Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

8/9/2013
04:46 PM
Mike Rothman
Mike Rothman
Commentary
50%
50%

Black Hat: The Problems Don't Change, But The Solutions Have

An increase in attacker capabilities has drawn an innovative response from industry, and emerging research promises more to come

Bill Brenner figures there is nothing new in security. But it seems he's looking at it only from the perspective of the problem space. I agree that the problems we face as security professionals remain consistent. Bad folks want to steal our stuff. Employees and senior management don't care about security. And these same employees get very pissed when you tell them they can't do something, like watch adult movies on their iPads while connected to the VPN looking at next quarter's financials. Go figure.

Click here for more of Dark Reading's Black Hat articles.

But here's the deal: For the first time in a long time, there is real innovation happening in security. And we need that kind of innovation because the adversaries continue to up their games -- big time. They game applications, they blow up business processes, and they seem to have inside information about how your defenses work. So to think that your signature-based controls and traditional PCI-approved security products will stop these adversaries is naive. And, of course, you aren't naive, right?

Combine that with some pretty good outcomes for investors, like Sourcefire's multibillion-dollar deal with Cisco and FireEye's projected IPO, and you have a Internet bubble-style feeding frenzy on all things cybersecurity. And with new business models and technology architectures (yes, cloud, I'm looking at you), the attack surface is getting bigger and the risk continues to skyrocket. The only thing constant in security is change. So if you thought you were getting into a nice, cushy gig when you studied for that CISSP, forget about it.

Having just returned from a month at Black Hat (well, three days in Vegas seems like a month), there is a lot of stuff to talk about. Remember that Black Hat (and DEF CON, as well) are about emerging research. The stuff I talk about in the Vulnerabilities and Threats section now -- that will be covered in Dark Reading's Attacks and Breaches section in 12 to 18 months. The research at Black Hat was split among a number of pretty timely areas, including malware detection and evading those detections, security monitoring, and mobility.

The most active for research (and innovation) continues to be advanced malware detection. I mentioned a little of what's happening in Controlling the Big 7 a few weeks ago. These new endpoint-centric controls are the tip of the iceberg. Expect to see significant innovation coming to market relative to endpoint forensics and network-based malware detection. Is it perfect yet? No. Will these new tools promise to block every attack? Of course not. The reality is, today's traditional controls can't even block script kiddies using attack kits they bought on Craigslist with Bitcoins. These new offerings will fair better, although they'll be far from perfect.

The tactics to detect malware continue to advance as well. A few years ago, doing malware analysis required a significant investment (think millions of dollars) for both highly skilled people and gear to figure out what malware was doing and to profile it. Now we're seeing folks offering up Web-based services to do the same thing, and open-source initiatives to leverage Big Data analytics to decipher patterns across large data sets to isolate bad behaviors. I guess Big Data can be useful for more than figuring out how to make you pay the most for your airplane ticket or hotel room, and figuring out what should be on the shelves of your local Wal-Mart.

We also saw a bunch of research that can be useful to improve your protection against these malware attacks. But the sessions weren't pitched like that. You saw talk after talk about evasion, and there's a reason for that. Researchers don't really find protection that compelling. But getting around existing protections? Yeah, that's cool. So that means you (as a defender) need to figure out how these new evasion tactics obviate your preventive controls. Then you need to respond and evolve your defenses. Given the sexiness of sandboxes (on both the endpoint and network), it wasn't surprising to see a lot of research focused on bypassing these sandboxes. I hope the vendors were listening, since by the time research is shown at Black Hat, it's well on its way to being weaponized by the adversaries.

There was also Black Hat research on timely issues, like denial-of-service (DoS) attacks and attacking mobile devices. Actually, I was surprised by the modest number of sessions on mobile. Mobility was all over Black Hat last year, so either the topic is not as interesting (unlikely) or the selection committee has mobile exhaustion (more likely). And with the preponderance of DoS attacks, it's not surprising that research is going into figuring out how to evade the scrubbing services and other mitigation techniques.

I understand that Bill may be frustrated that the industry continues to have the same discussions about the same problems year after year without seeming to make any progress. But when you look under the covers both on the attack front and the defense front -- there is plenty of innovation happening. You just need to know where to look.

Mike Rothman is President of Securosis and author of The Pragmatic CSO Mike's bold perspectives and irreverent style are invaluable as companies determine effective strategies to grapple with the dynamic security threatscape. Mike specializes in the sexy aspects of security, like protecting networks and endpoints, security management, and ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
macker490
50%
50%
macker490,
User Rank: Ninja
8/10/2013 | 12:47:23 PM
re: Black Hat: The Problems Don't Change, But The Solutions Have
the single consistent thread in computer based business is a failure to authenticate,-- whether that be financial transactions -- or software. the solution has been available for years -- public key encryption. It was developed back in the 60s and made publicly available by Phil Zimmerman.

that PGP has not become a general practice is a question that needs to be examined: Cui Bono?
Why Cyber-Risk Is a C-Suite Issue
Marc Wilczek, Digital Strategist & CIO Advisor,  11/12/2019
Unreasonable Security Best Practices vs. Good Risk Management
Jack Freund, Director, Risk Science at RiskLens,  11/13/2019
Breaches Are Inevitable, So Embrace the Chaos
Ariel Zeitlin, Chief Technology Officer & Co-Founder, Guardicore,  11/13/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Navigating the Deluge of Security Data
In this Tech Digest, Dark Reading shares the experiences of some top security practitioners as they navigate volumes of security data. We examine some examples of how enterprises can cull this data to find the clues they need.
Flash Poll
Rethinking Enterprise Data Defense
Rethinking Enterprise Data Defense
Frustrated with recurring intrusions and breaches, cybersecurity professionals are questioning some of the industrys conventional wisdom. Heres a look at what theyre thinking about.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-13581
PUBLISHED: 2019-11-15
An issue was discovered in Marvell 88W8688 Wi-Fi firmware before version p52, as used on Tesla Model S/X vehicles manufactured before March 2018, via the Parrot Faurecia Automotive FC6050W module. A heap-based buffer overflow allows remote attackers to cause a denial of service or execute arbitrary ...
CVE-2019-13582
PUBLISHED: 2019-11-15
An issue was discovered in Marvell 88W8688 Wi-Fi firmware before version p52, as used on Tesla Model S/X vehicles manufactured before March 2018, via the Parrot Faurecia Automotive FC6050W module. A stack overflow could lead to denial of service or arbitrary code execution.
CVE-2019-6659
PUBLISHED: 2019-11-15
On version 14.0.0-14.1.0.1, BIG-IP virtual servers with TLSv1.3 enabled may experience a denial of service due to undisclosed incoming messages.
CVE-2019-6660
PUBLISHED: 2019-11-15
On BIG-IP 14.1.0-14.1.2, 14.0.0-14.0.1, and 13.1.0-13.1.1, undisclosed HTTP requests may consume excessive amounts of systems resources which may lead to a denial of service.
CVE-2019-6661
PUBLISHED: 2019-11-15
When the BIG-IP APM 14.1.0-14.1.2, 14.0.0-14.0.1, 13.1.0-13.1.3.1, 12.1.0-12.1.4.1, or 11.5.1-11.6.5 system processes certain requests, the APD/APMD daemon may consume excessive resources.