Whitelisting: there is more to it than just blocking or allowing applications

Details

Category: Cyber Security (Personal)

Technical control wise it is one of the strongest yet it is often not used or people simply use it for controlling applications (software). Many people argue against it since it is expensive, fiddly to install and maintain. Defence wise it can stop unknown malware from executing and installing or stop users installing unlicensed software thus saving disputes. Whitelisting can be applied to almost anything which we will explore later.

What is wrong with blacklisting you may ask? It effectively permits 99% of the World Wide Web (or software) and a blacklist tries to block the 1%. The 1% will change by the second and no service or product can ever keep on top of it. Antimalware companies run hours or days behind. Spear phishing websites may only exist for minutes or hours. Take a white-collar criminal for instance, you cannot profile one as the following: 42 years old, navy stripped jacket, reddish tie, cufflinks, gold watch & jewellery, illicit white powder on the table and surrounded by woman. If you have not worked it out yet, this is DiCaprio in Wolf of Wall Street. Trying to block the 1% does not simply work and products cannot profile as profiling does now work.

Read more …

The security triangle: simplicity and user intuitiveness can equal reduced security

Details

Category: Cyber Security (Personal)

A few days ago a friend who has recently moved into the information security department at the corporate where he works emailed saying he is playing around with “next-generation” endpoint antimalware detection, removal and blocking endpoint software. He named a few names, most well known and all claim to use “machine learning” to do their job. Go to Info Security Europe in Olympia and every year there is a “craze”. This year was machine learning with about every stall claiming to offer a tool to find and block advanced malware. Everyone seems to be jumping on the same bandwagon and you have to wonder how many “next generation” or “machine learning” products actually work. I have personally tried some “cutting edge” products and in beta phase even a basic macro virus was let through. With another claiming to block hidden downloads which did not work.

Remember the security triangle you studied for a certification? Security, usability and cost. As security increases cost goes up and user friendlessness goes down. The products a friend mentioned work on looking for patterns not just simple killing or blocking everything not on the list (whitelisting). Take a house for instance, you have by default a front door operated by a key. Add an alarm, it costs you money and makes it a bit harder to get in your house. Increased security with small downsides. Add a second lock and forgot the key, and you cannot get in. Add an outer fence with a swipe card, the layers add great security but cost you dearly and slow you down. Keep everything in your house which is valuable in a under floor safe and each time you want to get a item it takes 2-3 minutes which means you leave the house slower. Get the idea?

Read more …

Me quoted in the SC Magazine: The information security implications of M&A deals

Details

Category: Blog

https://www.scmagazineuk.com/the-information-security-implications-of-ma-deals/article/576067/