Folks in California are so used to earthquakes that sometimes they barely notice when one happens. Folks in the security business are so busy and swamped with the noise of the market that we often miss tectonic shifts in our own world. Let me help you with that last one:
BREAKING NEWS: “Endpoint Security Earthquake Hits: McAfee Actively Endorses Application Whitelisting. Magnitude & Ramifications Are Significant.”
This week, McAfee, one of the two dominant forces in reactive, blacklist-based endpoint security, actively and unequivocally endorsed Application Whitelisting. Ironically, in hard coverage of Symantec’s recent problems with pcAnywhere, the industry is actively recommending application whitelisting too.
First, let’s cover the major quake: McAfee’s active endorsement of application whitelisting—for corporate desktops and laptops. Continue reading this post…
Earlier this week, I wrote a post comparing the cybersecurity strategies of the United States and Australian Departments of Defense. In that post, I applauded the Australians for having a strategy that was “detailed, well-researched and supported, and focused on proactively solving security problems rather than blindly reinforcing outdated and ineffective strategies.” The strategy was based on the DoD’s Defence Signals Directorate’s (DSD) analysis of attacks–learning from what happened to suggest approaches that would have prevented the attacks/breaches. The strategy outlined 35 mitigations, with a strong recommendation to implement the top 4 strategies (#4 is application whitelisting, btw):
“While no single strategy can prevent this type of malicious activity, the effectiveness of implementing the top four strategies remains unchanged. Implemented as a package, these strategies would have prevented at least 70% of the intrusions that DSD analysed and responded to in 2009, and at least 85% of the intrusions responded to in 2010.”
Also earlier this week, McAfee released a report that just about everyone in the security industry has likely now read, “Revealed: Operation Shady RAT”. The report, written by Dmitri Alperovitch, VP Threat Research at McAfee, is an eye opening read covering targeted intrusions into over 70 global companies, governments and non-profit organizations over the last 5 years. The report covers the types of organizations hit the hardest (not shockingly, defense contractors led the list with 13 of the intrusions detected), the ramifications of the breaches, estimated times each were compromised (shortest being 1 month, an honor shared by 9 victims) and even outlines the generic attack approaches utilized: Continue reading this post…
Earlier this week, I came across some coverage about some of the Australian Department of Defence’s (DoD) cyber-security strategies. While not completely fair, I found it an interesting study in contrasts between the Australian strategies/tactics and those recently outlined by the United States DoD.
Toney Jennings, CoreTrace CEO and a former Air Force information warfare officer, recently blogged on the US DoD’s “Strategy for Operating in Cyber-Space”. The main objective of his “DoD Cyberspace Strategy: Is the DoD really ready to embrace new technologies & companies???” post was to openly challenge the US DoD to modify their procurement and evaluation processes to enable small and innovative companies to assist in cyber defense. However, Toney also made a few other key points. Most relevant to this post is that Toney highlighted that the document was extremely high level and highly prone to status quo thinking and actions, e.g.,
“Unfortunately, a significant portion of the document is simply reiterating the government’s ‘business as usual’ tactics. I’ve got to believe that for the five strategic initiatives, the DoD already has active programs in place. Therefore, the first question that comes to mind is how effective are these defenses? I suspect that the fundamental problem with the existing defenses is that the government is using traditional security solutions that don’t measure up against evolving cyber attacks. The root of this problem stems from the fact that the government continues to favor status-quo, ‘no one ever got fired for buying from’ large companies and contractors.”
Which brings me to the Australian DoD. In contrast to the high-level US cyberstrategy document, the Australian DoD’s “Strategies to Mitigate Targeted Cyber Intrusions”” plan is detailed, well-researched and supported, and focused on proactively solving security problems rather than blindly reinforcing outdated and ineffective strategies. Continue reading this post…
Coming from an application whitelisting provider, you might think it’s rather odd that we would agree with anyone who says whitelisting is not a replacement for antivirus. Because each solution takes an opposing approach to fighting malware, it’s only natural that people think that you can only use one or the other. But it’s just not true.
In the article, “Whitelisting on its own not a substitute for antivirus,” Network World’s Ellen Messmer writes how whitelisting should be used as a complementary security defense, not a standalone solution. And we absolutely agree. Here’s why. Continue reading this post…
Over the past few years, the Zeus virus has infected millions of financial systems worldwide, capturing account credentials that cybercriminals use to gain access to corporate networks and steal sensitive data. While there have been competitive programs designed to dethrone Zeus and remove the widespread malware from infected systems, a newly announced malicious software is threatening to one-up the infamous do-it-yourself banking Trojan. Continue reading this post…