Tag Archives: Managed Security Service

The Need for a Security Mindset

Keeping antivirus software protection current on all company-owned computing devices has become an essential business practice. That’s not a simple endeavor.

ThirdCertainty recently sat down with Andy Hayter, security evangelist at antivirus vendor G Data Software, to discuss the intricacies of managing antivirus solutions effectively, particularly in small and mid-sized companies. (Answers edited for clarity and length.)

3C: With hackers updating their virus signatures almost minute-to-minute, why do companies still need antivirus protection?

Hayter: One of the myths out there today is that antivirus is dead. But the good news is that antivirus software today isn’t just signature-based. It includes heuristic technology that looks at the characteristics of a piece of software executing on your computer.

So in many cases, even though a particular piece of malware may not necessarily have been identified through a signature, it can easily be identified through the heuristics.

Security & Privacy Weekly News Roundup: Stay informed of key patterns and trends

3C: As a business owner or manager, if I’m implementing my antivirus solution on my own, what should I know?

andy hayter
Andy Hayter, G Data Software security evangelist

Hayter: Having a management interface is important, so that you can manage all devices and deploy the antivirus software out to all your devices and keep it maintained and updated. Your vendor should offer training to your key personnel.

It’s important for them to understand how to manage threats, and understand what’s going on in your network environment from a malicious software perspective.

3C: Is relying on my IT department to take charge of security wise?

Hayter: Most small and mid-sized companies are going to look at the IT department to do this. They are not large enough to have a separate security function. The CEO and CFO still must fully understand the impact malware can have.

3C: What about outsourcing security?

Hayter: Many smaller companies don’t have the time or resources to get someone up to speed and trained, or even multiple people trained, because this is a 24-hour type of situation. So more companies are looking at managed security Service (MSS) providers to take this on for them. This entails a solution that a third party manages remotely through a remote management console.

So it depends on whether the business has the time and the money to train people or wants to outsource this to a professional whose business is security. Either way, you still need to train your IT staff so they know the fundamentals of security and can protect the business in an emergency.

3C: So I can’t just outsource and wash my hands of security?

Hayter: No. You cannot wash your hands of security. Your managed security service provider is there for you, but you still have to understand the basics. You still have to perform the training. And you still are the person on site to talk to your employees about situations that might occur at 8:30 in the morning when they log on their PC and get a strange e-mail.

3C: Establishing a security mind-set for my company is a day-to-day thing?

Hayter: Right. If you do outsource your security, you cannot just forget about it and pray that it’s done completely. You still need to train your employees and help them understand that bad things can happen to them.

New Way to Audit Digital Assets

In the real world, it would be considered reasonable and appropriate to require an independent audit of digital assets to be insured. In cyberspace, this is more challenging. Insurers have to rely on the insured to tell the truth about what assets have been affected by a breach.

Integrity standards for data enable insurance companies to conduct an independent audit of what digital assets exist (e.g., client data, intellectual property) prior to a breach, thus preventing fraudulent claims.

One aspect of a data integrity standard is keyless signature infrastructure, known as KSI. KSI is a disruptive new technology standard that can effectively address some of the issues insurers face in the rapidly emerging cyber liability domain. It can enable mutual auditability of information systems to allow stakeholders to know the cause of a breach, mitigate the risk of breach escalation in real time and provide indemnification against subrogation and other legal claims.

The concept of a digital signature for electronic data is very straightforward: a cryptographic algorithm is run on the data, generating a “fingerprint of the data”; a tag or keyless signature for the data that can then be used at a later date to make certain assertions, such as signing time, signing entity (identity) and data integrity. KSI offers the first Internet-scale digital signature system for electronic data using only hash-function-based cryptography. The main innovations are:

  1. Adding the distributed delivery infrastructure designed for scale
  2. No longer requiring cryptographic keys for signature verification
  3. Being able to independently verify the properties of any data signed by the technology without trusting the service provider or enterprise that implements the technology

Other features include:

  • Unlike digital certificates, keyless signatures never expire; the historical provenance of the signed data is preserved for the lifetime of the data, and people are not required in the signing process.
  • Use of keyless signatures strengthens legal non-repudiation for data at rest.
  • There are no keys to be compromised or to revoke. This fundamentally changes the security paradigm. It is important to understand that if data integrity relies on secrets like keys or trusted personnel, when these trust anchors are exploited there becomes an unlimited liability for the data protected by those trust anchors. This occurs because there is no way to determine what has happened to the data signed by those private keys or maintained by those trusted personnel. Evidence can be eliminated; data changes can occur without oversight; and log/event files can be altered. The exploiters can provide the picture they want you to see. Keyless signatures remedy this problem.
  •  During a breach, active integrity can be provided with cyber alarms and correlated to other network events by auditors, network operations center and security operations center(s). Active Integrity means real-time, continuous monitoring and verification of data signed with keyless signatures. With active integrity, real-time understanding is achieved as to the coherence and reliability of technical security controls and whether the digital asset has integrity.
  • Underwriting cyber policies becomes much simpler and more efficient because there is transparent evidence certifying the integrity of the data, the technical security controls protecting the information and rules governing the transmission, modification, or state of the insured asset(s).

A “managed security service” resulting from the implementation of KSI marks a new era for insurers. As they seek organizational intelligence of digital assets to make real-time policy adjustments, they are also making concrete conclusions about the insured asset risks, threat, exposure and cyber landscapes affecting clients. Claims processing and disputes become simpler as the technology preserves the forensic traceability and historical provenance of the digital asset, enabling rapid determination of when and how a breach or manipulation occurred and who or what was involved. Hackers and malicious insiders cannot cover their tracks. Moreover, proving negligence is now possible. Negligent acts may be quickly detected and proven in the event the service provider does not comply with the contracts maintained in force with the enterprise.  

Most breaches today go unnoticed until long after they occur and the damage has been done. Active integrity involves continuous verification of the integrity of data in storage using keyless signatures. It is equivalent to having an alarm on your physical property and a motion detector on every asset that cannot be disabled by insiders.

Because of the volatile nature of electronic data, any hacker knows how to delete or manipulate logs to cover his tracks and attribute his activity to an innocent party, which is why attribution of crimes on the internet is so difficult. Integrity is the gaping security hole. A loss of integrity is what leads to data breaches, introduced by malware, viruses or malicious insiders.

Public key infrastructure (PKI) will never be the solution to integrity or usable for large-scale authentication of data at rest. The forensic evidence of keyless signatures makes legal indemnification issues easy to resolve, highlighting who, what, where and when a digital asset was touched, modified, created or transmitted. This places the onus on the “use” of data and not collection, providing auditability across service providers and the internet. Privacy is maintained, but there is also transparency and accountability for how data is used. Every action can be traced back to the original source that is legally responsible. This simplifies service-level agreements, pinpoints liability in the event of accidental or malicious compromise, and indemnifies independent data providers from legal claims.

This article is an excerpt from an EY report titled “Cyber Insurance, Security and Data Integrity; Part 1: Insights into cyber security and risk — 2014.” For the full report, click here