STE WILLIAMS

The US government will require each civilian agency to create a public policy for software-vulnerability disclosure, as well as a strategy for handling any potential security weaknesses reported by researchers. 

In the statement posted online, the US Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency (CISA) raised concerns that most civilian agencies’ lack of disclosure policies will lead to confusion, a lack of faith that issues are getting fixed, and the fear of potential legal action. The requirement of a vulnerability disclosure policy (VDP) will mean that every vulnerability reporter will know what to expect when they find and report a software flaw.

“A VDP allows people who have ‘seen something’ to ‘say something’ to those who can fix it,” CISA said in its announcement. “It makes clear that an agency welcomes and authorizes good faith security research on specific, internet-accessible systems.”

The move is the latest by the US government to work with security researchers and hackers to find — and plug — the weaknesses in its Internet-connected systems. In 2016, for example, the US Department of Defense announced its digital disclosure policy and launched the Hack the Pentagon challenge, the first-ever bug bounty for the federal government. Since then, every branch of the military has had a bug bounty challenge.

Without a vulnerability disclosure policy, good-faith researchers will not come forward with information on a security weakness outside of such programs, says Chris Wysopal, chief technology officer for software-security provider Veracode.

“[Having] no VDP is definitely a chilling effect of receiving good information from cooperative researchers,” Wysopal says. “They don’t know if an organization will be friendly to researchers contacting with vulnerability information.”

Game Change

The effort is a significant change in how government agencies treat vulnerability reporting. Not even a decade ago, the feds pursued charges against many vulnerability reporters. In 2005, for example, federal prosecutors charged information-technology specialist Eric McCarty with hacking after he used a Web-application vulnerability to access a handful of records on the application website of the University of California. McCarty reported the issue to the press.

Private industry also has targeted researchers. In 2017, one e-mail marketing firm pursued security research Chris Vickery, now at Upguard, for discovering that the company had left 1.4 billion email accounts users accounts in a publicly accessible cloud server — records that pointed to the company as a significant spam operation.

Federal agencies do not, in general, have a formal way of allowing security researchers or other third parties to submit information about vulnerabilities to them. And if an outside researcher or group did submit an issue, there is no process for handling that report and acting on it, the CISA stated in draft document, Binding Operational Directive 20-01, Develop and Publish a Vulnerability Disclosure Policy. 

“These circumstances create an environment that delays or discourages the public from reporting potential information security problems to the government, which can prevent these issues from being discovered and fixed before they are exploited or publicly disclosed,” the agency said.

The Binding Operational Directive requires that civilian agencies create a security contact with 15 days and publish a vulnerability disclosure policy within 6 months. The BOD also mandates that agencies collect data on reported vulnerabilities and how quickly they are remediated. DHS is soliciting comments on the proposed rule until Dec. 27.

“If structured properly, VDPs can provide a secure channel for disclosures that do not prematurely inform adversaries of flaws in websites or applications,” says Brian Fox, chief technology officer and co-founder of software-management firm Sonatype. “Clear documentation would be needed by the VDP program on what is allowed in regards to finding versus exploiting a vulnerability. Paired with a strong communication protocol, researchers and VDP program teams can safely work through remediation efforts without political or national security implications.”

While the proposed rule is a good first step, do not expect to see a rise in attempts to find vulnerabilities in production sites, says Veracode’s Wysopal. 

“I don’t think researchers are going to test government sites without an explicit VDP,” he says. “There is perceived risk that the government will be more sensitive to having security issues exposed than corporations are.”

A public comment can be submitted through GitHub.

Related Content

• ‘Hack the Marine Corps’ Bug Bounty Event Held in Vegas
• New FISMA Report Shows Progress, Gaps in Federal Cybersecurity
• Amazon S3 Bucket Leaks Expose Classified US Veteran Data
• RNC Voter Data on 198 Million Americans Exposed in the Cloud
• Hack The Pentagon: DoD Launches First-Ever Federal Bug Bounty Program

Check out The Edge, Dark Reading’s new section for features, threat data, and in-depth perspectives. Today’s top story: “A Cause You Care About Needs Your Cybersecurity Help.”

