Signs Of A Shift To Intel-Driven Defense

Organizations such as AIG move away from operations-based to intelligence-driven security strategies, emerging technologies

The first two minutes of a cyberattack are crucial -- thats when the attacker sets up camp and downloads additional malware to dig in and establish a firm foothold in the victim organizations network. But traditional malware detection technologies typically cant keep up with that tight of a deadline, nor are the network and endpoint security systems in sync to catch it that quickly.
Its no wonder many organizations dont learn theyve been breached for months or even years after the fact, as was revealed in Verizons new Data Breach Investigations Report, with close to 70 percent finding out from a third party that theyve been hit. Some security vendors are taking a different tack and making the endpoint -- the typical initial target -- better capable of quickly detecting and thwarting damage, such as bot infiltrations, stolen data, or widespread malware infections, amid the new reality that attacks today are basically inevitable.
The newly announced integration between Bit9s endpoint security software with FireEyes and Palo Alto Networks threat detection products is the latest example of a shift toward making the endpoint a key piece of the defense. Palo Alto Networks struck a similar deal with Mandiant earlier this year, and CounterTack in February rolled out what it calls a honeypot for the endpoint for catching and gleaning intelligence from attacks on client machines.
Security experts say security has been a siloed operation for too long, and any interoperation or integration among various vendors products can help -- such as sharing information between the network and endpoint security tools. Not only that, but most large organizations have been focused on putting out fires rather than really understanding what attackers are after.
If you have these advanced network defense tools and they dont have their own play on the endpoint, nothing can identify the target, says Scott Crawford, managing research director, security and risk management, at Enterprise Management Associates. Why not engage what you have on the endpoint?
Bit9s new Connector tool for FireEye and Palo Alto was the result of pressure from large customers who have products from all three vendors and were looking for better integration among the tools and better intelligence on attack attempts against them.
Brian Hazzard, vice president of product management for Bit9, says the new Bit9 Connector for FireEye and for Palo Alto Networks lets Bit9 identify the machines infected with the malware that the FireEye and Palo Alto tools find. The vision was to combine network security with endpoint defense to help our common customers combat these [threats], Hazzard says.
[Most organizations today arent investing in the same kind of visibility and control over their endpoint devices as they spend on network-based controls. See
Gathering More Security Data From Your Endpoints
.]
Attackers increasingly have benefited from, and ultimately capitalized on, the way endpoint and network security have traditionally operated separately. The reality is that we have gotten to the point where both network-based defense and endpoint defense need to evolve together. One without the other creates a gap where things can sneak through, says Wade Williamson, senior security analyst with Palo Alto Networks. If you have perfect visibility into the network, you still need to correlate with what is going on at the endpoint.
Palo Alto and Mandiant in February announced that Mandiants new appliance-based Security Operations product and endpoint agents would be integrated with Palo Alto Networks next-generation firewalls and WildFire malware prevention service. Well be picking up the indicators of compromise, such as what changes are in the registry, and what files are created, Williamson says of the deal with Mandiant.
AIG Traps Attackers
Meanwhile, large enterprises are gradually shifting gears from operational security mode to intelligence-based security. Take insurance giant AIG, which is running a small but soon-to-be-expanded deployment of CounterTack Scout endpoint honeypots in its U.S. data centers. Paul de Graaff, the former global CISO for AIG, says a year-and-a-half ago, the concept of an intelligence model for security was a foreign concept and intelligence was all about SIEM.
AIG was looking for better visibility into threats and wanted to employ a more intelligent security architecture. We came out of the financial crisis, and the security side, we started centralizing and visualizing a lot of the IT infrastructure, and it became apparent there were things happening to AIG and we didnt have as much visibility as we wanted, de Graaff says. It was not so much targeted stuff -- we saw a lot of generic [threats], he says.
We were very operations-focused, so we moved more toward an intelligence-focused [approach], he says. Having to convince the IT organization we needed to deal with this more ... was a big sell. On the business side, to actually have honeypots sitting in our environment attracting [attackers] was a big thing. Were interested in what they are after -- source code or claims system, for example, he says.
AIG now can analyze a malware sample that hits the endpoint and discern what the attackers are after, de Graaff says. We make that decision very quickly. We try to fence them in so they cant exfiltrate, he says.
The key selling point is that that kind of intel helps the company better plan its technology investments based on risk, he says. So far, the main threats AIG has found with the CounterTack endpoint honeypot is attackers searching for customer information, he says. But like many other big companies, AIG eventually will be the target of cyberspies as well, he says.
You cant stop attackers from getting in. Once they do get in, there are so many things they can do, says Neal Creighton, CEO at CounterTack. The attacker does all of the initial beachhead work in the first 120 seconds, so stopping them within that time frame is ideal for mitigating the damage and preventing theft of data, he says.
CounterTacks approach is different from Bit9s in that it is more about studying the attackers moves and analyzing it than blocking malware or other badness. Its like having a camera over the attackers shoulder, Creighton says. Were not doing a lot of blocking ... were taking data and shifting it to analysis. Its designed to watch the attacker.
Bit9s Connector analyzes the malware and also blocks it. In the case of its integration with Palo Alto Networks, for instance, Bit9 grabs any malware from an endpoint or server for Palo Alto to analyze and, if necessary, block.
When FireEye or Palo Alto catch malware on the network, they generate alerts, Bit9s Hazzard says. Well automatically enforce policy ... and drive detonation based on what we see on the endpoint.
Have a comment on this story? Please click Add Your Comment below. If youd like to contact
Dark Readings
editors directly,
send us a message
.

Last News
▸ ArcSight prepares for future at user conference post HP acquisition. ◂ Discovered: 07/01/2025 Category: security	▸ Samsung Epic 4G: First To Use Media Hub ◂ Discovered: 07/01/2025 Category: security	▸ Many third-party software fails security tests ◂ Discovered: 07/01/2025 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
Signs Of A Shift To Intel-Driven Defense