Welcome to Delicate template
Header
Just another WordPress site
Header

As you may know, our company provides 24×7 Network Security Monitoring services to many customers.  Our clients vary widely in size, industry, and information security maturity.   Even so, we see many similar successes, failures, and trends in security monitoring alerts between these customers.  Spyware infections tendsto be a significant number of the incident reports we generate.  Today, I would like to write about the reason spyware alerts are a threat to your organization, why you should take them seriously and respond timely, and what you can do to decrease these incidents on your network.

The danger of spyware is two-fold.   First, it indicates a deficiency on the part of the user in general information security knowledge and specific corporate information security policies.  A spyware infection means that the user likely installed unapproved software on his/her system.  Perhaps the user was doing non-business related web surfing and found the “Totally Awesome Change Your Life Toolbar” from hAcme Software, Inc.  Or maybe the user was tricked into installing this software via social engineering.  (“Click here to install a media player to see Jane E. Celebrity in a bikini!”)  Either way, the user was not aware of the dangers of his/her actions wrt. information security and wrt. corporate security policies.  (You do have policies defining acceptable use of corporate information resources and punishment for misuse, right?)

The second danger (related to the first–in fact, the first is a consequence of the second, so maybe I should have reversed these points–oh well) indicated by a spyware infection is that the user has sufficient rights to execute unapproved software on his/her system that can modify his/her settings and hijack information.  With these rights the user may be delivered and subsequently execute much more damaging malware that exfiltrates personal and/or corporate information or receives and executes instructions from external attackers.  This malware may be delivered by the spyware itself.  Regardless of how it is delivered, your organization has a problem, and it needs to be fixed.

For these two reasons above you should take spyware infections seriously and respond to them in a timely manner.  But what can you do to limit future infections?

  1. Limit user rights.  Do not make them a member of the local Administrator or Power Users groups.  If you have applications that require Administrator privileges to run (QuickBooks, I’m looking in your diretion), get rid of them.  That is a poorly designed application and is likely going to have far worse flaws.
  2. One word: Education.  Provide it to your users.  If you don’t have a sufficiently trained and knowledgeable employee who can teach one day classes on information security, there are plenty of companies that provide that service–and you won’t have to develop the curriculum.  Google is your friend, here.
  3. Follow the hardening guidelines from Microsoft, NIST and NSA on how to secure your Windows systems and networks.
  4. Use Group Policy or other enforcement mechanisms available from companies like Cisco, Symantec, etc., to whitelist applications.  Only applications listed in the whitelist can be executed by the user. Use Group Policy to disable all but a few approved Internet Explorer BHOs (Browser Helper Objects).  This will prevent a lot of the toolbar spyware software from infecting your systems.
  5. Get serious about your corporate information security posture.  Convince upper management to dedicate sufficient time and money to sustaining a CISO position.
Brett Edgar

Brett Edgar

Brett is a Founder and the former Director of Managed Security Services at TRUE. He has been working in the system and network forensics field since graduating from the University of Tulsa with a B.S. Computer Science in 2003. He speaks hexadecimal fluently and is TRUE's resident human Ethernet transceiver. He holds CISSP, CSSLP, and CNSS 4011-4015 certificates, loves MLB and NCAA Football, and when he gets tired of hexadecimal, he goes home to hang out with his wife and kid.

More Posts - Twitter

The Verizon Business RISK Team released a very interesting study early in June with detailed results and analysis from more than 500 forensic investigations it conducted over a four-year period (2004 to 2007). It claims that this study represents one-fourth of all publicly disclosed data breaches in that time frame. The report is chock full of statistics and percentages. The study examines the age-old question of IT risk-management: who is the largest threat source, insiders or outsiders?

The study weighs the impact of breaches (number of data records compromised) along with the frequency of threat source causing the breach. It also adds a third threat source to the mix: business partners, a sort of blended insider/outsider. One of the interesting results is that, using the classic risk equation (risk = likelihood * impact), business partners represent the greatest threat, followed closely by insiders.

The paper presents statistics but makes no blanket-conclusions on what to do about the problems, instead leaving that up to the individual organization (as it should). Everyone knows that monitoring the insider threat is difficult and time-consuming. It is somewhat easier to monitor business partners since they (should) have limited access via well-defined conduits. Given the results of this study, monitoring business partner interaction with the corporate network data sources may become the new fad in IT risk-management.

Brett Edgar

Brett Edgar

Brett is a Founder and the former Director of Managed Security Services at TRUE. He has been working in the system and network forensics field since graduating from the University of Tulsa with a B.S. Computer Science in 2003. He speaks hexadecimal fluently and is TRUE's resident human Ethernet transceiver. He holds CISSP, CSSLP, and CNSS 4011-4015 certificates, loves MLB and NCAA Football, and when he gets tired of hexadecimal, he goes home to hang out with his wife and kid.

More Posts - Twitter

Legitimately bad

February 16th, 2008 | Posted by Dominic Schulte in Logs | Monitoring | Security - (0 Comments)

I have spent a fair amount of time over the last several months analyzing the Security Information Management (SIM) market to see how products like Arcsight[arcsight.com], QRadar[q1labs.com], SecureVue[eiqnetworks.com], and enVision[rsa.com], could benefit us (and our customers) as a Managed Security Service Provider (MSSP)[truedigitalsecurity.com]. I was intrigued, then, when I picked up the December issue of The ISSA Journal and saw an article entitled, “Logs Do Not Lie.”

While there are many advertised benefits to SIM solutions (log management, forensics, threat management, compliance, etc.), one of the take-aways I had from this article regarding the benefits of using a SIM solution was the idea that authorized activity is not always the same thing as safe or legitimate activity.

The two examples provided by the article to illustrate this point involve website mirroring and file transfers. Website mirroring looks a lot like regular web browsing, except it is usually complete (every page is visited) and the pages are viewed in rapid succession. Firewalls and web servers typically log traffic suspected of mirroring the site, but it is not usually treated as actionable information because it is so similar to legitimate activity. Website mirroring is interesting, however, because it could be a precursor to a phishing attack, especially if the source of the mirroring is not a regular client or is located in an interesting geographic region.

The file transfer example is related to Network Behavior Anomaly Detection (NBAD), a feature provided in one form or another by many SIM products. The idea with this illustration is that a given network user may routinely transfer information via external File Transfer Protocol (FTP) servers. If, however, this user’s typical exchanges are around 10K and a 600M exchange is identified, it is noteworthy and probably merits further investigation.

Both examples illustrate the value in collecting information from the various sources on your network (routers, firewalls, servers, IDSs, etc.) in order to analyze and report on that information. Judging by the customer lists on the SIM vendor websites, it would appear that there are quite a few organizations already seeking to take advantage of this information.

Dominic Schulte

Dominic Schulte

Dominic Schulte currently serves as the Managing Director of Security Services & Consulting at TRUE, where he is responsible for the execution of a wide range of security and regulatory compliance services. Previously, Dominic worked with the National Security Agency (NSA) as a Global Network Exploitation and Vulnerability Analyst in the National Security Incident and Response Center (NSIRC). He holds CISSP, QSA and CNSS 4011-4015 certifications.

More Posts