Month: August 2017

Posted on

Some courts making ‘it might happen’ grounds for litigation

The U.S. appeals courts are split on whether the simple perception or belief that stolen data might be used is grounds for litigation.

A recent federal appeals court ruling in a putative class action lawsuit that says plaintiffs can sue even if there is only fear of, but no actual, damage from a data breach further deepens an appeals court split on the issue and enhances its chances of being considered by the U.S. Supreme Court, experts say (Greenwald, 2017)

This is interesting and concerning.  All organizations are vulnerabile to an attack.  No security framework is perfect.  Prevention, detection, and response are all important actions taken by diligent organizations, so how these are implemented and conducted should be considered.  Juries and judges are likely not to understand this.

I agree that negligence should is grounds for litigation.  However, no organization that promptly and effectively responds to a breach should not be held liable.  Thoughts?

 

 

Posted on

NetSarang Computer Xmanager software backdoor

Kaspersky Lab discovered a backdoor in signed code from NetSarang Computer, a South Korean company.  The software, Xmanager, is used to manage Linux/Unix applications on Windows platforms.  According to Kelly Jackson Higgins in a DarkReading article,

The cyber espionage malware was embedded in one of the source code libraries of NetSarang Computer’s July 18, 2017 software builds. Its Xmanager Enterprise 5.0 Build 1232, Xmanager 5.0 Build 1045, Xshell 5.0 Build 1322, Xftp 5.0 Build 1218, and Xlpd 5.0 Build 1220, were all compromised.

NetSarang Computer’s network was apparently compromised, resulting in distribution of trusted, signed code with embedded malware (Goodin, 2017).  This is now patched, and customers should apply the patch immediately.

This is an example of an attacker-created vulnerability created by attacking the supply chain instead of actual targets.  As in this case, customers have no reason to believe the vendor is malicious.  NetSarang Computers is not a threat agent, but a vulnerability in its security resulted in weaknesses in many organizations.

As with any organization, no security framework is perfect.   We have to believe that, as target organization security strengthens, attackers will start looking at supply chain attacks.  Some organizations have hundreds, or thousands, of applications installed by IT and business employees.  One or more of these vendors will eventually fall victim to an attack like that experienced by NetSarang Computer.  Goodin writes,

The NotPetya worm that shut down computers around the world in June used the same tactic after attackers hijacked the update mechanism for tax software that was widely used in Ukraine. Supply-chain attacks that targeted online gamers included one used to spread the PlugX trojan in 2015 and the malware dubbed WinNTi in 2013.

In this case, blocking and monitoring for anomalous traffic would likely prevent or detect backdoor activity.  However, software whitelisting is still one of the best ways to minimize the number of applications you have to watch.

Posted on

“Security in depth is spending in depth”

It’s always a good idea to understand our current controls and how they work together.  We must also fully utilize each control.  This is becoming something expected by business managers during budget time.  Dawn Kawamoto writes,

One possible contributor to tight security budgets and tempered growth in the industry is a desire by companies to achieve greater efficiencies with their existing technology. “Rather than spending more on security, boards are asking ‘what are you doing to spend less and do it in a better way than what we are doing?'” Pescatore says. “Security in depth is spending in depth.”

I wrote about this several years ago.  Using a controls matrix, it’s easy to start bringing together the information we need to optimize each control and more effectively manage risk.

 

Posted on

AWS improves S3 bucket configuration security

It’s easy to misconfigure any system resulting in security vulnerabilities.  New AWS Macie alerts customer security teams when vulnerable bucket configurations exist.

Amazon’s new Macie service was not created in response to this year’s S3 leaks, but could help address similar incidents by alerting security teams to events like misconfigured bucket permissions, which led to the Deep Root Analytics leak.