DOCSLIB.ORG

Poster: Exploitation of Vulnerabilities - If, When and How Often

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
Poster: Exploitation of Vulnerabilities - If, When and How Often Poster: Exploitation of vulnerabilities - if, when and how often Kartik Nayak∗, Daniel Marinoy, Petros Efstathopoulosy, Tudor Dumitrasz, [email protected], Daniel [email protected], Petros [email protected], [email protected] ∗Student, University Of Maryland, College Park ySymantec Research Labs zAssistant Professor, University Of Maryland, College Park I. INTRODUCTION best of our knowledge, the size and variability of attack surfaces has not been evaluated empirically in the field. It is, In order to improve the security of our software systems, therefore, difficult to determine the effectiveness of this metric we need to be able to measure how they are impacted by in capturing real-world conditions. the various defensive techniques introduced to the system. Measuring security, however, is challenging. Many security metrics have been proposed, including the total count of These examples illustrate that our ability to assess the vulnerabilities in source code, the severity of these vulner- security of systems that are deployed and actively utilized abilities, the size of the attack surface and the time window is currently limited by the metrics being used. In particular, between the vulnerability disclosure and the release of a patch. the developers and the users may employ different security System administrators and security analysts often rely on these metrics. For example, one way of estimating the vulnerability metrics to assess risk and to prioritize some patches over density and the attack surface is to use existing tools that others, while developers use them as guidelines for improving measure these properties by directly analyzing the code and software security. Practical experience, however, suggests that the configuration of the system in question [5], [6]. However, the existing security metrics exhibit a low level of correlation these measurements are conducted in lab conditions, and do with vulnerabilities and attacks, and they do not provide an not reflect the real-world security of systems that are deployed adequate assessment of security [1], [2]. and actively used in the field. The total number of vulnerabilities discovered in source code is commonly used as a measure of the system’s secu- For these reasons, users are ultimately interested in metrics rity [1], [2]. However, this metric does not account for the fact that help them assess the effectiveness of these techniques in that cyber attackers never make use of some of the discovered the field. Figure 1 illustrates this problem. The total number vulnerabilities, which may be hard to successfully exploit in of vulnerabilities discovered in the code-base of Windows the presence of security technologies such as data execution OSes does not follow a clear trend with respect to the OS prevention (DEP) and address space layout randomization release date. Basing the evaluation of system security on this (ASLR). For example, CVE-2007-1748 was exploited in the metric would lead to the conclusion that security has not wild, but there is no similar evidence for CVE-2007-1749. improved considerably over the past decade. However, the number of vulnerability exploits exhibits a decreasing trend Another popular metric is based on the observation that over time,which suggests the existence of deployment-specific attacks can succeed only if the vulnerable software accepts factors, yet to be characterized systematically, that influence input from potential attackers. For this reason, system admin- the security of systems in active use. istrators have long advocated turning off unnecessary system services to avoid exposure to exploits of unpatched or unknown vulnerabilities. For example, network-based attacks exploiting Our goal in this work is to propose new metrics that better CVE-2007-1748 are unsuccessful—even if the vulnerability reflect security in the real world and to employ these metrics was not yet patched—if the DNS server is not running. for evaluating the security of popular software. Rather than This idea is formalized in the concept of attack surface [3], measuring security in lab conditions, we derive metrics from [4], which proposes quantifying the amount and severity of field-gathered data and we study the trends for vulnerabilities potential attack vectors that a system exposes using a formula and attack surfaces exercised in attacks observed in the real that takes into account the open sockets and RPC endpoints, world. These metrics try to capture the notion of whether the running services and the privilege at which they are disclosed vulnerabilities are exploited and how often they are running, the active Web handlers, the accounts enabled, etc. exploited. While the vulnerability count and the attack surface Reducing the attack surface, however, does not always improve are metrics that capture the opportunities available to attack- security; for example, including