The Sans Top 20 Control 5 Malware defense

Check this link:
http://www.sans.org/critical-security-controls/control.php?id=5

     Everyone knows they should have Anti-Virus software.  Well, I would hope most people do.  Anecdotal evidence aside, why should people have Malware defense?  Well like anything else I think a discussion of definitions needs to occur.  Now hold on, this isn't going to be some boring list of words.  It's going to be an exciting one!  Malware is really just a catchall term for any piece of bad software.  It's all the viruses, spyware, Trojans, logic bombs, ad-ware, and spyware that exists.  Think of it as software that wants to hurt you and your PC.
   Ok, now that we have defined it what can we do to stop it?  Well the short answer is... not much.  The people who are creating advanced malware are working very hard to do so.  They have access to all the latest software and antivirus software.  In fact they have kits which are intended to help them do this.  You can actually lease time on cloud based services designed to create and distribute sophisticated attacks.  https://blog.damballa.com/archives/tag/cloud.  So if you are still reading you may be thinking, "well that's a lot of doom and gloom."  Well hang in there.

   While sophisticated attacks do exists many of the attacks being used are not.  In fact many of the attacks which occurred last year were unsophisticated. http://blog.trendmicro.com/trendlabs-security-intelligence/how-sophisticated-are-targeted-malware-attacks/  This article discusses this idea.  In addition, for a far more detailed analysis you can check to he Verizon Data Breach Investigation report.  So if the attacks are using known vulnerabilities why can't we just fix them?  In some cases this is due to the vendor not being able to re-work a difficult issue.  However, in some cases it is because the end users need the functionality that is being exploited.  Or, it may be that the flaw is not in public view.

   The answer to all of these concerns is Malware defense.  In a corporate environment have an automated anti-virus solution, monitor that antivirus solution, act on the reports it gives you, update the system, and most importantly educate users about it.  This type of protection can also be integrated into firewalls.  Network monitoring tools can look for known viruses, and bad behavior on a network.  Most importantly have a plan.  What will you do if a system becomes compromised?  Who will you call, where will a replacement PC come from?  More importantly how will you rebuild a server?  How long will it take?  Will you invest in a cleanup and evidence preservation effort?  If you don't have the answers to all of these questions you are like most people.  If you are looking for a place to start read SANS control 5.

   The secret to malware defense is understanding the risk present, proper protection, and a recovery plan.  

Why on earth would I use Microsoft Visio

This week I decided to write about a feature in Visio that I until recently was unaware of.  For those of you who don’t know Microsoft Visio allows users to create and map.  You can map a city, office, network, even a process or idea.  This is very useful.  Interestingly enough it also allows its users to show relationships graphically.  If any of you have ever needed to explain how authentication works on a network the picture will certainly inform the topic.  Here is an example.

______________________________________

____________________________________

In addition to this functionality the product also allows you to diagram a website.  This is a new function I was unaware of until recently.  While documentation is an obvious need in security website diagrams are more directly related.  In order to use this functionality one must select a new Visio document, got to software and database, then select website. (http://office.microsoft.com/en-us/visio-help/generate-a-web-site-map-HP001209112.aspx).  Once that is complete simply follow the import dialogue.  You will put the URL you are looking for in place.  At that point you just hit OK and wait.  Here is an example.

I chose to use Altoro Mutual.  This is demo site setup by IBM.  Security professionals use it to test this type of tool.  http://www.testfire.net/default.aspx

____________________________________

___________________________________

This tool allows the user to map the links and relationships in a website.  From my perspective it shows me hidden links as well as possibly forgotten pages.  This is something anyone who designs web pages should take full advantage of.  It also allows you to graphically illustrate website design.

Identifying Credible Resources, a how to!

     So we are living in the information age, so they say.  In Cybersecurity we constantly find ourselves attempting to defend systems and ultimately information.  One of the ways we do that is by getting intelligence.  It’s kind of like the Maginot Line.  The Maginot Line was designed for use during World War Two using a World War One mindset.  The line consisted of numerous tunnels, walls, and forts which ran along the border of France and Germany.  It was thought that these fortresses would be superior to the trenches experienced in World War I.  However, the world changed!  While the Germans were not able to route the occupants of these fortresses they were able to bypass them and take France.  Ok, so intelligence or information informs our decisions.  It enables us to focus on what we are trying to protect and more importantly the best way to go about it.  I’ve divided information gathering in this context into a few categories.

      1.  Blogs or internet Media

      2. Vendors

      3.  People, Conferences, and Groups

     Since we have decided to get more information how do we know what to trust?  The place to start is finding out what other people are doing.  For example check out a blog.  I like Krebs on Security.  This blog is run by a veteran in the field.  He will tell various stories from a unique perspective.  In addition he has invested significant time in creating online personas which have access to the darker side of the web.  I also like to check on Bruce Schneier.  Bruce is less involved but more academic.  Reading his work will help you understand concepts.  Lastly check out some security podcasts.  These will typically contain up to date information.  I typically check on Security Now.

     That covers blogs and current events.  You can also subscribe to the vendors for the systems you protect.  The most obvious example would be Microsoft TechNet.  Many people realize that Microsoft has a patch Tuesday, but not everyone realizes they send out messages about those updates a week before.  You can even sign up to get them via e-mail and notifications via twitter if you sign in with a live ID.  HP is another good example.  When you register products they will notify you via E-mail of important driver and system updates.

     Lastly, talk to people.  Take a class at a lowly university.  If you can get there go to a conference.  You can also join some other organization like Infragard.  The key to all of this is talk to people!  People have experiences and may have considered methods you have not.  They may also recommend programs, products, software, and other people!

     While all of these ideas are a good place to start they can’t be the end.  One of the reasons it is important to develop and grow a security intelligence network is threats are ever present.  As a professional you must design, document, and tailor your own network.  As always trust what you hear buy verify the veracity.

The SANS Top 20 Control 4, Continuous Monitoring

I need to take a moment to not it has been a few years since my last blog post.  That being said, the controls have changed numbers.  Since I already discussed inventory previously, I’m going to go ahead and jump in sequence with a control I missed before.  Here is a link to the Top 20 in case anyone is interested http://www.sans.org/critical-security-controls/

What is continuous monitoring?  I recall hearing about this a few years ago, more aptly it should be called continuous automated monitoring.  This type of work usually involves some sort of product scanning an information system in an ongoing capacity.  The system then reports back to a central database.  That information is then read and reported on.  Hopefully that information can then be used to drive changes within an organization.  Some examples of free versions of this are OpenVAS http://www.openvas.org/.  While I have used this before I must admit most of my experience is with a Tenable product called Nessus.  This product does provide a free download.  However, if used in a business a license should be purchased.  Without this license automatic updates will not work.  In addition new features like passive vulnerability scanning will not become available.  Another product commonly used for this is Nexpose.  This product works in concert with backtrack or Kali Linux.  It is also quite popular. http://www.rapid7.com/products/nexpose/

Ok now I've listed a few of the possible products which can be used for this type of work.  So, how do they work?  The high level view here is they collect data about patch updates, common vulnerabilities, virus update definitions, and many other small issues.  These devices then scan networks and look for these issues.  People can then log into the system, view the result, update the systems, and confirm the result is gone.  One of the key programmatic elements here is that these scans can become part of business as usual.  For example, before a system goes into production a scan should be run.  This can ensure the system is being updated.

So what about additional features?  Many of these systems allow custom definitions or audits to be created.  These files can allow companies to look for a specific detail on systems.  I once created a file to search the registry for a specific key.  This key referenced an application which my company was using.  While these systems all find vulnerabilities they do not fix them.  In addition, they do not explain the consequences of system changes.  I recommend that these systems are viewed as a part of a larger vulnerability mitigation plan.

Week 10, what we’ve covered so far.

Up until this point we've covered about half of the SANS top 20. For those of you who don't know I tend to reference the SANS information security reading room. This is where you can locate information on the top 20. I occasionally will bring in some experience or talk about a product I've used. When it comes to that I may reference a specific vendor. Ok, onto the specific review.

We've covered, why you need to know what you have. Why it's important to define how you setup systems. How to protect your border network, and analyze logs of all types, and lastly controlling who get's administrative privileges. The main idea is focusing on the things you can control. Most I.T. Security professional don't want to mention some of the more nasty truths out there. There is a really good chance that if someone wants to get into your network they can. However, the SANS top 20 isn't about that. It is about stopping the majority of attacks that are using well known and understood vectors. Furthermore, it's about limiting and understanding the damage post incident. I recently read the Verizon Report for 2011. This report shows that from the time of penetration to the time data is harvested, you have a sizable window to find out. Depending on the type of attack this could be anywhere from weeks to months. This means that if you are doing what SANS recommends you can minimize the impact! Furthermore, you will know what the impact was!

Next week I will be back with an exciting new topic… Malware prevention… Until then.

The SANS Top 20 Week 9

    This week we will be discussing controlled access. Most people are thinking, you mean like permissions on files? While this is certainly a large part of the picture, it is not the only part of it! Controlled access starts with asking who needs to know? I have often found myself in the position to decide who should have access to information. For the last few years I have fought this freely given power. When someone sends me a message which says, "I can't get into file x" I will typically respond with a few questions. These questions in my mind are the keys to controlling access to information.

    Questions I ask myself.

1. Who is in control of this data?
   
   1. Does the user already have access to this data? Many times the answer is yes.
      
   2. Do I need to ask HR or a department head about this?
      
   3. Is the data even being stored in the correct place? Is the user trying to share a personal directory?
      
2. What level of access is needed?
   
   1. In windows this is fairly straightforward
      
   2. Is this access permanent?
      

   
    

Questions I ask the user.

1. When do you need this by?
   
2. Does anyone else need access
   
3. Who is requesting this?
   
4. Have you opened a ticket or sent an e-mail (paper trail people, paper trail)
   

Ok, so I've made a point of giving out some basic information about what should be asked. This is what I've done in most situations which are not ideal. However, ideally what should happen is the following.

1. DFS should be used. This gives data redundancy and availability.
   
2. All shares should be hidden. While this isn't the end all be all of security it does stop casual browsing.
   
3. Knowledge owners should be identified. In other words someone needs to approve these changes.
   
4. When possible, setup shares by work area
   
5. Drives should be universally understood and applied via script
   
6. Access based enumeration should be used
   
7. Make sure a process is known to request changes
   

While access to data is important, remember, just because you have the keys doesn't mean you should open the door!

The SANS Top 20 Week 8

    This week we will be discussing… Controlled use of administrative privileges. This idea begins with a discussion on what accounts have administrative access. Ok, after a few weeks of reading these I would expect most people to already be saying, "How can I know what I'm limiting if I don't know what I have?" That of course is a great question. When it comes to PC's, I recommended using group policy. You can actually set restricted groups. This will make sure that no matter what when a PC is rebooted only the list groups have admin access. This means that if an admin wanted to give a user rights and then forgot, they would be gone when the PC rebooted. Another recommendation I have is checking who in active directory is part of the admin users group. This can be accomplished with a power shell script or even a manual glance at the group. Additionally, you can do some research. You should spend time finding out when the last time the admin password for any system was changed. I recommend beginning to document some of this in a spreadsheet or something. If you need to change an admin password go ahead and do it. After that, I would recommend finding out which processes i.e. backups, websites, services, etc… are dependent on admin passwords. Once you find this out you can begin the process of making sure those accounts are using service accounts. The big picture here is making sure that admin accounts are used by administrators only, only used when needed, and are relatively secure. In my experience the issue with changing admin passwords is the unpredictable things which break in a network upon doing so. Documentation and planning are truly the keys to this week's topic.