STE WILLIAMS

The modern enterprise doesn’t live within four walls. It’s distributed, with companies leveraging digital communications to connect their brightest minds, and give teams the flexibility they need to successfully execute their most pressing tasks. But for all the benefits that decentralization promises, it also begins to blur the network perimeter, which forces security teams to think more critically and creatively about their defenses. When networks become distributed, there are numerous pitfalls that await them.

Pitfall 1: Devices and Users
The proliferation of mobile devices has put fully functional computers in the palms and pockets of virtually every modern worker. Whether part of a bring your own device initiative or delivered to employees directly by the company, employees use these essential work tools to access business-critical data, even when they aren’t plugged in at corporate headquarters.

The downside is that when employees connect to information systems and enterprise data from outside of the safety of the corporate network, it’s critical to keep tabs on where that traffic originates and if the device or user has permission to access enterprise data. Administrators need to be sure that they keep directories current to dictate permissions and proxy settings, while also doing all they can to monitor for traffic origins that could indicate illegitimate or malicious activity. By having an up-to-date registry of users, their devices and the associated permissions of that individual’s rank and role, teams will more easily be able to spot anomalous traffic patterns that indicate data theft.

Pitfall 2: More devices breed more applications – and threats
Part-in-parcel with the proliferation of mobile devices in the workplace is a boom in new applications and software – both for business and for pleasure – that employees are hungry to download. The problem here is twofold: For starters, non-essential applications can be a drain on bandwidth, so administrators need the ability to prioritize network capacity toward business-critical activity to avoid latency.

Further to that, just downloading any content onto the network from an outside source – whether a smartphone game or a word document – can open the floodgates to potential threats hiding in plain sight. Trojans – malware hidden within seemingly innocuous file types – can be unleashed on a corporate network via a personal email attachment, initiating a wealth of attacks – from DDoS to command and control callbacks – aimed at stealing data and disrupting network performance.

Pitfall 3: Bulky defenses only complicate security
Even security teams that are already meeting these challenges may not be taking the easiest or most effective route to securing decentralized networks. For instance, many teams will layer on security solutions by purchasing additional on-premises security appliances as bandwidth needs grow. While this approach will provide the additional security capacity needed to protect traffic, each piece of hardware will require dedicated security management, and put extra demands on IT to create costly and complicated backhaul networks.  

A better solution is for organizations need to simplify control and network pathways in order to give their business as much visibility into the activity taking place on their network as possible. Rather than installing hardware in a cumulative fashion, adopting additional consoles and vantage points into the network for teams to monitor, organizations need to strive to have all network activity presented from a single pane of glass.  

The decentralized organization isn’t a passing fad, but as costs pile up, a business that doesn’t evolve its security strategy to enable it might be. Doubling down on outdated security practices while the number of users leveraging enterprise networks grows is an easy race to the bottom for organizations moving to distributed workflows.

Paul Martini is the CEO, co-founder and chief architect of iboss, where he pioneered the award-winning iboss Distributed Gateway Platform, a web gateway as a service. Paul has been recognized for his leadership and innovation, receiving the Ernst Young Entrepreneur of The … View Full Bio

Article source: https://www.darkreading.com/partner-perspectives/iboss/top-3-pitfalls-of-securing-the-decentralized-enterprise/a/d-id/1330817?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

In the world of information security, people are often told to “think like a hacker.” The problem is, if you think of a hacker within a very narrow definition (e.g., someone who only breaks Web applications), it leads to a counterproductive way of thinking and conducting business.

A little knowledge is a dangerous thing, not least because isolated facts don’t stand on their own very well. As legendary investor Charlie Munger once said:

Well, the first rule is that you can’t really know anything if you just remember isolated facts and try and bang ’em back. If the facts don’t hang together on a latticework of theory, you don’t have them in a usable form.

You’ve got to have models in your head. And you’ve got to array your experience both vicarious and direct on this latticework of models. …

[You’ve] got to have multiple models because if you just have one or two that you’re using, the nature of human psychology is such that you’ll torture reality so that it fits your models, or at least you’ll think it does. …

This is worth bearing in mind for security pros.

When we look at the thought process of a (competent) security professional, it encompasses many mental models. These don’t relate exclusively to hacking or wider technology, but instead cover principles that have broader applications.

Let’s look at some general mental models and their security applications.

1. Inversion
Difficult problems are best solved when they are worked backward. Researchers are great at inverting systems and technologies to illustrate what the system architect should have avoided. In other words, it’s not enough to think about all the things that can be done to secure a system; you should think about all the things that would leave a system insecure.

From a defensive point of view, it means not just thinking about how to achieve success, but also how failure would be managed.

