The Top Information Security Risks for 2008

Blogging has it’s rewards.

I recently published a list of the Top Ten Cybersecurity Threats for 2008.

This list motivated another collaborative list for 2008, organized by Dr. Gary Hinson, The Top Information Security Risks for 2008.

Complex Event Processing with Esphion Neural Agents

Detection-oriented technologies generally fall into two broad areas, signature-based detection and anomaly-based detection.    Complex event processing (CEP) is also a detection-oriented technology, so we can readily understand that CEP applications must also fall within the same two general areas.

Signature-based detection is sometime referred to as static detection because the technology relies on pre-defined rules, filters, and signatures to match known patterns.  At the most fundamental level, a virus checking program is an example of a signature-based system. 

On the other hand, anomaly-based detection systems strive to maintain a baseline of what is considered normal and then matches patterns outside normal operating parameters, often usings adaptive or artifical intelligence techniques.

Experts know that both anomaly and signature-based detection methods are important and each have their unique challenges and engineering tradeoffs.  For example, signature-based systems tend to generate false negatives because it is not possible to write all possible rules and filters to match every pattern, especially in dynamic real-time environments. Anomaly-based detection, on the other hand, tends to generate false positives because it is quite difficult to create a perfect profile of normal behavior. 

The challenge in most, if not all, detection-oriented systems is finding the right balance between false positives and false negatives.  In some situations, a system should error toward false positives.  In other applications, the system should error toward false negatives. 

CEP is, by defination, a technology to detect both opportunities and threats in distributed networks, in real-time, so it goes without saying that CEP is challenged by the same engineering tradeoffs that affect other detection-oriented systems.

A few weeks ago, I was discussing CEP with a CTO of one of Thailand’s largest telecommunications companies and he was very bullish on neural-based anomaly detection and from Esphion.

First generation detection systems rely on determinism, which is generally rule-based, and known to be insufficient for more complex real-time problems.  Esphion uses neural agents to gathering information on network activity and then creates a unifying situational infrastructure to protect against previously unknown threats.   For example, a fast spreading threat, such as the SQL/Slammer worm, will have reached all possible targets faster than any signature can be published or rule can be written, as mentioned in Worm detection – You need to do it yourself.

Since CEP is designed and marketed as a technology that brings real-time advantages to the detection of both opportunties and threats, we must ask ourselves the question why do all the current CEP software vendors fail to provide non-deterministic methods that are proven to adapt to a rapidly changing world?  

In Anomaly Detection 101, Esphion does a great job of describing how they do not rely on any pre-specified rules, baselines, models, signatures, or any other apriori knowledge.   They claim, and my highly respected telecommunications CTO colleague confirms, that there is no prior knowledge required and their customers are no longer adversely affected by zero-day anomalies or changing network conditions.

The technology behind Esphion does is what I would call complex event processing.

End Users Should Define the CEP Market.

My friend Opher mistakenly thought I was thinking of him when I related the story of the fish, as he replied, CEP and the Story of the Captured Traveller.

I must not have related the fish story very well, because to understood the story of the fish, is to know that we are all like the fish, in certain aspects of life, and there is nothing negative to be gleaned from the story.

However, to Opher’s point on CEP, I disagree.   Just because the marketing people (not the market) has misdefined CEP and therefore the vendors are drifting from the technology described in Dr. Luckham’s original CEP work, including his CEP book, we should not change the context of CEP.    Therefore, I don’t agree we should redefine CEP, as David envisioned, as Intelligent Event Processing (IEP) because CEP, as today’s software vendors sell it, is really SEP (or whatever!)  Please recall that David’s background at Stanford was AI and he did not define CEP as the software vendors have defined it either!

The fact of the matter is that the software marketing folks have decided they are going to use Dr. Luckham’s book to sell software that does not perform as Dr. Luckham described or envisioned!   I make no apologies for being on the side of end users who actually need to solve complex problems, not sell software that underperforms.

As I mentioned, this positioning and repositioning does not help solve complex problems.   At the end of the day, we have problems to solve and the software community is not very helpful when they place form over substance, consistently. 

Furthermore, as most customers are saying, time and time again, “so what?” … “these COTS event processing platforms with simple joins, selects and rules do not solve my complex event processing problems.”  “We already have similar approaches, where we have spent millions of dollars, and they do not work well.”

In other words, the market is crying out for true COTS CEP solutions, but the software community is not yet delivering.  OBTW, this is nothing new.  In my first briefing to the EP community in January of 2006, I mentioned that CEP required stating the business problem, or domain problem, and then selecting the method or methods that best solve the problem or problems.

To date, the CEP community has not done this because they have no COTS tool set other than SEP engines (marketed as either ESP engines or CEP engines – and at least ESP was closer to being technically accurate.) 

Experienced end users are very intelligent. 

These end users know the complex event processing problems they need to solve; and they know the limitations of the current COTS approaches marketed by the CEP community.  Even in Thailand, a country many of you might mistakenly think is not very advanced technologically, there are experts in telecommunications (who run large networks) who are working on very difficult fraud detection applications, and they use neural networks and say the results are very good.   However, there is not one CEP vendor, that I know of, who offers true CEP capability in the form of neural nets.  

Almost every major bank, telco, etc. has the same opinion, and the same problem. They need much more capability than streaming joins, selects and rules to solve their complex event processing problems that Dr. Luckham outlined in his book.   The software vendors are attempting to define the CEP market to match their capability; unfortunately, their capabilities do not meet the requirements of the vast majority of end users who have CEP problems to solve.

