Accelerating Detection and Response

Finding IT breaches via well-integrated solutions

Last spring, in late March, regional grocer Schnucks Markets reported that the credit card data of more than 2 million customers was stolen by cybercriminals. The company wasn’t made aware of the breach until mid-month; it took nearly two weeks to find the problem and another 36 hours to contain it. Even more disconcerting? The attacks had begun in December, several months before they were discovered.

Schucks isn’t the only company to have suffered at the hands of cyber attackers. Hundreds of thousands of security incidents were reported in 2012, with hundreds of confirmed data breaches. Businesses know that when it comes to protecting the networks and systems that run operations, nothing is more important than detecting and stopping an attack before any damage is done. In fact, worldwide spending on security infrastructure is expected to rise to $86 billion by 2016, according to market research firm Gartner.

Despite the awareness of and apparent commitment to funding protective measures, rapid cybersecurity detection and response doesn’t often happen. Unfortunately, most organizations find out about security breaches after the fact, and often aren’t the ones belatedly discovering them.

Central to this problem is that the kinds of cybersecurity solutions capable of quickly identifying, responding and stopping breaches require a variety of IT security and management tools along with disciplines that are automated, tightly-integrated and, ideally, managed from central command. However, few companies have the time or expertise required to implement and run such a well-integrated, comprehensive, cybersecurity program.

Rising Attacks, Multiple Challenges

Despite the challenges, building and running an effective cybersecurity program should be at the top of every organization’s agenda as corporate data theft, hacking and malware attacks continue to rise.

In a recent study, the 2013 Data Breach Investigations Report (DBIR), conducted by the Verizon RISK Team with cooperation from 18 organizations that contributed data and analysis, including the CERT Insider Threat Center at the Carnegie Mellon University Software Engineering Institute, the U.S. Secret Service, the European Cyber Crime Center (EC3) and numerous cybercrime agencies around the world, analyzed more than 47,000 reported security incidents and 621 confirmed data breaches from the past year. The study found that 92 percent came from external agents (sources outside of an organization and its network of partners).

DBIR began in 2004, indicating external attacks have been on the rise, while those from internal sources have dropped considerably in recent years. Of all the confirmed breaches in 2012:

  • 52 percent were the result of hacking;
  • 40 percent incorporated malware;
  • 35 percent involved physical attacks;
  • 29 percent leveraged social tactics; and
  • 76 network intrusions exploited weak or stolen credentials.

Responding to these statistics should be an effective cybersecurity program; however, challenges of such programs include:

Incident response times. Of the organizations analyzed in the DBIR, 66 percent of them took months or more to discover the breaches. This response time is too slow, and the problem is getting worse.

Breach discovery. Sixty-nine percent of the incidents were discovered by a third party, according to the report, and even more shocking is that 9 percent of breaches were found by customers. DBIR also found that more than half of the breaches identified internally were spotted by end users rather than IT teams.

Lack of an incident response plan. This is likely one reason for such dismal discovery and action. According to the Global State of Information Security Survey 2013, a worldwide study by PwC and CIO and CSO magazines, only 27.2 percent of the business and technology executives surveyed said that their organizations have an incident response process to report and handle breaches, disseminating that to third parties who handle data.

“There has been a long-term decline in the use of some basic information security detection technologies,” according to this study. Stated in the 2013 Global State of Information Security Survey:

  • 71 percent reported that their firms used malicious code detection tools in 2012; that’s less than the 83 percent who reported using those tools in 2011.
  • Less than half (46 percent) reported using vulnerability scanning tools, down from 59 percent the year prior.
  • Only 39 percent used data loss prevention tools, down from 48 percent in 2001.
  • Only 36 percent used security event correlation tools, down from 47 percent in 2011.

Vulnerability scanning, data loss prevention and event correlation tools are vital components of an effective cybersecurity program, and the apparent drops in their use impacts how prepared an organization is to respond to an attack or proactively prevent one.

Complex cybersecurity initiatives. IT security professionals continue to grapple with the ever-increasing complexities of their cybersecurity initiatives, many of which are riddled with security tools that lack visibility, integration, automation and collaboration. Used by different teams within IT, these tools are: complex to manage; lead to slow response times; cause security oversights; and require varying skillsets, lengthy custom development and multiple screens/command centers.

InformationWeek’s 2012 Strategic Security Survey found that managing the complexity of security was the biggest IT security challenge facing companies today. The survey blames the high volume of threats and technologies being used, and policies that need to be enforced.

A Well-Integrated, Fully-Stocked Central Command

Organizations need solutions that deliver automated, integrated systems for identifying and defending against hacks, malware, targeted attacks, advanced persistent threats (APTs) and other malicious activity that initiate responses before any damage is done, all from a single-user interface. These solutions need to guide analysis and audits, and strengthen the institutional knowledge and intelligence about cybersecurity.

In other words, organizations need well-integrated, fullystocked central commands to run their enterprise-wide, cybersecurity programs that ultimately mitigate risks.

To improve response times and remediation, organizations need automated incident response that can be customized and is holistic enough to include specific tasks such as packet capture and investigation, examination of hard drives and memory/ RAM, and malware disassembly via two-way communication. This should be supported by a single platform that reveals integrated analysis to get to the bottom of an incident in minutes, while facilitating real-time collaboration among the network security, forensics, malware and information architecture teams. A Security Information and Event Management (SIEM) platform and a comprehensive Incident Response (IR) platform together provide both endpoint threat detection and rapid response.