2. Confirmation Bias
What people wish, they also believe. We see confirmation bias deeply rooted in applications, systems, and even entire businesses. It’s why two auditors can assess the same system and arrive at vastly different conclusions regarding its adequacy.

Confirmation bias is extremely dangerous from a defenders’ perspective, and it clouds judgment. This is something hackers take advantage of all the time. People often fall for phishing emails because they believe they are too clever to fall for one. Reality sets in after it’s too late.

3. Circle of Competence
Most people have a thing that they’re really good at. But if you test them in something outside of this area, you may find that they’re not well-rounded. Worse, they may even be ignorant of their own ignorance.

When we examine security as a discipline, we realize it’s not a monolithic thing. It consists of countless areas of competence. A social engineer, for example, has a specific skill set that differs from a researcher with expertise in remotely gaining access to SCADA systems.

The number of tools in a tool belt isn’t important. What’s far more important is knowing the boundaries of one’s circle of competence.

Managers building security teams should evaluate the individuals in the team and build the department’s circle of competence. This can also help identify where gaps are that must be filled.

4. Occam’s Razor
Occam’s razor can be summarized like this: “Among competing hypotheses, the one with the fewest assumptions should be selected.”

It’s a principle of simplicity that’s relevant to security on many levels. Often hackers will use simple, tried-and-tested methods to compromise a company’s systems: the infected USB drive in the parking lot or the perfectly crafted spearphishing email that purports to be from the finance department.

While there are also complex and advanced attack avenues, these are not likely to be used against most companies. By using Occam’s razor, attackers can often compromise targets faster and cheaper. The same principles can and should be applied when securing organizations.

5. Second-Order Thinking
Second-order thinking means to consider that effects have effects. This forces you to think long-term when considering what action to take. The question to ask is, “If I do X, what will happen after that?”

It’s easy in the security world to give first-order advice. For example, keeping up to date with security patches is good advice. But without second-order thinking, this can lead to poor decisions with unforeseen consequences. It’s vital that security professionals consider all implications before executing. For example, “What impact will there be on downstream systems if we upgrade the OS on machine X?”

6. Thought Experiments
A technique popularized by Albert Einstein, the thought experiment is a way to logically carry out a test in one’s own head that would be difficult or impossible to perform in real life. In security, this is usually used during “tabletop” exercises or when risk modeling. It can be extremely effective when used in conjunction with other mental models.

The purpose isn’t necessarily to reach a definitive conclusion but to encourage challenging thoughts and to push people outside of their comfort zones.

7. Probabilistic Thinking (Bayesian Updating)
The world is dominated by probabilistic outcomes, as distinguished from deterministic ones. Although we cannot predict the future with great certainty, we often subconsciously make decisions based on probabilities. For example, when crossing the road, we believe there’s a low risk of being hit by a car. The risk exists, but if you’ve looked for traffic, you are confident that you can cross.

The Bayesian method says that one should consider all prior relevant probabilities and then incrementally update them as newer information arrives. This method is especially productive given the fundamentally nondeterministic world we experience: we must use both prior odds and new information to arrive at our best decisions.

While there may not be a simple answer to what it means to “think like a hacker,” the use of mental models to build frameworks of thought can help avoid the pitfalls associated with approaching every problem from the same angle.

I’ve listed seven mental models here, some which you may already be familiar with and others you could try. Please share any of your favorite security and hacker mental models and problem-solving techniques in the comments.  

Related Content:

• 6 Personality Profiles of White-Hat Hackers
• Top 8 Cybersecurity Skills IT Pros Need in 2018
• CISOs’ Cyber War: How Did We Get Here?

Javvad Malik is a London-based IT Security professional. Better known as an active blogger, event speaker and industry commentator who is possibly best known as one of the industry’s most prolific video bloggers with his signature fresh and light-hearted perspective on … View Full Bio

Article source: https://www.darkreading.com/threat-intelligence/mental-models-and-security-thinking-like-a-hacker/a/d-id/1330780?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

The ICEBRG Security Research team discovered four malicious Google Chrome extensions during a routine investigation of anomalous traffic. More than 500,000 users, including workstations in major businesses around the world, have been affected.

The team was analyzing an unusual spike in outbound traffic from a workstation at a European VPS provider. Upon further investigation of the traffic, researchers found four malicious extensions available in Google’s Chrome Web Store: Change HTTP Request Header, Nyoogle – Custom Logo for Google, Lite Bookmarks, and Stickies – Chrome’s Post-it Notes.

This finding highlights the threat of browser extensions, which are available in most major web browsers and an oft-overlooked attack vector. Threat actors know employees usually trust, and have control over, downloading these extensions. Using this knowledge, they can execute code via seemingly legitimate applications to gain a foothold into organizations.

Read more details here.

Dark Reading’s Quick Hits delivers a brief synopsis and summary of the significance of breaking news events. For more information from the original source of the news item, please follow the link provided in this article. View Full Bio

Article source: https://www.darkreading.com/endpoint/four-malicious-google-chrome-extensions-affect-500k-users/d/d-id/1330822?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Image Source: Shutterstock via VGStockstudio

Security pros are under siege. Just in the last weeks we discovered major vulnerabilities in basic hardware chips, dubbed Meltdown and Spectre. Hacking from nation-states continues unabated, prompting fears that it will deter our ability to have safe elections later this year. And now, even the basics can go wrong as was displayed last week when the power went out at the 2018 Consumer Electronics Show in Las Vegas.

There’s big money on the line. Ponemon estimated the average cost of a breach in 2017 at $3.62 million, but the cost to a company can be much more than financial. Damage to the brand and public perception is often hard to judge.

And then there’s security holes you may not have thought about – or seem so obvious that you considered them handled years ago – like making sure the company has a back-up generator on hand for its data center.   

In interviews with three security experts, we developed a list of 10 gotchas that may not lock the organization down for good, but will go a long way to making sure you can sleep at night. They range from being ever more vigilant about phishing emails and DNS calls to taking more care about deleting accounts when an employee leaves. The latter can be a real headache because merely deleting a user from Active Directory doesn’t cut it any more.

To develop the list we spoke to John Pescatore, director of emerging security trends at the SANS Institute; Christos Dimitriadis, head of security for Greece’s INTRALOT Group; and Stephen Cobb, senior security researcher at ESET. 

Steve Zurier has more than 30 years of journalism and publishing experience, most of the last 24 of which were spent covering networking and security technology. Steve is based in Columbia, Md. View Full Bio

Article source: https://www.darkreading.com/vulnerabilities---threats/doh!!!--the-10-most-overlooked-security-tasks/d/d-id/1330820?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

The most popular exploits in 2017 targeted Microsoft Office and Windows, report researchers at AlienVault, who say the most common flaws remain exploited for a long period of time.

Each year, the company records anonymized security events from customers and from other vendors’ threat reports recorded via its Open Threat Exchange (OTX) platform. It combines findings from the two datasets into a single picture of the year’s threat landscape.

There is significant difference between the most common exploits reported by vendor reports on OTX, and from AlienVault’s customers. The dataset of 80 vendor reports indicates four of the top 10 exploits from 2017 target Microsoft Windows and three affect Office. There is one vulnerability each for Adobe Flash, Microsoft .NET, and Android/Linux on the list.

The top-ranked exploit, CVE-2017-0199, is an Office exploit that has been used by targeted attackers in North Korea, China, and Iran, as well as by criminal groups deploying Dridex. CVE-2012-0158, the third most-referenced vulnerability, affects Microsoft Windows.

AlienVault threat engineer Chris Doman reports Microsoft has “exceptionally mature” processes to prevent exploits. However, because its software is so widely used, exploits that slip through the cracks are used heavily once they are discovered.

In contrast with the vendors’ threat reports, the AlienVault customer dataset is very large and contains billions of security events. Many of the most common exploits reported are fairly old and affect Windows 2000, Miniupnp, SNMP, OpenSSL Poodle, and PHP. There is one Microsoft Office vulnerability (CVE-2011-1277) and an Apache Struts vulnerability on the list.

Doman notes the data is biased toward “noisy” network-based exploit attempts from worms and exploit scanners, which is why the company is still collecting vulnerabilities from 2001 and 2002. It advises consulting the dataset on vendor reports when planning defense tactics.

Other key findings include the discovery that most effective exploits are quickly adopted by criminal and nation-state groups. NjRat malware variants were most common persisting on networks. On a geographical level, they noticed an increase of attackers located in Russia and North Korea, and a “significant drop” in activity coming from threat actors based in China.

Related Content:

• Microsoft Patches Exploited Office Bug
• Microsoft Confirms Windows Performance Hits With Meltdown, Spectre Patches
• Doh!!! The 10 Most Overlooked Security Tasks

Kelly Sheridan is Associate Editor at Dark Reading. She started her career in business tech journalism at Insurance Technology and most recently reported for InformationWeek, where she covered Microsoft and business IT. Sheridan earned her BA at Villanova University. View Full Bio

Article source: https://www.darkreading.com/vulnerabilities---threats/most-common-exploits-of-2017-in-microsoft-office-windows/d/d-id/1330823?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple