Original URL: https://www.theregister.co.uk/2014/06/24/security_wars_you_aint_seen_nothing_yet/

Daddy, what will you do in the new security wars?

Depends which enemy are we talking about, son

By Tom Brewster

Posted in The Channel, 24th June 2014 13:31 GMT

A senior figure at the anti-virus giant McAfee once told this writer the security industry was a mess. There were too many vendors trying to do too many things. But what the industry mirrors is the threat landscape it is trying to calm down.

Just look at what’s happened in the past six months. Two of the most significant breaches in the history of the web have occurred, with the attacks on US retailing firm Target and auction giant eBay. There was also the small matter of the Heartbleed vulnerability in OpenSSL, one of the most high-profile web security flaws to date. From a security perspective, things aren’t letting up and there appears to be no end in sight.

One common, depressing problem that’s emerged from each of these issues is that many people just aren’t doing the old basics right. The whole security sector, from vendors to customers, needs to be sensible in its response, says Javvad Malik, analyst from 451 Research.

“The industry’s been messy for a while now and it’s important the industry responds in a pragmatic and unified manner to try and win back confidence of businesses that investing in security isn’t a completely lost cause. We’re still bad at managing the basics, patching, privilege identity management, tools that overload users with alerts within which important issues can be missed,” Malik says.

Whilst IT teams are often told they need a new approach to protecting the business, they have to get the old problems nailed first.

A new approach to malware protection

Beyond the rudimentary matters, though, coping with these manifold problems effectively will require traditional protections to change and new ones to emerge from research labs and find their way into businesses. “As the internet touches more and more areas of our lives – smart devices, currencies such as Bitcoin, cloud and virtualisation – simply reacting to threats is no longer the most effective way to protect both individuals and organisations,” says David Emm, senior security researcher at Kaspersky Lab.

That does not mean killing anti-virus, however, even if the traditional signature-based approaches have failed. Modern AV systems, the best ones, at least do some heuristic and reputation analysis, rather than just try to detect malicious software that’s already been seen in the wild.

Emm says malware detection technologies should look beyond the static and evaluate objects or applications within the context of a specific environment, questioning what it’s doing there, what it’s connecting to and what it has been designed to do compared with its expected behaviour.

“This enables security experts to identify anything that is being used for nefarious purposes before an attack has been carried out,” he adds.

“There have been those who have said that ‘AV’ protection is dead but what this really means is that we have to go beyond traditional signature-based protection and use more sophisticated technologies including heuristics, sandboxing, proactive behaviour detection, cloud-enabled threat intelligence, application control, automatic exploit prevention, secure banking and more.”

Out of the perimeter

Outside of malware problems, the rise of mobile has brought about a dismantling of the IT perimeter. That’s why the firewall has also taken a battering in recent years. And yet it still survives as a technology, whether in the traditional or “next-generation” sense. Rather than taking down the firewall, the response to the death of the perimeter should be based on a layered approach, not a rip and replace strategy, says Professor Alan Woodward, of the computing department at the University of Surrey.

“I think we can take lessons from how physical security has been mounted historically: something as simple as a castle didn’t have just one wall. There were layers of walls and eventually a redoubt within which the most precious items were kept,” Woodward says.

“Defence in depth has to be seen as the default approach. With the rise of insider threats and spear phishing attacking those with privileged access, the perimeter is becoming less of an absolute barrier to intruders but is still causing some attacks to bounce off so it would seem a little silly to simply let it crumble.”

Emm says such an approach needs to focus more on the individual, rather than attempt blanket security measures. “People do still work in the office, connecting to corporate servers so that network still needs to be protected. However, the workspace has become more diverse in that many people will work from home on a laptop or on the move with their smartphone or tablet,” Emm adds.

“This leads to a host of additional security issues - from people logging on to insecure Wi-Fi networks that could potentially be being watched by cybercriminals, to losing their device on public transport - and it is these devices that are not protected by traditional policies, firewalls, endpoint protection and mail filtering that exist in offices.

“We therefore need to look at a security solution that protects the individual, taking into account new devices and policies and procedures for untrusted environments – i.e. ‘follow-me’ security.”

This all points to a need for better intelligence systems, ones that can alert organisations to anomalies on the network caused by zero-day threats and access inconsistencies, whilst allowing for greater analysis of attacker behaviour. The most effective are likely to be based on Big Data technology, ones that can draw together different data types to determine the nature of the threat. Use of Hadoop and big data warehousing projects will likely be the domain of large enterprises. Security Information and Event Management (SIEM) technologies will likely be suitable for smaller enterprises, the most attractive being those that allow for actionable intelligence and pull in as many different sources as possible.

Proper intelligence solutions aren’t just thought to be useful in understanding the adversary, they’re also likely to save businesses money. Research from the Ponemon Institute last year, looking at 234 breached organisations, showed those who invested in security intelligence systems gained average cost savings of nearly $2m in comparison to those who didn’t.

