You Cannot Manage, What you Cannot Measure:
Security Risk Metrics
State of CA CISO Lecture Series
Stuart McClure
VP Operations/Strategy
Risk and Compliance Business Unit
McAfee, Inc.
Introductions
Curriculum Vitae
How to motivate change
Carrot? Stick? Both?
1. Attack (worm, malware, privacy breach)
2. Compliance Deadlines (FISMA, IAVA, PCI)
3. Live Demonstrations (approved on your own
systems, databases, accounts of course!)
4. Security Metrics (Quantify and track your risk
over time. Predict your next attack/breach)
In the end Its all about relationships,
building trust and credibility
Agenda
Security Drivers
Security Metrics
Real World Examples
Security Drivers
October 1, 2009
What drives us?
Threats: Opportunity Meets Motivation Meets Ability
Targeted
attacks
Bots, Botnets
DDOS networks
PDA,
cell phone,
wireless
Spam, mass-mailers,
phishing, pharming
MALICIOUS
INTENT
MISUSED
FUNCTIONALITY
DESIGN
FLAWS
Spyware,
Adware, PUPs
POOR COMMON
SENSE
User-propagated
viruses, Trojans,
PW stealers
Social
Engineering
Vulnerabilities,
Exploits,
Scripted attacks
Misused Functionality In the Real World
April 19, 1995
168 souls
Commonly used materials
costing $5,000
Misused Functionality In the Security World
Famous examples:
Mass mailing functions
Melissa virus (1999)
ILOVEYOU (2000)
ActiveX functions
Zlob Trojan (2005)
Icon modification functions
IEs Browser Helper Objects
(BHO)
PWS.Cashgrabber (2005)
PWS.Banker (2008)
File sharing
Conficker.B (2009)
OSX/Leap (2006)
Autorun/Autoplay functions
W32/Virut (2003)
W32/Sality (2006)
Autorun.worm.gen (2008)
Mitre recently added new
category Common
Configuration
Enumeration (CCE)
October 1, 2009
Misused Functionality In the Security World
Autorun: The Floppy Disk of the New Millennium
Design Flaws In the Real World
Feb. 24, 1989
9 souls
Faulty cargo door design
Went unfixed for years
10
Design Flaws In the Security World
Famous examples:
MS01-033 (Code Red) 2001 (1 mo)
MS02-039 (SQL Slammer) 2003 (6 mos)
MS08-067 (Conficker) 2008 (2 weeks)
SANS reports 60% of attacks today are web
based
CVE rate = 18/day, 3700 average/yr
Over 39,000 vulns in NVD. Over 40,000 in CVE:
Malicious Intent
War Games movie (1983) [Matthew Broderick]
Morris Worm* (1988) [Robert Morris]
Moonlight Maze (1998-99)
Good Times virus (1994)
First Word Macro viruses (1995)
Solar Sunrise (1998) [Ehud Tenenbaum]
Melissa virus (1999) [David L. Smith]
US Military attack (2000) [Gary McKinnon]
ILOVEYOU virus [Reomel Lamores], DDOS attacks (2000)
Klez*, Sadmind, Code Red, Nimda worms (2001)
Slapper, Spida*, Bugbear, Opaserv* worms (2002)
Root server DoS (2002)
Blaster [Jeffrey Parson], SQL Slammer worms (2003), Titan
Rain (2003-2005)
MyDoom, Witty, Sasser/Netsky, Korgo worms (2004) [Sven
Jaschan]
Rbot/Sdbot/Zotob (2005) [Farid Essebar aka Diabl0 and
Atilla Ekici aka Coder]
Storm Worm (2007)
TJX/Heartland/Hannaford, etc. (2009) [Albert Gonzalez]
Making it Real Recent News
Three hackers indicted in NJ on 8/17/09
1 co-conspirator not indicted
Allegedly responsible for:
T.J. Maxx (94M), Heartland (130M), Hannaford Bros. (4.2M), 7-Eleven, Barnes &
Noble, BJs Wholesale Club, Boston Market, DSW (1.5M), Forever 21 (99k), Office
Max (200k), Sports Authority
Attacked from systems/zombies from:
US (NJ/CA/IL), Netherlands, Ukraine, Latvia
Techniques used:
SQL Injection attacks
Installed malware (including AV bypassing)
References:
http://www.washingtonpost.com/wpdyn/content/article/2009/08/17/AR2009081701915.html
http://voices.washingtonpost.com/securityfix/heartlandIndictment.pdf
Cyber Crime Ecosystem (The Bad Guys)
Malicious Intent: The result - Malware YTD
200,000 unique malware per month
6,000 per day
More than double last
years midyear metric
Security Metrics
16
October 1, 2009
Risk and Compliance
The Dilemma
Increasing Risk
Threats
Vulnerabilities
