Black Hat: The Problems Don't Change, But The Solutions Have

Bill Brenner figures there is nothing new in security. But it seems he's looking at it only from the perspective of the problem space. I agree that the problems we face as security professionals remain consistent. Bad folks want to steal our stuff. Employees and senior management don't care about security. And these same employees get very pissed when you tell them they can't do something, like watch adult movies on their iPads while connected to the VPN looking at next quarter's financials. Go figure.

But here's the deal: For the first time in a long time, there is real innovation happening in security. And we need that kind of innovation because the adversaries continue to up their games -- big time. They game applications, they blow up business processes, and they seem to have inside information about how your defenses work. So to think that your signature-based controls and traditional PCI-approved security products will stop these adversaries is naive. And, of course, you aren't naive, right?

Combine that with some pretty good outcomes for investors, like Sourcefire's multibillion-dollar deal with Cisco and FireEye's projected IPO, and you have a Internet bubble-style feeding frenzy on all things cybersecurity. And with new business models and technology architectures (yes, cloud, I'm looking at you), the attack surface is getting bigger and the risk continues to skyrocket. The only thing constant in security is change. So if you thought you were getting into a nice, cushy gig when you studied for that CISSP, forget about it.

Having just returned from a month at Black Hat (well, three days in Vegas seems like a month), there is a lot of stuff to talk about. Remember that Black Hat (and DEF CON, as well) are about emerging research. The stuff I talk about in the Vulnerabilities and Threats section now -- that will be covered in Dark Reading's Attacks and Breaches section in 12 to 18 months. The research at Black Hat was split among a number of pretty timely areas, including malware detection and evading those detections, security monitoring, and mobility.

The most active for research (and innovation) continues to be advanced malware detection. I mentioned a little of what's happening in Controlling the Big 7 a few weeks ago. These new endpoint-centric controls are the tip of the iceberg. Expect to see significant innovation coming to market relative to endpoint forensics and network-based malware detection. Is it perfect yet? No. Will these new tools promise to block every attack? Of course not. The reality is, today's traditional controls can't even block script kiddies using attack kits they bought on Craigslist with Bitcoins. These new offerings will fair better, although they'll be far from perfect.

The tactics to detect malware continue to advance as well. A few years ago, doing malware analysis required a significant investment (think millions of dollars) for both highly skilled people and gear to figure out what malware was doing and to profile it. Now we're seeing folks offering up Web-based services to do the same thing, and open-source initiatives to leverage Big Data analytics to decipher patterns across large data sets to isolate bad behaviors. I guess Big Data can be useful for more than figuring out how to make you pay the most for your airplane ticket or hotel room, and figuring out what should be on the shelves of your local Wal-Mart.

We also saw a bunch of research that can be useful to improve your protection against these malware attacks. But the sessions weren't pitched like that. You saw talk after talk about evasion, and there's a reason for that. Researchers don't really find protection that compelling. But getting around existing protections? Yeah, that's cool. So that means you (as a defender) need to figure out how these new evasion tactics obviate your preventive controls. Then you need to respond and evolve your defenses. Given the sexiness of sandboxes (on both the endpoint and network), it wasn't surprising to see a lot of research focused on bypassing these sandboxes. I hope the vendors were listening, since by the time research is shown at Black Hat, it's well on its way to being weaponized by the adversaries.

There was also Black Hat research on timely issues, like denial-of-service (DoS) attacks and attacking mobile devices. Actually, I was surprised by the modest number of sessions on mobile. Mobility was all over Black Hat last year, so either the topic is not as interesting (unlikely) or the selection committee has mobile exhaustion (more likely). And with the preponderance of DoS attacks, it's not surprising that research is going into figuring out how to evade the scrubbing services and other mitigation techniques.

I understand that Bill may be frustrated that the industry continues to have the same discussions about the same problems year after year without seeming to make any progress. But when you look under the covers both on the attack front and the defense front -- there is plenty of innovation happening. You just need to know where to look.

Mike Rothman is President of Securosis and author of The Pragmatic CSO