look around

While big data security analytics promises to deliver great insights in the battle against cyber threats, the concept and the tools are still immature, according to a panel of security experts.

The US Computer Emergency Response Team (US-CERT) has yet to achieve its vision for big data security analytics, said Peter Fonash, CTO for the cyber security office at the US Department of Homeland Security.

“We are still working towards our vision of a cyber threat 'weather map' that is predictive,” he told the Global Cyber Security Innovation Summit in London.

An important goal for big data analytics is to enable organisations to identify unknown indicators of attack, and uncover things like when compromised credentials are being used to bypass defences.

At the recent Nato summit in Wales, CERT-UK was able to mine social media data to support operations to maintain cyber security at the event.

“However, handling unstructured data and combing it with structured data to arrive at an accurate assessment is one of the big challenges,” said Neil Cassidy, deputy director for operations in the UK's national Computer Emergency Response Team (CERT-UK).

“At the Nato conference, it was challenging to establish what claims were true and which were false to know what was actually happening,” he said.

But suppliers said big data security analytics is already delivering value by enabling organisations to analyse data from previously disconnected security data sources.

“Attackers are exploiting the fact that security data is in silos,” said Feris Rifai, CEO of analytics firm Bay Dynamics.

“Security analytics is not only about big data repositories, it is also about collecting together lots of small bits of data from point solutions to make better decisions,” he said.

Rifai said the need for bid data security analytics has never been greater because IT security professionals spend most of their time on discovery.

“By looking at the intersections between data from multiple sources, security professionals can more quickly identify what they need to priortise,” he said.

Most organisations, however, are still tending to store data and forget about it, rather than running multiple queries against it, which is key, said Peter LaMontagne, CEO at another analytics firm, Novetta Solutions.

But Fonash said many firms lack people with the right skills in running queries across multiple data sources.

“Another common challenge is how to disseminate information in real time or near real time and in a machine-readable format for process automation,” he said.

To overcome some of these challenges, Cassidy said CERT-UK is looking at structured language for cyber threat intelligence information called Structured Threat Information eXpression (Stix).

“Getting information out is a challenge, but we believe Stix could be key to enabling different CERTs to share information at speed and scale,” he said.

CERT-UK is working with counterparts in the US and Australia to find ways of getting information to defenders quickly in a format that is useful.

Handling unstructured data and combing it with structured data to arrive at an accurate assessment is one of the big challenge of big data security analytics

Neil Cassidy, CERT-UK

“But there are several issues around automatically ingesting information, including how to ensure that recipients can trust information sources,” said Cassidy.

A common challenge for US-CERT, said Fonash, is navigating internal politics to get complete datasets from various government agencies.

For all organisations, it remains a challenge to identify the most relevant or useful threat intelligence feeds.

“Linking a threat to an IP address, for example, is not necessarily useful, as that IP address could represent hundreds of thousands of machines or users,” said Cassidy.

But few organisations have a mature understanding of big data security analytics, and fewer still are actively using it as part of their cyber security strategy in the UK, Cassidy told Computer Weekly.

For big data security analytics to be successful, he said, organisations first need to have a clear idea of exactly what they want to get out of it.

“Only once you know what you want to achieve can you begin evaluating which are the most relevant technologies and feeds,” said Cassidy.

Register now to receive ComputerWeekly.com IT-related news, guides and more, delivered to your inbox.By submitting you agree to receive email from TechTarget and its partners. If you reside outside of the United States, you consent to having your personal data transferred to and processed in the United States. Privacy$("a#eproductLogin").attr('href', function(i) { return $(this).attr('href') + '?fromURL=' + regFromUrl; });

View the original article here

Security experts at the IEEE Center for Secure Design (CSD) have published a report on the top 10 software security design flaws.

The report is based on real-world data collected at the world’s top technology companies and includes information on techniques to avoid the most significant software security design flaws.

According to the IEEE, practical advice ranges from encouraging the correct use of applied cryptography to validating each individual bit of data.

The CSD is part of a cyber-security initiative launched in 2014 by the IEEE Computer Society, an association for computing professionals.

The broader initiative is aimed at escalating the IEEE’s involvement in the field of cyber security.

The CSD was set up to shift some of the focus in security from finding bugs to identifying common design flaws in the hope that software architects can learn from others’ mistakes.

Its main aims are to provide guidance on recognising software system designs that are likely to be vulnerable to compromise, and on designing and building software systems with strong, identifiable security properties.

CSD founding members include Cigital, EMC, Harvard University, HP, Intel/McAfee, RSA and Twitter.

Its members believe proper security design has been the Achilles’ heel of security engineering for decades.

“The CSD will play a critical role in refocusing software security and security engineering on the most challenging open problem in security,” said Bob Lord, chief security officer at Twitter.

“By getting past the myopic focus on implementation bugs in code and talking about security design, the CSD does even the most advanced companies in the space a huge service.”

Gary McGraw, chief technology officer at Cigital and author of the book Software Security, said bugs and flaws are two very different types of security defect.

 “We believe there has been quite a bit more focus on common bugs than there has been on secure design and the avoidance of flaws, which is worrying because design flaws account for 50% of software security issues,” he said.

McGraw said the CSD had provided the opportunity for its members to refocus, gather real data, and share the results with the world.

The report contains a list of recommendations drawn from a workshop to help developers avoid the top security design flaws. Each technique is described in detail in the report.

Summary of recommendations:

Earn or give, but never assume, trustUse an authentication mechanism that cannot be bypassed or tampered withAuthorise after you authenticateStrictly separate data and control instructions, and never process control instructions received from untrusted sourcesDefine an approach that ensures all data is explicitly validatedUse cryptography correctlyIdentify sensitive data and how it should be handledAlways consider the usersUnderstand how integrating external components changes your attack surfaceBe flexible when considering future changes to objects and actor
Register now to receive ComputerWeekly.com IT-related news, guides and more, delivered to your inbox.By submitting you agree to receive email from TechTarget and its partners. If you reside outside of the United States, you consent to having your personal data transferred to and processed in the United States. Privacy$("a#eproductLogin").attr('href', function(i) { return $(this).attr('href') + '?fromURL=' + regFromUrl; });

View the original article here