International Monetary Fund, Citibank Suffer Security Breaches

This past week, it was widely reported that both the IMF and Citibank’s IT infrastructure was breached. With a breach at Sony Online Entertainment and Sony Pictures occurring slightly more than a month ago, it appears that hackers are finding more holes in the IT defenses of organizations. In an eWeek article last week, Mark Hatton, president and CEO of Core Security, noted that deploying defensive technologies and hoping they keep the bad guys out is “clearly not working.” You can read the entire eWeek article on the Citibank breach here. For more information on the IMF breach, read the SC Magazine article.

Given that hackers seem to be readily gaining access inside networks, bypassing traditional “perimeter” defenses, what are companies to do? Certainly, perimeter defenses have their place, but now is the time to investigate other technologies that give multiple layers of security. In other words, ensuring a defense-in-depth strategy. Newer, advanced IT system integrity monitoring technologies such as CimTrak function as a last line of defense in IT networks, monitoring not only critical files, but also configurations on perimeter protection devices such as firewalls. Knowing when changes occur, such as a file being added or a port being opened, can mean the difference between timely detection of malicious activity and a breach.  Visit www.cimtrak.com to learn more.

Can you see paradise by the dashboard light???

The big buzz around RSA this year seems to be the concept of dashboards.  By establishing frameworks, various vendors will be able to integrate data from their respective products.  Users will be able to view a simple interface and “see” the status of their network security.  While at first blush this may seem to be a giant leap forward and a truly helpful product, is it really all it is cracked up to be?  I think not.  Much like compliance checklists, a nice pie chart or bar graph can deceive users into thinking they are truly secure; but are they?  A deeper understanding of what these dashboards are truly quantifying or measuring is essential.  While almost everyone knows that the gauge in their car with the little gas pump icon tells how much gas is in the car’s tank, will every viewer of a “security dashboard” really know what information is being conveyed?  This especially applies to those not in the trenches but to those that make decisions about money, specifically, how much of it will be allocated to IT security projects.  Time and time again we see short sightedness because the minimum has been done and the enterprise is technically “in compliance.”  Why would we need to do more, the money dolers ask?  I fear that a fancy dashboard with nice colorful lights will only serve to delight a select few and cause further battles for those truly in the know.  

Focused too much on perimeter protection?

Security experts at the Government Technology Research Alliance Council meeting held this week in Pennsylvania discussed the challenges facing cybersecurity professionals in 2010.  You can read the article in Government Computer News here.  Too much focus on network-layer defenses seems to be a major problem plaguing the cybersecurity community.  Heavy reliance on signature based tools means reacting to only the known, while heuristic based tools rely on past experience.  With the emergence of new and more sophisticated attacks, these types of tools are often simply not enough.  Using more sophisticated cybersecurity tools in addition to signature and heuristic based options would go a long way towards greater IT security.  It's also important to remember that threats can originate internally and many sources will suggest that internal threats, while fewer in number, often have more catastrophic consequences than external threats.  Increasing utilization of tools that don't rely on signatures or heuristics, and do not differentiate between internal or external threats can help those in both the government and commercial space stay one step ahead of emerging and unknown threats whether internal or external.