If the current CEP platforms were truely solving complex event processing problems, annual sales would be orders of magnitudes higher.  Hence, the users have already voted.   The problem is that the CEP community is not listening.

CEP Center of Excellence for Cybersecurity at Software Park Thailand

In July 2007, at InformationSecurityAsia2007,  I unveiled an idea to create a cybersecurity CEP Center of Excellence (COE) in Thailand.  Under the collaborative guidance of Dr. Rom Hiranpruk, Deputy Director, Technology Management Center, National Science and Technology Development Agency (NSTDA), Dr. Prinya Hom-anek, President and Founder, ACIS Professional Center, and Dr. Komain Pipulyarojana, Chief National Security Section, National Electronics and Computer Technology Center (NECTEC), this idea continues to move forward.

Today, in a meeting with Mrs. Suwipa Wanasathop, Director, Software Park Thailand, and her executive team, we reached a tentative agreement to host the CEP COE at Software Park.   

The mission of Software Park Thailand is to be the region’s premier agency supporting entrepreneurs to help create a strong world-class software industry that will enhance the strength and competitiveness of the Thai economy.

Since 2001, Thailand’s software industry has experienced approximately 20% year-over-year (YOY) growth.  Presently, Software Parks Thailand supports a business-technology ecosystem with over 300 active participants employing over 40,000 qualified software engineers across a wide range of technology domains.

I am very pleased that Software Park Thailand is excited about the potential benefits of CEP in the area of cybersecurity and detection-oriented approaches to cyberdefense. The COE will be working with best-of-breed CEP vendors to build, test and refine rule-based (RBS), neural network (NN) based and Bayesian network (BN) based approaches (as well as other detection methods) for cybersecurity.

I will be announcing more details in the future, so stay tuned.  Please feel free to contact me if you have any questions.

The Asia Business Forum: Information Security Risk Assessment and Management (Day One)

Today is the opening day of the Information Security Risk Assessment and Management conference in Bangkok.   Mr. Charoon Boonsanong, Lecturer, Faculty of Economics, Chulalongkorn University, open the conference.  

Dr. Komain Pipulyarojana, Chief National Security Section, National Electronics and Computer Technology Center, will lead off with a presentation on the Latest Trends, Standards and Threats for Information Security & Future Direction.   Dr. Komain also serves as the lead for ThaiCERT.    

Police General Yanaphon Youngyuen, Deputy Commissioner, Department of Special Investigation, Royal Thai Police, will present Legal Updates: Interacting with Law Enforcement After a Cyber Crime or Systems Intrusion & Its Impact on Todays Business.

The last presentation before lunch is my presentation, CEP and SOA: An Event-Driven Architecture for Operational Risk Management.   

After lunch, Mr. Phillip Chong, Partner, Enterprise Risk Services, Deloitte Touche Tohmatsu Jaiyos Advisory Company Limited, will talk to us about Governance, Risk Management and Compliance (GRC) as a Model for the Management of Corporate Information.

The last presentation before I must rush off to fight the traffic in Bangkok for a cross-town meeting is, Mr. David Old, Partner, Information Risk Management, KPMG Poomchai Business Advisory Limited.

The Top Ten Cybersecurity Threats for 2008 – Final Draft

As promised, here is the final draft of my perspective on the top ten cybersecurity security threats for 2008. 

I reviewed many prior “top ten” threat lists and noticed most of them accidentally confuse vulnerabilities and threats, listing vulnerabilities as threats.   In my review, I could not find any “top ten” threat lists which attempted to use, or follow, the security professional’s textbook definition of threats.   Even the 2008 McAfee list makes this common mistake, listing Window’s Vista and VoIP as “threats” when, technically speaking, they are vulnerable systems (McAfee’s graph in their PDF has the caption “Windows Vulnerabilities” – this speaks for itself.)

My goal was not to create “yet another vulnerability list.”  Instead, my objective was to create a top ten cybersecurity threat list which actually focuses on threats, not vulnerabilities.  Please feel free to comment, as there is certainly room for improvement.   Your comments are very welcome as we rapidly approach 2008.   Thanks!

Top Ten Cybersecurity Threats for 2008

   — Cyber masquerading to abuse, attack, blackmail, bully, extort, or molest.

   — Password and identity theft from phishing, spyware, malware and theft of hardware.

   — Criminal use of botnets and botnet-like technologies.

   — Cyberbullying, cyberterrorism and other forms of electronic violence.

   — Subversion of democratic political processes.

   — Criminal manipulation and subversion of financial markets.

   — Spying by governments, industry and criminals.

   — Denial-of-service attacks.

   — Sabotage, theft and other attacks by disgruntled employees and insiders.

   — Cyberspace vandalism.

©2007 Tim Bass – All Rights Reserved

The Top Ten Security Threats for 2008 (Part 15) – Insiders

Here is my final entry for the 2008 list of top ten cybersecurity threats:

      — Sabotage, theft and other attacks by disgruntled employees and insiders.

The Computer Security Institute and FBI conduct an annual CSI/FBI Computer Crime and Security Survey of U.S. corporations, government agencies, financial institutions, and universities. Eightly percent of the information security professionals who responded indicated that disgruntled and dishonest employees are the greatest threat to their computer systems [reference]. 

This list would not be complete without adding “the insider threat.” Next, I will consolidate and order the list, completing an earlier promise to give my opinion on the top ten cybersecurity threats for 2008.