How advanced attacks succeed, despite $20B spent annually on enterprise IT security

The FireEye Advanced Threat Report focuses on the threats that have successfully evaded traditional defenses.  As the findings below show, to close the gap in their networks, enterprise security leaders must assume that their networks are compromised, familiarize themselves with the nature and intent of modern attacks, and supplement the traditional defenses they currently use with tools designed for today’s sophisticated attacks.

  • 90% of malware and domains change in just a few hours; 94% within a day.
  • Fastest growing malware categories are Fake-AV and Info-stealer executables.

Read the complete report here:FireEye Advanced Threat Report – 1H 2011


Value of Corporate Secrets

This is a great read: Value of Corporate Secrets

Chief information security officers (CISOs) face increasing demands from their business units, regulators, and business partners to safeguard their information assets. Security programs protect two types of data: secrets that confer long-term competitive advantage and custodial data assets that they are compelled to protect. Secrets include
product plans, earnings forecasts, and trade secrets; custodial data includes customer, medical, and payment card information that becomes “toxic” when spilled or stolen.

We found that enterprises are overly focused on compliance and not focused enough on protecting their secrets.  We confirmed that, indeed, increased collaboration increases data security’s importance, and that compliance pressures continue to be the motor that turns the IT security budget wheel. We also confirmed the conventional wisdom that,
75% of the time, data security incidents are attributed to insiders.
However, we also reached some surprising conclusions. Forrester concluded that not all enterprises are created equally.  High-value firms manage information that is 20 times more valuable than low-value firms. And they are much more eager collaborators. As a result, the number and type of data security incidents experienced by high-value firms were four times higher, and the costs are nearly twice as high.

Key findings include:

• Secrets comprise two-thirds of the value of firms’ information portfolios.
• Compliance, not security, drives security budgets.
• Firms focus on preventing accidents, but theft is where the money is.
• The more valuable a firm’s information, the more incidents it will have.
• CISOs do not know how effective their security controls actually are.

Key recommendations include:

• Identify the most valuable information assets in your portfolio.
• Create a “risk register” of data security risks.
• Assess your program’s balance between compliance and protecting secrets.

• Reprioritize enterprise security investments.
• Increase vigilance of external and third-party business relationships.
• Measure effectiveness of your data security program.

Microsoft: Sex, Lies……and cybercrime?

Microsoft also recently released an eye catching paper aptly named that discusses the validity of security reports.  Far from being broadly-based estimates of losses across the population, the cyber-crime estimates that we have appear to be largely the answers of a handful of people extrapolated to the whole population.

Sex, Lies and Cybercrime Surveys

Latest Microsoft Security Report

Microsoft’s Security Intelligent Report (SIR) v10 has been released and can be found here.

The key highlights from Microsoft’s own Roger Halbheer:

  • Industry vulnerability disclosure trends continue an overall trend of moderate declines since 2006. This trend is likely because of better development practices and quality control throughout the industry,which result in more secure software and fewer vulnerabilities.
  • Vulnerability disclosures for Microsoft products increased slightly in 2010 but have generally remained stable over the past several periods.


  • The exploitation of Java vulnerabilities sharply increased in the second quarter of 2010 and surpassed every other exploitation category that the MMPC tracks,including generic HTML/scripting exploits,operating system exploits,and document exploits.
  • The number of Adobe Acrobat and Adobe Reader exploits dropped by more than half after the first quarter,and remained near this reduced level throughout the remainder of the year.


  • Exploits that affected Adobe Acrobat and Adobe Reader accounted for most document format exploits detected throughout 2010. Almost all of these exploits involved the generic exploit family Win32/Pdfjsc


  • Microsoft Office file format exploits accounted for between 0.5 and 2.8 percent of the document format exploits that were detected each quarter in 2010.


  • As in previous periods,infection rates for more recently released Microsoft operating systems and service packs are consistently lower than older ones,for both client and server platforms. Windows 7 and Windows Server 2008 R2,the most recently released Windows client and server versions,respectively,have the lowest infection rates.
  • Infection rates for the 64-bit versions of Windows Vista® and Windows 7 are lower than for the corresponding 32-bit versions of those operating systems. One reason may be that 64-bit versions of Windows still appeal to a more technically savvy audience than their 32-bit counterparts,despite increasing sales of 64-bit Windows versions among the general computing population. Kernel Patch Protection (KPP),a feature of 64-bit versions of Windows that protects the kernel from unauthorized modification,may also contribute to the difference by preventing certain types of malware from operating.


  • In the first half of 2010,phishers showed signs of targeting online gaming sites with increasing frequency,although this push appeared to have dwindled as social networks came under increased attack. Impressions that targeted gaming sites reached a high of 16.7 percent of all impressions in June before dropping to a more typical 2.1 percent in December.
  • Phishing sites that target social networks routinely receive the highest number of impressions per active phishing site. The percentage of active phishing sites that targeted social networks increased during the final months of the year,but still only accounted for 4.2 percent of active sites in December,despite receiving 84.5 percent of impressions that month. Nevertheless,the number of active sites targeting gaming sites remained relatively high during the second half of the year,which suggests that more campaigns may be coming.


True Cost/Benefit Analysis of Online Privacy

I came across an interesting article regarding online privacy.  It presents surprising research arguing the advantages of online advertising may actually outweigh the costs including identity theft.

Do you think privacy advocates arguments are flawed?  Find out for yourself…. Applications Want to be Free: Privacy Against Information

HTCIA’s 2010 Report on Cyber Crime Investigation

The High Tech Crime Investigation Association (HTCIA) has released their 2010 Report on Cyber Crime Investigation.  Nothing earth shattering here.  Security professionals report:

  • Increase in criminal use of digital technology
  • Lack of dedicated personnel
  • Need for better training at multiple levels
  • Need for improvements in information sharing and collaboration
  • Need for better reporting, strategy and policy