurity responsibilities to the IT department.
One clue to the wide range of cybersecurity needs lies in a properly conducted risk analysis, but only if the effort was properly scoped and performed. It is common to identify cybersecurity risks requiring a broad range of technical and non-technical responses, with responsibilities for risk mitigation assigned to many departments outside of IT, including physical security, human resources, biomedical engineering, contracts management (sometimes called strategic sourcing), and others. Unfortunately, dollars spent are a highly visible yardstick, but this disproportionately favors expensive technical solutions over many non-technical initiatives that require staff and process. In addition, the “dollar yardstick” will not necessarily represent all, or even the highest, risks present.

Misconception 3: Cybersecurity professionals and IT staff are interchangeable.
The first flaw in this logic is that cybersecurity staff does the same job as IT staff. First, while all IT staffers have some security responsibilities, it is not their primary job. Cybersecurity professionals need to have a broad range of skills beyond IT, including business process, vendor management, physical security, threat awareness, and business continuity management (not just disaster recovery). The basic skills needed are executive leadership, budgeting, and a good understanding of compliance, audit, and technology. Hiring someone into these positions requires developing a career ladder; otherwise, it will be difficult to recruit top talent. This will require the involvement of the human resources team to set pay bands for each step in the ladder based on minimum skills, experience, and certifications. It may also be necessary to work with trade organizations or organizational management resources to identify appropriate national competitive pay rates.

Misconception 4: We can always find local talent.
The demand in most markets for security talent has far outstripped supply. Healthcare organizations are competing with other domains such as manufacturing, banking, and energy, which have demonstrated that they are willing to pay higher wages and offer a better career path to be competitive. Forbes reported in 2016 that there are 1 million unfilled cybersecurity positions, a number expected to grow to more than 1.5 million by 2020. That will makes it necessary to identify potential candidates from other sources, or grow talent internally. This strategy works best when there is a mentoring program that leverages healthcare member-based organizations, outside contractors who serve in a partnership role, and frequent higher-level training. It will fail when organizations invest in the training and growth of individuals, then fail to appropriately adjust their pay bands to keep up, as the skills/pay imbalance will eventually cause attrition.

Misconception 5: Outsourcing is expensive.
Architecting and then implementing a solid security program that blends advanced technology, trained staff, mature processes, and executive support takes specialized talent. The challenge is that this type of talent is expensive and may not be interested in operating the program once deployed. Healthcare executives may want to consider outsourcing the security program development, implementation of technology and processes, even skilled resources, and then use local resources to operate the system.

In this case, the senior security official, or project sponsor, should first evaluate the level of skills the necessary for accomplishing specific measurable objectives, as well as the duration. Some tasks are better suited to a project-type of engagement, which can limit costs. Other long-term projects may require interim staffing that provides services on a part-time basis (such as a virtual chief information security officer) or on a full-time basis for a limited duration (such as biomedical security architect). Any of these models work, as there are advantages to all. Don’t forget that periodic reviews are valuable for providing midcourse corrections, filling specific skill gaps in recruiting, and staff augmentation. 

Addressing security vulnerabilities and building a security management program requires leadership and resources that can be met with both internal and vendor-supported roles. The process of identifying a leader to manage the transformation requires an individual with a broad set of skills. However, trying to find one person to meet all requirements is unlikely and ill-advised. It takes a team, but every team needs a leader. 

Related Content:

• Why InfoSec Hiring Managers Miss the Oasis in the Desert
• NotPetya: How to Prep and Respond if You’re Hit
• The ‘Team of Teams’ Model for Cybersecurity
• Hacking the Security Job Application Process

Join Dark Reading LIVE for two days of practical cyber defense discussions. Learn from the industry’s most knowledgeable IT security experts. Check out the INsecurity agenda here.

Clyde Hewitt is vice president of security strategy at CynergisTek. He brings more than 30 years of executive leadership experience in cybersecurity to his current position, where his many responsibilities include being the senior security advisor and client executive, … View Full Bio

Article source: https://www.darkreading.com/careers-and-people/health-it-and-cybersecurity-5-hiring-misconceptions-to-avoid/a/d-id/1329932?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Image Source: Adobe Stock

This week’s news that a legitimate version of Avast’s CCleaner tool was compromised to deliver malware offers a stark example of how damaging security tools can be when the bad guys’ subvert them to act maliciously.

For several decades now, we’ve heard the dangers of security tools that don’t properly recognize malware or malicious activities. But the last few years have flipped the script as more security researchers and black hats have discovered that many security tools can also act as a very convenient tool for compromising the enterprise.

In order to properly work, these tools usually need very high administrative privileges and typically run processes at the lowest levels of the system. This makes them a prime target for attackers.