security mechanisms in the OS ers, we instead focus on attempted, though not necessarily may increase the attack surface, but render the system more successful, attacks in the field. This new understanding will secure. Furthermore, the attack surface of software products allow developers, system administrators and policy makers to changes after they are deployed in the field, as users install improve security by focusing on the attacks and vulnerabilities new applications and modify system configuration. To the that matter most in practice. XP SP2 64-bit Windows 2000 SP4 60 XP SP2 64-bit 200 Server 2003 50 XP SP2 XP SP3 Windows 2000 Windows 2000 XP SP1 64-bit Windows 2000 SP4 Windows 2000 SP3 150 XP Server 2003 SP2 64-bit XP SP1 Server 2003 Server 2003 SP2 40 XP XP SP2 Vista SP1, Vista SP1 64-bit Server 2008 SP1, Server 2008 SP1 64-bit Windows 2000 SP3 Vista SP2, Vista SP2 64-bit Windows 7, Windows 7 64-bit Server 2003 SP1 XP SP1 64-bit 100 XP SP1 30 Server 2003 SP1 64-bit Server 2008 SP2 Server 2008 R2 64-bit Server 2008 R2 SP1 64-bit XP SP3 Server 2008 SP2 64-bit Server 2003 SP2 64-bit Server 2003 SP1,Server 2003 SP1 64-bit Server 2003 SP2 Vulnerabilities exploited Vulnerabilities Vulnerabilities disclosed Vulnerabilities Windows 7 SP1 20 Vista SP1, Vista SP1 64-bit 50 Windows 7 SP1 64-bit Server 2008 SP1, Server 2008 SP1 64-bit Vista, Vista 64-bit Windows 2000 SP2 Vista, Vista 64-bit Vista SP2, Vista SP2 64-bit Windows7, Windows 7 64-bit 10 Server 2008 SP2 Server 2008 SP2 64-bit Windows 2000 SP1 Windows 2000 SP2 Server 2008 R2 SP1 64-bit Server 2003 R2 Server 2008 R2 64-bit 0 Server 2003 R2 64-bit Windows 7 SP1, Windows 7 SP1 64-bit 2000 2005 2010 2015 2000 2005 2010 2015 Release date Release date (a) All vulnerabilities disclosed publicly. (b) Vulnerabilities exploited in the wild. Fig. 1. Number of vulnerabilities disclosed and exploited for Microsoft Windows over 11 years of releases, estimated using the National Vulnerability Database and WINE. No clear trend exists for total number of vulnerabilities disclosed but number of vulnerabilities actually exploited in the field decreases with newer OSes. II. PROPOSED METRICS is used to compute the exploitation metrics. Using the binary reputation dataset, we find the products installed on the hosts. We propose several metrics, derived from field-gathered The IPS telemetry dataset identifies an attack on a host. data, that capture the state of system security as experienced Knowing the products installed on the host as well as the by the users. signatures corresponding to vulnerabilities, relevant attacks on The following metrics capture the notion of whether dis- the hosts can be detected. This information can be used to closed vulnerabilities get exploited. compute the attack volume and attack surface metrics. 1) Count of vulnerabilities exploited in the wild. IV. CONCLUSION 2) Exploitation ratio. The exploitation ratio is the pro- portion of disclosed vulnerabilities for product p that Our ability to improve system security rests on our under- have been exploited up until time t. It captures the standing of how to measure and assess security under real- likelihood that a vulnerability will be exploited. world conditions. We believe that our metrics would better reflect security in the real world and help evaluate the security We also propose the following metrics that capture how often of softwares. This can help the design of future security vulnerabilities are exploited on hosts in the wild. technologies. 1) Attack Volume. The attack volume is a measure that REFERENCES captures how frequently a product p is attacked. 2) Exercised Attack Surface. The exercised attack sur- [1] Y. Shin, A. Meneely, L. Williams, and J. A. Osborne, “Evaluating complexity, code churn, and developer activity metrics as indicators face captures the portion of the theoretical attack of software vulnerabilities,” IEEE Trans. Software Eng., vol. 37, no. 6, surface of a host that is targeted in a particular month. pp. 772–787, 2011. [2] T. Zimmermann, N. Nagappan, and L. A. Williams, “Searching for a III. EXPERIMENTAL METHODS needle in a haystack: Predicting security vulnerabilities for windows vista,” in ICST, 2010, pp. 421–428. We use the National Vulnerability Database (NVD) [7], [3] M. Howard, J. Pincus, and J. M. Wing, “Measuring relative attack Symantec attack signatures [8], [9] and Symantec’s Worldwide surfaces,” in Workshop on Advanced Developments in Software and Intelligence Network Environment (WINE) [10] for our study. Systems Security, Taipei, Taiwan, Dec 2003. The NVD is a widely accepted database for research related to [4] P. K. Manadhata and J. M. Wing, “An attack surface metric,” IEEE software vulnerabilities. Symantec security products include an Trans. Software Eng., vol. 37, no. 3, pp. 371–386, 2011. extensive database of attack signatures obtained from Syman- [5] Microsoft Corp., “Microsoft Attack Surface Analyzer - Beta,” http://bit.ly/A04NNO. tec’s intrusion-protection systems as well as descriptions of [6] Coverity, “Coverity scan: 2011 open source integrity report,” 2011.
