Home Contact

M-unition

The Ammunition You Need to Find Evil and Solve Crime

About Us

Welcome to M-unition, the MANDIANT blog. Here we share our insights about the tools we create and use to find evil and solve crime.

What’s Your Poison?

Written by Kris Harms

A bit ago, (yes, this blog post is coming late, but crime hasn’t taken a day off lately!) I spoke at the Northern Ohio Infragard Chapter meeting regarding the state of incident response. Afterward, I participated in a panel where I got a great question that I wanted to pose to the M-Unition readers. The question (paraphrased of course) is, “What are organizations doing, or not doing, that enable today’s attackers to be so successful at getting in and staying in? ”

I had to think about this one for a minute, but here is what I came up with. The most attacker enabling characteristics I’ve seen within an organization is the sense of entitlement employees have to unfiltered Internet and the unrestricted ability to install third-party software. Combine these two characteristics with the organization’s unwillingness to challenge these “rights” and you have yourself a recipe for a business affecting security incident in the very near future. In addition to that, your remediation will feel like the Detroit Lions 2008 NFL season. (0-16 if you were wondering).

The simple expectation that Facebook, Lady Gaga mp3s and desktop photo software are all acceptable content can have a crushing impact on a security team’s ability to defend the network. This is because the amount of software and network traffic that now needs to be monitored and secured is infinite. Unless you have an infinite security budget (if you do, please call me immediately!), your network is likely not defensible in a cost-effective manner. Disallowing these “rights” will have a significant impact on the number of “drive by” spyware infections, an attacker’s ability to steal data without being detected, and the amount of data a network monitoring team is responsible for reviewing. It will even save you bandwidth, which has a direct cost benefit if you are still on the hook for ROI for your security team. That however, is a conversation for another post.

Does this ring true for everyone else? What is it about your organization that enables an attacker? Culture, politics, still running Windows NT4.0?

. 05 Aug 09 | General
«
»


Leave a Reply

You must be logged in to post a comment.