Friday Security Highlights: Security Breach Showcase

Welcome to another week in infosec with Friday Security Highlights. Yesterday from the @McAfeeBusiness Twitter handle, we live-tweeted the Dark Reading & InformationWeek virtual session The Aftermath of a Security Breach – Getting the Ship Righted Again. We tuned in as speakers and infosec thought leaders Jerry Johnson (@jerryjpnnl), Ernest McDuffie, and Rich Mogull (@rmogull) led an informative discussion on the long-term effects of an enterprise security breach, a theme we would like to showcase in this week’s wrap-up.

Ernest McDuffie, Ph.D., Lead for the National Initiative for Cybersecurity Education (NICE), began his segment with a strong statement on how humans are often the weakest link in enterprise security. The best software and hardware in the world is useless without a highly educated workforce, and even then, the most skilled cybersecurity professionals can only do so much for an uneducated public. The goal of McDuffie’s NICE initiative is to develop a highly competent, globally competitive cybersecurity workforce as well as create a generation of internet-savvy Americans fully aware of the risks of their online activities.

In a much talked-about example of one type of breach NICE was created to prevent, a piece of Chinese military propaganda has been making rounds this week, notable for B-roll footage that reveals custom-built Chinese cyber-attack software. Officially, the Chinese government denies that it is involved in cyber-attacks, but the fleeting shots of the software, using a compromised IP address belonging to a United States university, show the name of the software and the Chinese university that built it.  Presumably, an individual unaware of the clip’s significance passed it through the editing process – a prime example of how lack of security education can cause critical damage to an organization, or even to an entire nation.

Beyond the need for a highly skilled workforce to prevent this kind of critical error, a second theme our speakers touched upon was the importance of having a plan – knowing what to do in the event of a breach. Rich Mogull, Securosis CEO and former Gartner analyst, went deeper into the realm of incident response with what he calls React Faster and Better (RFAB).

First on Mogull’s list was that organizations need to realize that they will never be able to stop all attacks – and that they will, sooner or later, be breached. Breach monitoring and incident response tactics need to be created with that in mind in order to gain the upper hand against the bad guys. He stressed that information security needs to be a continuous operation, combining extensive monitoring and alerting with internal segregation to close hackers’ operational window once they’ve already made it through the front door.

After this initial preparation and response, Mogull stressed the importance of communication and investigation. While an organization’s instinct is often to cover up a breach as much as possible, this almost always fails and can even damage an enterprise’s reputation. At times, the more customers know, and the more they see you working in their interest, the less fallout you will have to deal with later. In addition, organizations cannot put off a formalized root cause analysis and post-breach evaluation of the response process if they expect to prevent similar breaches from happening again.

Jerry Johnson, CIO of Pacific Northwest National Laboratory, also touched upon the importance of having a response plan set in place, noting that when an attack occurs, you have to immediately work on the assumption that a re-compromise of the network is unacceptable. This involves an immediate lockdown of the breach, but it also requires an extended investment in cyber forensics in order to reevaluate and improve response tactics for the next (inevitable) intrusion. When asked what was the #1 long-range effect of the Pacific Northwest National Laboratory breach, Johnson responded that it was the lesson in planning PNNL took away from the incident – they now have an emergency course of action set in place.

A perfect example of the importance of post-breach response cropped up in the media this week as news of a Purdue University data breach hit the press. The Lafayette, Indiana school released a statement confirming that hackers had accessed the personal data, including Social Security numbers, of 7,093 former students and faculty that had been placed on the computer in error. The breach occurred April 5, 2010 and left a daunting task for Purdue’s forensics team, who had to spend a full year sorting through the context of each of the 6.6 million 9-digit numbers compromised to figure out which of those numbers were Social Security numbers and who those numbers belonged to.

Luckily for Purdue (and for the students), the team assigned to the case found no evidence that the attack’s purpose was to gather data from the system. Rather, the attack seemed to be an attempt to use the Purdue system to launch attacks against other servers. So, while the breach of Social Security numbers turned out to be a relatively benign threat, the information gathered from the forensics team was invaluable in the prevention of similar cyber attacks.

The final theme we would like to touch on is something that all three of our speakers brought up – the importance of staying on top of the latest vulnerabilities and threats.

In addition to sharing security news and information among infosec pros, Rich Mogull noted that we should all be “thinking like a hacker” if we truly want to head off the bad guys. On that note, here’s a rather neat bit of hacker news from this past week, research on stealing ATM PINs with a thermal camera.

Thanks for joining us, and stay tuned for more announcements in our blog and on the @McAfeeBusiness Twitter handle about our upcoming #SecChat on Data Center Security.

We’ll be touching upon some of the themes I’ve brought up today, and we’ll explore how trends such as virtualization and cloud computing have transformed the challenges security pros face in securing the modern data center.

Tags: #SecChat, Cybercrime, data breach, enterprise, Network Security