The news has recently been littered with stories of scams and computer worms that are compromising data and personal information–even when protective security measures were in place. Recent examples of mainstream malware include:
–PDF Virus: Vulnerabilities in PDF files, commonly used to share documentation and other trusted information resulted in malware that can be activated without even opening the PDF document.
–Phishing in a recession: The economic downturn has created an opportunity for phishers, who can often solicit those desperate to find a job or quickly gain what’s been lost from their 401k. According to Gartner, more than 5 million U.S. consumers lost money to phishing attacks in the 12 months ended September 2008. The number of consumers affected was nearly 40% higher than the year prior.
–Conficker worm: While its awakening on Apr. 1 did not result in the “Death of the Internet,” the Conficker worm still infects millions of PCs worldwide.
–Twitter worm: Twitter was initially hit with an XSS worm (Cross Site Scripting), and now a Twitter worm taunts celebrities with huge followings.
These attacks, some of which were preventable, bypassed security measures of some of the top organizations and claimed their victims. Why are these protective measures proving to be ineffective? The answer lies in the realm of the negative and unknown.
“Negative” security, or the ability to detect and thwart “known bad” events, has provided a layer of security assurance for years. The ability to block known viruses, worms and other “bad” event signatures has kept many systems from being compromised.
The most widely known example of the negative security model is the classic anti-virus product, which checks the subject document against a database of known virus signatures, alerting and blocking if a match is found and a virus is detected. The document is then considered unsafe and is not allowed to be opened.
If a document contains a virus that is not in the database, the document is considered safe, even though it contains a damaging virus. This results in a false-negative security condition. The false-negative security condition (where a problem exists but goes undetected) is arguably the worst condition a security manager wants to face.
Trust is artificially placed in a document that is untrustworthy, and the hapless user who receives the document has no clue about the hidden problem.
The negative security model isn’t bad; in fact, it’s essential. It just isn’t enough.
As users, we feel safe when our security product has blocked an attack that would have otherwise compromised our system. But when’s the last time you saw an actual virus get blocked? New attacks have come along and are outside the scope of the negative security model. The threat landscape has changed, but we’re still relying on a model that has proven to be ineffective on its own.
A “positive” security model identifies scenarios with a known degree of trust, only allowing access to trusted resources. The positive model assumes that a new scenario is un-trusted, and requires that trust be assigned before access and usage is granted. In the classic positive security model, only known good requests and known good results are delivered.
An example of the positive security model exists in protecting Web sites. If a Web application designer only intends a form to accept one of the 50 U.S. states, then a list of those 50 states is the only valid input. Input that contains the valid name of a single state is valid, and any other input is rejected as invalid.
Because positive security involves granular risk-weighted decisions, implementing it is a highly dynamic process. Risks are constantly changing, as both the threat surface and risk-tolerance of the Internet economy react and evolve. Positive security is built through the interaction of policy, profiling and learning. However, positive security alone can have high-management overhead in most environments. The fluidity and complexity of today’s applications demand that the best aspects of positive and negative security be used in concert.
Both the positive and negative security models have attractive characteristics that allow them to stand on their own. However, these models are best used together in an interactive fashion to provide unparalleled defense in depth.
The Payment Card Industry (PCI) Security Standards Council has also recognized the need for both positive and negative security in the PCI Data Security Standard (PCI DSS, or simply PCI).
The combination allows the negative security technologies to quickly perform triage, discarding events that are clearly erroneous. The combination also allows for simplified management and administration, offering a more streamlined technical security analysis process.
Today’s threats and regulations demand the holistic security management that is achieved by combining these measures in innovative ways to both protect and enable secure business.
Kurt Roemer is chief security strategist at Citrix Systems.