STE WILLIAMS

A hacker who recently stole U.S. military secrets about combat drones and tried to sell them on the black market apparently accessed the data by searching the Internet for misconfigured Netgear routers and exploiting a 2-year-old known vulnerability involving default login credentials. Clearly, even the military struggles to protect itself from threats and attacks.

The root of this data breach emanates from an old way of thinking about implementing security — one that relies on static risk and vulnerability management. These principles and practices, which are locked in a binary view of the world, are diminishing in effectiveness in the face of a dynamically changing threat landscape. Unlike the old world of black and white, and good and bad, grayness is the new the reality in security.

To deal with this gray zone, organizations need a new approach, one that continuously monitors, assesses, adapts, and responds to risk as needed in real time.

Research firm Gartner has defined this new approach as Continuous Adaptive Risk and Trust Assessment (CARTA). The firm predicts that by 2020, 25% of new digital business initiatives will adopt a strategic CARTA approach, up from fewer than 5% in 2017.

In a nutshell, Gartner sees CARTA as a way for organizations to manage the risks that come with the digital world by deploying security that moves at the speed of digital business.

How to Implement CARTA
Under CARTA, all systems and devices are considered potentially compromised and their behaviors are continuously assessed for risk and trust. Here are the five key components for deploying a CARTA-inspired security model:

Asset Discovery
The first step in implementing a CARTA-based security program involves gathering and maintaining a comprehensive and up-to-date asset inventory. Without this data, it is virtually impossible to assess risks and apply appropriate defenses. Asset management should be automated so an organization can efficiently keep track of devices — their type, model, location, functions, and configurations — and of software, notably versions, patches, problems, and a history of vulnerabilities.

Without such information, an organization cannot perform basic proactive security measures such as monitoring network activity, taking snapshots of current configurations, and preventing attacks. Asset information can also be used to restore devices and software if an attack occurs.

Trust Relationships
Strong asset management is only as strong as the process for managing trust relationships between various devices, software, and the people who use them. Accordingly, organizations need to understand, monitor, and manage how devices, software, and people interact on an hourly basis each day.

As trust and risk increases and decreases dynamically based on context and behavior, models of trust and risk should be created that observe patterns over time. If the risk score of a specific device or user gets too high and outweighs the trust (for example, a user who tries to download a massive amount of sensitive data to an unmanaged device), an organization has two choices: reduce the risk score or increase the trust score.

Vulnerability Assessment
This consists of continuous assessment and prioritization of vulnerabilities for remediation. Because thousands of vulnerabilities are discovered each year, addressing all of them is not achievable. A more effective approach is to focus on the most serious, imminent, and executable threats. For example, remote code executions (RCEs) are among the most toxic threats to an organization. These should receive a high prioritization, especially when evidence from security intelligence feeds indicates a particular RCE vulnerability has been weaponized and is being actively exploited in the wild.

Metrics
As always, the devil is the details. This has become increasingly important because cybersecurity is now also a concern of the C-suite and boards of directors. Being able to report security metrics in business terms is now a requirement in larger organizations. These metrics are also critical to senior management when they make the case for additional investments in security resources; shoring up cyber defenses requires fact-based evidence of threats, gaps, and risks that can be understood by a nontechnical audience.

Adaptability
This is the core component of any CARTA-based security program. In response to changing security conditions, organizations need to reassess their risk levels each month, certainly each quarter. A best practice is to be proactive and adaptive, leveraging a risk-based strategy to security that adapts to the changing network of devices and applications. In addition, since the network changes far more rapidly than policies and procedures in standard compliance frameworks, a risk-based approach should be implemented on top of frameworks that may change only once a year.

Digital transformation, which is being driven by cloud, mobile, and Internet of Things technologies, is making static approaches to enterprise security irrelevant. Defending a constantly expanding attack surface, which often lacks a perimeter, requires a dynamic and continuous approach to vulnerability and risk assessment, prioritization, and remediation.

CARTA provides a useful road map for implementing a security program that is capable of responding to the volume and velocity of threats and their polymorphic nature.

Related Content:

• What You Should Know About Grayware (and What to Do About It)
• Worst Malware and Threat Actors of 2018
• Finding Gold in the Threat Intelligence Rush

Black Hat Europe returns to London Dec. 3-6, 2018, with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier security solutions, and service providers in the Business Hall. Click for information on the conference and to register.

Christopher Acton is vice president of security services and customer success for RiskSense, a provider of vulnerability prioritization and management software. He is a security researcher and expert in web application, infrastructure and system security. View Full Bio

Article source: https://www.darkreading.com/risk/carta-a-new-tool-in-the-breach-prevention-toolbox/a/d-id/1333244?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Excluding the financial services industry, there were 649 breaches reported on and analyzed for the 2018 Verizon Data Breach Investigations Report (DBIR) in industries that are considered part of infrastructure verticals. These include utilities, transportation, healthcare, and others that employ operational technology (OT) systems in addition to traditional IT for their main operations.

In total, that represents 29.2% of reported breaches (not incidents). So, what exactly does that mean?

It means that just because an incident hasn’t happened in your infrastructure environment, that doesn’t mean it won’t happen or that you can postpone or underfund your cybersecurity efforts. No, I don’t believe we are facing a “Cyber Pearl Harbor.” But I do believe organizations operating both IT and, particularly, OT systems need to put a more conscious effort into securing these systems not only from a security perspective but in terms of quality, safety, and reliability.

Although OT industries face a similar set of problems as traditional IT, the overall application of security programs and technologies is quite different in OT, and there is even more differentiation based on the characteristics of each vertical. That being said, there are best practices in key areas, both technical and organizational, that can help mitigate the risk to infrastructure environments, regardless of the vertical. Here are five.

Risk 1: Your Environment
An organization is at a serious disadvantage if it doesn’t take the time to inventory its systems and assess the security posture for a given environment. It is nearly impossible to secure an environment if you are unaware of what is in it, how everything is connected, what data it uses (or generates), and how it affects your bottom line.

Best Practice: One of the best pieces of advice for organizations with a large installed base or many infrastructure environments is to pick a representative environment. Once you have selected an important or representative environment, move forward by cascading the lessons you’ve learned to the rest of your environments.

Risk 2: Patch Management
One of the prevailing issues in OT networks is the lack of technical solutions and organizational practices for patching. This is particularly relevant if the application sits on a commercial OS, as most do. In my experience, the average number of remote code execution vulnerabilities on the host operating system alone in OT environments is around 55! Consequently, developing and maintaining a strong patch management strategy is one of the most effective activities an organization can undertake. It’s also a daunting undertaking.

Best Practice: To get started, interact with your system vendors. If your representative isn’t familiar with the company’s patching solutions, press deeper into the organization. Most major automation manufacturers are working toward solution sets compliant with standards such as IEC 62443, and customer pressure can convince niche vendors to address this problem as well.

Risk 3: Network Segmentation
Many OT systems are deployed in a flat network topology or without any segmentation between systems that should not be able to interact. There are two reasons for this. First, due to a misunderstanding about which systems need to communicate with one another, and the second, as a result of deploying systems from multiple vendors or integrators over time.

Best Practice: After assessing the network topology and data flows, you will need to develop network segmentation policies, which are similar to various industry standards language describing the zones and conduits of controlling access. The goal of these policies is to mitigate the damage potential of breaches or issues related to anomalous network traffic. Bottom line: only required traffic should pass between systems, and restrictions on communication paths between various zones should be enforced.

Risk 4: Your Supply Chain
In many OT environments, vendors maintain an aspect of control over the technical implementation of the solutions they provide through support contracts and changes that must be validated and certified to ensure the safe operation of a given system.

Best Practice: Your organizations should be sure to include security requirements for the procurement of new systems as well as ongoing maintenance efforts within their vendor management programs. Industry standards such as IEC 62443 can provide guidance in this effort.

Risk 5: IT vs. Process Control Teams
Over the past few years, at both the leadership and execution levels, IT security teams have become involved in OT network security efforts. In several cases, the differences in priorities and the understanding of technology has led to organizational stalemates and differing opinions on how to address security in operational environments.

Best Practice: Organizations need to bring these groups together with a common goal in order to foster a culture of cooperation between the two groups to address cyber threats. Training for both OT and IT security personnel should be part of that effort, including the development of a common understanding of objectives and solutions that work for your organization.

Related Content:

• 7 Steps to Start Your Risk Assessment
• Constructing the Future of ICS Cybersecurity 
• Hidden Costs of IoT Vulnerabilities

Black Hat Europe returns to London Dec. 3-6, 2018, with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier security solutions, and service providers in the Business Hall. Click for information on the conference and to register.

Michael Fabian is a principal consultant within the Synopsys Software Integrity Group. His primary area of specialization involves adapting and bringing systems-level security objectives, processes, and technical solutions into a variety of non-traditional cyber systems in … View Full Bio

Article source: https://www.darkreading.com/vulnerabilities---threats/vulnerabilities-in-our-infrastructure-5-ways-to-mitigate-the-risk/a/d-id/1333211?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Penalties in a global cell phone fraud scheme continue to mount as a fifth defendant has pleaded guilty in connection to the case. Braulio De la Cruz Vasquez, a 54-year-old former resident of West Palm Beach, Fla., entered pleas in the Southern District of Florida.

De la Cruz pleaded guilty to one count of wire fraud, one count of aggravated identity theft, and one count of conspiracy to commit wire fraud, access device fraud, the use, production or possession of modified telecommunications instruments and the use or possession of hardware or software configured to obtain telecommunications services.

According to the US Department of Justice, the scheme involved stealing access to existing cell phone accounts, then fraudulently opening new accounts based on the information. In his admission of guilt, De la Cruz said that thousands of international calls would be routed via the internet to his residence, where phones programmed with the fraudulent accounts would be used to place the calls to countries such as Cuba, Jamaica, and the Dominican Republic, while the charges were billed to the original customers’ accounts.

De la Cruz received amounts in the tens of thousands of dollars from VoIP companies for routing the calls. Sentencing is scheduled for Jan. 18, 2019; others in the case have already received sentences of 36 to 75 months for their roles in the scheme.

For more, read here.

Dark Reading’s Quick Hits delivers a brief synopsis and summary of the significance of breaking news events. For more information from the original source of the news item, please follow the link provided in this article. View Full Bio

Article source: https://www.darkreading.com/mobile/guilty-plea-made-in-massive-international-cell-phone-fraud-case/d/d-id/1333237?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Everyone has seen them: applications that come on many new systems offering services with unfamiliar names, or apps that have familiar names but are offered on sites that aren’t from their publishers. They’re grayware – or “potentially unwanted applications” – and they’re an ongoing issue for computer security.

Grayware’s nature makes it difficult for organizations to keep it away from their systems. “It’s not a technical problem, it’s a classification problem. There is a thin line being malicious or not and the operators play with the line. Which limits what researchers and law enforcement can do,” said Vitor Ventura, senior security researcher at Cisco Talos, in an email interview.

Some IT professionals might be tempted to ignore grayware while they focus on more obvious malware and other threats. But there are legitimate reasons not to.

“Oh, it’s horrible,” says Chet Wisniewski, principal research scientist at Sophos. “Not only are you getting something that’s annoying to the user, it’s often more than doubling the attack surface of your computer because of the additional amount of Internet-facing code that’s often poor quality.” That’s in addition to the privacy and productivity implications of code that tracks activity and pops up unwanted ads, he says.

IT and security teams need to consider a number of factors about grayware, both in terms of what it is and how to deal with it. Without many automation option to help, response is up to a well-informed staff.

(Image: typographyimages)

Curtis Franklin Jr. is Senior Editor at Dark Reading. In this role he focuses on product and technology coverage for the publication. In addition he works on audio and video programming for Dark Reading and contributes to activities at Interop ITX, Black Hat, INsecurity, and … View Full Bio

Article source: https://www.darkreading.com/vulnerabilities---threats/what-you-should-know-about-grayware-(and-what-to-do-about-it)/d/d-id/1333216?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Dropbox has partnered with Israeli security firm Coronet in an agreement expected to ramp up security for the file-sharing platform while increasing Coronet’s user base.

Coronet’s data breach protection platform will be incorporated into Dropbox as part of the collaboration. The cloud security integration will build on Dropbox’s security with data loss prevention, malware mitigation, suspicious behavior detection, and data breach protection.

Small to midsize businesses are Coronet’s target market, Reuters notes, because they struggle to afford and manage enterprise-level security resources.

Coronet expects the partnership will help add to the 1 million users, devices, and software-as-a-service applications using its platform. Dropbox Business is used among more than 300,000 teams. This integration will be available to Dropbox Business customers by the end of 2018, they report.

Read more details here.

Black Hat Europe returns to London Dec 3-6 2018  with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier security solutions and service providers in the Business Hall. Click for information on the conference and to register.

Dark Reading’s Quick Hits delivers a brief synopsis and summary of the significance of breaking news events. For more information from the original source of the news item, please follow the link provided in this article. View Full Bio

Article source: https://www.darkreading.com/risk/dropbox-teams-with-israeli-security-firm-coronet/d/d-id/1333239?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

CSAW – Brooklyn, New York – New York University’s CSAW, which calls itself the world’s largest student-run cybersecurity competition, this week announced the 397 high school, undergraduate, and graduate students from around the world who will enter its final round.

CSAW started in, and is organized by, NYU’s Tandon School of Engineering. This year, its 15th running, saw 3,500 teams from more than 100 countries enter the games. The remaining contenders will now travel to academic sites across four continents to compete in the finals.

The competition was founded in 2003 as a small local event by Nasir Memon, an NYU professor of computer science and engineering. It has since expanded to include eight global events, all of which evolve to host challenges and contests that align with the changing threat landscape.

“It started accidentally, like many things start,” said Memon in an interview with Dark Reading at the North American branch of the CSAW finals. The event is taking place this week on NYU Tandon’s campus in Brooklyn, New York.

CSAW’s first participants, all Tandon students, were challenged with cleaning up poorly configured laptops among other adversarial tasks designed to test their offensive and defensive security skills. The internal competition quickly expanded — first to local New York universities, then throughout the tri-state area, and now in Mexico, Israel, and around the world.

“What we really caught on to was, there’s a kind of talent that likes these adversarial challenges,” Memon explained. “You cannot really teach security by lecturing in a classroom. You have to understand how attackers work.”

The first stage of CSAW happens online. When competitors reach the finals, they’re brought together so they can get to know each other. “In order to protect … you need to be sharing information with each other,” he said. “Otherwise, the bad guys have an advantage.”

Challenges are designed with the help of New York City’s top white-hat hackers. Players of all ages and levels can join Capture the Flag, the flagship CSAW event that tests hacking and defensive skills. An embedded security challenge, which CSAW calls its most difficult event, pits red teams against blue teams in simulated cyberattacks. This year’s, created with the United States Office of Naval Research, requires participants to perform data exfiltration attacks against Internet of Things devices.

Different challenges attract students of different levels and expertise. A Policy Challenge attracts students in policy and law school who are interested in how security will play a role. Applied Research accepts peer-reviewed security papers that have been published in scholarly journals. A forensics analysis competition is restricted to high school students, he explained.

Memon said CSAW has proven an effective way to attract students to cybersecurity, a concept he said wasn’t yet in people’s minds when the competition started 15 years ago. Studies show after competing, students often decide to pursue cybersecurity careers, he pointed out. If they don’t, they have greater security awareness as software engineers or other non-infosec roles.

The event has become a hot spot for recruiters, who CSAW initially brought in to help offset the cost of transportation and accommodations for students who fly in for the finals. “We’re not doing this to make money,” Memon said, noting all the workers are volunteers. But flights and hotels for a growing pool of student competitors can get expensive.

Companies “across the board” come to CSAW to recruit security employees, he said, with the majority representing the tech and financial sectors. A growing number of businesses are expressing interest in attending the event to seek out talent.

Related Content:

• 20 Cybersecurity Firms to Watch
• Finding Gold in the Threat Intelligence Rush
• 5 Things the Most Secure Software Companies Do (and How You Can Be Like Them)
• Symantec Uncovers North Korean Group’s ATM Attack Malware

Black Hat Europe returns to London Dec. 3-6, 2018, with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier security solutions, and service providers in the Business Hall. Click for information on the conference and to register.

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance Technology, where she covered financial … View Full Bio

Article source: https://www.darkreading.com/risk/inside-csaw-a-massive-student-led-cybersecurity-competition/d/d-id/1333241?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple