The results of the investigation into the recent DigiNotar SSL CA breach reads like a laundry list of “Things Not To Do™” on your critical servers and networks: no antivirus, no centralized logging, and outdated/vulnerable software exposed to the Internet, among other items.  What’s funny about the above list is that if the breached systems had been part of DigiNotar’s PCI cardholder data environment, then DigiNotar could never have passed a PCI QSA audit as all three items I noted above are required by the PCI DSS.  While I couldn’t verify that DigiNotar accepts credit card payments for its SSL certificates, it almost assuredly does (or did!).  It almost certainly had undergone a PCI QSA audit, too.

What are we to conclude from this information?  If my preceding two assumptions are true, then it would appear that DigiNotar likely protected its servers and networks involved in accepting and processing credit card transactions better than it protected the servers and networks involved in generating SSL certificates.

There is no reason not to have antivirus loaded on every server and workstation and no reason not to conduct regular vulnerability scans of your external services in an effort to identify vulnerable software.  For medium-sized businesses (50 or more users, 2 or more IT guys) there should be one person in IT who is designated to watch vendor software websites for security announcements and new releases for all software in use that is exposed to the Internet.  The organization should be committed to at least protecting the external services, even if it can’t spare the resources to perform the same on the internal network.

On to the central point of this blog post: Centralized Logging.  This area is where things get a bit more involved and difficult.  It is not too hard to purchase and setup a machine with 1TB of drive space that could adequately serve as a collector of logging data.  It is also not too difficult to setup most common systems (switches, routers, firewalls, and Windows and Unix servers) to log to this system.  Where the difficulty lies is making that data useful in near-real time, rather than as a source of information after a breach.  To make that data useful you will need an event correlator, which is usually part of a larger service called SIEM (Security Information and Event Management).  To date, I have not been made aware of any SIEM products that are affordable to purchase for most small businesses.  And, that is to say nothing of the cost in personnel time to properly wield such a product.   From what I have seen, the open-source SIEM products are even harder to configure and use than the commercial products, so I can’t recommend any free (or low-cost) alternatives.

So, what is a smaller sized company to do?  That’s a good question.  If you can afford an SIEM product, buy one and pay a Managed Security Services Provider (MSSP) (like True!) to setup and manage the device.  If you can’t afford a full SIEM product, at least purchase an inexpensive server with two 1TB drives, install Ubuntu, put the drives in a software RAID-1 configuration, and setup a syslog daemon (Syslog-ng is perfect) to collect logs from the network.  At least if you are breached you (or the investigator you hire–True!) have a lot more information at your disposal to determine the extent of the breach.

Brett Edgar

Brett is a Founder and the Director of Managed Security Services at TRUE. He has been working in the system and network forensics field since graduating from the University of Tulsa with a B.S. Computer Science in 2003. He speaks hexadecimal fluently and is TRUE's resident human Ethernet transceiver. He holds CISSP, CSSLP, and CNSS 4011-4015 certificates, loves MLB and NCAA Football, and when he gets tired of hexadecimal, he goes home to hang out with his wife and kid.

Twitter - More Posts

The Verizon Business RISK Team released a very interesting study early in June with detailed results and analysis from more than 500 forensic investigations it conducted over a four-year period (2004 to 2007). It claims that this study represents one-fourth of all publicly disclosed data breaches in that time frame. The report is chock full of statistics and percentages. The study examines the age-old question of IT risk-management: who is the largest threat source, insiders or outsiders?

The study weighs the impact of breaches (number of data records compromised) along with the frequency of threat source causing the breach. It also adds a third threat source to the mix: business partners, a sort of blended insider/outsider. One of the interesting results is that, using the classic risk equation (risk = likelihood * impact), business partners represent the greatest threat, followed closely by insiders.

The paper presents statistics but makes no blanket-conclusions on what to do about the problems, instead leaving that up to the individual organization (as it should). Everyone knows that monitoring the insider threat is difficult and time-consuming. It is somewhat easier to monitor business partners since they (should) have limited access via well-defined conduits. Given the results of this study, monitoring business partner interaction with the corporate network data sources may become the new fad in IT risk-management.

Brett Edgar

Brett is a Founder and the Director of Managed Security Services at TRUE. He has been working in the system and network forensics field since graduating from the University of Tulsa with a B.S. Computer Science in 2003. He speaks hexadecimal fluently and is TRUE's resident human Ethernet transceiver. He holds CISSP, CSSLP, and CNSS 4011-4015 certificates, loves MLB and NCAA Football, and when he gets tired of hexadecimal, he goes home to hang out with his wife and kid.

Twitter - More Posts

I have spent a fair amount of time over the last several months analyzing the Security Information Management (SIM) market to see how products like Arcsight[arcsight.com], QRadar[q1labs.com], SecureVue[eiqnetworks.com], and enVision[rsa.com], could benefit us (and our customers) as a Managed Security Service Provider (MSSP)[truedigitalsecurity.com]. I was intrigued, then, when I picked up the December issue of The ISSA Journal and saw an article entitled, “Logs Do Not Lie.”

While there are many advertised benefits to SIM solutions (log management, forensics, threat management, compliance, etc.), one of the take-aways I had from this article regarding the benefits of using a SIM solution was the idea that authorized activity is not always the same thing as safe or legitimate activity.

The two examples provided by the article to illustrate this point involve website mirroring and file transfers. Website mirroring looks a lot like regular web browsing, except it is usually complete (every page is visited) and the pages are viewed in rapid succession. Firewalls and web servers typically log traffic suspected of mirroring the site, but it is not usually treated as actionable information because it is so similar to legitimate activity. Website mirroring is interesting, however, because it could be a precursor to a phishing attack, especially if the source of the mirroring is not a regular client or is located in an interesting geographic region.

The file transfer example is related to Network Behavior Anomaly Detection (NBAD), a feature provided in one form or another by many SIM products. The idea with this illustration is that a given network user may routinely transfer information via external File Transfer Protocol (FTP) servers. If, however, this user’s typical exchanges are around 10K and a 600M exchange is identified, it is noteworthy and probably merits further investigation.

Both examples illustrate the value in collecting information from the various sources on your network (routers, firewalls, servers, IDSs, etc.) in order to analyze and report on that information. Judging by the customer lists on the SIM vendor websites, it would appear that there are quite a few organizations already seeking to take advantage of this information.

Dominic Schulte

Dominic Schulte currently serves as the Managing Director of Security Services & Consulting at TRUE, where he is responsible for the execution of a wide range of security and regulatory compliance services. Previously, Dominic worked with the National Security Agency (NSA) as a Global Network Exploitation and Vulnerability Analyst in the National Security Incident and Response Center (NSIRC). He holds CISSP, QSA and CNSS 4011-4015 certifications.