Education lacking

The answer to the rise of internet attacks won’t come solely through technology. If there’s one topic that security experts can agree on, as they squabble over the code-level response, it’s that the education of the general public needs to improve. Not enough attention goes on people and this has been the industry’s biggest failing, says Professor Woodward.

“Machines don’t spontaneously mount attacks – they are commanded by people and people are more often than not the specific target of engineering an attack. A little awareness can go a long way,” Woodward says.

“That awareness needs to extend beyond just top level headlines. I think end users … need to be constantly updating themselves about the nature of the threat. Knowing how some piece of social engineering works today does not mean it will help in several months time when the miscreants will have thought of a new ruse to fool you.

“Personally I think the only way this will happen is if there is a suitable combination of carrot and stick. After all, we expect people to take reasonable precautions in protecting physical property – insurance companies won’t pay out if you haven’t done so.”

The UK government has shown some inclination towards improving public awareness. In January it launched the Cyber Streetwise campaign. It saw posters put up across the country, calling on people to use more complex passwords, decent anti-virus and adequate privacy settings. Little is known of the initiative's actual impact.

But it’s not just individuals who don’t get the problem. Basic steps to improve workers’ awareness of social engineering, which is used in most modern-day attacks on companies, would be a good start, says Peter Wood, CEO of consultancy First Base Technologies.

“The obvious response is to invest in people as much as technology. It’s a complex and creative task, very similar to a professional marketing campaign, but it has to be done and it has be an ongoing process. Sending out an email and telling people to read the security policy never worked, but imaginative and evangelical awareness programmes can work if the right people are involved and commitment is made at the top,” says Wood.

Whilst the average employee could do with a lesson in security, too often, the lack of understanding goes right to the top of organisations, says Simon Placks, head of cybercrime investigations at EY.

“Companies are starting to understand that they need to assess their exposure, but are doing so with limited situational awareness. We need to see companies re-thinking how they view security. The best approach an organisation can take is to raise cyber security to board level responsibility,” Placks adds.

“Similarly, when breaches occur, corporations need to treat incidents as corporate investigations, not IT remediation exercises. Many organisations are still treating network intrusions as if they were virus outbreaks. An intrusion is not an illness that can be prevented with good cyber-hygiene. Someone is out to get you, and you need to respond accordingly, otherwise it is only a matter of time before we see the first large-scale corporate collapse following a devastating cyber-attack.”

Policy points

The policy response will be crucial too. In the UK, the Computer Misuse Act, the Data Protection Act and fraud legislation are designed to protect people’s data, with police forces like the National Cyber Crime Unit and privacy watchdog the Information Commissioner’s Office set up to enforce the law.

Yet they may all need developing and updating, if cyber crooks are to be caught. According to Stewart Room, barrister and solicitor specialising in data protection, that legislation is required to improve the fight against online crimes, is an indictment of the efforts of non-public organisations.

“Regulatory laws are designed to cure ‘market imperfections’, by which I mean the failure of markets to cure themselves of their own ills. When regulations are adopted, the law is saying that the market does not have the skills, wherewithal, incentives or drivers to do what is necessary in the wider interests of society, which includes the wider interests of the economy, to fix itself,” says Room.

“In this sense, the adoption of regulations is a bleak statement about the market. If the hacking problem needs regulations to improve cyber security, then as a matter of simple logic the medicine has to be strong, because the market has utterly failed.”

Whilst Woodward and Malik believe market forces should be allowed to do their work, Room says a much harder line might have to be adopted if the industry can’t up its game. “Any scheme of regulation to improve the performance on cyber security will need to include compulsory breach disclosure, regulatory audits, fines and penalties. Toothless regulation will not improve anything.

“I am not an immediate fan of increased regulation, however, and I believe that badly designed regulation can cause as much difficulty as it solves. My preference would be for the market to improve itself, with leadership from the security industry and other insiders. However, I have very little confidence that tough regulation will be avoided forever, because the cyber security problem seems to be getting worse.”

In the US there is much talk of changing the Computer Fraud and Abuse Act (CFAA), with many hopeful of the passage of the proposed Aaron’s Law, named after the late internet activist Aaron Swartz who committed suicide after being threatened with the hacking law. Yet in the UK, little has been said of giving the CMA a thorough updating. That’s not to say it won’t happen soon, however.

“The blistering pace of technology change and the cyber threats that come with it are only going to accelerate… Stronger regulation of cybersecurity in the public sector, private sector critical infrastructures, ICT service provision and companies critical to the UK's economy may happen in the future, as well as more proactive detection, investigation, prosecution and disruption of the threat by government and law enforcement,” says Placks.

Outside of improving and expediting the police response to digital crime, mandating education could be the way forward for government, adds Wood. “My change to regulatory frameworks would be to include a specific requirement for continual investment in user education. Not the tick-in-a-box compulsory basic training offerings, although they can play a part, but audited requirements for full-blown awareness campaigns, backed by creative people and ideas.”

Law that educates rather than punishes? Now that would be novel. ®