Veteran technology journalist of more than 20 years. Former research engineer. Written for more than two dozen publications, including CNET News.com, Dark Reading, MIT’s Technology Review, Popular Science, and Wired News. Five awards for journalism, including Best Deadline … View Full Bio

Article source: https://www.darkreading.com/vulnerabilities---threats/dhs-to-require-federal-agencies-to-set-vulnerability-disclosure-policies-/d/d-id/1336499?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Offensive Security, maintainer of the Kali Linux penetration-testing platform, has released a new version of the widely used open source project.

Key improvements in Kali Linux 2019.4 include a brand-new default desktop environment, a unified user interface, and an undercover feature that allows security researchers to use the pen-testing tool in a public setting without tipping their hand.

With the new release, Offensive Security has moved Kali Linux from Gnome to Xfce, a lightweight, open source desktop environment for Linux, BSD, and other Unix-like operating systems. The move is designed to improve performance and the user experience for pen-testers, according to Offensive Security.

Xfce, for instance, runs on all levels of Kali installs from high-end laptops to lower-end ARM-based systems. It also supports a unified user interface (UI) regardless of where the user is running Kali, whereas with Gnome some of Kali’s lower-end ARM builds had a very different UI than on other platforms. Importantly, Xfce supports all the functionality the average Kali Linux user requires with none of the additional overhead associated with the Gnome desktop environment, according to Offensive Security.

“Gnome has been overkill for many Kali users, and we wanted to move to a desktop environment that does only what’s needed,” says Jim O’Gorman, chief content and strategy officer at Offensive Security.

Most Kali Linux users typically just want a web browser and a window manager that allows them to run multiple terminal windows at once. “By moving to Xfce, we’re providing a lightweight, to-the-point experience, and a unified UI regardless of where you’re running Kali.” The switch allows for Kali Linux to be more responsive and use less system resources, O’Gorman says.

The Kali undercover feature meanwhile is designed to give Kali Linux users a way to remain inconspicuous when doing security assessments in public, he notes. “The classic Kali dragon is so iconic it’s often a dead giveaway for what you are doing, even for people that don’t work in this space,” O’Gorman notes. The undercover theme is designed to appear like a Windows desktop to the casual viewer. The theme is unlikely to hold up to a detailed examination but is perfectly adequate for fooling a casual observer, he says.

Kali Linux has been downloaded millions of times for each release. But Offensive Security does not have any exact numbers on how many organizations, pen-testers, and security researchers around the world might be using it currently, O’Gorman says. “We see Kali being used in the workplace, with ‘live-build,’ allowing for people to generate their own image of Kali, with their settings and programs preapplied,” he notes.

Kali Linux penetration testing tools come in a variety of forms including those that can be used for information gathering, vulnerability analysis, wireless attacks, and vulnerability exploitation. Well-known and widely used Kali Linux tools include Nmap, Burp Suite, and the Metasploit Framework.

Offensive Security is currently going through every aspect of the Kali Linux project to see how it can be improved and what might need to be jettisoned. The analysis has already prompted changes in how Kali’s Git repository is managed, how the software is mirrored and distributed, the way new releases are packaged, what tools get packaged with each Kali release, and other aspects.

“With the 2019.4 release in the rearview mirror, we will soon begin looking at our online services, such as support forums, bug tracker, real time chat, and so on,” O’Gorman says.

• Kali NetHunter App Store Now in Public Beta
• FireEye Creates Free Attack Toolset for Windows
• Penetration Test Data Shows Risk to Domain Admin Credentials
• 8 Legit Tools and Utilities That Cybercriminals Commonly Misuse

Check out The Edge, Dark Reading’s new section for features, threat data, and in-depth perspectives. Today’s top story: “A Cause You Care About Needs Your Cybersecurity Help.”