Load more

Recommended publications
  • Enhanced Security Administrative Environment Helps Prevent Compromise of Administrative Credentials from Cyber-Attacks
    Enhanced Security Administrative Environment Helps prevent compromise of administrative credentials from cyber-attacks Enhanced Security Administration Production Resources Protections for your most valuable accounts Overview Provide an enhanced security environment Cyber-attackers have been very successful at rapidly for administrative accounts gaining administrative access to corporate and government Implement advanced security tools computing environments. These devastating attacks result including exploit technique mitigations, in malicious actors with full remote access to most or all of attack surface analysis, and application an organization’s electronic documents, presentations, whitelisting applications, databases, and other intellectual property. Separate admin and user accounts Recovery from these attacks is extremely difficult, slow, and Enforce two-factor authentication for expensive. admins Restrict admin accounts to high trust The Enhanced Security Administrative Environment (ESAE) computers offering is designed to help thwart a critical element of Restrict internet browsing and other high- these credential theft attacks by limiting exposure of risk activities for administrative accounts administrative credentials. Monitoring of enhanced security environment and production Domain How the Offering Works Controllers (DCs) for security events and The ESAE offering leverages advanced technologies and operational health recommended practices to provide an administrative Easy to use for administrators environment and
    [Show full text]
  • Windows 2012 Server Network Security Save 30% on Syngress Books and Ebooks
    Windows 2012 Server Network Security Save 30% on Syngress books and eBooks n Save 30% on all Syngress books and eBooks at the Elsevier Store when you use promo code CW3013. n Free shipping on all orders. No minimum purchase. n Offer valid only on Syngress books sold by the Elsevier store until 31 December 2014. Click here to order a copy of: Windows Server 2012 Server Network Security How it works: 1. Choose a Syngress title. 2. Add the title to your shopping cart. 3. Click on “Enter Discount Code” in your shopping cart. 4. Enter code CW3013 to obtain your discount and click apply. Windows 2012 Server Network Security Securing Your Windows Network Systems and Infrastructure Derrick Rountree Richard Hicks, Technical Editor AMSTERDAM • BOSTON • HEIDELBERG • LONDON NEW YORK • OXFORD • PARIS • SAN DIEGO SAN FRANCISCO • SINGAPORE • SYDNEY • TOKYO Syngress is an Imprint of Elsevier Acquiring Editor: Chris Katsaropoulos Editorial Project Manager: Heather Scherer Project Manager: Priya Kumaraguruparan Designer: Mark Rogers Syngress is an imprint of Elsevier 225 Wyman Street, Waltham, MA 02451, USA Copyright © 2013 Elsevier Inc. All rights reserved. No part of this publication may be reproduced or transmitted in any form or by any means, electronic or mechanical, including photocopying, recording, or any information storage and retrieval system, without permission in writing from the publisher. Details on how to seek permission, further information about the Publisher’s permissions policies and our arrange- ments with organizations, such as the Copyright Clearance Center and the Copyright Licens- ing Agency, can be found at our website: www.elsevier.com/permissions.
    [Show full text]
  • Mitigating Pass-The-Hash and Other Credential Theft, Version 2
    Mitigating Pass-the-Hash and Other Credential Theft, version 2 Trustworthy Computing Trustworthy Computing 1 Legal disclaimer This document is for informational purposes only. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED, OR STATUTORY, AS TO THE INFORMATION IN THIS DOCUMENT. This document is provided “as-is.” Information and views expressed in this document, including URL and other Internet website references, may change without notice. You bear the risk of using it. Microsoft, Windows, Active Directory, Forefront, Windows Server, and Windows Vista are either registered trademarks or trademarks of Microsoft Corporation in the United States and/or other countries. Copyright © 2014 Microsoft Corporation. All rights reserved. The names of actual companies and products mentioned herein may be the trademarks of their respective owners. 2 Mitigating Pass-the-Hash and Other Credential Theft, version 2 Acknowledgments Writers Patrick Jungles Mark Simos Ben Godard Joe Bialek Matthew Bucher Cal Waits William Peteroy Thomas Garnier Contributors Aaron Margosis Eric Leonard Michael Howard Aaron Tebrink Eric Mitchell Michael Poole Adam Stasiniewicz Eugene Siu Michael Scovetta Al Tieman Georgeo Pulikkathara Michiko Short Andrea Piazza Glenn Pittaway Nate Morin Andrew Idell Graham Calladine Nathan Ide Arden White Hasnat Naveed Nicholas DiCola Bill Talbot James Noyce Patrick Arnold Chris Betz Joe Corey Paul Cullimore Chris Hale John Rodriguez Roger Grimes Chris Jeuell John Wall Ted Daley Cristin Goodwin Joshua Talbot Tom Stolk Cynthia Sandvick Keith
    [Show full text]
  • Windows Server 2012 Security from End to Edge and Beyond Save 30% on Syngress Books and Ebooks
    Windows Server 2012 Security from End to Edge and Beyond Save 30% on Syngress books and eBooks n Save 30% on all Syngress books and eBooks at the Elsevier Store when you use promo code CW3013. n Free shipping on all orders. No minimum purchase. n Offer valid only on Syngress books sold by the Elsevier store until 31 December 2014. Click here to order a copy of: Windows Server 2012 Security from End to Edge and Beyond How it works: 1. Choose a Syngress title. 2. Add the title to your shopping cart. 3. Click on “Enter Discount Code” in your shopping cart. 4. Enter code CW3013 to obtain your discount and click apply. Windows Server 2012 Security from End to Edge and Beyond Architecting, Designing, Planning, and Deploying Windows Server 2012 Security Solutions Thomas W. Shinder Yuri Diogenes Debra Littlejohn Shinder Richard Hicks, Technical Editor AMSTERDAM • BOSTON • HEIDELBERG • LONDON NEW YORK • OXFORD • PARIS • SAN DIEGO SAN FRANCISCO • SINGAPORE • SYDNEY • TOKYO Syngress is an Imprint of Elsevier Acquiring Editor: Chris Katsaropoulos Editorial Project Manager: Benjamin Rearick Project Manager: Punithavathy Govindaradjane Designer: Alan Studholme Syngress is an imprint of Elsevier 225 Wyman Street, Waltham, MA 02451, USA Copyright © 2013 Elsevier, Inc. All rights reserved. No part of this publication may be reproduced or transmitted in any form or by any means, electronic or mechanical, including photocopying, recording, or any information storage and retrieval system, without permission in writing from the publisher. Details on how to seek permission, further information about the Publisher's permissions policies and our arrangements with organizations such as the Copyright Clearance Center and the Copyright Licensing Agency, can be found at our website: www.elsevier.com/permissions.
    [Show full text]
  • Secure Coding in C and C++ Second Edition the SEI Series in Software Engineering Software Engineering Institute of Carnegie Mellon University and Addison-Wesley
    Secure Coding in C and C++ Second Edition The SEI Series in Software Engineering Software Engineering Institute of Carnegie Mellon University and Addison-Wesley Visit informit.com/sei for a complete list of available publications. he SEI Series in Software Engineering is a collaborative undertaking of the TCarnegie Mellon Software Engineering Institute (SEI) and Addison-Wesley to develop and publish books on software engineering and related topics. The common goal of the SEI and Addison-Wesley is to provide the most current information on these topics in a form that is easily usable by practitioners and students. Titles in the series describe frameworks, tools, methods, and technologies designed to help organizations, teams, and individuals improve their technical or management capa- bilities. Some books describe processes and practices for developing higher-quality soft- ware, acquiring programs for complex systems, or delivering services more effectively. Other books focus on software and system architecture and product-line development. Still others, from the SEI’s CERT Program, describe technologies and practices needed to manage software and network security risk. These and all titles in the series address critical problems in software engineering for which practical solutions are available. Make sure to connect with us! informit.com/socialconnect Secure Coding in C and C++ Second Edition Robert C. Seacord Upper Saddle River, NJ • Boston • Indianapolis • San Francisco New York • Toronto • Montreal • London • Munich • Paris • Madrid Capetown • Sydney • Tokyo • Singapore • Mexico City The SEI Series in Software Engineering Many of the designations used by manufacturers and sellers to distinguish their products are claimed as trade- marks.
    [Show full text]
  • Quizzes Security
    أﻣن اﻟﺗطﺑﯾﻘﺎت واﻟﻣﻌطﯾﺎت اﻟدﻛﺗور ﺳﺎﻣﻲ ﺧﯾﻣﻲ ISSN: 2617-989X Boo ks أمن التطبيقات والمعطيات الدكتور سامي الخيمي من منشورات الجامعة اﻻفتراضية السورية الجمهورية العربية السورية 2018 هذا الكتاب منشور تحت رخصة المشاع المبدع – النسب للمؤلف – حظر اﻻشتقاق )CC– BY– ND 4.0( https://creativecommons.org/licenses/by-nd/4.0/legalcode.ar يحق للمستخدم بموجب هذه الرخصة نسخ هذا الكتاب ومشاركته وإعادة نشره أو توزيعه بأية صيغة وبأية وسيلة للنشر وﻷية غاية تجارية أو غير تجارية، وذلك شريطة عدم التعديل على الكتاب وعدم اﻻشتقاق منه وعلى أن ينسب للمؤلف اﻷصلي على الشكل اﻵتي حصرا : سامي خيمي، اﻹجازة في تقانة المعلومات، من منشورات الجامعة اﻻفتراضية السورية، الجمهورية العربية السورية، 2018 متوفر للتحميل من موسوعة الجامعة /https://pedia.svuonline.org Data and application security Sami Khiami Publications of the Syrian Virtual University (SVU) Syrian Arab Republic, 2018 Published under the license: Creative Commons Attributions- NoDerivatives 4.0 International (CC-BY-ND 4.0) https://creativecommons.org/licenses/by-nd/4.0/legalcode Available for download at: https://pedia.svuonline.org/ ISSN: 2617-989X وثيقة تعريف المادة المقرر: أمن البيانات والتطبيقات. رمز المقرر: IWB404 ملخص: يقدم محتوى المادة مقاربة لموضوع أمن المعلومات من منظور سوية التطبيقات بالتركيز على حقيقة أن اﻷمن كالسلسلة قوي بقوة أضعف حلقة في هذه السلسلة. إن طبيعة و تنوع واختﻻف معايير تطوير تطبيقات الوب والتقنيات التي يستخدمها المطورون يجعل من سوية التطبيقات من أكثر اﻷهداف عرضة للهجومات الموجهة إلى أنظمة المعلومات. يركز المحتوى في هذه المادة على إعطاء الطالب فكرة نظرية و تطبيقية عن أكثر الهجومات شيوعاً والتي تؤثر على سوية التطبيقات مع التركيز على الذهنية و اﻹجارئية المستخدمة من قبل المخترقين في تنفيذ الهجوم إضافة إلى اﻷدوات المستخدمة لهذا الغرض.
    [Show full text]
  • Certified Network Defense (CND) V2-Outline 1. INTRODUCTION
    CND Outline Certified Network Defense (CND) v2-Outline 1. INTRODUCTION CNDv2 Module 01: Network Attacks and Defense Strategies LO#01: Explain essential terminologies related to network security attacks . Asset . Threat Threats Sources o Natural o Unintentional o Intentional . Internal . External Threat Actors/Agents o Hacktivist o Cyber Terrorists o Suicide Hackers o State-Sponsored Hackers o Organized Hackers o Script Kiddies o Industrial Spies o Insider . Vulnerability Common Reasons behind the Existence of Vulnerability Network Security Vulnerabilities: Technological Network Security Vulnerabilities: Configuration Network Security Vulnerabilities: Security Policy . Risk o Risk Levels o Risk Matrix . Attack o Intent-Motive-Goal Certified Network Defender Copyright © by EC-Council All Rights Reserved. Reproduction is Strictly Prohibited. CND Outline o Tactics-Techniques-Procedures (TTPs) LO#02: Describe the various examples of network-level attack techniques o Reconnaissance Attacks o Network Scanning o Port Scanning o DNS Footprinting o Network Sniffing o Man-in-the-Middle Attack o Password Attacks Password Attack Techniques . Dictionary Attack . Brute Forcing Attacks . Hybrid Attack . Birthday Attack . Rainbow Table Attack o Privilege Escalation o DNS Poisoning o DNS Cache Poisoning o ARP Poisoning o DHCP Starvation Attacks o DHCP Spoofing Attack o Switch Port Stealing o MAC Spoofing/Duplicating o Network-based Denial-of-Service Attack (DoS) o Distributed Denial-of-Service Attack (DDoS) o Malware Attacks o Advanced Persistent Threats (APTs) LO#03: Describe the various examples of application-level attack techniques SQL Injection Attacks Cross-site Scripting (XSS) Attacks Parameter Tampering Directory Traversal Cross-site Request Forgery (CSRF) Attack Certified Network Defender Copyright © by EC-Council All Rights Reserved.
