The gold standard for creating an application security (AppSec) program is ??? and always will be ??? to follow best practices. By following preestablished and proven methods, you can ensure that you are maximizing the benefits of your AppSec program.
Unfortunately, time, budget, culture, expertise, and executive buy-in often restrict organizations from following best practices. But that doesn???t mean that you can???t create an impactful AppSec program. You should aim to follow best practices but ??? when you can???t ??? there are practical first steps you can take to position your program for future improvements.
Ideally, you should be using every testing type ??? static analysis, dynamic analysis, software composition analysis, interactive application security testing, and penetration testing.
Each AppSec test has its own strengths and weaknesses, with no one tool able to do it all. If you choose not to employ a specific test, you could be leaving your application vulnerable. For example, if you don???t employ software composition analysis, you may miss vulnerabilities in your third-party code. And if you don???t employ dynamic analysis, you could miss configuration errors. But by using all of the testing types together, you can drive down risk across the entire application lifetime from development to testing to production.
If you don???t have the funds or support to employ every AppSec testing type, you should always begin with the test(s) that will have the most impact, in the shortest amount of time, for the least amount of money. This will depend on factors like your release cadence, risk tolerance, and budget.
For organizations releasing software less than four times a year, manual AppSec scans will probably suffice. But if you release software daily or weekly ??? likely in a CI/CD fashion ??? you will need to automate your AppSec scans with each code commit.
You also need to consider the speed of different scan types. Static analysis can provide immediate feedback with each commit. Penetration tests, on the other hand, are much slower because they rely on a human pen-tester to review the code.
But speed isn???t the only concern. You also need to consider the risk of your applications. An application housing sensitive data ??? like banking information ??? needs to undergo more in-depth AppSec tests than a lower-risk application. In-depth AppSec tests, like penetration testing, may take longer but they are critical in preventing cyberattacks. It really comes down to weighing the risk vs. time to market. In some instances, it may be okay to release software with low- or medium-severity risks. But for high-severity risks, you should break the build until the vulnerability is remediated.
Budget is also a major factor. Penetration tests are considerably more expensive than other testing types. So, if you???re on a tight budget, frequent pen tests may not be feasible. You might be better off pen-testing on an annual or bi-annual basis.
Once you???ve successfully implemented the AppSec testing type(s) that provides the most value to your organization, it???s time to start making the case for additional scans. As always, consider your budget, risk tolerance, and technology when adding to your AppSec mix.ﾂ?
To learn more about AppSec best practices and practical first steps, check out our guide, Application Security Best Practices vs. Practicalities: What to Strive for and Where to Start, and keep an eye out for our upcoming best practices blogs. ﾂ?
Hackers are friends not foes, says Alyssa Miller in this opening argument for our latest debate
Register debate Welcome to the latest Register Debate in which writers discuss technology topics, and you – the reader – choose the winning argument. The format is simple: a motion is proposed, the argument for the motion is published today, and the argument against will be published on Friday.…
According to Risk Based Security’s 2020 Q3 report, around 36 billion records were compromised between January and September 2020. While this result is quite staggering, it also sends a clear message of the need for effective database security measures. Database security measures are a bit different from website security practices. The former involve physical steps, […]… Read More
The post 10 Database Security Best Practices You Should Know appeared first on The State of Security.
Buzzwords and acronyms abound in the MSP industry, an unfortunate byproduct of marketing years in the making. Cybersecurity is a hot watercooler topic at any business. Well, now probably more likely a virtual happy hour than a watercooler, but nevertheless cybersecurity remains top-of-mind.
To sleep at night, MSPs feel they must enhance or expand their security offerings beyond the standard layers, like; firewalls, firewall filtering, active directory protocols, DNS Filtering and antivirus/malware detection. One of the ways many MSPs feel they can satiate their cybersecurity concerns involves buzzword-y new acronyms floating around involving “EDR” or endpoint detection and response. But what is EDR really and what can it do for MSPs and their clients?
But first, besides EDR, there’s also ADR, MDR, xDR and the industry can surely expect newer blank-DR acronyms coming in the next few years. What are all these acronyms and how do they help MSP protect their clients? Here are a few definitions:
- EDR (Endpoint Detection and Response) – Technically, every security agent sitting on an endpoint is an EDR solution. The information the agents feed back to administrators determines what action to take and when.
- ADR (Automatic Detection and Response) – Newer technology allows the agent to automatically make a decision without human intervention. Ideally, ADR automatically remediates a situation and reports to the administrators on action taken.
- xDR – This newer acronym refers to agents across a network communicating to make a remediation decision or report decision across multiple endpoints.
- MDR (Managed Detection and Response) – A best-of-breed solution using EDR, ADR and possibly xDR tools in various combinations, MDR allows a human team to make decisions and respond to situations. While more complex and administrative heavy, MDR closes the gap that arises when suspicious applications are being monitored and observed, but not reacted to by an ADR or xDR solution. Human-driven MDR ferrets out the suspicious and reacts.
Here are five things MSPs should consider when evaluating EDR solutions:
1. All security tools with an endpoint agent are basically EDR.
Their job is to detect malicious code, applications, scripts or other malicious files and make a status determination on the fly. Most security agents use various methods like physically scanning file hashes, scanning file content, watching behaviors, looking at scripts, detecting known attack surfaces and other techniques to try to ascertain if a newly encountered file is good or bad.
How the security agent reports its activity depends on the EDR tool. So, while many security tools claim they offer an “EDR” solution, the key is to determine the level of threat, suspicions and action taken in reporting or alerting that adds value for MSPs.
2. The “R,” or response, is key to a successful EDR solution.
While many security tools report and alert, the level of response is the most important aspect of any security practice. If the security agent provides minimal information for decision making, it’s of limited use to the technical personnel responsible for intervening.
On the other hand, technicians can take advantage of security tools with consoles that display alerts, reports and visibility into whether an agent responded, how and the agent’s current status. Too often tools don’t provide necessary insight for reviewing or comparing threat data or approaches – like the MITRE attack framework or other sites with relevant threat information.
Solutions with a more comprehensive API are advantageous for custom review, integration into more dedicated threat review tools or for alerting through a log gathering and reporting tool. APIs are valuable for providing added information from which human technicians can make decisions.
3. What can be done with the EDR information? Is it actionable?
Once a tool has been selected, what should be done with the information it provides? Answering this is key to successfully setting EDR expectations for customers. If a client requires an MSP has an EDR solution in place, installing an agent is only half of the equation.
Gathering the information into a comprehensive tool or suite can be daunting. If the security solution provider has tools like alerts, reports or an API, start there. However, these tools are often limited and need to be supplemented by a solution with higher performance or a faster response time.
Log gathering tools are a higher performance option that allow many tools to feed into a single system. Once such a solution is in place, the next challenge is to build rules for sifting through the millions of ingested points of information. These rules provide human reviewers more details for making decisions. It may take several cycles to hone in on the rules that lead to successfully spotting suspicious or malicious activity and protecting customers.
4. Understand what’s behind the EDR hype.
What’s the buzz around EDR and why has it become such a topic for discussion? Fair question considering level of effort to stand up, manage, monitor and address a situation when it arise can be costly and time consuming. Simply having a security vendor “supports EDR” isn’t enough. Selecting a check box to satisfy a requirement is, again, only half of the equation.
So, why go through the time and expense of implementing EDR? Here are three top reasons:
- Cybersecurity insurance – With the rise of breaches across business and public sector landscapes, cybersecurity insurance on the rise. Many providers have requirements from governance to tools that meet a specific scope. EDR is one such requirement.
- Good practice – Having layers of protection for customers is important. Extending security offerings by adding an EDR solution with a process will increase that security footprint.
- Managed Security Service Provider (MSSP) – More and more MSPs are adding value to their customers by adding cybersecurity-specific services. With cybersecurity challenges on the rise, many service providers can increase revenue and provide greater security posture for their customers. Implementing an EDR solution will contribute to that effort.
5. Plan out next steps for adopting EDR at your MSP
- Evaluate the need. Investing in potentially costly new solutions because of a buzzword is not advisable.
- Determine the level of effort required to adopt an EDR solution and devise a plan for doing it.
- Review existing tools and determine if existing solutions are being leveraged most effectively today.
- Build the team. Part of the plan for adopting EDR should include designating a security team to both manage the solution and respond to its findings.
Simply selecting ticking an EDR box won’t necessarily contribute to client security. MSPs should evaluate the needs EDR will satisfy, the level of effort it takes to implement and how EDR fits into their overall service offering. Vendors won’t hesitate to offer “EDR solutions,” but it’s up to the MSP to properly implement and establish process to support expectations. Simply having the solutions does no good. EDR done right requires the additional team focus, rules, review and responses. Implement an EDR offering with caution and planning.
The post Fools Rush in: 5 Things MSPs Should Know Before Adopting EDR appeared first on Webroot Blog.
Reading Time: ~ 4 min.
In my previous blog post, Why Healthcare Organizations are Easy Targets for Cybercrime, I discussed various reasons that hospitals and healthcare organizations make desirable and lucrative targets for hackers. In this second installment, I’ll go over how criminals are attacking these organizations, the methods they use, and also what needs to be done to begin to address this dangerous threat.
Medical Device Compromise
As I mentioned in my first blog on this topic, there is a wide array of connected medical devices in a hospital environment. These devices can be classified into 5 broad categories:
- Consumer wearables, such as sleep pattern monitors, fitness trackers, etc.
- Patient monitoring devices, including insulin pumps, ECG, heart rate monitors etc.
- IVD, blood analyzers, etc.
- Embedded devices, such as pacemakers and implants
- In-house equipment, like medicine dispensing systems, MRI, CT, and X-ray machines, etc.
Devices like these can he hacked in an alarming number of ways. In addition to attacks that could endanger patients’ lives, such as remotely tampering with pacemakers or insulin pumps, these devices may be exploited to enable data theft or to gain access to other hospital infrastructure or systems. In one example from 2017, penetration tester Saurabh Harit managed to compromise a digital pen used for writing prescriptions, which gave him access to a patient database and scans of each prescription.
Learn how can endpoint protection help you secure your business.
Medical data is a valuable commodity that is openly traded on the dark web. Although hackers and automated malware are often to blame, old-fashioned user error can play a major role in these types of compromises. Phishing remains a preferred method for stealing data and infiltrating networks.
Some examples of stolen medical data include:
- Patient data. Identity and insurance fraud are relatively easy when you have access to the kinds of data medical organizations store about their patients. Additionally, this information can be used to charge expensive medical procedures, claim prescription drugs, or be exploited to breach other organizations outside of the healthcare industry. It can even be used for personal extortion and a host of other crimes.
- Administrative paperwork. Criminals may target medical licenses to forge prescriptions and commit other types of fraud or extortion.
- Prescription information. Criminals may forge prescriptions or drug labels and use them for purposes like fraud and even drug smuggling.
- Biometric data. As biometrics are increasingly used in security measures and law enforcement practices, records of fingerprints, ocular scans, and even heartbeats could be stolen and used for nefarious purposes.
Because the services that medical facilities provide are essential and often cannot be disrupted without serious risk to patients, ransomware is a weapon of choice. Many organizations have no choice but to pay the ransom, and some health facilities have had to shut down permanently due to these attacks.
Medical facilities worldwide have turned patients away, curtailed or suspended services, and even closed as a result of ransomware attacks. The groups that carry out these attacks have typically done recon on their targets to discover exactly how to breach them and which systems to encrypt to cause maximum disruption.
Of course, when we talk about ransomware affecting healthcare organizations, one attack stands out above them all: WannaCry. This nasty threat spread like wildfire across the world in 2017 and crippled many organizations through a combination of lateral wormlike propagation and machine-wrecking encryption. One of the largest and most publicized victims was the U.K.’s National Health Service. The attack “disrupted services across one-third of hospital trusts and around 8% of GP practices,” according to a report published by the NHS a year later. On top of that, ambulance services were affected and over 19,000 appointments were cancelled.
Despite the financial gains to be had when attacking healthcare organizations, WannaCry was actually an example of a cyber-weapon spreading far beyond its intended targets; the attack was not specifically aimed at the NHS or other health orgs affected.
Ultimately, WannaCry really highlighted the poor security practices prevalent in so many healthcare organizations. The NHS fell under a lot of scrutiny in the aftermath of the attack, particularly as Microsoft had issued a Windows® update that would have fixed the exploited vulnerability months before. Since then, the health service has undertaken a number of changes to shore up defenses.
According to a survey of industry Chief Information Security Officers (CISOs) by Carbon Black, the state of cybersecurity in healthcare is somewhat bleak, if unsurprising.
- 83% of surveyed healthcare organizations said they’ve seen an increase in cyberattacks over the past year.
- Two-thirds (66%) of surveyed healthcare organizations said cyberattacks have become more sophisticated over the past year.
- With increased adoption of medical and IoT devices, the surface area for healthcare attacks is becoming even larger.
- Limited cybersecurity staffing and stagnant cybersecurity budgets in the industry further compound the issues.
Other reports by security companies Thales and Fortinet paint a similar picture. A recent report in the HIPAA Journal puts data breaches at record levels in 2019.
What Needs to Happen
Healthcare’s poor track record when it comes to updates, patching and obsolete operating systems needs to be addressed—no question. Below are some of the other things that need to happen to improve security all around at hospitals and other healthcare practices.
- All staff members should be trained on security risks and best practices to avoid them.
- Medical device designers need to adopt security as a design principle ASAP.
- Hospitals and other facilities need to better audit and patch their devices, operating systems, applications, firmware, etc. to help eliminate vulnerabilities.
- Government initiatives and coordination are essential, not just for the public facilities they run but also for private practices.
- All healthcare practices should have antivirus and other cybersecurity solutions and should have access to security teams who can investigate any breaches to identify and address vulnerabilities.
- Access to devices, middleware, and APIs should be restricted where possible and secured.
And, finally, the “blame game” culture that pervades healthcare needs to be seen for what it really is: an obstacle to progress. Cybersecurity is a group effort that we should all share. From governing bodies to businesses to individual users, each of us has a role to play in creating a more secure connected world.
The post Healthcare Cyber Threats That Should Keep You up at Night appeared first on Webroot Blog.