In the past two years, a number of embarrassing zero-days have come to light that had the criminals, or cyber spies, licking their chops at the thought of the complete ownage that such flaws can afford them.

Ericka Chickowski specializes in coverage of information technology and business innovation. She has focused on information security for the better part of a decade and regularly writes about the security industry as a contributor to Dark Reading.  View Full Bio

Article source: https://www.darkreading.com/vulnerabilities---threats/10-security-product-flaw-scares/d/d-id/1329942?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Criminal hacking is the greatest threat to Americans’ well-being, according to a new survey that found it outranks air pollution, motor vehicle accidents, and artificial intelligence.

The online random survey conducted by ESET, which queried 740 American respondents via SurveyMonkey, asked participants to rate 15 types of risks, from “no risk at all” to “very high risk,” as it relates to human health, safety, or prosperity. The participants were left to interpret their own definition of criminal hacking, says Stephen Cobb, ESET senior security researcher.

Criminal hacking scored a weighted average of 5.41, compared to the survey’s overall weighted average of 4.92. Not far behind hacking in the rankings was air pollution, with a rating of 5.33, and disposal of hazardous waste in landfills at 5.24.

“It’s pure speculation on my part as to why criminal hacking was rated the highest, but one suggestion is criminals breaking into computers is a more immediate threat,” Cobb says. “Maybe the headlines in the news also made a difference. The survey was done right after WannaCry and NotPetya.”

“One takeaway for enterprises looking at these results is that criminal hacking as a threat to the general well-being of Americans is right up there in Americans’ consciousness. This signals to companies that they need to take security seriously,” Cobb warns.

Age and Wealth Matter

Americans’ views on the risk criminal hacking poses to their well-being varies depending on their age and wealth, the survey shows.

Survey respondents between the ages of 45- to 59-years-old expressed the highest concern for criminal hacking, with 65% rating it a “very high” or “high” threat to their well-being. The next largest age group with similar concerns were respondents 60-years-old and beyond (55%), followed by 18- to 29-year-olds (49%), and 30- to 44-year-olds (47%).

Older people say they limit their Internet use because it reduces their risk of a cyberattack, explains Lysa Myers, an ESET security researcher. Younger people are on the Internet all the time and it would be harder for them to justify that if they felt they were putting their well-being at risk, she notes.

Meanwhile, 58% of survey respondents with household incomes of $75,000 or less rate criminal hacking as a “very high” or “high” risk to their well-being, compared to 48% of survey participants with incomes higher than $75,000, according to the survey.

“If you are working two jobs and have to take time off to sort out identity theft, you may be more concerned about the risk,” Cobb says. “People from more well-funded households may feel less risk.”

Join Dark Reading LIVE for two days of practical cyber defense discussions. Learn from the industry’s most knowledgeable IT security experts. Check out the INsecurity agenda here.

Related Content:

• 10 Ways to Prevent Your Mobile Devices From Becoming Bots
• Navigating The Slippery Slope Of Public Security Disclosure
• A Not-So-Secret Secret About Cybercrime
• A Year Later, Most Americans Think Snowden Did The Right Thing

Dawn Kawamoto is an Associate Editor for Dark Reading, where she covers cybersecurity news and trends. She is an award-winning journalist who has written and edited technology, management, leadership, career, finance, and innovation stories for such publications as CNET’s … View Full Bio

Article source: https://www.darkreading.com/vulnerabilities---threats/americans-rank-criminal-hacking-as-their-number-one-threat/d/d-id/1329946?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

The average number of new phishing sites created in a given day has skyrocketed to more than 46,000, or 1.385 million each month, according to the Webroot Quarterly Threat Trends Report released this week.

This number of these sites is up substantially from Webroot’s quarterly report released in December, which noted more than 13,000 new phishing sites were created daily. 

The trend of temporary phishing sites continued with the majority of sites remaining active for only four to eight hours. The purpose of the short-lived sites, according to Webroot, is to avoid detection by such measures as block lists.

Meanwhile, the top 10 websites that were impersonated the most during the first half of the year include Google, 35%; Chase, 15%; Dropbox, 13%; PayPal, 10%; Facebook, 7%; Apple, 6%; Yahoo, 4%; Wells Fargo, 4%; Citi, 3%; and Adobe, 3%.

Read more about Webroot’s September report here. 

Join Dark Reading LIVE for two days of practical cyber defense discussions. Learn from the industry’s most knowledgeable IT security experts. Check out the INsecurity agenda here.

Dark Reading’s Quick Hits delivers a brief synopsis and summary of the significance of breaking news events. For more information from the original source of the news item, please follow the link provided in this article. View Full Bio

Article source: https://www.darkreading.com/threat-intelligence/14-million-new-phishing-sites-launched-each-month/d/d-id/1329955?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple