STE WILLIAMS

On January 9, 2005, the Donttrip malware infection hit Northwest Hospital, a large medical facility in Seattle that served thousands of people. The malware clogged up the hospital’s network systems with surges of exploit network scanning. Medical operations ground to a halt as laboratory diagnostic systems couldn’t transfer data. Intensive Care Unit terminals went offline, internal pagers were silenced, and even the automatic operating room doors were locked down.

The IT team bailed valiantly against the sinking ship, but as soon as they cleaned a machine and put it back on the network, it got re-infected. Staff moved to implement disaster recovery processes, using manual or backup systems to bypass the affected systems. The quality of patient care was diminished, but no lives were seriously endangered, and the hospital weathered the storm. The FBI swooped in, eventually arresting the guilty parties, and the word went out: hospitals can be affected by cyber incidents.

That was over 12 years ago. Have things improved?

In April 2017, a 1,000-bed hospital in Buffalo, New York was virtually shut down by a ransomware attack. Then on May 12, the WannaCry ransomware pounded through Europe like a tsunami, leading to substantial IT outages. WannaCry was particularly devastating to UK’s National Health Service, disrupting over a third of health-serving organizations at 603 primary care facilities. With the proliferation of complex IT in healthcare on highly critical but widely open networks, it is no surprise that their systems are at such high risk. Ransomware had proven itself as an existential threat to medical service delivery in modern hospitals.

I recently had a chance to observe the procedures from inside one of the highest ranked hospitals in America. As I was under their care, I couldn’t help but carefully watch and ask questions about their IT security procedures. I followed this up with some research into their security policies and incident histories. I found their cyber hygiene was of an equally high standard. There are also some good IT security lessons worth sharing.

I’ve written before about the insecurity of the Internet of Things, and during my hospital stay I had concerns about all the medical gear like scanners and monitoring devices hospital staff wheeled around and used on patients. It turned out that much of that equipment was air-gapped away from the main network. Most of this equipment was manually controlled, requiring a live operator to enter commands. Old fashioned, yes, but no malware was going to infect an IV feed and overdose a patient. To retrieve data, nurses used a very regimented manual process to capture and record readings from these systems. The amount of data captured was also very small, usually a short series of numbers, which reduced mistakes in the handoff. Over the course of weeks, I observed dozens of different medical professionals executing the same manual process in the same exact way.

In order to enter this data, the nursing staff needed access to wired data terminals. All the corridors and hospital rooms had a computer for data entry and retrieval. All these terminals required a login to access, and I didn’t see one that was left unlocked when unattended. Again, the staff was obviously well trained in locking their systems when leaving. When not logged in, each terminal displayed screen savers showing security awareness and anti-phishing warnings.

It’s no surprise that medical personnel could be well trained and disciplined in following detailed instructions involving complex systems and tools. It was refreshing to see that this hospital put as much emphasis into their secure IT procedures as they did into their patient care processes. My review of their training materials also showed me that they made direct connections between security and patient care quality—a great way to link security processes to the organizational goals.

Nevertheless, being a security professional, I am always thinking about what can go wrong. So, I asked about the plan if the IT systems went down. A nurse told me that the hospital overstaffs with redundant personnel on every shift so they can backfill for emergencies. I could see the value in this. Not only is this insurance against IT disasters but also any kind of medical emergencies when additional personnel may be needed. It may cost extra in the daily operational budget, but it’s worth it to fulfill the mission of the organization (that is, save lives).

In addition to the processes I was directly exposed to, I was given an opportunity to review a lot of the hospital’s security policies and training materials. I was pleased with what I found. There was a method for securely leveraging BYOD smartphones and tablets, as well as two-factor remote access. Both disk and network encryption were placed throughout the entire infrastructure. And there was an appropriate emphasis on asset management and vulnerability testing. They were doing everything they were supposed to be doing.

The most significant thing that struck me was the emphasis on disciplined process that covered the entire staff. I’ve always felt that strong process around key controls was a game changer in maintaining a secure organization. As they say: it’s always the simple things, but the simple things are hard.

Get the latest application threat intelligence from F5 Labs.

Raymond Pompon is a Principal Threat Researcher Evangelist with F5 labs. With over 20 years of experience in Internet security, he has worked closely with Federal law enforcement in cyber-crime investigations. He has recently written IT Security Risk Control Management: An … View Full Bio

Article source: https://www.darkreading.com/partner-perspectives/f5/avoiding-the-epidemic-of-hospital-hacks/a/d-id/1330877?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Back in 1965, a young Ralph Nader wrote an evisceration of the US auto industry. This book, Unsafe at Any Speed, attacked the industry for lagging behind best practices with respect to safety — essentially, carmakers were putting the public at risk by their reluctance to invest in safety features. It’s hard to believe that over 50 years have passed since then, but at the opening of 2018, and as we deal with serious security and safety issues in the computer world, I’ve been reflecting on the situation in which we found ourselves half a century ago.

What’s triggered this reflection is the rotten start of this year, with the revelation of Spectre and Meltdown, two serious vulnerabilities that between them impact most modern computers. The newspapers and Web have been full of descriptions, and yes, these bugs are as unpleasant as they sound. Unlike most of the things we read about, these represent problems in the actual hardware, so there’s no simple software patch that makes everything better. These are not problems that involve a programmer forgetting to check the size of an array; these are problems in the very “brain” of the computer, the CPU.

As chief scientist for a large security company, I’m pretty immune to hype and spin: I deal in realities. As such, I recently gave a company-wide tutorial on these two vulnerabilities (and, really, they involve a class of vulnerabilities rather than discrete things). There’s nothing like having to teach how something works to test that you really understand it. In the case of these bugs, I understand them all too well: these are nasty little side-channel attacks that allow the slow leak of data to an attacker.

Let me be technical for a moment. These problems exist and are exploitable because of a few features of the chip: the translation lookaside buffer and memory caching in general (used to make memory access much quicker), speculative and out-of-order execution (used to make the CPU execute a set of instructions more quickly), and, in the case of one version of Spectre, JIT, or just-in-time compilation (used to make interpreted code run more quickly). When I put it like this, do you see a pattern? I do. These are all related to steps we’ve taken to speed up computing. I get it — people buy CPUs because this year’s model is a shade faster than the one they have. Speed good. Lag bad. Features, especially speed, sell.

Computers have moved from an adjacent spot in our lives (I remember my first computer, on which I mostly played Elite, a space trading game) and have become machines that literally are responsible for helping to keep us alive. My cellphone is with me at all times, a computer applies the brakes in my car, my thermostat happily interacts with servers on the Internet to let me know what the weather outside is, and the lights literally stay on because of modern computation. And it’s not just me — the entire modern world is based upon secure, safe, reliable computing. There is not one aspect of our lives, from birth to death, that doesn’t rely on the magic of computation.

These new vulnerabilities should remind us that the foundation that technologically enables our society is cracked. We have focused on performance, on glitz… more pixels, a couple more gigahertz, animated emojis. The list is endless. But what we haven’t done, outside of a woefully small group of people who make security their life’s work, is put the safety of that complex, beautiful system ahead of its glitter. I’m picking my words with care — security sounds abstract and cold, but we all “get” what it means to make something safe and what the consequence of something being unsafe can be.

I am in awe at the advances we have made in computation. During my career, I’ve gone from hand-coding a machine that ran at 3.25MHz and had a whopping 1KB (!) of memory. By way of contrast 30-something years later, my home laptop works away almost 1,000 times faster per core (and it has several of them) and with seven orders of magnitude more memory available. I can deploy cloud services with a wave of my hand, commanding more computation than I ever dreamed. What we have done is amazing. We should look at those accomplishments with pride. We should also look at the lack of attention we have put into security, at the design stage, with dread: without this infrastructure being secure, it means nothing.

My wish, though made with little hope, is that Spectre and Meltdown will be a wake-up call for all of us. For too long, security has been placed second or worse to features and performance. This must change if we are to really realize the benefits that computation can bring to mankind. I don’t blame the vendors here, but the entire ecosystem. Security and safety typically haven’t been drivers for purchases in IT, and companies can’t be blamed for making products that sell. Somehow, this must change.

Ralph Nader’s Unsafe at any Speed shook up the automotive world over 50 years ago. Perhaps it’s time to apply those same concepts to computation. I don’t want to be unsafe at any speed. No matter how fast my computer, if I can’t trust it, it’s less than worthless — it’s downright dangerous. 

Related Content:

• Doh!!! The 10 Most Overlooked Security Tasks
• Meltdown, Spectre Patches, Performance My Neighbor’s Sports Car
• 5 Steps to Better Security in Hybrid Clouds

Dr. Richard Ford is the chief scientist for Forcepoint, overseeing technical direction and innovation throughout the business. He brings over 25 years’ experience in computer security, with knowledge in both offensive and defensive technology solutions. During his career, … View Full Bio

Article source: https://www.darkreading.com/vulnerabilities---threats/meltdown-and-spectre-computings-unsafe-at-any-speed-problem/a/d-id/1330884?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Confirm, a Boston-based identity verification startup, has agreed to be acquired by Facebook. The two companies have not disclosed the terms of their deal.

For three years Confirm has specialized in building technology that confirms user identities using photos of their driver’s licenses or other forms of ID. The company has developed APIs and SDKs that can be integrated into applications for verification purposes.

Following the acquisition, Confirm has updated its website to state its current digital identity authentication software offerings will be wound down. It will join Facebook’s office in Cambridge, Mass., but has not confirmed how many employees will stay with the company.

Read more details here.

Dark Reading’s Quick Hits delivers a brief synopsis and summary of the significance of breaking news events. For more information from the original source of the news item, please follow the link provided in this article. View Full Bio

Article source: https://www.darkreading.com/application-security/facebook-buys-identity-verification-firm/d/d-id/1330904?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Voice security company Pindrop today announced the release of Deep Voice, a new voice biometrics engine that uses deep neural network machine learning technology, and the release of Pindrop Passport, a new multi-factor authentication product that is powered by the Deep Voice engine.

According to Pindrop, the Deep Voice engine can recognize a repeat caller regardless of whether there is background noise, whether they are making only short utterances, and whether they’re speaking to an interactive voice response system, or a human call center agent. The engine uses whitelisting, blacklisting and anomaly detection. The individual’s voice is analyzed every time they call, thereby strengthening the credential with every call.

The Pindrop Passport product combines Deep Voice, device authentication, and behavior analytics to create a passive multi-factor authentication solution that call centers can use to confirm callers’ identity – instead of requesting personal information that might have been exposed in a data breach.  

Pindrop claims that Passport could reduce call handle times by up to 55 seconds and call center operations by up to $1 per call, as well as reduce fraud. 

Read more information here.

Dark Reading’s Quick Hits delivers a brief synopsis and summary of the significance of breaking news events. For more information from the original source of the news item, please follow the link provided in this article. View Full Bio

Article source: https://www.darkreading.com/endpoint/new-voice-mfa-tool-uses-machine-learning-/d/d-id/1330905?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

In technology, as in life, the only constant is change. As systems undergo innovation, so do the ways people attack them, adapting their methodologies in tandem with their motives to stay ahead of the curve and maximize returns.

When money was to be made by compromising individual databases through the corporate data center, attackers learned to bypass firewalls and network intrusion prevention systems. As the network perimeter eroded and data moved into software-as-a-service offerings, smart attackers shifted to endpoint compromise and ransomware. With the rise of cloud-based systems, attackers now seek to exploit the massive quantities of data available via Web applications, microservices, and APIs.

The pace of hacker innovation never slows. Now security technologies and methods must adapt with equal urgency.

Renewable Infrastructure Changes the Security Game
The old-school application, simple and static, is quickly becoming a relic of the past. Once upon a time, the entire technology stack for a typical app was contained entirely within the data center. Now, it’s more likely to incorporate a mix of cloud-based infrastructure-as-a-service (IaaS) or platform-as-a-service (PaaS) elements assembled checkbox by checkbox. Instead of being updated once or twice each year, application code is now pushed to production upward of 10 to 20 times each day by DevOps teams using Agile methodologies. While the long shelf life of traditional applications once left system-level attacks available for a long period of time, serverless architectures and containers have now decreased both system footprint and attack surface.

The increasing adoption of this modern infrastructure has important implications for security. While many traditional Web-style attacks can still effectively target poorly written code, the shift in how applications are built, deployed, and developed has opened many new opportunities for attackers to compromise sensitive and valuable data. In fact, IaaS misconfigurations have figured in more than one high-profile breach in the last year, and enterprises using modern deployment models must now protect their configuration as if it were the infrastructure itself. This includes configuration management, constant assessment for configuration errors, and appropriate access control. They must also monitor the provider and configuration in real time and make sure that logging provides adequate data to detect attack.

However, new development and deployment models leveraging renewable systems (or temporal systems) also afford security teams new protection methods, including a security model that Justin Smith of Pivotal calls the three Rs. “Its idea is quite simple,” he writes. “Rotate data center credentials every few minutes or hours. Repave every server and application in the data center every few hours from a known good state. Repair vulnerable operating systems and application stacks consistently within hours of patch availability.”

The rotate, repave, and repair model gives application security teams a road map into limiting the exposure window for attack, making it much more difficult to target a system built and deployed into a modern stack. It’s a great way to stay ahead of attackers — but it’s not bulletproof.

A Shift to Attacker Persistence and Automation
Traditional persistent infrastructure allows attackers to take a methodical approach, first penetrating the environment, then moving laterally to seek high-value targets. With the shift to containers and serverless computing, the infrastructure can be entirely refreshed rapidly, as often as every hour or even every few minutes. If the box you’re attacking is about to disappear it’s much more difficult to persist on the host, therefore you’ll shift your attack to the app instead. This makes strong application security a requirement in the modern era.

As the concept of attack persistence diminishes, hackers are turning to automation so they can restart their attack from scratch in a matter of seconds each time a system is reset. When long persistence becomes unavailable, automation of attack sequences becomes key, making it possible to return to the furthest penetration point in seconds, every time the infrastructure is refreshed.

This provides a new key indicator for security teams via identification of real-time attack telemetry. If you’re seeing the same system, infrastructure, or application requests or changes being made over and over again, there’s a good chance you’re under attack. To detect this type of automation, application security experts have to focus on threshold-based detections of actions over time. They can do this by creating scripts or systems in their current Web protection technology, or they can look at log entries or use a security information and event management system, such as Splunk. It might not always be an exploit that’s detected; it could be as simple as a multistep application manipulation being executed from the same user account or source IP address every time a refresh is triggered, or N times in X minutes.

For modern attackers, the game is no longer about achieving system persistence but, rather, simply achieving the goal. Instead of advanced threats, persistent threats and long-term compromise, the shift to cloud- and service-based infrastructures favors a hit-and-run style attack model that can be executed within a single refresh period, or automated to live and execute over multiple refreshes.

It’s impossible to overstate the importance of these shifts — in both application technology and attack methodology — for security teams. Hackers thrive by staying on the leading edge of innovation, and the targets that are slowest to adapt are the easiest to compromise. By adapting your security model to match the emerging threat landscape, you can ensure that your next-generation application environment is every bit as secure — or even more so — as it was in the traditional data center and perimeter days.

Related Content:

• Where to Find Security Holes in Serverless Architecture
• Responding to the Rise of Fileless Attacks
• Avoiding Micro-Segmentation Pitfalls: A Phased Approach to Implementation

Tyler Shields is Vice President of Marketing, Strategy, and Partnerships at Signal Sciences. Prior to joining Signal Sciences, Shields covered all things applications, mobile, and IoT security as distinguished analyst at Forrest Research. Before Forrester, he managed mobile … View Full Bio

Article source: https://www.darkreading.com/cloud/how-containers-and-serverless-computing-transform-attacker-methodologies/a/d-id/1330896?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple