More Insider Threat Data

RSA recently released their latest data on Insider security.

Some interesting results:

53% of respondents feel they NEED to work around security policies to get their jobs done.

37% of respondents have stumbled into areas of the network to which they SHOULDN'T have access.

50% of U.S. respondents switched roles and still had access to UNNECESSARY accounts/resources.

And that's with most respondents understanding security policies and having been given training about the importance of following security practices.

The last time I wrote about an RSA survey pointing out that employees feel they NEED to work around security controls to get their jobs done, the number was at 35%. So, it's either gotten worse or it varies from crowd to crowd (likely the latter).

Get the full survey report here

Ian's Managed Identity Services Survey

Ian Yip has posted his Managed Identity Services survey results. Good stuff. Thanks Ian!

I would've identified the top two benefits of a managed solution as:

• Lower Cost
• Fewer Skills/Knowledge Required
  (Hiring, Training, Employee Turnover, etc.)

The respondents confirmed those, but reversed the order. To them, the fact that a managed solution eliminates the need to find and keep people with the right knowledge/skills is more important than the fact that a managed solution costs less. (That's my own analysis of question 13 after combining a few of the answers.)

Another interesting point is from question 12 - biggest barrier to outsourcing IdM. If you take away the top two concerns by leaving infrastructure and data on-site and limiting external access to sensitive data, the top concern is cost - which was also identified as one of the top benefits. So is there confusion about whether outsourcing cost more or less? Or is it listed as a barrier to changing the way things are done today (as in, I need to find budget)?

Check out the results for yourself to do more digging.

Effects of the Economy on InfoSec

Should we start talking about how the economy will affect IT and Info-Security? Spending has slowed for many of the people that I've talked to. I don't think things are dyer quite yet as software companies are still hiring for pre-sales help. But, customer budgets have gotten smaller. And some are predicting that cost-cutting solutions will likely be king.

But how do organizations reconcile the need for security with cost-cutting? Security solutions are not always about cutting obvious costs. There's often a focus on reducing the potential cost of a breach or failed audit. What about operational costs?

Perhaps now is the time for service-based solutions? Identity-as-a-Service or Audit-as-a-Service? There's a pretty clear argument that allowing someone else to manage a complex infrastructure will save cost vs. trying to build expertise and manage it yourself. ...more on this very soon. But, what do you all think? Should we be buying the duct tape and plastic sheets to brace for a coming storm? How has this economy affected IT security buying decisions?

Litmus Test for Metadirectory vs. Virtual Directory

No, I don't want to re-open a debate. Just floating someone else's idea...

I already mentioned some of the things I overheard at DIDW 2008 and the panel titled Lessons From Successful Virtual Directory Deployments. I was looking at my notes today and wanted to float an idea that one of the panelists offered (I think it was Divya Sundaram of Motorola). He said (paraphrased):

If you front-end data (or a data store) that you don't own (or don't have control of), then you need to replicate/sync data (instead of virtualizing the view).

Is that a good general litmus test for the Metadirectory vs. Virtual Directory debate?

As I've said numerous times, I can think of clear use-cases for both scenarios. But this might be a good general rule of thumb. BTW - the panel seemed to unanymously agree that both capabilties are useful and should be part of the toolbox.

Better data from Active Directory for your SIEM

If you Have or are Planning to Have:

• A SIEM solution (ArcSight ESM, RSA enVision, Novell Sentinel, IBM TCIM)
• An enterprise Log Management solution (LogLogic, TriGeo, SenSage)

And your employees log on to:

• Microsoft Active Directory / Windows
• Novell eDirectory / NetWare

And you're unhappy with the solution's ability to:

• Get complete information from the directory or file system
• Filter which information is collected
• Generate highly relevant alerts based on filtered event data and custom policies
• Collect event data directly from the source (independent of system logs)
• Apply decisions or alerts based on WHO is performing the action
• Report on ANY combination of objects and attributes in the directory
• Report on who is opening or modifying files, folders, or file system permissions

THEN ...Please give us a call.

I recently wrote a paper discussing how we (NetVision) extend the ability of SIEM or log management solutions by getting better, more reliable, and more relevant information directly from what is arguably your most critical source (the network directory). The paper isn't publicly available (it's not that kind of paper). So, let us know and we'll pass it along or we can save you the trouble of reading and just explain it.

85% of Security Breaches are Opportunistic

I've talked before about security breaches being crimes of opportunity. I've given presentations and webinars discussing the Insider Threat and talking about security breaches. And I always mention that I don't think the concern should be that people are bad. I don't think that employees are out-to-get their companies.

I didn't want to paint a picture of bad guys huddled in a dark room trying to figure out how to breach the company's security. Sure, that happens too. But, I don't think that's the real Insider Threat. Some of those attacks may have an element of insider advantage, but the big number of security breaches that I attribute to insiders are more opportunistic. It's administrators who have been given explicit access to sensitive information and stumble across it in their daily routine. And it happens all the time.

According to a new Data Breach Report by Verizon Business,

85% of security breaches are opportunistic.

I always thought the percentage of insider breaches that are opportunistic would be high. But, of the breaches covered in this report,

18% were caused by insiders.

I believe that number to be much higher. This report is based on breaches that were not only reported, but brought to Verizon Business for help. Nobody calls a forensics team when an admin opens up an HR doc containing a co-worker's salary. Or when an admin creates a new account and grants full system rights in order to get a new application up and running. I would consider both scenarios to be a security breach, but neither would appear in this report (or other reports). Those breaches are generally not reported and quite often not even noticed.

Does your environment have a mechanism that enables you to even see that kind of activity? Most do not. ...which leads me to the last stat I'll share from the report:

87% of breaches in this study were considered
avoidable through reasonable controls

...and I would argue that the same is true for the unreported, opportunistic, insider-threat type of breaches that are likely unrepresented in this research.

Identity-Based NAC or UTM

While walking the floor at Interop in NYC this week, I stopped to chat with the guys at the Cyberoam booth. Cyberoam provides a security appliance that provides identity-based Unified Threat Management (UTM). Similar to most Network Access Control (NAC) devices, the solution grants and denies access to systems and resources based on the IP+port destination address. Typically, this is done at the network layer by enforcing policies based on the requesting machine's MAC address (laptop X is allowed to access application Y on server Z).

Cyberoam's messaging is that they are identity-based. This means that the appliance (the red box below) doesn't enforce policies strictly based on MAC address (the user's hardware). It is identity-aware in that it knows who is logged onto the desktop, verifies policies and access rights against the network directory (Microsoft's Active Directory, for example) and grants access to the user rather than to the machine. This is a level of protection and intelligence above purely hardware-driven NAC solutions.

I can't vouch for Cyberoam as a solution. I haven't used it and don't know more than was told to me in a five minute conversation. But, I immediately recognized a use-case scenario for NetVision.

If access to systems and assets across the network is based on data held within Active Directory, then you better be able to monitor changes to that data and get immediate alerts if there's a policy breach. If it's true that 88% of IT admins would steal from their employers or snoop around the network, then an environment that puts the keys to the kingdoms in the hands of the Active Directory administrators needs a comprehensive ability to audit and monitor administrative activity.

So, if you are a Cyberoam customer or if you have a similar NAC or UTM solution that relies heavily on the network directory, please let me know. Even if you're not interested in finding a monitoring solution, I'll buy you a cup of coffee and maybe lunch if you're willing to tell me about your environment, the business challenges, how it's going, what risks you see, etc..

Building a Central Identity Store

The folks at SECUDE Consulting, who are SAP ERM specialists, have an identity practice that focuses on (among other things) SAP NetWeaver Identity Management solutions (the former MaXware products). Matt P, part of SECUDE's IAM team, recently authored a white paper titled Strategies for Creating an Authoritative Store.

If you are building a provisioning system, deploying SAP NetWeaver Identity Management, or designing an enterprise identity store, you should review this paper. Matt discusses terminology like source repositories and target systems, discusses data join techniques, and introduces the concept of layering. The paper provides an overall road map for designing an enterprise identity store, which can be a critical component of a provisioning solution.

You can get a copy via the links or contact info in Matt's blog post about the paper.