Database Security 3.0

Black Hat 2008

Last week I took part in  the yearly security pilgrimage called Black Hat in Las Vegas. This years briefings were at Cesars Palace, with 8 parallel tracks ranging from App Sec and 0-Day to Reverse Engineering and Over The Air.

Day 1

I started the day out with a great refresher on everything Application Security by Jared DeMott. Anybody interested in a great general purpose intro on all the different App Sec jargon, and techniques should take a look at this once it shows up in the Black Hat archives.

Next I wanted to see Dan Kaminsky’s ‘DNS is broken’ presentation. Unfortunately clouds of people were already outside the doors and I could not get in the room. But then this got covered by the press and on various blogs in enough detail by now. So in the end, it won the ‘coveted’ most overhyped talk award at the end of day one.

After lunch I sat in the talk by Petko Petkov aka PDP. He had a great presentation mostly talking about x-site/application authentication issues. The core of his message was that we can’t take systems out of context for security testing. An application that is quite secure standalone or in a particular environment, can be used quite maliciously when integrated with another app, or ported to a new platform. For example Apple’s Quicktime™ which runs quite secure in the Mac™ environment has had a flew of issues in the recent past on Windows™.

Bruce Potter of SchmooCon fame, had probably the funniest of all presentation and should really consider a second career path as a comedian. While he did quite extensively promote his newest venture, he had some really good thoughts on presenting vast amounts of audit data. Presentation of data can make or break a security product and I’m really exited about our continued reporting enhancements in DbProtect.

Day 2

I started the day out with Arian Evans presentation about double/triple-encoding as well as transcoding attacks. This February’s highly successful SQL Worm and its more recent derivatives are using this class of attacks. Basically an attacker can circumvent all web app firewalls by properly encoding SQL code, and hide its malicious payload until the database interprets the mumbo jumbo passed through from the web sites POST command. Our security team jumped on this earlier this year, and we were able to create DbProtect activity monitoring filters and rules for these attacks.

I see this as proof, that a comprehensive security posture requires more then just perimeter protection, but that the bad guys will always find their way around these protections, and make their way to where the data is, which is where DAM really comes to shine.

Incidentally, my next stop were some short ‘turbo talks’ of which one was by Justin Clarke, who looked at the same class of attacks from a slightly different angle, and who had a really nice working attack demo.

Later this day Microsoft™ introduced 3 new security initiatives. As a security vendor I was really exited about MAPP, the Microsoft Active Protections Program. In a nutshell, Microsoft will give pre-release announcements to select 3rd party vendors for upcoming security patches, including some pretty detailed vulnerability information. This will give active protection vendors like AppSec a leg up on the hackers, allowing for release of application protection content at the same time new patches are released. Allowing IT departments to thoroughly test these new patches, while still being protected from new attacks exploiting the new vulnerabilities.

I really hope for this to be successful, and for IBM™, Oracle™, etc. to come up with similar initiatives.

Finally I was all set to go to David Litchfields talk. I had never had the chance to see him before and was really looking forward to it. Turns out he lost his passport, and by the time he got a replacement, the airfare would have been not worth it for him, to go for one day.

I can’t help it, but to be disappointed. While I don’t know how much his airfare would have been, I wish he would have thought about his audience, too.

There are no IPOs. What does that mean to you?

A post at the Private Equity HUB today reveals that...

Not a single venture-backed company has gone public on U.S. exchanges since March, and none are scheduled to do so before Q2 ends next Monday... It is the first quarterly shutout in more than 30 years, which well predates the modern venture capital era.

Whoa.

So what does this mean for IT security departments?  Nothing good. 

Don't get me wrong - M&A activity remains strong for solid security companies.  And for many customers, the acquisition route is preferable.  Just when they are getting ready to role out more broadly the innovative technology they've been selectively deploying, an acquisition can remove a ton of risk from the equation. 

But without a viable IPO market, valuable security firms are sure to wither and die because an acquisition just isn't in the cards for reasons that have nothing to do with the value of their solution to customers.  Not only are customers left holding the bag, innovation in general suffers.

Indeed, if the security market can't get a Google of it's own, it's unlikely a revolutionary approach can truly change the security landscape, not only offering an alternative to the Big Security vendors, but forcing them to innovate. 

Evolving Threats and Budgeting

Posted by Josh Shaul

Where did I put that crystal ball?

It occurs to me that in the information security business, managers have a tough task when it comes to budgeting. Many organizations plan and establish their budgets 9-12 months in advance. This means way back in January, February and March of 2007 many enterprises were making detailed budgeting plans for money to be spent in 2008. This gives organizations much needed visibility into how much money they plan to spend in each area and some real specifics on how the money will be spent. All good stuff when you’re trying to manage finances and run a corporation.