Change
Regulations
Decreasing Protection
Insufficient budget
Limited people resources
Result: Controlled Chaos
Lost data / Privacy breaches
Audit/Remediate/Repeat
Decreased system availability
Reactive fire-fighting
Poor system performance
Delays in strategic projects
Configuration creep
Lost business
Risk and Compliance
The Goal
1. Reduce time and cost associated with patching and audits
2. Manage more effectively against policies
3. Report-on-demand for internal or external audits
4. Increase security of my data, applications, and network
5. Enhance system availability and application performance
Get in Control, Stay in Control
Risk and Compliance
Assess
Completely
Remediate
Easily
Enforce
Automatically
Get in Control
Optimize
Security
Stay in Control
Audit Once, Report Many
Increased security and compliance
Enhanced availability and system performance
Reduced time & cost of audits, patching, upgrades
Report
Intelligently
Compliance Security
Lessons learned
RBS WorldPay Breached
Hannaford Bros. Breached
Affected: 1.5CCN / 1.1M SSN
Lawsuit: 2/18/09
Source: Hacked
Note: $9M in fraud
Affected: 4.2M CCN w/exp dates
CardSystems Solutions Inc. Lawsuit: March/April 2008
Source: Hacked, installed malware
Affected: 40M CCN
Note: July 08 CIO resigns
Lawsuit: Multiple
PCI: Event occurred before PCI
Source: Hacked
2005
2006
Heartland Payment Systems Breached
Affected: Unknown (est. 5-100M)
Lawsuit: Jan 28. 09 (NJ) Class Action
Source: Hacked, installed sniffer malware
2008
2009
Heartland
PCI Compliant
By Trustwave
CardSystems
Solutions goes
Bankrupt
Hannaford Bros.
PCI Compliant
By Rapid7
RBS WorldPay
PCI Compliant
By Trustwave
Datalossdb.org
Managing Security Risk
Where do we start?
Security Risk Management Lifecycle
Desired State of IT Audit Maturity Optimized
The relationship to cost and security and compliance diverge during
progression to the managed and optimized states.
Compliant
Proactive
Optimized
Value
Secure
Additive cost
Organizational Maturity
Maturity of process reduces audits from months to days and enables
sustainable compliance
Cost savings occur through reduction of point products and increased
automation
22
Key Customer Challenges
Audit Fatigue requires Automation
Majority of IT Audit Controls are Manual
57% of large organizations have automated
less then 25% of their controls
Collecting
accurate, timely
data is a
protracted effort.
Difficult to ensure
integrity of data.
McAfee- commissioned IT Audit Study: Based on
400 IT audit-related professionals in North America
and Europe (ISSA and ISACA). Conducted by the
Internet Research Group
Key Customer Challenges
Patch Panic creates delays in mitigation
Anxiety inhibits action
Symptom
No definitive answer to: Does the new threat
released today apply to us?
Statistics
Microsoft released 78 Security Bulletin items in 2008,
with many out-of-cycle
5443 vulnerabilities added to NVD database in 2008
Consequences
Distracts from day-to-day operational workload
Decreases performance and availability of IT assets
Exposes a lack of IT leadership and planning
Managing Security Risk
How do companies manage it?
Risk Transfer
Contractual transfer to 3rd party or insurance
provider.
Risk Avoidance
The power button technique of risk management.
Risk Acceptance
Cannot eliminate all risk, at some point someone/somewhere must accept
what remains.
Risk Mitigation
Find and apply security countermeasures (people/process/technology)
Security Metrics
Qualitative
Traditional IT audits (EY/PWC/DT)
SAS70/BS7799/ISO17799/ISO27001/ISO27002
Question/answers
Checklist jockeys/bunnies
Quantitative
Independently verifiable
Objective
Repeatable
Automatable with technology
26
October 1, 2009
1
Are you spending your
security dollars the right
way?
2
What kind of return are
you getting for your
security dollars?