SIEM solutions are available from a variety of IT providers and are designed to centralize the storage and analysis of events generated by other software on the network, such as anti-virus software. SIEMs can provide advanced reporting tools and indepth event analysis through flexible and extensible integration capabilities.

The best SIEMs should enable:

  • The capture of any data from any device, system or application using a simple “drag-and-drop” framework;
  • the ability to synchronize user, role, and entitlement information from corporate directories to find unauthorized user activity;
  • shared account usage;
  • role policy violations; and
  • the capability of interfacing with IT management frameworks.

Advanced SIEM solutions, tightly integrated with a variety of security tools that collect and manage their own events, is what provides the central command. Without it, it’s difficult—in some cases nearly impossible—and time-consuming to follow, detect, analyze and correlate events culled by multiple systems.

Prepare for Cyber Combat

DBIR recommends that cybersecurity initiatives focus on better and faster detection through a blend of people, processes and technology without compromising prevention. The report also said that organizations need to collect, analyze and share incident data, tactical threat intelligence and indicators of compromise so they can build more effective security programs. Organizations should regularly measure the number of compromised systems at any given time and the mean time it takes to detect incidents to better understand their state of security and to refine security practices.

Events monitoring and analysis can be done across the enterprise and on a variety of devices, servers, databases, and just about any data type, including email. Events are discovered from a central console, and responses and analysis can also be done from the same central command without having to switch back and forth between tools. Data spillage can be actively monitored, and automated responses can be configured using templates or easy-to-use customization. Ultimately, a well-integrated, fullystocked solution will enable organizations to effectively manage and analyze millions of events and block any trouble before it impacts their IT operations, service, customers, brand and company value.

Businesses have to be prepared; and putting up defenses requires due diligence and combining a best-of-class SIEM with best-of-class security tools into a tightly-integrated, security solution with a single user interface. This will go a long way in helping organizations fight back.

This article originally appeared in the December 2013 issue of Security Today.

Featured

  • New Report Reveals Top Security Risks for U.S. Retail Chains

    Interface Systems, a provider of security, actionable insights, and purpose-built networks for multi-location businesses, has released its 2024 State of Remote Video Monitoring in Retail Chains report. The detailed study analyzed over 2 million monitoring requests across 4,156 retail locations in the United States from September 2023 to August 2024. Read Now

  • Gaining a Competitive Edge

    Ask most companies about their future technology plans and the answers will most likely include AI. Then ask how they plan to deploy it, and that is where the responses may start to vary. Every company has unique surveillance requirements that are based on market focus, scale, scope, risk tolerance, geographic area and, of course, budget. Those factors all play a role in deciding how to configure a surveillance system, and how to effectively implement technologies like AI. Read Now

  • 6 Ways Security Awareness Training Empowers Human Risk Management

    Organizations are realizing that their greatest vulnerability often comes from within – their own people. Human error remains a significant factor in cybersecurity breaches, making it imperative for organizations to address human risk effectively. As a result, security awareness training (SAT) has emerged as a cornerstone in this endeavor because it offers a multifaceted approach to managing human risk. Read Now

  • The Stage is Set

    The security industry spans the entire globe, with manufacturers, developers and suppliers on every continent (well, almost—sorry, Antarctica). That means when regulations pop up in one area, they often have a ripple effect that impacts the entire supply chain. Recent data privacy regulations like GDPR in Europe and CPRA in California made waves when they first went into effect, forcing businesses to change the way they approach data collection and storage to continue operating in those markets. Even highly specific regulations like the U.S.’s National Defense Authorization Act (NDAA) can have international reverberations – and this growing volume of legislation has continued to affect global supply chains in a variety of different ways. Read Now

Featured Cybersecurity

Webinars

New Products

  • 4K Video Decoder

    3xLOGIC’s VH-DECODER-4K is perfect for use in organizations of all sizes in diverse vertical sectors such as retail, leisure and hospitality, education and commercial premises. 3

  • QCS7230 System-on-Chip (SoC)

    QCS7230 System-on-Chip (SoC)

    The latest Qualcomm® Vision Intelligence Platform offers next-generation smart camera IoT solutions to improve safety and security across enterprises, cities and spaces. The Vision Intelligence Platform was expanded in March 2022 with the introduction of the QCS7230 System-on-Chip (SoC), which delivers superior artificial intelligence (AI) inferencing at the edge. 3

  • Luma x20

    Luma x20

    Snap One has announced its popular Luma x20 family of surveillance products now offers even greater security and privacy for home and business owners across the globe by giving them full control over integrators’ system access to view live and recorded video. According to Snap One Product Manager Derek Webb, the new “customer handoff” feature provides enhanced user control after initial installation, allowing the owners to have total privacy while also making it easy to reinstate integrator access when maintenance or assistance is required. This new feature is now available to all Luma x20 users globally. “The Luma x20 family of surveillance solutions provides excellent image and audio capture, and with the new customer handoff feature, it now offers absolute privacy for camera feeds and recordings,” Webb said. “With notifications and integrator access controlled through the powerful OvrC remote system management platform, it’s easy for integrators to give their clients full control of their footage and then to get temporary access from the client for any troubleshooting needs.” 3