2011-10 The Path to Compliance

Alert Logic

The Path to Compliance

September 2011

Agenda

• State of the security market– Organized Cybercrime– Common Attack Methodology

• Compliance defined– The Compliance Two-Step– The Obligatory Response

• A Security First Approach

• Real World Examples

STATE OF THE SECURITY MARKET

Recent Attacks

4

May 4, 2009 Virginia Prescription Monitoring Program, Richmond VirginiaCompromised Records: 531,400Type of Attack: Outside HackerOutcome: Attacker is still at-large. State notified 531,400 people of the breach by letter

November 10, 2010 Holy Cross Hospital, Ft. Lauderdale FloridaCompromised Records: 44,000 (1500 Confirmed)Type of Attack: Internal Employee gained access to server Outcome: Employee was fired and arrested. 5 other suspects have been charged.

February 10, 2011 Texas Children’s Hospital, Houston TexasCompromised Records: 19,264Type of Attack: MalwareOutcome: Attacker is still at-large. All patients were notified by letter

2010 Data Breaches

Who is breaching data?70% External Sources (-9%)

48% Inside Sources (+26%)

11% Business Partners (-23%)

27% Multiple Partners (-12%)

How do breaches occur?48% Involved Privilege Misuse (+26%)

40% Hacking (-24%)

38% Malicious Code (<>)

28% Employed Social Tactics (+16%)

15% Physical Threats (+6%)

What Commonalities Exist85% Attacks were not highly difficult

85% Breaches were the result of opportunistic attacks

96% Were considered avoidable through reasonable controls

*Statistics from 2010 Verizon Business Data Breach Investigation Report5

ORGANIZED CYBERCRIME

The Numbers– Global computer crime market estimated

to be $7B in 20101

– Russia responsible for $2.5B– Growing ~35% per year overall

Interesting Trends– Increase of specialization of participants– On-Demand and Pay-Per-Use services – Developing C2C market

Cybercrime Market

1 Group-IB Report - 2010

Crime Pays

Stolen Assets/Criminal Activity Payout

Credit Card Details $5-10, expected $1-2 post PSN

Bank Credentials $80-$700

Bank Transfers 10% to 40% of amount transferred

Social Security Numbers $30-50

0Day Exploits $5,000 - $100,000

Exploits for published vulnerabilities $5,000 - $50,000

Exploit Packs $200 - $5,000

Malware Pay-Per-Install Up to $1.50 for US victims, $0.15-0.60 for other countries

How it Works – The Business Model

1Purchase Malware Pack

2

4

Infect Users, P2P seeding, XSS

Register With Cybercrime Group

DISTRIBUTOR

CYBERCRIME GROUP

3

VICTIMS

Infected Users Send Data to Group

BLACK MARKET

5Data Sold Wholesale

6 Payment Made

COMMON ATTACK METHODOLOGY

Hacker Profile– Talented individual – Young, bored

Motivation– To prove a point– Curiosity – Credibility

Attack Methods– Worms targeting memory vulns in network services– Attack payload not usually customized

Traditional Attacks

Hacker Profile– Organized Crime (84%)– Dedicated teams who are paid– Teams often work for criminal

organizations as a career

Motivation – Targeted attack for financial gain – Desire anonymity

Attack Methods– Vulnerable web applications– Client side applications – Malware used to keep control

Modern Attack Profile

Delivery/Attack Surface

Infection Method Difficulty Effectiveness

Websites Easy Good

P2P Networks Easy Medium

SPAM Easy Medium

Paid Ads Medium Medium

Phishing Easy Poor

Traditional Network Exploit Difficult Poor

Blackhat SEO Medium Medium

Cross Site Scripting‐ Most sites are vulnerable‐ Easy to find and users trust the websites

SQL Injection‐ Easy to find‐ Very common

Source: Veracode State of Software Security Report, April 2011

COMPLIANCE DEFINED

Security and Compliance Management is Becoming More Difficult Every Day

Increasing number and sophistication in security threats

Increasing complexity in maintaining compliance

Increasing cost to support and maintain (HW, SW, FTEs)

• Improved organization and sophistication of attackers• Prolonged and persistent targeting with compressed timelines to react• Rise of contaminated spam, botnets, and social engineering for malicious breaches

• Continuous updates in requirements and reporting standards• Adoption of new regulatory compliance standards• Manual and laborious processes

• Training on the latest compliance requirements and security threats• Updating, patching, and maintaining software, scripts, and processes• Rollout of new HW/SW to keep up with increased demand

Complicated and Costly Compliance Picture for Healthcare

Implement People, Process, & Technology for Compliance• HIPAA §164.308 Administrative safeguards• HIPAA §164.312 Technical safeguards

Penalties for EMR Non-Compliance Coming into Effect• Penalties and Fees up to $1.5M for neglect• Data Breach Notification to HHS and Local Media for breaches

>500 patients

What about PCI compliance?• PCI applies to every entity that stores, processes,

or transmits cardholder information• Patient billing, pharmacy, etc.

