Enterprises Should Bring Some Security Research In-House

Rapid7 researcher pleads case for enterprises to dedicate resources to analyze in-the-wild malware data to prioritize vulnerability mitigation

When it comes to prioritizing vulnerabilities, some security experts believe organizations put too much emphasis on the technical impact rankings from security research community rather than focusing mitigation efforts based on which attacks are already actively targeting businesses similar to theirs. Next week, a security researcher with Rapid7 will present a talk at the UNITED Security Summit that will explain how organizations should stop relying wholly on security companies for research into malware and build a malware analysis function in-house that can take general crimeware statistics and tailor it to the business specific risk priorities.
[Using SQL injection to attack PDFs. See
Serving Up Malicious PDFs Through SQL Injection
.]
People still tend to prioritize the way that they react against vulnerabilities based on the old-fashioned rankings of technical impacts of a specific vulnerability, instead of realizing which vulnerabilities are actually being used in the wild and which are relevant to them because it goes after a specific asset or element of their company, says Claudio Guarnieri, security researcher for Rapid7.
An event focusing primarily on how to move security forward through better collaboration and innovation, UNITED Security Summit will highlight a keynote by Dan Heath, the author of Switch, along with a slate of researchers like Guarnieri. For his part, Guarnieri will put forward the premise that enterprises would be much more effective at dealing with the flood of vulnerabilities announced each year if they were better able to analyze how these flaws are really being exploited by the bad guys and match that up with whether or not those attack trends are effecting the specific industry or infrastructure type relevant the organization in question.
This means collecting publicly available data and combining that with data collected from the organizations own logs, SIEM feeds and collected malware to better track whats going on in the wild and inside the company itself to create a threat model far more customized to handle targeted attacks.
So you should actually be deploying some internal infrastructure to collect threat intelligence (based on whats) being used in the wild and using the data itself for proactively blocking off malicious domains, malicious IPs and anything like that, he says. Then combine those types of separate intelligence together with different technologies you already have in place for better-designed security.
Guarnieri plans on highlighting a tool he helped write called Cuckoo Sandbox that can help organizations with a piece of this intelligence: malware analysis. The open source tool automatically picks apart malware samples to offer statistics that give the user a view into how it works, the resources that it targets and the vulnerabilities it uses to wreak havoc. Utilizing a tool like that in-house against the type of malware most used within an organizations industry could show IT that some groups of vulnerabilities it focuses on mitigating quickly may not actually be used in the wild as often as another group of vulnerabilities getting the short shrift.
Then you have a pretty good perspective on how the threat space looks and youre able to prioritize the security flaws you have in your infrastructure not by the severity of the vulnerability or of the malware itself but by the relevance of that specific type thing to your infrastructure, he says. So you can actually understand why one thing should be more important than another from a real world perspective, not just because some researcher told you so.
Have a comment on this story? Please click Add Your Comment below. If youd like to contact
Dark Readings
editors directly,
send us a message
.

Last News
▸ New threat discovered: Mobile phone ownership compromised. ◂ Discovered: 23/12/2024 Category: security	▸ Some DLP Products Vulnerable to Security Holes ◂ Discovered: 23/12/2024 Category: security	▸ Scan suggests Heartbleed patches may not have been successful. ◂ Discovered: 23/12/2024 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
Enterprises Should Bring Some Security Research In-House