FIRST.org (CVSS)
Common Vulnerability Scoring System (0-10)
CVSSv2 (2007)
www.first.org/cvss
Scoring Components (3 major):
Base Metrics
Exploitability Metrics
Exploitability
Access Vector
Remediation Level
Access Complexity
Report Confidence
Authentication
Impact Metrics
29
Temporal Metrics
Environmental Metrics
Confidentiality Impact
Collateral Damage
Potential
Integrity Impact
Target Distribution
Availability Impact
Security Requirements
October 1, 2009
FIRST.org (CVSS)
NVD CVSS
online
calculator
30
October 1, 2009
Center for Internet Security (CIS) Metrics
Consensus Metric Definitions v1.0.0 (May 2009)
www.cisecurity.org
20 metric definitions involving:
Incident Management
Vulnerability Management
Patch Management
Application Security
Configuration Management
Financial Metrics
First realistic security metrics program
More complex but more complete
31
October 1, 2009
Quantitative Metrics
Foster Trust and Credibility
Measure the Major 3:
1. Risk Rating (1-100)
Attack surface
Misused functionality
Design flaws
WoE
User awareness
2. Incident costs ($$)
Incident expense, loss time quantification, fines/lawsuits
associated, notification costs
3. Security expense/spending ($$)
Operating expenses, Capital expenses
.. Notification costs per data
record are now $202
Quantitative Metrics - Risk Rating
Attack Surface:
How many of you know exactly what assets
you have and where you have them?
Q: How do you measure attack surface?
A: Find and track over time the number of devices on your
network:
IPv4/IPv6: ICMP, TCP, UDP discover
IPX/SNA/APPC/AppleTalk
Query all asset databases, CMDBs, in realtime and on-demand
Quantitative Metrics - Risk Rating
Misused Functionality
What configuration settings are present in your environment
that contribute to exploitation and malware?
Q: How do we measure the number of functions present that can
be misused?
A: Scan and track over time all your systems
for the top 10 configuration weaknesses:
- Autorun enabled
- File sharing enabled
- Execution permissions on IE Temporary Folders
- Etc
Quantitative Metrics - Risk Rating
Design Flaws
What vulnerabilities are present in your environment that
contribute to exploitation and malware?
Q: How do we measure the number of vulnerabilities present that
can be misused?
A: Scan all your systems for at least the following:
- Microsoft Security Bulletins
- SANS Top 20 or similar
- OWASP Top 10 and/or CWE 25 (Web)
Quantitative Metrics - Risk Rating
Window of Exposure (WoE)
How quickly does IT fix the problems that security finds?
Q: How do we measure your IT staffs ability to patch and
remediate the misused functionality and design flaws found?
A: Measure it with technology:
- Vulnerability Management program
- Patch Management program
- Configuration Management program
- Find the mis-configurations and vulnerabilities and measure how
quickly they are remediated.
Quantitative Metrics Risk Rating
User Awareness
How educated are your users on general
security hygiene?
Q: How do we measure your users preventative
awareness?
A: Ask them (questionnaire - ideally at login):
- Pick 5 to 10 questions about general user decision making
skills:
1.
If you receive an attachment or a web link from someone
you dont know, do you open it?
2.
If you are given a USB key, do you plug it into your
computer without scanning it?
3.
Do you go to websites you do not know are safe?
4.
Etc
Quantitative Metrics - Overall
38
October 1, 2009
Design Flaws Return on Investment
SDLC
Microsofts Software Development Lifecycle (SDL)
Reduce the number of vulnerabilities
Reduce the overall development costs
NIST, May 2002 eliminating vulnerabilities in design can cost 30x less
than fixing them after release.
Microsoft ROI whitepaper: http://go.microsoft.com/?linkid=9684360
Behavioral Analysis
Applied to Security
Motivation + Opportunity + Ability = Potential
Motivation
- Value of data available
Opportunity
- Laxed or non-existent
laws
- # of interconnected
devices
- Ease or difficulty
catching
- # of vulnerabilities
- # of functions available to misuse
- Sophistication of users/admins
- # of tools available
- # of domain registrations Ability
- # of websites accessible - Knowledge level of the bad guys
- Criminal mentality
- Information publicly available
Conclusion
Threats and events continue to increase
Stay abreast with current world events
Understand the current economic climate
Understand your organizations needs
Measure EVERYTHING!
Thank you!
[email protected]
949-297-5585