HIPAA & HITECHVulnerability Assessment

164.308 (a)(1)(ii)(A)Risk Analysis – Conduct Vulnerability Assessment

IDS/IPS/Log Management

164.308 (a)(1)(ii)(B)Risk Management – Implement security measures to reduce risk of security breaches

164.308 (a)(1)(ii)(D)Information System Activity Review – Procedures to review system activity

164.308 (a)(5)(ii)(B)Protection from Malicious Software – Procedures to guard against malicious software host/network IPS

164.308 (a)(6)(i)Log-in Monitoring – Procedures and monitoring for log-in attempts on host IDS

164.308 (a)(6)(iii)Response & Reporting – Mitigate and document security incidents

Log Management 164.312 (b)Audit Controls – Procedures and mechanisms for monitoring system activity

Compliance… a costly problem

PCI DSSPenalties: fines, loss of credit card processing, and level 1 merchant requirements

SOX (CobiT)Penalties: fines up to $5M, up to 10 year in prison

Vulnerability Assessment

6.2 Identify newly discovered security vulnerabilities

11.2 Perform network vulnerability scans quarterly by an ASV

DS 5.9 Malicious Software Prevention, Detection, and Correction“put preventive, detection, and corrective measures in place (especially up-to-date security patches and virus control) across the organization to protect information systems and technology from malware (e.g., viruses, worms, spyware, spam)”

Intrusion Detection

5.1.1 Monitor zero day attacks not covered by Anti-Virus

11.4 Maintain IDS/IPS to monitor & alert personnel, keep engines up to date

DS 5.6 Security Incident Definition“clearly define and communicate the characteristics of potential security incidents so that they can be properly classified and treated by the incident and problem management process”

DS 5.10 Network Security“use security techniques and related management procedures (e.g., firewalls, security appliances, network segmentation, intrusion detection) to authorize access and control information flows from and to networks.”

Log Management

10.2 Automated audit trails10.3 Capture audit trails10.5 Secure logs10.6 Review logs at least daily10.7 Maintain logs online for 3 months10.7 Retain audit trail for at least 1 year

DS 5.5 Security Testing, Surveillance, and Monitoring“…a logging and monitoring function will enable the early prevention and/or detection and subsequent timely reporting of unusual and/or abnormal activities that may need to be addressed.”

Compliance… a costly problem

The Ugly Truth

• Compliance is the output of post-mortem– Some organization did not secure their data, and now everyone else

must deploy solutions, software, policies, and guidelines

• Compliance will always be a step behind the latest threat

• Compliance will NEVER mean you are secure

• Compliance mandates will continually be expanded, as hospitals, insurance companies, and other health care resources experience breaches, privacy violations, and security issues

The Compliance Two-Step

• Organizations continue to check the compliance box and then struggle to maintain compliance

• IDS, Log Manamement and Vulnerability Scanning are the most expensive and resource intensive – and also the most difficult for organizations to implement and maintain

• Attacks are not being detected in an acceptable time

• Organizations that achieve compliance are able to protect their patient data

• Companies will continue to fail to achieve compliance due to lack of time, budget, and technical resources

Protective Technical Controls• Firewalls• Routers• Antivirus• System Patching• Complex Passwords• Data Access Controls• Whole Disk Encryption• VPNs

The Obligatory Response

A SECURITY FIRST APPROACH

Analyzing the Facts

• Companies aren‘t detecting attacks in an effective way

– Why? Chasing false alarms, other priorities, etc…

• Companies are not focusing on continuous security– Too many companies check a box and move on

• Companies must review log data– Companies need to be more vigilant in this area

• Most of the 99% of breaches could have been caught

– With effective intrusion detection systems, log management and vulnerability assessment

25

Common Trends

• Strong push towards SaaS and MSSPs to augment their staff

• Some are looking towards cloud-based technologies to reduce technology expenditures

• Moving away from general standards like HIPAA and SOX towards PCI and DISA Standards

• Deploying centralization solutions to tie together their compliance efforts

• Using GRC tools

AV Isn’t Enough– Malware evolves ahead of AV signatures

Education

– At least half of the executables on P2P network infected – Don’t install software from untrusted sources– Safe browsing– Flash drives

Defending Users

Close your Perimeter (egress too!)

Patch your systems

Vulnerability scanning– Automated vuln scans & review them regularly

IDS– Attempted botnet comm, network scans– Propogation over RPC exploits, brute forcing Windows shares

Log Management– Account lockouts due to brute force– Proxy logs

WAF

Infrastructure Defense

REAL WORLD EXAMPLES

Use Case #1: Security Issues and Identity Theft

• Scenario• One of your system administrators returned from a two-week vacation

and was unable to login• He believes his account has been locked out, but he’s not sure why

•Key Questions to Answer:• Why is the account locked out? • Where did the lock out occur?• When did it occur?• How did it occur?

Effective Log Management Can Prevent Breaches and Provide Compliance

Breached customer records cost businesses an average of $202 per record in 20091

“86% of victims had evidence of the breach in their logs…”“in most attacks, the victim has several days or more before data was compromised.”2

Suspicious Log Activity

Intrusion or Penetration

Breach orMalicious Activity

IT alerted

Log collection and monitoring detects activity; sends alert

SOC is alerted and security containment steps are executed

Too Late

Breach is Avoided

Without Log Mgmt

WithLog Mgmt

Compliance and Security Simplified:Security Issues and Identity Theft

Investigating Monitoring Alerting

WithoutLog Management

Log in to a domain controller. Examine the AD object for the user to determine the time of lock-out. Review the logs on each domain controller manually.

Log in to a domain controller daily. Create a filter on the username every day, and review the logs. Repeat process for every domain controller.

Wait for the System Admin to call if their account is locked out again.

Issue: Manual & Timely Issue: Expensive Issue: Reactive

Key Compliance and Security Activities

WithLog Management

• Common index with search capabilities. • Automated alerting and notification.• Regular reporting and forensics

Use Case #2: Audit Resolution Challenges

• Scenario• A new policy is initiated to require any new Domain Administrators to

only be added by the Security Department• A few weeks later, a routine audit discovers some new members in the

Domain Admin Group

•Key Questions to Answer:• When were these users added?• Who added them?• Who was added?

Compliance and Security Simplified:Audit Resolution Challenges


WithoutLog Management

Log in to a domain controller. Review the logs for group changes. Hope the logs are still on the system and have not rolled over. Repeat for each DC.

Log in to a domain controller daily. Review Domain Admins group and verify no one has been added or removed since the last review.

Wait for the System Admin to call if their account is locked out again.



WithLog Management

• Search on the Group Member Added and filter on Domain Admin. • Save View and have the report emailed on a regular basis.• Build an automated alert to notify when users added, removed, changed

Use Case #3: Hacker/Attacker

• Scenario• For several weeks your network has been running slow• Some systems have been performing abnormally and there are new

user accounts that cannot be tied back to a particular user• Suddenly, you receive an odd e-mail from an alleged hacker who claims

to have access to sensitive patient files

•Key Questions to Answer:• Have you been hacked?• If so, when did it begin?• How would you respond?• Should you notify the media?

Compliance and Security Simplified:Business Critical Applications


WithoutIntrusion Detection

Log in to the firewall/VPN gateway, look through the logs (if it can store the logs). Look for disconnect messages, and errors. Etc.

Log in to VPN. Search inside of the VPN Disconnect messages. See what time the disconnect occurred and all errors related to the VPN session.

Wait for the Network Engineer to log in and discover it is down.



With Intrusion Detection

• Use logs to search for suspicious message, account creation, firewall messages.

• Use IDS to look for attack attempts.• Focus efforts on actionable security incidents

With Complicated Threats, There is a Need for Security Expertise

Lots of point solutions, but difficult to consume all the data

It is nearly impossible to be aware of all forms of attacks and attack-responses, and perform all the other functions expected relating to daily operations

Suspicious Log Activity

Intrusion or Penetration

Breach orMalicious Activity

IT alerted

Log collection and monitoring detects activity; sends alert

Security containment steps are executed

Too Late

Breach is Avoided

Without IDS

With IDS

CONCLUSION

Meeting the Challenges Head On

• Move from manual to automated log management– Keys to success: effective and sustainable log management and review

• Choose a vulnerability assessment solution that aligns with your network

– Keys to success: centralized view and remediation knowledge

• Select an intrusion protection solution that doesn’t require costly implementation, configuration and management

– Keys to success: Implement a solution that adapts to your network security policies and minimizes the work load of your resources

Q&A

Who is Alert Logic?Founded: 2002Customers: 1,200+, spanning 3 continentsStaff: 100+Service Renewal Rate: ~99%Experienced ManagementProfitable w/ Strong Balance Sheet

• Easy to implement and deploy• Flexible and Scalable

• Improve security and threat visibility• Meet compliance requirements• Lower, more predictable costs• Quicker Time-to-Value

Log ManagerThreat Manager

Patented SaaS Products

• 24x7 Security Operations Center• GIAC-certified security analysts

LogReviewActiveWatch

Integrated Services

Delivering measurable customer benefits

Contact

• Mark Brooks

• [email protected]

mailto:[email protected]