I attended the session first thing in the morning on Mal-ware with Michael Thumann of ERNW GmbH. He gave quite a bit of technical detail on how to methodically go through the detection and investigation process highlighting specific tools and tricks. His slides are available online and provide sufficient detail to be understood out of the presentation context. Definitely recommend downloading them! A few nuggets I took away:
Malware best practices:
- When you have been targeted by an unknown (to anti-virus) malware attack and specifically if it is against key persons within the organization the code should be preserved and reverse engineered by a professional to uncover what details were employed and including in the application to understand the risk landscape.
- Most malware (windows) is designed to NOT run on virtualized VMWARE systems. The reason is these systems are used primarily in the anti-malware reverse engineering environment. So – 2 points: First virtualized client workstations sounds like a reasonable defense for some organizations, and second be sure to follow de-Vmware identification efforts when building such labs (check using tools such as ScoobyNG).
Virtualization panel moderated by Becky Bace with Hemma Prafullchandra, Lynn Terwoerds, and John Howie;
The panel was fantastic – best of the entire conference and should have been given another hour or a keynote slot. Becky gave great intelligence around the challenges and framed the panel perfectly. There was an immense amount of content covered, and below are my quick notes (my apologies for broken flows in the notes):
Gartner says by 2009: 4M virtual machines
- 2011: 660M
- 2012: 50% of all x86 server workload will be running VMs
- 93% of organizations are deploying server virtualization
- 78% have virtualization deployed
Morgan Stanley CIO Survey stated that server virtualization management and admin functions for 2009 include: Disaster recovery, High availability, backup, capacity planning, provisioning, live migration, and lifecycle management (greatest to smallest)
Currently advisories vs vulnerabilities are still showing patches leading before actual vulnerabilities being introduced… i.,e, the virtualization companies are fixing things before they become vulnerabilities by a fair degree.
Questions to consider?
- How does virtualization change/impact my security strategy & programs?
- Are the mappings (policy, practice, guidance, controls, process) more complex? How can we deal with it?
- Where are the shortfalls, landmines, and career altering opportunities?
- What are the unique challenges of compliance in the virtualized infrastructure?
- How are the varying compliance frameworks (FISMA, SAS 70, PCI, HIPAA, SOX, etc) affected by virtualization?
- How do you demonstrate compliance? e.g., patching or showing isolation at the machine, storage, and network level
- How do you deal with scale rate of change? (Asset/patch/Update) mgmt tools?
- What’s different or the same with operational security?
- Traditionally separation was king – separation of duties, network zones, dedicated hardware & storage per purpose and such – now what?
- VMs are “data” – they can be moved, copied, forgotten, lost and yet when active they are the machines housing the applications and perhaps even the app data – do you now have to apply all your data security controls too? What about VMs at rest?
- Due to the rapidity of creation and deletion it is necessary to put in procedures and process that SLOWS down activities to include review and careful adherence to policies. The ability to accidentally wipe out a critical machine or to trash a template are quick and final. Backups do not exist in shared system / storage environment.
- Better access control on WHO can make a virtual machine; notification of creation to a control group; people forget that their are licensing implications (risk 1); it is so cheap to create vm; people are likely to launch vm to fill the existing capacity of a system; storage management must be managed; VMs are just bits and can fill space rapidly; VMs can be forgotten and must be reviewed; Audit VMs on disk and determine use and implementation; VMs allow “Self-Service IT” where business units can reboot and operate systems; Businesses will never delete a virtual machine; Policy that retires VMs after X period and then archives, and then deletes after Y perood; Create policy akin to user access policies.
- In the virtualization world you have consolidation of 10 physical servers on 1 server .. when you give cloud-guru access you give them access to all systems and data and applications.
People that come from highly regulated industries require you to put your toe in where you can … starting with redundant systems to give flexibility… the lesson learned is managing at a new level of complexity and bringing forward issues that existed within the organization and become more emphasized.
We need some way to manage that complexity. while there are cost pressures and variables driving us towards virtualization we need ways to manage these issues.
Must show that virtualization will offset the cost in compliance and lower or hold the cost bar – otherwise impossible to get approval to deploy technology.
The complexity you are trying to manage is the the risk and audit folks. This means internal and external bodies
- Utility computing will exacserbate the problems of instantiating an amazon instance is preferred over using internal resources. Challenge is getting users to not go and setup an Amazon server is at the forefront – saying no and penalties are not the right pathway…must find positive pro-business rewards to bringing such advantages internal.
- Finance is saying “take the cheapest route to get this done” … Capex to OpEx is easier to manage financially.
- Is there a tool / appliance that allows you to do full lifecycle machines? Is there a way to track usage statistics of specific virtual machines? -> answer yes, available in the systems.
GREATEST concern of panel: The shadow IT systems are not tracked or do not have the life cycle. The deployment of systems on amazon are a black hole – especially due to the fact or use of credit cards…. Is the fix simply as having company setup an account to allow employees to use?
Classic Apply slide: (download the slides!)
- Do not IGNORE virtualization – it is happening:
- Review programs and strategies as they affect virtualization / cloud
- Existing security & compliance tools and techs will not work….
The other session I enjoyed on the conference was the Show Me the Money: Fraud Management Solutions session with Stuart Okin of Comsec Consulting and Ian Henderson of Advanced Forensics:
- Always conduct forensic analysis
- Fraudsters historically hide money for later use post-jail time.
- Consider IT forensics and be aware of disk encryption – especially if it was an IT administrator and the system is part of the corporation. Basically – be sure of the technology in place and carefully work forward.
- Syncronize time clocks – including the CCTV and data systems
- Be aware of the need for quality logs and court submitable evidence
- There are many tools that can support the activities of a fraud investigation and daily operations, but the necessity is complete and sufficient logs. Meaning that the logs have to be captured and they have come from all the devices that matter. Scope is key to ensuring full visibility.
- Make someone is responsible for internal fraud
- Management must instate a whistle-blowing policy w/hotline
- Be attentive to changes in behavior
- Obligatory vacation time
- Ensure job rotation
- Audit employee access activation and logging
- maintain and enforce strict duty
- Pilot deterrent technologies (EFM) <– as the use of these will highlight problems in regular operations and help lift the kimono momentarily allowing aggressive improvements.
Overall a great conference. Much smaller than the San Francisco Conference, but the result is better conversations; deeper examination of topics, and superior networking with peers.
Till next year,
James DeLuccia IV