Application scanning companies tackle Web 2.0 threats

On Monday, March 23, 2009, HP’s Application Security Center announced the release of a free tool, SWFScan, designed to analyze security vulnerabilities in applications using Adobe Flash.

A few months earlier, IBM Rational announced the availability of their scanning/testing capability against Adobe Flash objects, which is a new addition to their AppScan 7.8 release on January 13, 2009.

For those who are not familiar with Adobe Flash, Flash is a multimedia platform that allows better processing of graphics, animation, special efforts, and bi-directional video streaming. Many websites that have rich interactive content or multimedia content use Flash as an underlying technology.

Before IBM and HP launched their Flash analysis tools, application scanners did not have the capability to process Flash objects. Given that many websites today use Flash, it is not surprising that we are starting to see the emergence of malicious Flash objects or Flash vulnerabilities being exploited for security breaches. Some embedded objects contain explicit exploits which, once downloaded, can turn your machine into a bot or otherwise wreak havoc on your PC.

An October 2008 study from the Opera developer community and found that 30-40% of all websites use Flash. Even this number seems a bit low to me; I can’t recall the last time I went to a site that didn’t use Flash. But then again, I’d imagine some geographies may be a bit slow in adopting technologies like this. Regardless, it’s without question that Flash is widely deployed and many expect to see Flash expanding its foothold in the Web development community.

HP and IBM took different approaches in analyzing Flash. HP’s SWFscan is a static analysis tool, meaning that the tool actually decomposes the scripts behind the Flash object (ActionScript), and statically analyzes what the script code does. IBM, on the other hand, utilizes a dynamic analysis approach — their analysis engine emulates the execution of the Flash object to discern its behavior and the existence of any vulnerabilities.

Which approach is better? Many in application security would agree that if you can do static analysis, you should do static analysis. Static analysis allows you to derive deeper knowledge of the code. Dynamic analysis is somewhat limited and has the problem of not knowing which is the right order of events to execute. However, in cases where Flash carries obfuscated code, it may be better to go with dynamic analysis.

The SWFScan tool is the first free tool of its kind in industry. This should help to spur interest within the Flash developers' community to more thoroughly test and develop secure Flash applications. Both SWFScan and IBM’s AppScan 7.8 support all versions of Flash.

Adobe also has resources on how to create secure Flash applications, available here.

What would you do if you knew your network only had a week to live?

 

 

We’ve all seen movies where the hero or heroine has just days or hours to live.  This genre is always suspenseful.  Next Wednesday, IT administrators and security folks all over the world may find themselves living an action movie plot.  The highly publicized Conficker worm is set to go off on April 1.  I won't belabor the April Fools jokes that have been inevitably bouncing around the Internet.  Conficker is not a joke.  It is a highly sophisticated piece of malware that has already infected millions of hosts.  No one seems to know exactly what will happen on April 1 when Domain Generation Algorithm, or DGA , is activated.  It can't be good.  At the very least it is going to generate a bunch of traffic and at the worst, well… Here is SRI’s diagram of Conficker C:

Conficker exploits a known Microsoft vulnerability and affects some of the underlying network protocols we use everyday such as RPC and SMB.  Last week I had an interesting conversation with Tom Cross, Manager of the IBM-ISS X-Force Advanced Research team, and he pointed out that Conficker was going to illuminate the basic, everyday security tasks, like patching and password management, that are integral to today's enterprise networks.  This worm takes advantage of unpatched systems and weak user passwords.  Conficker could be the world's biggest penetration test.

Just like our hero, the IT and security staff’s at networks around the world have just a short amount of time to try and save themselves from possible destruction.  On April 2 we’ll know if this worm was instructive or not.  We will also know which companies took the threat seriously and which companies did not.  So what should you do to protect your network from potential damage?

• Take steps to discover if you are already infected by Conficker.  One piece of evidence that you might have a Conficker problem is an increase in the number of account lockouts you are seeing.
• Monitor Active Directory for suspicious activity.
• Immediately patch all your vulnerable systems.
• Enforce the use strong passwords in your domain.
• Do not allow the Internet or partners access to SMB.  
• Do not allow local, adhoc or peer to peer on your network.  This is one of the primary ways Conficker spreads in networks.  Instead, centrally managed window file sharing. 
• Use network and host-base IPS to prevent infection or contain the proliferation of the worm if you do become infected.

Nearly 20 years to the day of the release of the infamous Morris worm, Conficker is poised to eclipse all its predecessors and take the title of world's greatest malware.  Are you ready?

Data Toxicology

As most Forrester customers know, data security has rocketed to the top of the list of CISO priorities for 2009, even considering the down economy. Our Business Data Services group has published some excellent quantitative research on this subject, which we've summarized in report form for Forrester customers. I refer you to Jonathan Penn's excellent The State of Enterprise Security 2008 to 2009 for more details. But for those of you who want the sound bite, 90% of CISOs said that data security was either "important" or "very important" on their proirity lists for this year. That trumped disaster recovery, identity and access management and regulatory compliance.

The elevation in importance of data security has, in turn, spurred interest in several security product categories, notable data leak prevention (DLP). According to the survey data I just cited, about 38% of enterprise customers have DLP implemented already. Another 21% are planning to implement it this year. That's an amazing expected uptick in adoption considering the overall state of the security market (flat or slightly up). And of course, if you are a DLP vendor, this is very good news indeed.

Digging deeper, though, what's been most interesting in the dozens of customer calls I've had since January 1 has been the amazing consistency of much of the interest. We are clearly getting past the Early Adopter stage of adoption, and are now well into Early Majority. I'd say about 2/3 of the enterprise customer inquiries I've fielded have been around product selection: Who are the leading vendors? Is the incumbent vendor who provides my anti-virus software a good choice for DLP also? What are the most important qualities in selecting a DLP product?

As an analyst, these are the kinds of questions I expect to hear at this stage of adoption. But what's most striking are the questions I have not heard. Here's what nobody seems to be asking about:

• What can I do to persuade my boss?
• How do I justify the investment?

You might be asking yourself, Why is this? How come the usual justification questions aren't coming up for this particular purchase decision?  Based on my conversations with clients, the answer to this is clear: may enterprises are living in mortal fear of suffering from a toxic data spill. Put simply, certain types of customer information have become highly toxic. The most commonly cited toxic data are:

• Customer names and addresses, when combined with one or more of the following: 
• Government identifiers (taxpayer ID, SSN) 
• Health care identifiers
• Bank account details 
• Cardholder data (number, expiration date)  

Just like asbestos, these data types have become toxic when airborne. Why? Because they have monetary value. Robust black markets have arisen to acquire, buy, sell and barter customer information at "market prices," particularly credit cards. We don't track this kind of thing, but I'd refer you to some of the research done by Symantec and others if you want to know what "street prices" these data types are fetching.

Of course, if the toxic data problem related solely to black-market selling, that alone would not explain the interest in DLP. And here's where the second driver kicks in: the mushrooming number of state and federal statutes and regulations around data breach disclosure. PCI is a key driver too: although it isn't a statute per se, it is a contractual agreement that many enterprises are subject to.

These two issues -- increased toxicity of customer data, and mandates designed to protect that toxic data -- are the primary reason DLP is taking off. About 80% of the time, enterprises evaluating DLP are doing it because of toxic data problem. They are not doing it primarily because of the fear of leaking more ethereal forms of intellectual property, like product plans or sales forecasts. Yes, we do hear that IP protection is driving some interest. It's just not the primary driver -- at least not amongst the mainstream adopters who are now kicking the tires and exploring their options.

In future posts and in my written research, I'll examine the follow-on phases of DLP adoption: that is, what do you do once you have it? How do you use DLP successfully within organizations? Based on the conversations I've been having with customers, we are already seeing some very sharp and distinct trends with successful adopters. Stay tuned!

Lost Laptops Get the Press; Server Breaches Cause More Stress

In the next few weeks, Forrester Research will release my report, Forrester TechRadar: Database and Server Data Security, Q1 2009. In this report, we describe how the risks of theft, corruption and abuse has made securing data stored on servers and in databases much harder. To help security and risk professionals plan their next decade of investments in server data security, the report describes current and future state of 8 important technologies: centralized key management, data classifiers for security, data discovery scanners, data obscurity tools, database activity monitoring, database encryption, outbound web application filtering, and tape and backup encryption.

As part of the process of researching some of the business drivers for this report, I analyzed data from DataLossDB, a public database containing information on data loss events reported in the press and to governmental organizations as required by various disclosure laws. The data makes for fascinating study, and I urge our readers to take a look at it if they want to see what's been going on in the whole area of data breaches. Best of all, I know some of the principals involved in the project, and they are doing a terrific job.

Some of the analysis nuggets we mined from the database are fascinating. I thought I'd share one here, as excerpted from the report:

• "Bulk customer data remains the coin of the realm for thieves. Personally identifiable information that enterprises keep about customers is often used to manufacture identities and open credit lines. According to the Open Security Foundation’s DataLoss DB, 67% of 553 reported data theft incidents in 2008 targeted Name and Address or Social Security Numbers.... Data loss type 'Stolen laptop' was the most common, at 20% of incidents (112 incidents).
• "Databases remain target-rich environments. A significant proportion of sensitive information resides on web-based applications connected to databases. While lost and stolen laptops remain the most common source of lost data, according to DataLoss DB, hacks were the second-most common kind in 2008 (16%, or 88 incidents). Non-exhaustive analysis of these incidents shows that the vast majority were hacks against web applications, typically using SQL injection or other common techniques. Hacking incidents, generally against SQL servers, were extremely effective, with an average of 200,000 records disclosed per incident.
• "By contrast, lost, stolen and missing laptops and computers resulted in one-eighth as few lost records. Of 154 incidents of type LostComputer, LostLaptop, MissingLaptop, StolenComputer, StolenComputer/StolenDrive, StolenLaptop, StolenLaptop/StolenDocument, StolenLaptop/StolenMedia, and StolenLaption/StolenTape, the total records affected was 4 million. Average records per incident was 26,270, with a standard deviation of 89,665."

So the punchline is this: if you believe the numbers (and my analysis), servers tend to be 8-10x more radioactive than endpoint computers. I will likely be recommending a few methodological changes to the DataLoss DB schema to capture a few more pieces of information and make analyses such as mine more credible.

In the meantime, I'd love to hear from blog readers on the subject of data breaches. What kinds of data are "toxic" for your organization? How are you protecting them? We'd like to hear from you.