Having security technologies in place, without proper knowledge of how to operate them, is akin to filling an operating room with surgical tools, then bringing in a janitor to perform the roles of a doctor on a waiting patient. This may sound extreme to some, but it is an accurate statement. Technology can only do so much. While a scalpel may be used to remove a tumor, not everyone is qualified to use a scalpel.

There were many instances of breaches that could have been avoided had they been properly addressed. The technology never failed, the design didn’t fail, nor did the deployment. It boiled down to issues of training, having qualified individuals “manning the battle stations.” This is a common theme within many instances of data breaches, not having the proper people in place, or properly training those tasked with certain tools.

Asleep at the wheel

I have stated this before “anyone can go to SEARS and buy every single mechanic tool on display, but it will not make that individual a mechanic.” In the security arena, there is more involved than just containing incidences. Often, we have seen that companies (when infected with malware, or viruses) clean up the mess without taking the time to determine how the mess got there, if they are safe from more malicious activities post remediation, and how they could avoid similar mishaps in the future.

Case in point? The Target breach. “Target Corp’s security software detected potentially malicious activity during last year’s massive data breach, but its staff decided not to take immediate action” [1] How much did this little mishap cost Target? Depends on which view you choose to look at. As of right now, their stock since the fiasco is down 18.26% since the incident. An estimated $200 million USD to replace stolen cards. This does not include the damage to Target’s reputation, lost clients, potential lawsuits lurking, and so forth. How much would it have cost to properly train their employees? Unsure, but I doubt it is even ten percent of the $200 million.

Target is not the only instance of this occurring. Here are some snippets from the Government Accountability Office [2] which illustrate the same hiccups, with regards to incident response, the technologies, and the ball being dropped:

In a malware incident, sensors on an agency’s network recorded an agency computer contacting an external domain known to host malicious files, and downloading a suspicious file. Incident handlers closed the ticket without recording any actions taken to contain or otherwise remediate the potential malware infection. [2]

Anyone operating any security event information management (SIEM) system can tell you that these devices generate an awful lot of alerts, and events. Imagine purchasing a system that is to “be on the lookout for” cars. A red car drives by, you get an alert. A blue car? Alert. Thousands of cars later, you begin to ignore the alerts. It is only when a catastrophe occurs that in hindsight, you state: “Darn I should have paid attention.” With SIEM devices, most if not all, have mechanisms to alert on specifics: “Show me ONLY the BLUE cars where anyone inside of the car is wearing a mask.” Properly tuning the technology is not that difficult, but determining what should be flagged, can become tricky.

In a malware incident, incident handlers noted that they had requested the creation of network blocks to isolate the infected computer and the collection of its hard drive for analysis, but the ticket had not been updated to indicate whether the incident handlers had performed the requested actions or any subsequent actions. [2]

Another common hurdle is collaboration. In the event mentioned above, we have seen this occur quite frequently. I will now share a real world incident with a client. A client from the health care industry, took “change management” to the extreme. While having proper policies, and guidelines in place, the client was stepping on its own toes because of their policies. Whenever something needed immediate fixing, their triage was as follows: “Submit a request for change/modification. The form will need to be signed by four people. Meeting needs to be set up with four people. This takes a week. Once approval is given, the task can only be done during non business critical hours (this is usually a Saturday, or Sunday circa the 1AM mark).” Compromise? Well that will have to wait until we determine who’s on first, and what’s on second. All the while any malicious attacker is not governed by any rules or regulations

Imagine having to contain an incident under these conditions. While policies and guidelines are amust, businesses, and security managers must also realize that attackers follow no guidelines, care little about policies, won’t think twice about using MALICIOUS tools against a network, let alone trusted security tools. Yet professionals tasked with security responsibilities, are acting a bit irresponsible in their own right. Security is more than just technology, it is more than a guideline, baseline, standard, framework. It is a process that changes rapidly. Awareness, and education complement any security application, any program, and is the bridge between keeping your infrastructure safe.

– Posted by Blue

[1] http://www.reuters.com/article/2014/03/13/us-target-breach-idUSBREA2C14F20140313
[2] http://www.gao.gov/assets/670/662901.pdf