    [Show full text]
  • RESILIENT CLOUD COMPUTING and SERVICES by Farah Emad Fargo Copyright © Farah E. Fargo 2015 a Dissertation Submitted to the Fa
    Resilient Cloud Computing and Services Item Type text; Electronic Dissertation Authors Fargo, Farah Emad Publisher The University of Arizona. Rights Copyright © is held by the author. Digital access to this material is made possible by the University Libraries, University of Arizona. Further transmission, reproduction or presentation (such as public display or performance) of protected items is prohibited except with permission of the author. Download date 06/10/2021 16:18:40 Link to Item http://hdl.handle.net/10150/347137 RESILIENT CLOUD COMPUTING AND SERVICES By Farah Emad Fargo Copyright © Farah E. Fargo 2015 A Dissertation Submitted to the Faculty of the DEPARTMENT OF ELECTRICAL AND COMPUTER ENGINEERING In Partial Fulfillment of the Requirements For the Degree of DOCTOR OF PHILOSOPHY In the Graduate College THE UNIVERSITY OF ARIZONA 2015 THE UNIVERSITY OF ARIZONA GRADUATE COLLEGE As members of the Dissertation Committee, we certify that we have read the dissertation prepared by Farah E. Fargo entitled ―RESILIENT CLOUD COMPUTING AND SERVICES‖ and recommend that it be accepted as fulfilling the dissertation requirement for the Degree of Doctor of Philosophy _________________________________________________________Date: 1/7/15 Dr. Salim Hariri _________________________________________________________Date: 1/7/15 Dr. Ali Akoglu _________________________________________________________Date: 1/7/15 Dr. Janet Wang Final approval and acceptance of this dissertation is contingent upon the candidate's submission of the final copies of the dissertation
    [Show full text]
  • Some Vulnerabilities Are Different Than Others: Studying Vulnerabilities and Attack Surfaces in the Wild
    Some Vulnerabilities Are Different Than Others Studying Vulnerabilities and Attack Surfaces in the Wild * y y * Kartik Nayak , Daniel Marino , Petros Efstathopoulos , Tudor Dumitras, *University of Maryland, College Park ySymantec Research Labs Abstract The security of deployed and actively used systems is a moving target, influenced by factors not captured in the existing security metrics. For example, the count and severity of vulnerabilities in source code, as well as the corresponding attack surface, are commonly used as measures of a software product's security. But these measures do not provide a full picture. For instance, some vulnerabilities are never exploited in the wild, partly due to security technologies that make exploiting them difficult. As for attack surface, its effectiveness has not been val- idated empirically in the deployment environment. We introduce several security metrics derived from field data that help to complete the picture. They include the count of vulnerabilities exploited and the size of the attack surface actually exercised in real-world attacks. By evaluating these metrics on nearly 300 mil- lion reports of intrusion-protection telemetry, collected on more than six million hosts, we conduct an empirical study of security in the deployment environment. We find that none of the products in our study have more than 35% of their dis- closed vulnerabilities exploited in the wild. Furthermore, the exploitation ratio and the exercised attack surface tend to decrease with newer product releases. We also find that hosts that quickly upgrade to newer product versions tend to have reduced exercised attack-surfaces. The metrics proposed enable a more complete assessment of the security posture of enterprise infrastructure.
    [Show full text]
  • D2.5 Threat Actors' Attack Strategies
    Advanced Cyber–Threat Intelligence, Detection, and Mitigation Platform for a Trusted Internet of Things Grant Agreement: 786698 D2.5 Threat actors’ attack strategies Work Package 2: Cyber–threat landscape and end–user requirements Document Dissemination Level PU Public X CO Confidential, only for members of the Consortium (including the Commission Services) Document Due Date: 31/12/2018 Document Submission Date: 31/12/2018 Co–funded by the Horizon 2020 Framework Programme of the European Union D2.5 Threat actors’ attack strategies Document Information Deliverable number: D2.5 Deliverable title: Threat actors’ attack strategies Deliverable version: 1.00 Work Package number: WP2 Work Package title: Cyber–threat landscape and end–user requirements Due Date of delivery: 31/12/2018 Actual date of delivery: 31/12/2018 Dissemination level: PU Editor(s): Konstantinos Limniotis (UOP) Contributor(s): Nicholas Kolokotronis, Costas Vassilakis, Nicholas Kalouptsidis, Konstantinos Limniotis, Konstantinos Ntemos, Christos–Minas Mathas, Konstantinos–Panagiotis Grammatikakis (UOP) Dimitris Kavallieros, Giovana Bilali (KEMEA) Stavros Shiaeles, Bogdan Ghita, Julian Ludlow, Salam Ketab, Hussam Mohammed, Abdulrahman Alruban (CSCAN) Reviewer(s): Pavué Clément (SCORECHAIN) Michele Simioli (MATHEMA) Project name: Advanced Cyber–Threat Intelligence, Detection, and Mitigation Platform for a Trusted Internet of Things Project Acronym Cyber–Trust Project starting date: 01/05/2018 Project duration: 36 months Rights: Cyber–Trust Consortium Copyright Cyber–Trust Consortium.
    [Show full text]
  • Segmentation and Shared Active Directory of a Cardholder Data Environment
    Segmentation and Shared Active Directory of a Cardholder Data Environment This is something that many QSAs (Qualified Security Assessors) are unable to agree on and I’ve been involved in many discussions for and against utilising a shared Microsoft Windows Active Directory (AD) infrastructure. As I’ve already written about, this is something that in the past I have not allowed because when I used to do penetration testing, the ability to compromise the whole Windows Domain from simply gaining administrative access to a domain joined host was usually trivial. That said, one could argue that this was due to the configuration of AD and the security of the Windows systems supporting it. From a PCI DSS perspective, the PCI SSC guidance “Information Supplement: Guidance for PCI DSS Scoping and Network Segmentation” (https://www.pcisecuritystandards.org/documents/Guidance- PCI-DSS-Scoping-and-Segmentation_v1_1.pdf) (Referred to as the PCI SSC Scoping Guidance herein) includes the use of Microsoft AD as a ‘Shared Service’, meaning that the same Microsoft AD can be used to service the in-scope Cardholder Data Environment (CDE) and the not-in-scope environments. This still finds me somewhat uneasy and I would still highly recommend designing a separate Microsoft AD environment to support the CDE and non-CDE environment as sharing a Microsoft AD environment will introduce unnecessary risks to the CDE and the cardholder data (CHD) being handled. Mis-configurations over time to a shared Microsoft AD will only increase the chances of a compromise, therefore this is an important risk that must be managed well to ensure the environment stays secure.
    [Show full text]
  • Ask WINE: Are We Safer Today? Evaluating Operating System Security Through Big Data Analysis Position Paper
    Ask WINE: Are We Safer Today? Evaluating Operating System Security through Big Data Analysis Position Paper Tudor Dumitras, and Petros Efstathopoulos Symantec Research Labs {tudor_dumitras, petros_efstathopoulos}@symantec.com ABSTRACT errors are unavoidable and that the volume of security vulnerabilities exploited grows with the size of the oper- The Internet can be a dangerous place: 800,000 new mal- ating system’s code base [4]. Meanwhile, operating sys- ware variants are detected each day, and this number tems have evolved as well. Today, they have reduced at- is growing at an exponential rate—driven by the quest tack surfaces—the number and importance of attack vec- for economic gains. However, over the past ten years tors that viruses have at their disposal (e.g., open sockets operating-system vendors have introduced a number of that may receive a buffer overflow exploit) [3]—and se- security technologies that aim to make exploits harder curity updates patching vulnerabilities are released fre- and to reduce the attack surface of the platform. Faced quently. For example, during the last 10 years several with these two conflicting trends, it is difficult for end- security technologies have been added to the Windows users to determine what techniques make them safer operating system, such as software data execution pre- from Internet attacks. In this position paper, we argue vention (safe structured exception handling), hardware that to answer this question conclusively we must ana- data execution prevention (the NX bit), or address space lyze field data collected on real hosts that are targeted layout randomization (ASLR). Many of these technolo- by attacks—e.g., the approximately 50 million records of gies are able to protect not only the operating system, but anti-virus telemetry available through Symantec’s WINE also the running programs.
    [Show full text]