In many parts of the modern IT infrastructure this kind of planning works well and makes sense. Hardware ages and needs to be replaced. Buying new servers, additional storage, new network equipment, even cooling and power are all fairly predictable, particularly in well established organizations. But the challenge is quite different when it comes to budgeting for information security products. The reason for this is the evolving threat. We in the data security world are facing a constantly evolving threat, an arms race if you will, where organizations need to be nimble and react quickly to new attacks vectors on increasingly short notice. The threat in February of 2007 was different then it is today in May 2008. It will be different yet again in January 2009. The fact is, planning to spend on protection technologies more then a year in advance is hard and often requires reshuffling and reallocation of budget dollars to go where the money (and defense) is needed the most.

Over the last year or so we have seen dramatic shifts in the evolution of the threat to the sensitive data that many organizations store. We’ve gone from protecting our network perimeter with firewalls and IDS devices, to the realization that web applications leave gaping holes in the firewall….which led to a quick reallocation of budget dollars to spend on web application scanning tools, code scanning tools, and web application firewalls. Most folks were only getting started planning for and purchasing these technologies when another shift occurred. We started to acknowledge that the data that hackers want to steal mostly lives in a database. At the same time, the concept of Insider Threat has ballooned into something very real and serious, with experts stating that 80+% of attacks on data today involve some component of insider access.

Now organizations that had planned to plug sometimes small sometimes large holes in web applications with various technologies have shifted their focus to the databases for the first time. It’s fairly common today to talk to database administrators that have never scanned their databases for vulnerabilities, never applied a patch, and never enabled auditing on a production system. It’s astonishing to think about it. Databases house the “Gold” in today’s corporations and governments. Banks don’t have cash in the vault, it’s in a database. The IRS doesn’t keep your tax return dollars under a mattress some where, it’s in a database. Companies don’t keep paper files about their customers anymore, it’s all in a database. And for many, up to today the threat to those databases was not at the level of many other threats, so little or no attention was paid to those systems.

The big shift has arrived. For many it comes along with regulatory pressure to comply with various industry and government standards, such as PCI-DSS (Payment Card Industry Data Security Standard), Sarbanes-Oxley, FISMA (Federal Information Security Management Act), and several others. These regulations are often vague when it comes to IT assets and how they should be protected, but the bottom line is always the same. It’s data that is regulated, and wherever that data is stored it must be protected. For others, the concern was less about regulated data and more about pure security. “If I lose my customer data, I lose my business” is the mantra many have adopted. The threat has evolved, attackers are focusing on data stored in databases, and the market is moving aggressively to react.

Let’s go back to where we started. The challenge of budgeting long in advance for purchases of technologies that may not exist yet, or of technologies that may not yet have any relevance to your business. I don’t have the answers, but it is an interesting topic to discuss. How do you handle budgeting for IT Security purchases? Do you have a bucket of dollars allocated to emerging threats? Do you regularly revisit your budget decisions to ensure they are still in line with your business needs? Do you skip the details all together, pick a budget and then figure out how to spend it when the time comes?

This is a big challenge for many and a tough problem to overcome. Whatever type of business you work in, be sure to at least consider the nature of the evolving threat model as you plan next years security spending. If you do, when the threat changes and the time to adjust your defenses arrives, you will be very happy not to have to go reallocating, reexamining, or worst case waiting for next year in order to deal with what the hacker community throws at us.

Database Security Hits Home – I’m a Statistic, Pt. 1

View this photo

Posted by Ted Julian

Given what I do all day, thisis pretty ironic.  Today I got a letter in the mail that said, “your account number may have been illegally obtained as a result of a merchant database compromise and could be at risk for unauthorized use...” 

I’ll post more on this later.  But for now, a note to merchants, banks, processors, etc. – please secure your databases!

It’s 10:00 PM, Do You Know Where Your Sensitive Databases Are?

Submitted by Ted Julian

Growing up in upstate New York I remember hearing the public service announcement before the 10 PM news, “It’s 10 p.m. Do you know where your children are?”
(http://www.barrypopik.com/index.php/new_york_city/entry/its_10_pm_do_you_know_where_your_children_are/)
Not unlike security marketing FUD, it certainly was an effective message if the attention and imitation it spawned are any indication.  Multiple discussions at the office today (about customer issues and on a few media calls) reminded me of this phrase’s applicability to not only database security specifically, but data security generally. 

As techies (or in my case a wanna be) it’s tempting to dive right into the sexy features of a database security deployment, like activity profiling or privileged user auditing. But do you know which databases you’d bless with this slick functionality?  After all, with over 220 million records compromised in the last 2+ years
(http://www.privacyrights.org/ar/ChronDataBreaches.htm) and 99 incidents already in 2008 (http://attrition.org/dataloss/#2008) the risks are very real and it’d be a shame to miss one.  In other words, it’s 10 p.m. do you know where your sensitive databases are?

Any database security project, indeed I’d argue any sensible data security initiative, should start with a thorough database discovery.  Sure, we’ve got a great product (http://www.appsecinc.com/products/index.shtml) to help automate this process so this probably seems self serving.  But honestly, whether you buy ours, someone else’s, or do it manually, just be sure to build this inventory.  Experience with hundreds of customers over the years has shown that even the most tightly run IT security organizations have critical databases they don’t know about.  It’s not hard to see why – M&A activity,
a decentralized approach to IT, or simply a rapid pace of change could result in lots of orphaned databases which security staff are unaware of.  Before you jump into deploying any protective database measures, do a discovery first so that as you start with the most important databases, you don’t miss any. 

This same concept applies to assumptions about users as well.  Rich Mogull has a great entry at his Securosis blog here
(http://securosis.com/2008/05/05/information-centric-security-tip-know-your-users-and-infrastructure/ 
where he highlights the importance of knowing what users access your sensitive data before getting carried away with a DLP implementation.  Sort of like, “it’s ten o’clock, do you know whose accessing your sensitive data.” 

Book Tip: "Zero Day Threat", by Byron Acohido -- Full of Juicy Details

Posted by Ted Julian

Byron Acohido (http://www.asp.usatoday.com/community/tags/reporter.aspx?id=88)
and Jon Swartz (http://www.asp.usatoday.com/community/tags/reporter.aspx?id=321) should be well known to folks in the security industry.  Currently reporters at USA Today, each has covered security for longer than most and tech even longer than that.  In the course of their work they talk to gobs of people so they may not remember it, but I’ve spoken with Byron and Jon many times over the years going back to my days as an industry analyst.  They are solid guys
who know their security better than many tech beat reporters let alone mainstream journalists. 

So I was psyched to hear prior to RSA that their cyber crime book was coming out and launching at the show.  I was able to finally meet Byron face-to-face at the party and pick up a copy of the book “Zero Day Threat”  (http://tinyurl.com/3ggnpt).  I just finished reading it and can highly recommend it.

For newbies this book should probably be classified as a thriller: if you’re not versed in the security biz, ZDT will scare the wits out of you.  What really impressed me, however, is what a great read ZDT is even for long-time security pros.  I expected to find a lot more well-written accounts of incidents I was already familiar with – synopsis of widely available info. Not so. ZDT is crammed with incredible stories that are packed with fascinating detail.  For example, I knew a bit about the Florida crew that was nabbed using data stolen from TJX to buy gift cards at Wal-Mart.  But through this book I learned much more about who they were, how they operated, and how they got nabbed.  Many other stories were far less familiar to me but equally captivating.  Each chapter is broken into sections that talk about the crooks, the payments industry, and the evolving technology landscape (exploits) a device I found kept
things moving along while painting a complete picture of diverse ecosystem.

Stories are a great way to encapsulate, educate, and motivate; and this book is full of them. Whether you’re new to the security game and looking to learn what all the fuss is about or you’re a grizzled veteran looking to educate and motivate your staff and/or management, “Zero Day Threat” will not disappoint. 

InfoSecurity Europe – Security Biz Abuzz Across The Pond

Submitted by Ted Julian

This week I’m part of an elite AppSec US / Europe joint task force manning the InfoSecurity Europe show in London. If you’re familiar with the RSA conference in the U.S., this show is essentially the European equivalent from a tradeshow perspective (there are far fewer speaker sessions).   Given that RSA was just a few weeks ago one can’t help compare the two. 

Here are some impressions:

• McAfee two booths, Symantec none.  My theory is that one of McAfee’s acquisitions bought a booth some time ago and McAfee decided to keep both (or couldn’t back out without paying a ton).  In any case, the way they used them was brilliant.  One booth handed out the left “compliance sox” (a black sock with a snazzy McAfee logo on it)
  the other the right.  For a complete set you had to visit both booths.  Pretty clever approach for two booths and one that certainly sent a message about their commitment to the European market.
• Sarbanes matters in Europe, too.  McAfee’s “sox” gambit deserves extra credit for a credible tie-in between their product set and a critical business issue, Sarbanes compliance. Yup, Europe cares about Sarbanes, too – it’s been a major issue at every customer meeting so far on this trip.
• Database security, representation.  Counting us, there were at least three database security vendors with booths and another that was there to present.
• Speeds and feeds are in.  I was shocked to see that many booths were very much focused on their product feature set and value proposition as opposed to higher-level business drivers (ex. lower transaction costs through PCI compliance). And judging by booth traffic, attendees liked it that way. In contrast, booths at RSA (as others have pointed out) are so high-level they risk losing touch with reality.

As with RSA, there aren’t any obvious themes at InfoSecurity Europe. But interest is high, the show floor has been consistently packed. 

What is Security 3.0?

	Focus	Owner	Example	Use Case	Benefit
Sec- urity 1.0	PC	Sys admin	Anti-Virus	minimize virus infection	hardened client
Sec- urity 2.0	Net- work	LAN admin	Firewall	resist external attacks	hardened infra- structure
Sec- urity 3.0	Data	?	Database Activity Monitor- ing	protect sensitive data	hardened data

Submitted by Ted Julian

Like any major upgrade, the rollout of Security 3.0 is happening progressively and will take years.  Enterprises will continue to invest in 1.0 and 2.0 technology for quite some time.  But, they will look for efficiencies (like from better pricing through commoditization and outsourcing) to save money and fund their 3.0 rollout.

Paul Stamp from Forrester Research has written on this topic.  More information can be found at:

http://www.forrester.com/Research/Document/Excerpt/0,7211,44543,00.html