STE WILLIAMS

With DevOps principles taking root and reaching greater maturity at an increasing number of enterprises today, security strategists are in for some major disruption of the status quo in the coming years. That’s the message being brought forward by a number of talks at next month’s Black Hat USA, which will feature discussions on the impact that DevOps-driven practices and tools will have on the security world.

“The way software is being delivered is fundamentally changing. Security, frankly, just has to catch up,” says Kelly Shortridge, vice president of product strategy for Capsule8, who will be co-presenting a talk titled “Controlled Chaos: The Inevitable Marriage of DevOps Security.” “There is almost a Copernican revolution right now where the primitive models that we’ve held dear for decades and are the basis for a lot of security strategies no longer apply to this cloud and microservices world. So we have to rethink things in a lot of ways.” 

One of the most obvious fronts needing rethinking is with containerized workloads, which are self-encapsulated instances of application components that are changing the face of IT architecture. Containers aren’t explicitly a DevOps tool per se, but the DevOps philosophical push to make small, incremental changes to software through automation and microservices — breaking up large applications into smaller, reusable chunks — has been a catalyst for recent container adoption.

On the whole, enterprises are experiencing a stratospheric explosion in containers and an increasing reliance on container orchestration tools as a crucial part of the software delivery and operational toolchain. As evidenced by sessions scheduled at Black Hat, security researchers are already starting to probe the security and resilience of containers and container orchestration platforms like Kubernetes. For example, Ian Coldwater, lead platform security engineer at Heroku, and Duffy Cooley, staff cloud native architect at VMware, will present “The Path Less Traveled: Abusing Kubernetes Defaults,” a talk that will explore the attack surface exposed by running a default configuration of Kubernetes — essentially exploiting the as-designed features of the platform. 

Early exploration and research such as this notwithstanding, the average security practitioner still remains largely in the dark about container architecture, its unique peccadillos, and its inherent risks, says Shortridge’s colleague, Brandon Edwards, chief scientist for Capsule8.

“A lot of people sort of just group them up with [virtual machines] or similar technology, but they’re not,” says Edwards, who is co-presenting his own talk, “A Compendium of Container Escapes,” which will offer a primer for security professionals to get their arms around the basics of the container attack surface. “Containers have completely different security properties, so we’re just going through a variety of different ways of how they can be broken and where the security properties of containers exist and where they don’t.”

Edwards will also bring forward some predictions about the kinds of hacks and vulnerabilities we’re likely to see in the next 12 months as security researchers and attackers start truly digging into containers.

The mystery of containers for security people is a microcosm of the larger ripples caused by the disruptions wrought by rapidly changing software delivery methods. Security teams struggling to keep up are still wont to apply old models to the new technologies, which comes down to misperceptions about them, Shortridge says. For example, the false equivalency that Edwards mentioned about containers being perceived as lightweight virtual machines will throw off strategists’ thinking. 

“So if you’re operating off that assumption, then your threat models are going to be all wonky and wrong — particularly if you weren’t mapping the workloads and understanding how different systems are working with each other,” she says, explaining that misunderstandings about new technologies also lead to a naïve belief that old technologies can be ported to these modern systems. “So they might think, ‘Is there a firewall just for containers?’ But that doesn’t make any sense, and it’s not what we actually need.” 

That lack of understanding is a microcosm of the larger industry ripples caused by DevOps software delivery methods.

The good news is that for security people who can accept this is where IT is going and are willing to make the pivot to support it, it quickly becomes apparent that DevOps practitioners share many of their goals and that the new mode can open a lot of opportunities to simplify security work, Shortridge explains. This includes foundational principles like system resilience, repeatability, and traceability of processes. She says that the security triad of CIA — confidentiality, integrity, and availability — is likely to morph into what she calls the DIE triad in the modern DevOps world: distributed, immutable, and ephemeral. 

“They roughly involve the same characteristics. Distributed computing is similar to availability — you want to make sure that none of your resources are centralized,” Shortridge says. “For immutable, that’s like integrity. You want to make sure that data stays the same, right? You don’t want tampering or modification. And then for ephemeral, you also want to try to drive the value of assets down to zero, to make persistence less valuable, which you can do with a modern infrastructure. In a lot of ways, your job as a security person becomes a lot easier under this paradigm.” 

Related Content:

• 7 Hot Cybersecurity Trends to Be Highlighted at Black Hat
• A Security-First Approach to DevOps
• The 12 Worst Serverless Security Risks
• 6 Serverless and Containerization Trends CISOs Should Track

Black Hat USA returns to Las Vegas with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier security solutions and service providers in the Business Hall. Click for information on the conference and to register.

