Total Application Control (TAC): The best of whitelisting AND blacklisting…

As hackers get better at breaking into networks and compromising data, IT security experts continue to debate the best ways to defend their systems against highly targeted malware attacks. In the PCWorld article, “How to Stop Hack Attacks In One Easy Step: Whitelisting,” InfoSec pro Tony Bradley highlights some of the key differences between application whitelisting and traditional blacklist-based defenses. Let’s review those difference, but then I want to make the case for Total Application Control (TAC)–a blending of the best of both approaches.
On one hand, whitelisting stops all unauthorized applications from running, essentially blocking any malicious/unauthorized software from executing on all network endpoints–regardless of whether it was a previously known application/attack or a new, unknown one. But as Richard Stiennon observes, simple whitelisting can be too restrictive and potentially require too much administrative overhead to maintain. On the other hand, blacklisting stops known bad applications from exploiting a system, but lets programs execute on a system by default if they are not on the blacklist. This reactive approach means users can execute software, including malicious attachments, thereby leaving networks and data vulnerable until after a threat is identified. Blacklisting also forces a steady stream of patching requirements and fire-drill reactions that become a black hole of IT time and money (e.g., trouble shooting poorly functioning machines, reimaging and even purchasing new systems prematurely).
As the whitelisting versus blacklisting debate rages on, instead of focusing on the limitations or weak points of each technology, what we should really be discussing are the strengths that these two fraud detection super powers bring to the table — and when used together — can help organizations gain complete control over all applications across their enterprise. CoreTrace calls this Total Application Control (TAC). (Basically, we need to create the “Blue Ocean” strategy for endpoint security. If you are unfamiliar with the concept/book, check out: www.blueoceanstrategy.com.)
First, we need to clear some of the misconceptions that many still have, such as whitelisting being the same as “lockdown,” or that it doesn’t include cloud-based blacklists. The truth is, today’s leading application control solutions like CoreTrace Bouncer have evolved beyond straightforward whitelisting functionality. They’ve addressed the shortcomings around basic application whitelisting and blacklisting products by leveraging both technologies to provide the visibility organizations require to see all known good and bad applications in their environment. For a solution to achieve Total Application Control, it minimally needs to include three essential components:

1. Application Whitelisting: Whitelisting on all endpoints as the enforcement mechanism to ensure established policies are enforced and all unauthorized applications are prevented.

2. Change Management: The ability to seamlessly handle change (new authorized applications and upgrades) even in dynamic environments without impacting IT production or user productivity.

3. Cloud-based Whitelists… and Blacklists: Cloud-based reputation service to assign risk profiles to all applications, including identifying known-good applications and any known pieces of malware. “Cloud-based” is key phrase: use the information in a offline capacity, so as to not impact system performance with onerous scans.

I’ve often wondered if hackers are taking full advantage of the rhetoric that goes on between competitive security vendors, who despite having the same anti-malware objectives, continue to create a cloud of confusion throughout the industry that actually stalls innovation, and new proactive ways to defend networks against more dangerous modern malware. Maybe bringing longtime adversaries like whitelisting and blacklisting together to create Total Application Control is the last thing cyber criminals want to see. We certainly think so.
So stop debating and start controlling your systems with a blend of the top defense mechanisms. Move past confusion and into enlightenment and receive all the control and performance benefits of whitelisting with the reporting and compliance benefits of offline blacklisting.

by Toney Jennings

It’s a new platform… So why use an old (broken) security approach?

When it comes to protecting network endpoints against more cunning and deceitful modern malware attacks, deploying proven security tools to prevent malicious code from exploiting your system is job #1. Unfortunately, the cat-and-mouse game between IT security professionals and hackers is not easily won, if ever won at all. The key, of course, is to stay one step ahead of your adversary at all times.
That said, what continues to baffle me is the ongoing practice of re-applying beatable security technologies to evolving malware, and expecting a different outcome. Time and time again, we’ve seen how increasingly ineffective traditional anti-malware products like antivirus software are at stopping modern attacks.
More recently, we’re seeing how cyber criminals can rapidly rewrite code overnight to evade even the latest security updates. The article, “Apple’s malware detection update circumvented in 8 hours,” shows us how quickly malware developers are creating new variants that can bypass security updates mere hours after the update is available. But this doesn’t apply to Macs alone. I’ve also recently talked about the Microsoft security update that was out all but three days before hackers were conducting active attacks on the same patched vulnerability.
The way I see it, it’s wrong to apply a known broken security approach to any platform, but especially wrong to do so on new ones. Whether it is a Mac, Linux, tablet or smartphone, why on earth would you use an old, ineffective approach to secure a new platform?? Doing so puts your network endpoints and critical business data at risk, and it gives cyber criminals the upper hand.
Putting short-term fixes on long-term problems is not the answer. Instead of deploying reactive solutions and hoping for the best, we need to approach IT security with a proactive vision in mind. We need a solution that provides proactive security, minimal performace impacts and clear visibility / risk profiling of all applications installed in our environment. What we need are application control solutions like CoreTrace Bouncer.

by JT Keating

Lord of the Files – File Sharing Gone Wild

Who would have thought that the novel, Lord of the Flies, by William Golding, an English literature staple for English schoolchildren, was not only the idea behind the popular TV series “Lost”, but also provides important parallels to the story currently unfolding of enterprise file sharing gone wild. In the Lord of the Flies the attempts by the group of British schoolboys to govern themselves when stranded on a deserted island is in some ways akin to how business users are today attempting to govern their file sharing when deserted by IT.
The major themes of the Lord of the Flies include an exploration of the conflicts of civilization and the loss of innocence, both of which seem applicable to the current conflict of business user vs. IT in the world of enterprise file sharing. While the novel, and even the TV show, may be rather more graphic on the conflict of living by rules vs. savagery, valuing the good of the group vs. individual gratification and exploring law vs. anarchy perhaps some good lessons can be learned? Just how would Ralph, Jack, Simon and Piggy, the main characters in Lord of the Flies have handled file sharing?
Ralph, the elected leader of the group, the representative of order, civilization and productivity, thinks about how the boys should organize themselves and get to work to maximize their chance of survival and rescue. Is Ralph perhaps the CIO figure? Would Ralph, the CIO, be taking charge, implementing an enterprise file sharing solution so business users can not only survive and can get their jobs done, but also stay out of trouble.
Jack, the opposite of Ralph, the character representing savagery not civilization, demonstrates how he can use his savagery to control the boys who increasingly abandon civilization to follow him. Hmmmm… not sure about this Jack character, although we have all seen business users do things they shouldn’t.
Simon, is the character who just does what is right not because of Ralph or Jack’s influence, but just because he knows it is the right thing to do. This would be the business user every organization would like to have.
Piggy, the inventor and intellectual, uses his inventiveness to benefit the group. It is Piggy who initially finds a conch and blows it to bring all the boys together on the island and Piggy who makes a sundial so they can tell the time. Piggy, in the world of enterprise file sharing would have early on blown the conch he discovered, to alert IT and Security teams that they needed to work together to give business users a way to share files securely. Piggy would also be the one to design and implement the system.
So how does this story end? In Lord of the Flies, the boys are eventually rescued and returned to civilization, but not without some casualties. The adult who steps onto the island does remark that he would have expected better from British boys!
How does the story end in enterprise file sharing? I’m betting on the Ralphs and Simons of the world to give this story a happy ending.

by Paula Skokowski

Who would you bet on in the race between hackers and users?

No one will argue that deploying security updates is important, but a recent exploit showed the difference between having a patch available and actually implementing it (again). Today’s reality is that hackers are far quicker to exploit known vulnerabilities than users are to patch them.
In the article, “Hackers move fast to exploit just-patched IE bug,” Symantec reported that after Microsoft issued a patch for 11 bugs in Internet Explorer last week, active attacks were spotted on one of the “patched” vulnerabilities just three days later. Although the vulnerability has seen limited attacks at this point, it is another in a long line of examples that demonstrate why enterprises need multiple layers of protection–most of which truly need to be completely out of the hands of users.
What good are security updates if hackers can jump right back in and exploit the same vulnerability? Honestly, the impact of an unpatched vulnerability would be significantly less if the endpoint protection (specifically antivirus technology) was effective at stopping the payload. As is becoming more and more evident, this is not the case. Traditional antivirus solutions are continuing to fall further behind in stopping the growing volume of malware exploits and variants.
[Time for the shameless plug. You can exit now if you don't want to know how to help actually solve the dilemma.]
Rather than reactively patching or depending on blacklists to identify and stop the tens of thousands of new online threats that come along each day (60,000 a day, according to Gartner), organizations need to take a proactive approach to not only protect their endpoints from all known and unknown malware threats, but also gain total application control of their systems to allow only what they want to run on their networks at all times.
CoreTrace’s Bouncer application whitelisting solution does this by providing complete insight and control over all installed applications across a highly distributed environment. By combining total application control with advanced, non-intrusive self-defending mechanisms, Bouncer helps organizations stop all known bad and unauthorized applications from running on any endpoints–including those that exploit a known, unpatched vulnerability.

by JT Keating

iCloud, you Cloud, we all can Cloud. Let’s minimize data security risks, too.

Between this week’s high profile security vulnerability of free, cloud-based services and the recent iCloud announcement, the good, bad, and ugly of cloud deployments have garnered a lot of attention.
For the record, Accellion solutions are sold only to business and government organizations. Our customers have a choice in deployment options including, virtual or physical appliances, and public or private cloud. They can also have hybrid deployments.
No matter where you sit on the relative benefits of cloud deployments, the fact remains that employees are increasingly taking advantage of cloud-based consumer services to share confidential information and collaborate with people outside the organization, with little to no regard for corporate and IT security policies. These consumer-grade solutions allow individuals to share, send and sync files between devices, yet leave IT and security teams with no visibility into the sharing of enterprise data. With Apple iOS’ lack of a file system, iPad users are especially prone to using these applications.
Enterprises need to get ahead of the issue of how employees share information. Best practice requirements that cannot be met with consumer, dropbox-type applications include:
o Flexible deployment options
o Centralized IT administration and management
o Full audit and log capabilities
o Track and own your enterprise data
Bill French at iPadCTO sums it up best:

Box, DropBox, (and soon iCloud), represent the fast-food industry of document collaboration. Accellion is a sit-down restaurant complete with a five-course menu and even a chef in the kitchen who will customize your meal if you ask. And this restaurant has a really cool customer relationship feature that will tell you precisely what you and everyone in your party ate, when you ate it, and how many calories were in it. Oh yeah, and they serve outstanding espresso in an environment that’s pleasurable to have intimate conversations without the noise and distractions of a hyper-fast eatery.

As I mentioned, Accellion, unlike competing solutions, is sold only to business and government organizations and all customers have oversight of their cloud and on premise installations – including public, private, or hybrid cloud deployments. We let you make the choice.
We offer an enterprise solution that offers the control and flexibility that IT needs while keeping business users happy with an easy-to-use file sharing application that can be used anytime from anywhere.
For more information, read our latest white paper: Secure File Transfer and Collaboration in the Cloud: Maximizing the Benefits While Minimizing the Risks.

by Accellion

The next priority for CIOs...

The technology landscape is constantly changing. In the past year we have seen an insatiable consumer demand for mobile devices such as iPads and other tablets, as well as services like cloud computing. What was previously viewed as enterprise computing has been taken up by individuals eager to stay connected. This has led to what is now being known as the ‘consumerisation’ of technology in the workplace, whereby users bring their own devices.
At a conference in London this week IDC’s research director, Nick McQuire explained how consumerisation “presents a massive opportunity” to reduce upfront costs, aid innovation and increase productivity. However consumerisation also poses a number of challenges to businesses and a headache to security staff as they battle to secure boundaries and prevent data loss.
According to research by IDC, less than a fifth of businesses are estimated to have the software and skills in place to manage personal devices. And 41 % were worried about cost, while 37 % worried about management.
So how can businesses overcome the security issues bought forward by consumerisation? Organisations need to bring security out of the shadows and adopt flexible policies which can be integrated across the organisation. However taking an over-cautious approach when it comes to IT security can also cause problems. Stifling a company in red tape to such an extent that it becomes so constrained by its IT security that it is prevented from innovating or taking advantage of new and innovative technologies will not help it gain a competitive edge. As well as the issue of data security the main problem with consumerisation is the blurring of boundaries, as staff approach work security in the same way they would approach home security. The attitude to security at home can often be more lax and this may affect the level of professionalism usually taken towards security in the workplace. The key to overcoming this is education. By educating and explaining web and email policies staff can actively take on board the risks and adapt their behaviour in the long-term. As consumerisation looks set to stay businesses need to develop an appropriate approach to security to deal with it, this will undoubtedly need to become a priority for CIOs over the coming years.

by Clear Swift

Whitelisting: Only the first rung of the ladder to “Total Application Control”…

According to the article, “Top five strategies for combating modern computer security threats,” today’s surreptitious, very low profile cyber threats are exploiting any vulnerability they can to get malware onto a user’s laptop or computer. These computer viruses require organizations to proactively defend their networks from a growing volume of malicious software that can mutate within hours or even minutes to evade detection.
One of the recommended techniques for protecting computer systems from unauthorized and malicious software is application whitelisting. Clearly, we are biased, but we completely agree more with those across the industry (including the author of the article) who are recognizing the anti-malware benefits of application whitelisting over reactive blacklisting products.
Furthermore, we also agree with some of the cited shortcomings around basic application whitelisting technologies. For example, solutions must be able to prevent attacks that “subvert known good applications” like memory exploits. Solutions must also be able to handle dynamic environments without frustrating users or killing IT productivity–unless they are simply lockdown mechanisms for “static” environments like POS terminals, control systems and ATMs (though these systems are really less “static” than most would realize).
While these are valid concerns if all you are looking at is a whitelisting product, leading solutions like CoreTrace Bouncer have evolved beyond simple whitelisting and into “Total Application Control” (TAC) solutions. TAC solutions include enforcement mechanisms that prevent memory exploits and other attacks against authorized applications. TAC solutions also have trusted change mechanisms to address dynamic environments, provide intelligence about all installed applications and assess application risk via cloud-based reputation services. TAC includes learning/assessing what is in your environment, planning and establishing policies, and then enforcing those policies on the endpoint.
In short, application whitelisting at its core is an excellent anti-malware enforcement mechanism to protect endpoints from modern malware attacks. But it is only the first rung on the ladder to Total Application Control.

by JT Keating