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year … View Full Bio

Article source: https://www.darkreading.com/vulnerabilities---threats/kali-linux-gets-new-desktop-environment-and-undercover-theme/d/d-id/1336500?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

There’s no shortage of news about data breaches. In the first three quarters of 2019, we’ve seen reports of 1,152 data breaches, exposing more than 160 million records from companies ranging from banks and hospitals to social media sites and restaurants.

Admittedly, most security articles in the last decade or so can be started with a similar statistic. However, such headlines are more troubling today given the increase in security investments over the past few years.

They also tell an important story: We’ve yet to determine the best method for learning about threats, acting against them, and then securing our systems against future attacks. While many security professionals agree in principle that “know your enemy” is important, few actually put it into practice.

I saw this problem often during my eight years as a security analyst. Organizations have the intelligence, but not the ability to use it to further their goals. I continue to see the same issues and misconceptions when it comes to threat intelligence. Here are three common threat intelligence myths that are preventing organizations from reaching their full security potential.

Myth 1: It’s easy to use threat intelligence to prevent threats.
I’ve seen security teams try to incorporate intelligence into preventative controls, but many of these controls are inherently static and don’t effectively address intelligence uncertainties. Making an otherwise static preventative control more agile often presents an unsolvable challenge. On the other hand, security teams can and should use threat intelligence in detection and visibility controls because it allows you to make rapid adjustments. To use an imperfect analogy, it is easier to turn your spotlight or a magnifying glass on a new object than to build a concrete wall around it.

Static defenses can, in some cases, work rather well in prevention. For example, application whitelisting or network access controls contribute to security without any awareness of threat actors. You can also try using threat intel data in an IP or hash block list, with mixed results.

However, these are minimal-value use cases of threat intelligence, and some would even say that IP and hash block lists are not even true threat intelligence. Leveraging threat intelligence implies a degree of agility, which is often wasted by the teams that rely heavily on these static defenses. You are likely to contribute more to your security when you use threat intelligence for detection, alert triage, and incident response versus blindly trying to play “whack-a-mole” with an unknown attacker.

Myth 2: The more threat intelligence you collect the more secure you are.
Many organizations don’t know how to gain value from threat intelligence, and intelligence — cyber or not — doesn’t help people who aren’t willing to help themselves. If someone tells you that thieves are planning to rob your house tonight, what steps would you take to try to prevent it? You could lock the doors, hide your valuables, and maybe stay at a friend’s house. However, none of that would guarantee that the crime wouldn’t happen.

I’ve noticed that organizations don’t truly understand what it means to be “agile” when acting on threat intelligence. In my experience, an agile security team rapidly operationalizes and incorporates intelligence into detection processes, and deploys tools that work quickly to deliver detection. If you learn that a group is planning to hack your systems using a certain method, but you can’t adjust your infrastructure or existing controls to defend against that method, intelligence is wasted. You are only as secure as the next steps you take after learning about a threat — and if you take them in the time you have before it hits.

I once heard about a company that learned that its e-commerce website was on the verge of an attack. Since it couldn’t contact a new hosting provider overnight or make changes to their configurations, the company had no way to defend itself. Ultimately, it took nearly the same loss as it would have if it didn’t even know the attack is coming. What would have been more effective: if the security team quickly made direct changes to the hosting provider configuration or the website itself.

Myth 3: Everybody needs threat intelligence.
While threat intelligence can be sexy, security operations processes can’t become “intelligence-aware” overnight. In fact, a drive for more intelligence can often be a distraction for security teams, especially when such intelligence is not operationalized. In these cases, the organizations would be better off focusing on security measures such as removing administrative rights and application whitelisting, and others that work effectively in near-complete absence of threat intelligence.

It is much easier to hook up new threat intelligence data feeds than to accelerate the change management process to help the organization quickly find an affected asset. However, more intelligence does not lead to more security, and there is an opportunity cost to an “intelligence pack-rat approach.”