Ericka Chickowski specializes in coverage of information technology and business innovation. She has focused on information security for the better part of a decade and regularly writes about the security industry as a contributor to Dark Reading.  View Full Bio

Article source: https://www.darkreading.com/application-security/devops-inevitable-disruption-of-security-strategy/d/d-id/1335170?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

When it comes to insider threats, business and security leaders are facing a harsh reality. Last year, there were 50,000 mergers and acquisitions (MA) transactions worldwide, with a total value of about $4 trillion. The biggest concerns for dealmakers? They were not what you might expect. For more than a quarter of them, it wasn’t typical issues related to valuation, integration, or execution; instead, it was insider threat and other cybersecurity issues.

The risk of data loss or data theft increases during MA. Employees, especially at the sell-side company, will hedge their bets and prepare for the worst. “What does this deal mean for me? Is my job safe?” In times of uncertainty, even the best employees may take actions that are out of character in order to keep data that they believe belongs to them.

Consider a developer with high-demand skills at an artificial intelligence startup that was just acquired by the market leader. As part of the deal, the buy-side company announces a reorg. Hearing about the pending layoffs, a recruiter for the competition begins poaching talent with the promise of a big compensation package. Worried about losing his job, the developer accepts the offer. Before he leaves, he transfers some source code to personal cloud storage, thinking it might be useful in his new role. Now, your intellectual property (IP) has walked out the door.

Investing big in a merger or acquisition only to discover that you’ve lost valuable data is a dealmaker’s nightmare. And because data has never been more portable, taking it has never been easier. Employees can store hundreds of gigabytes on their mobile devices, put 1TB or more of data on removable media, or, like the developer, quickly transfer data to personal cloud storage services.

When you consider Deloitte’s estimate that IP can account for as much as 80% of a company’s value, it should not be surprising that securing the transition of that data will directly affect the success — or failure — of an MA deal. To better protect their investment, it’s time for buy-side companies to take a more holistic approach to data loss protection from insider threats.

Demise of the Castle Metaphor
Since the dawn of technology, security has been built around a castle metaphor. The idea is that your network and data is inside a castle that you need to fortify and safeguard. If you build a big enough “moat,” everything will be fine. This philosophy assumes that cybercriminals and malicious attacks are outside the moat, and that anything and anyone inside the walls of the castle should be inherently trusted.

However, the notion that you can trust everyone “inside” and prevent all of your sensitive or confidential data from being exfiltrated or compromised is flawed thinking. Data loss “prevention” is a ridiculous promise. Losing data is inevitable.

The Broken Promises of Legacy DLP
To guard against insider threat and data loss during MA, many buy-side companies opt for a traditional data loss prevention (DLP) solution. They install DLP software on the endpoints of the sell-side company and put strict policies in place to ensure sensitive data doesn’t leave the castle.

The problem is that these restrictive policies get in the way of employees getting their jobs done. The policies fail to account for new data being created as the companies work together through the MA process. They also throw off alerts every time a user moves data that has been classified as sensitive. For many employees, however, moving sensitive data is a completely normal and necessary part of their everyday work. The end result for security teams? Rigid classification rules that simply can’t keep up and a flurry of false alerts that are nothing more than noise.

Protect Everything and Trust No One
There is a better way to safeguard data and streamline the MA process. Rather than trying to identify and tag select files as sensitive, organizations should have visibility to all their data and where it lives and moves.

This approach fundamentally shifts the emphasis of a data security program from prevention to protection by focusing on speed of detection and response. It works based on the assumption that all data is important. Sales pipelines, forecasts, competitive campaigns, customer contact information, product road maps, prototype drawings — they’re all critical IP. And when you buy a company, you should be entitled to all the parts.

This next-generation approach to DLP also assumes that you trust no one. In other words, next-gen DLP software doesn’t care if an employee is a trusted user or not. It works at the data level, tracking and monitoring all data activity and flagging anomalies, while keeping copies of all files for fast retrieval and analysis. In an MA situation, you want to see the data you’re paying for, keep it, and protect it if it is threatened. Data blind spots will only leave your deal open to more risk.

When done right, MA is a great way to grow a company and gain a competitive edge. Having the right data security strategy and tools in place will keep your process on track, while protecting your investment. You don’t want to find yourself in the middle of a data security investigation the next time you’re ready to strike a deal.

Related Content:

• 6 MA Security Tips
• Security Matters When It Comes to Mergers Acquisitions
• Merging Companies, Merging Clouds

Black Hat USA returns to Las Vegas with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier security solutions and service providers in the Business Hall. Click for information on the conference and to register.

Joe Payne brings to Code42 more than 20 years of leadership and a proven track record with high-growth software companies. He has a broad experience base in delivering software and software-as-a-service (SaaS) solutions to enterprises across numerous industries. As President … View Full Bio

Article source: https://www.darkreading.com/perimeter/insider-threats-an-manda-dealmakers-nightmare/a/d-id/1335098?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Article source: https://www.darkreading.com/edge-feature-section/d/d-id/1334218?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

The Information Commissioner’s Office (ICO) of the UK said it intends to fine Marriott International £99,200,396, or approximately US$124,000,495, for General Data Protection Regulation (GDPR) violations.

The proposed fine, in response to the massive Starwood Hotels data breach that affected more than 500 million guests around the world, comes on the heels of a record £183 million (US$229 million) fine levied against British Airways for a breach of payment information of more than a half-million customers.

According to the ICO, Marriott has cooperated with the investigation and will now have a chance to present information to the Office regarding the potential fine. After hearing from Marriott and other interested parties, the ICO will decide on the final amount of the fine.

For more, read here.

Black Hat USA returns to Las Vegas with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier security solutions, and service providers in the Business Hall. Click for information on the conference and to register.

Dark Reading’s Quick Hits delivers a brief synopsis and summary of the significance of breaking news events. For more information from the original source of the news item, please follow the link provided in this article. View Full Bio

Article source: https://www.darkreading.com/attacks-breaches/marriott-faces-$124-million-gdpr-fine-in-uk/d/d-id/1335189?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

As more US states legalize recreational marijuana, security experts warn lawful cannabis retailers of their vulnerabilities to cyberattacks targeting consumer and patient information.

Thirty-four states sell marijuana for medicinal purposes; in January 2020, Illinois will become the eleventh to sell cannabis via state-licensed dispensaries. As Matthew Dunn, associate managing director for cyber risk at Kroll, says, “legitimate cannabis enterprises have all the responsibilities of a traditional business.” This means being aware of exposure to cybercrime.

“While they share with all retailers the duty to protect customer data and financial records, cannabis businesses must acknowledge a heightened state of sensitivity around privacy issues,” he writes. Dunn argues dispensaries face greater risk due to the controversial product they sell; as a result, it’s “imperative” they develop a mature cybersecurity strategy to mitigate risk.

The threat is greater for medicinal marijuana dispensaries, which store protected health information (PHI) records that are considered more valuable to attackers than typical PII due to the extent of health data they contain. Medicinal dispensaries aren’t covered under HIPAA, which would limit how they use patient data, but they still must comply with state privacy laws.

What should cannabis retailers watch for? Dunn points to the danger of email-based attacks, which affect retailers across industries but may prove especially prevalent among cannabis companies with relatively new workforces. Cyber extortion is another threat: criminals who access a dispensary’s client database could attempt to extort high-profile customers, he adds.

Also top-of-mind is the heightened risk of IoT attacks as many cannabis retailers use video surveillance equipment that connects to the Internet. While IoT devices offer convenience and flexibility of remote access, Dunn points out how many use default login credentials and oftentimes multiple employees will use the same password to access databases and platforms.

Read more details here.

Black Hat USA returns to Las Vegas with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier security solutions, and service providers in the Business Hall. Click for information on the conference and to register.

Dark Reading’s Quick Hits delivers a brief synopsis and summary of the significance of breaking news events. For more information from the original source of the news item, please follow the link provided in this article. View Full Bio

Article source: https://www.darkreading.com/risk/cybercriminals-target-budding-cannabis-retailers/d/d-id/1335184?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

The cloud certainly offers advantages, but as with any large-scale deployment, the cloud can also offer unforeseen challenges. The concept of the cloud just being “someone else’s data center” makes me cringe because it assumes you’re relinquishing security responsibility because “someone else will take care of it.”

Yes, cloud systems, networks, and applications are not physically located within your control, but security responsibility and risk mitigation are. Cloud infrastructure providers allow a great deal of control in terms of how you set up that environment, what you put there, how you protect your data, and how you monitor that environment. Managing risk throughout that environment and providing alignment with your existing security framework is what’s most important. 

Privacy and Risk
With the EU’s General Data Protection Regulation and similar policies in some US states (Arizona, Colorado, California, and others), organizations face increased requirements when protecting data in the cloud. And the solution isn’t as simple as deploying data loss prevention software in a data center because the data center has become fragmented. You now have a bunch of services, systems, and infrastructures that aren’t owned by you but still require visibility and control.

Cloud services and infrastructures that share or exchange information also become difficult to manage: Who owns the service-level agreements? Is there a single pane of glass that monitors everything? DevOps has forced corporations to go as far as implementing microsegmentation and adjusting processes around firewall rule change management. Furthermore, serverless computing has provided organizations with a way to cut costs and speed productivity by allowing developers to run code without having to worry about infrastructures and platforms. Without a handle on virtual private clouds and workload deployments, however, things can spin out of control and you start to see data leaking from one environment just as you’ve achieved a comfortable level of security in another.

Mitigation
Several steps can be taken to help mitigate risk to an organization’s data in the cloud.

1. Design to align. First, align your cloud environment with cybersecurity frameworks. Often, organizations move to the cloud so rapidly that the security controls historically applied to their on-premises data centers don’t migrate effectively to the cloud. Furthermore, an organization may relax the security microscope on software-as-a-service (SaaS) applications such as Salesforce or Office 365. But even with these legitimate business applications, data may end up being leaked if you don’t have the right visibility and control. Aligning cloud provider technology with cybersecurity frameworks and business operating procedures provides for a highly secure, more productive implementation of a cloud platform, giving better results and a successful deployment.

2. Make yourself at home. Cloud systems and networks should be treated the way you treat your LAN and data center. Amazon’s Shared Responsibility Model, for example, outlines where Amazon’s security responsibility ends and your security responsibility begins. While threats at the compute layer exist — as we’ve seen with Meltdown, Foreshadow, and Spectre — recent cloud data breaches have shown a breakdown in an organization’s security responsibility area, namely operating system security, data encryption, and access control. If your organization has standards that govern the configuration of servers, vulnerability management, patching, identity and access management, encryption, segmentation, firewall rules, application development, and monitoring, see to it that those standards are applied to cloud services and are audited regularly.

3. Stop the “sneaking out at night.” Not too long ago, you would see organizations struggle with employees who set up unsecured wireless access points in an attempt to gain flexibility and efficiency. Fast forward to today — wireless controllers providing rogue detection and intrusion prevention system capabilities have helped rein in that activity. With the cloud, employees are setting up cloud storage accounts, serverless computing environments, and virtual private networks as needed to circumvent cumbersome change control procedures, cut costs, and gain similar flexibility and efficiency. By rearchitecting legacy networks, readjusting decades-old processes and procedures, implementing cloud proxy or cloud access security broker (CASB) technology, and coupling that with strong endpoint security controls and an effective awareness campaign, an organization can provide that level of flexibility and efficiency but still provide for data protection.

4. Keep a close watch. The cybersecurity operations center (CSOC) should no longer be concerned with just the local network and data centers. The operational monitoring procedures, threat hunting, intelligence, and incident response that the SOC uses also apply to cloud environments where the organization’s data resides. Monitoring SaaS applications where corporate data may reside is challenging but can be done using effective endpoint security coupled with the monitoring of cloud access solutions (CASB, proxy, and others). For a serverless environment, depending on your CSOC requirements, this may mean the application of third-party monitoring platforms or solutions beyond what cloud providers offer. In all cases, event logging and triggers need to feed back to the CSOC to be correlated with local event data, analytics, and threat intelligence.

With all the cloud services available, it’s no wonder companies struggle to manage risk. Shifting from a culture of “do whatever it takes to get the job done” to “do what is right for the business” takes a lot of coordinated effort and time but is rooted in security becoming a business enabler rather than continuing to be in the business of “no.”

Organizations must include security in technology decisions if security is to continue to protect the business, and security must understand the needs of the business and changes in technology in order to be that enabler. To help to prevent people from seeking their own solutions to technology problems, IT and security teams must evolve their assets and functions to accommodate that speed and convenience or find themselves constantly trying to keep up. 

Related Content:

• The 2019 State of Cloud Security
• As Cloud Adoption Grows, DLP Remains Key Challenge
• The Life-Changing Magic of Tidying Up the Cloud
• How to Build a Cloud Security Model

Black Hat USA returns to Las Vegas with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier security solutions and service providers in the Business Hall. Click for information on the conference and to register.

Derrick Johnson is the National Practice Director for Secure Infrastructure Services within ATT Cybersecurity Consulting, responsible for its direction and overall business performance. Derrick’s practice provides strategic and tactical cybersecurity consulting services … View Full Bio

Article source: https://www.darkreading.com/perimeter/cloud-security-and-risk-mitigation/a/d-id/1335100?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple