StillSecure, After All These Years

An old/new kind of cybercrime/cybercriminal

I was reading Ellen Messmer's report today about the security incident over at Lending Tree. Yeah, I know another information breach by insiders case, BFD.  But I think there is something different about this one.  From what I am reading this is more a case of corporate espionage than the usual hackers for fraud and financial gain type of deal.  For a long time now we have been hearing from people like Bruce Schneier in this article talk about the front in security moving from dealing with script kiddies working for kicks to organized cybercriminal gangs that are in it for financial gain. Mostly the gain is about identity theft and gaining access to funds fraudulently.

In the Lending Tree case though there was not evidently a motive to use the ill begotten information for identity theft or fraud.  Rather they represented Glengary, Glen Ross leads.  That is the names, contacts and qualifications of people looking for mortgages.  A mortgage company would consider these leads more valuable than gold, more valuable even that gasoline!  So to my mind this is more a case of corporate espionage where a company that is competitive to Lending Tree infiltrated their networks through people, rather than technology to gain access to their corporate crown jewels. 

This sort of stealing your competitors information has been going on for decades, well before computers and cybercrime were around.  However, this is a great example of some things not going out of style.  Obtaining your competitors information is a great motive, computers are just the container where the information is kept.  Sort of like cracking a safe.  It is always easier getting into a safe if you are given the combination, than if you have to crack it yourself. 

Yet another front in the cybercrime war that security folks need to be on guard for!

A new, pragmatic approach to security - is it the future of security?

New times call for new ideas.  In security we have seen a revolution over the past few years in the depth and breadth of security solutions that are available to the security administrator and CSO.  However, all of this new technology and the methods of securing our businesses and data have not left us any safer or more secure.  The reasons for this are many.  Some are, the increased sophistication of the bad guys tools, the monetary reward to the hacker, the lack of secure software development, mono-cultural computing environments, etc.  So throwing more technology and dollars at the problem is not the solution.  What is the professional security person to do?  The answer comes from our friend Mike Rothman.  Mike has had a vision of writing a book and developing a community that offers the over-stressed security professional a new way of dealing with the problems.  A blueprint for success in security.  A realistic and holistic model to succeed in these tough new times.  In short a pragmatic methodology to becoming a successful security manager and a happier person.  He calls the book and the soon to be launched community the Pragmatic CSO. Don't let the CSO part fool you.  If you are in any way, shape or form responsible for security as part of your job or want to learn what to do to get a handle on a near impossible task, this book and the content to follow on the web site is for you.  At $97 dollars for the PDF version it is a steal and I would not waste any time before buying it.

I was lucky enough to be given an advance copy of the book by Mike last month.  Truthfully, I was going to take a look at it as a courtesy to Mike, but did not relish the thought of reading yet another boring business book. I was hooked in the first chapter.  The fictional Mike attends his first 12 step "security anonymous" program.  His story is one that is all too familiar to many of us in the security field.  Despite the hard work, the never ending flow of money out the door and the best of intentions, it is just not working.  The security is not there, the boss doesn't appreciate the problems or the amount of effort that goes into solving them and his life is running from one fire to another.  Into this desperate situation comes salvation in the form of the P-CSO 12 step program. The 12 steps are divided into 4 broad categories.  They  are as copied from the site:

Section 1 – Plan to be Pragmatic
	Step 1: Assess the Value of Your Business Systems You can’t protect what you don’t know about, so the first step is to figure out what you have. Likewise, you don’t want to spend $50,000 protecting a $2,000 business system, so in Step 1 you talk to senior management and discern how important each system is to the operations of the business. Then you can figure out how much to invest in protecting it.
	Step 2: Baseline Your Environment If you don’t know where you are, it’s pretty unlikely you’ll know that you’ve made progress. In Step 2, you gather data to understand your current state, where your most significant exposures are, and how much work you need to do.
	Step 3: Manage Expectations Managing executive expectations are the most critical responsibilities of the CSO. You must be very clear about what you are going to accomplish and how you are going to do it. In Step 3 you see the power of speaking security in the language of business, and how you can get everyone on the same page regarding what the security program does.
Section 2 – Build a Pragmatic Security Environment
	Step 4: Build Your Security Business Plan Every business needs a plan, and yours is no exception. In Step 4, you prepare a high-level business plan, laying out the reasons your business exists and presents a high level architecture, committed service levels, and the milestones that you plan to achieve.
	Step 5: Sell the Story You need money to secure anything, in Step 5 you package your business plan, associated service levels and milestones and sell the program to senior executives getting the funding you need to protect your corporate assets.
	Step 6: Procure the Solution A structured procurement process is critical to getting the right products, at the right time, for the right price. In Step 6, you learn about Security Incite’s Buying Security Products methodology and how that should be applied to how you buy the products and services you need for the Pragmatic CSO process.
Section 3 – Run Your Security Organization Pragmatically
	Step 7: Operate/Monitor Now that parts of the solution are implemented, you need to make sure they’re doing what they’re supposed to. In Step 7, you learn how to fortify your perimeter defenses, what you should be monitoring, and how to navigate the change control process.
	Step 8: Contain the Problem Inevitably you will have a compromise or breach situation. Dealing with that will make the difference between a CSO with a job and one collecting unemployment. In Step 8, you learn how to recover as gracefully as possible and use a structured incident response process to make sure you live to fight another day.
	Step 9: Train the Users Users are the weakest link in the security chain, so all the technology in the world will not help if a user gives up a password to the bad guys. In Step 9, you learn why a structured user awareness training process is critical to educate users to think and act securely and avoid many of the easy attacks used every day.
	Step 10: Assure Your Defenses It doesn’t matter if you say something is secure, you need third-party validation. In Step 10, you’ll engage third parties to try to penetrate your defenses, both to see where you are really exposed and also to make the case for more funding.
Section 4 – Communicate your Value
	Step 11: Benchmark Your Progress Quantitative measurements prove your worth and ensure your program is moving in the right direction. In Step 11, you’ll benchmarking your program by tracking the right metrics and comparing what you are doing relative to your peer group and other businesses your size.
	Step 12: Comply without Going Nuts Compliance with a variety of both internal policies and legislative regulations is a critical aspect of every CSO’s job. In Step 12, you see how compliance is a benefit of implementing the Pragmatic CSO program and how by generating a set of hard-hitting reports, the auditors will be gone in a fraction of the time it used to take.

Following the level headed, plain talking advice will give the reader and pragmatic practitioner a new sense of power over his security domain and a path to success.  It does not promise a magic bullet, just a realistic method and approach of dealing with the every day tasks and goals that all security folks live with. The writing style of the book is light and refreshing.  It is from Mike the recovering and now pragmatic CSO's point of view.  It will feel more like you are reading a short story than another how to business book.  I think the Pragmatic CSO will go down as a milestone in the security management arena.  I can already envision the follow ons as the pragmatic methodology is more fully fleshed out.  I am already thinking of how StillSecure can better align our products to help all of the new pragmatists that will be managing security out there.  Congratulations to Mike on a job well done!  I am looking forward to what is to come and seeing how the security pragmatists change the security world.

So who would you rather wake up next too?

So Mike Rothman (or should I call him Robin Gibb) has an issue with the  10 most important reasons security products don't work according to Dark Reading and the fact that I thought it helpful.  OK Mike, everyone is entitled to their opinions.  Mike says the problem is you go to bed thinking you are with Heidi Klum and wake up with Medusa. But I do detect some bias here.  First of all , against Dark Reading, as it appears Mike had some pre-conceived notions here.  Secondly and more troubling is the blame the vendor mentality.  I get that we are couching this in mismatched expectations, but when Mike digs in, it is always the job of the vendor to set expectations and we slimy vendors lie, cheat and steal our way into your hard won security dollars.  I don't know Mike, maybe you have been hanging out with the wrong crowd of security vendors and then I can see why you ran back to analysis.  Maybe, you are pandering to your constituency, the end user. What I can tell you, is don't paint us all with the same broad brush.  We try very hard here at StillSecure and I know other vendors do, to solve the customers problems.  To quote Chris Hoff, this "ain't my first ride on the tuna boat fella" and I know that I may fool a customer initially but sooner or later he is going to see through whether my product does the job for him or not. You can fool all of the people some of the time, but you only get to fool them once then.  Sell them a product yeah, we have end of quarter pressure and quotas to meet like everyone else.  Companies who stick around though build their business being honest with the customer and not pumping and dumping. 

Most of the problems I have seen in easily fall into one of the 10 categories the Dark Reading folks have highlighted.  Sometimes they are the vendors fault, sometimes they are the end user's fault.  We could all do a better job and that includes mismatched expectations.  But there are plenty of honest vendors out there who want to do more business with the customers in the future and know that they build those kind of relationships one sale at a time.

Pay it forward security tip #4

Not sure if Michael and Michael are still putting out the pay it forward tip of the day, but I already had one lined up for today, so wanted to put it out.  This one is a little different than my earlier ones, in that it is not aimed at an individual, but at the networked enterprise.  Today's tip is to regularly schedule vulnerability scans and put a comprehensive vulnerability management solution in place.  If your vulnerability policy is using Microsoft update after every patch Tuesday, you have  trouble.  If your only full vulnerability scan is a once a year audit, again you have trouble

Vulnerabilities are to fast and frequent to scan once or twice a year.  You should be scanning for them regularly.  Also,  there are many vulnerabilities that are not Microsoft or even Windows  specific.  You need to scan printers, faxes, switches, firewalls, routers, hubs, etc.  Anything with an IP needs to be scanned. Also, only about 20 to 25% of vulnerabilities need to be patched. Many need other types of remediation.  So a patch manager alone is not a comprehensive vulnerability  management solution.  When looking at a good VAM system, also remember how important reporting is as well.  Hope this helps.  If you want  an example of a good  vulnerability management system, check out our own VAM product.

Pay it forward security tip #3

Ok, here at the airport and wanted to post the pay it forward tip of the day.  For those who don't know this is a series of tips I am doing with Michael Farnum and Michael Wright.  Today's tip is another simple and obvious one, but unfortunately is too often not followed.  For those of you with wireless networks at home, enable even WEP or better yet WPA.  There is just no good reason not too.  Most wireless access points make it chimp-simple to do this.  Recently I was in NYC at a friends apartment.  I fired up my laptop and had my choice of about 8 or 9 networks to log on to.  Only 2 or 3 had any security, the rest were wide open.  Could I have gone on and done something bad?  Maybe, maybe not.  The computers may have been locked down tight and at best I would have had free internet access. However, you are looking for trouble.  While we are at it, not broadcasting your SSID is another good practice for your home wireless network.