Flow Tools

Thomas H. Ptacek, who co-authored a slightly famous paper on IDS several years ago, wrote me regarding his company's product, Peakflow X. According to their press release, the system profiles network traffic and complements traditional signature-based IDS:

"Upon installation, Peakflow X monitors network traffic, automatically constructing a holistic real-time model of the entire network from the inside out. Identifying factors such as services (HTTP, FTP, Microsoft File Sharing, etc.), inbound and outbound traffic, and host-to-host behavior, Peakflow X dynamically clusters all hosts into groups based on similar operational policies. For example, hosts that communicate primarily HTTP only to hosts in the marketing department would be grouped together, indicating an organization’s internal workgroup Web servers. Based on this detailed network-wide model, Peakflow X immediately detects anomalous behavior whether or not it stems from a known vulnerability. For example, should one of the internal Web servers initiate a file sharing connection to a system on the Internet, Peakflow X would immediately flag the activity as suspicious. As a result, Peakflow X can detect not only zero-day threats, like worms, but also internal misuse."

This seems like one of the best ways to deal with inspecting huge traffic flows. Readers may know I am a huge fan of products which independently capture network flows without processing stored libpcap data. Argus is the best stand-alone app, while Cisco NetFlow is an option. Luca Deri of ntop fame shared news of his nProbe, a PC-based NetFlow collector, and nBox, a Cyclades-TS100 appliance-based NetFlow collector. Commercial ntop support is available.

Read More

Problems with CISSP Questions

The June 2003 Information Security Magazine offered some great reading too. It reminded me of a Gartner statistic saying between 60 to 70 percent of Windows Server users run NT 4. Writing about his experience taking the CISSP exam, Andrew Briney nails the problem with CISSP questions:

"There's a chunk of questions that are difficult for all the wrong reasons. They're poorly worded, misleading or simply evasive. Evasive: that's the word that first came to mind when I walked out of the exam. It just seems like these questions serve no purpose other than to confuse and frustrate you.

It's because of these questions that you won't have an intuitive sense if you passed the exam. And it's because of these questions that the CISSP exam often gets a bad rap. Even though these questions comprise a comparatively small part of the exam, they're the ones that stick in your craw as you walk out the door."

I learned while reading Thomas Ptacek's commentaries of this article blasting the CISSP. I maintain that the main redeeming aspect of the CISSP is its code of ethics, which moves digital security closer to being a true profession with a code of ethics that matters.

Read More

Security "Return on Investment"

The June 03 SC Magazine offered several excellent articles. Peter Stephenson discusses new forensic certifications, like the Certified Information Forensics Investigator (CIFI). (If you qualify by 31 Dec 03, you might be able to grandfather the cert without sitting for the test.) The same issue featured a case study called Tracking Down Cybercriminals. Unfortunately, SC Magazine quotes an Addamarkl survey saying "companies are unwilling to prosecute hackers, even when they have enough evidence for legal action. Information security departments said they preferred to fix the damage or use forensic evidence to achieve a settlement with the wrongdoer, rather than opt for legal proceedings." This is too bad, as an article by Mark Doll of E&Y discusses the effect of security incidents on share prices. In short, within three days of X, share prices dropped by Y:

• "significant security breach": 5.6%, or $15-$20 million on average


• "theft of credit card data": 15%


• "denial of service": 3.6%


• "theft of customer information": 1.2%

Finally, I say forget all this talk about security providing "return on investment." Page 15 of the Deloitte Touche Tohmatsu 2003 Global Security Survey shows 63% of executives see security as "a necessary cost of doing business." Only 13% say security is "an investment in enabling infrastructure."

Read More

Network Tools

I'm trying to find products which can intelligently analyze network traffic to supplement traditional intrusion detection products. I'd like to get a look a Silent Runner, which offers visualization and analysis tools. Lancope Stealthwatch calls itself a "behavior-based IDS" which analyzes flows to identify anomalies. Incidentally, if you're looking for a giant list of IDS and other security products, visit Talisker's Network Security Resource. SPADE, the Statistical Packet Anomaly Detection Engine for Snort, is available but I have yet to try it.

Read More

Network Computing on Foundstone

After last week's bad press at Fortune and Slashdot, some good press for Foundstone. Network Computing likes Foundstone's 2.6 scanner -- and hasn't seen 3.0 yet. This job request looks fake to me.

Read More

Guess and FTC Settlement

The SANS and Neohapsis Security Alert Consensus told me of the settlement between Guess and the FTC. From the article:

According to the FTC complaint, since at least October 2000, Guess' Web site has been vulnerable to commonly known attacks such as "Structured Query Language (SQL) injection attacks" and other web-based application attacks. Guess' online statements reassured consumers that their personal information would be secure and protected. The company's claims included "This site has security measures in place to protect the loss, misuse, and alteration of information under our control" and "All of your personal information, including your credit card information and sign-in password, are stored in an unreadable, encrypted format at all times." In fact, according to the FTC, the personal information was not stored in an unreadable, encrypted format at all times and Guess' security measures failed to protect against SQL and other commonly known attacks. In February 2002, a vistor to the Web site, using an SQL injection attack, was able to read in clear text credit card numbers stored in Guess' databases, according to the FTC.

Read More

Transforming the U.S. Air Force Enterprise Network

A captain I worked with in the AFCERT several years ago, Carl Grant, published Transforming the U.S. Air Force Enterprise Network in the latest IA Newsletter. Carl talks about the AFNOSC, which was also discussed in this testimony by the Air Force CIO John Gilligan.

Read More