Related Content:

• 13 Security Pros Share Their Most Valuable Experiences
• 4 Ways to Soothe a Stressed-Out Incident Response Team
• Former White House CIO Shares Enduring Security Strategies
• Most Companies Lag Behind ‘1-10-60’ Benchmark for Breach Response

Check out The Edge, Dark Reading’s new section for features, threat data, and in-depth perspectives. Today’s top story: “In the Market for a MSSP? Ask These Questions First“

Anton is a recognized security expert in the field of log management, SIEM and PCI DSS compliance. He is the author of several books and serves on advisory boards of several security startups. Before joining Chronicle, Anton was a research vice president and Distinguished … View Full Bio

Article source: https://www.darkreading.com/threat-intelligence/3-modern-myths-of-threat-intelligence/a/d-id/1336452?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

This installment of the State of the Internet / Security examines credential stuffing and Web application attack trends over the past 17 months, with a focus on the gaming industry. One reason gaming is so lucrative is the trend of adding easily commoditized items for gamers to consume, such as cosmetic enhancements, special weapons, or other related items. Gamers are also a niche demographic known for spending money, so their financial status makes them tempting targets.

(Registration required.)

Article source: https://www.darkreading.com/edge/theedge/new-state-of-the-internet-web-attacks-and-gaming-abuse/b/d-id/1336486?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Music streaming service Mixcloud has disclosed a security incident in which unauthorized users gained access to some of its systems, resulting in the sale of customer data on the Dark Web.

Mixcloud published a notice regarding the incident late last week, confirming it received reports that intruders breached its systems. At the time, it reported the attack involved email addresses, IP addresses, and encrypted passwords for a minority of Mixcloud users. Most people sign up for the service via Facebook authentication; their passwords are not stored.

The passwords Mixcloud stores are salted and hashed, it says, and are unlikely to be decrypted. Mixcloud does not store full payment card numbers or mailing addresses, the company reports.

While Mixcloud did not disclose the breach’s scale, the alleged attacker who provided a portion of the data to TechCrunch said there were 20 million records stolen. However, 21 million records were listed for sale, and the data sample indicated there may have been up to 22 million records stolen. Data listed includes usernames, email addresses, and salted passwords.

Read more details here.

Check out The Edge, Dark Reading’s new section for features, threat data, and in-depth perspectives. Today’s top story: “A Cause You Care About Needs Your Cybersecurity Help.”

Dark Reading’s Quick Hits delivers a brief synopsis and summary of the significance of breaking news events. For more information from the original source of the news item, please follow the link provided in this article. View Full Bio

Article source: https://www.darkreading.com/threat-intelligence/data-from-21m-mixcloud-users-compromised-in-breach/d/d-id/1336491?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

The Edge is Dark Reading’s home for features, threat data and in-depth perspectives on cybersecurity. View Full Bio

Article source: https://www.darkreading.com/edge/theedge/sharing-is-caring/b/d-id/1336492?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Image Source: Adobe Stock (gpointstudio)

It may be hard to believe it, but the holiday season is upon us. It’ll be no time at all before our readers will need to gear up for cybersecurity team dinners and office parties. If you’re stumped on what to get security colleagues or industry friends, we here at Dark Reading have got you covered. We’ve collected a fun list of affordable choices that are sure to get a giggle, or at least a snort, from cybersecurity industry vets.

These are perfect for white elephant gift exchanges, secret Santa festivities, boss gag gifts, or sending away to conference buds you don’t get to catch up with nearly enough.

Ericka Chickowski specializes in coverage of information technology and business innovation. She has focused on information security for the better part of a decade and regularly writes about the security industry as a contributor to Dark Reading.  View Full Bio

Article source: https://www.darkreading.com/careers-and-people/cybersecurity-team-holiday-guide-2019-gag-gift-edition/d/d-id/1336398?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple