Tag Archive: PCI
On False Senses of Security
Customer conversations are the best part of my job. I really enjoy talking with users and buyers of security technology, especially in today’s hyperactive threat and attack climate. Most often these conversations are with customers proactively planning updates to their security strategy, or with prospects that have matured to a level where their tools need to be upgraded to enterprise solutions. However, there is small percentage of organizations we speak with who have come to eEye as a result of breach or a failed audit. One of *those* conversations was the impetus for this post.
More [...]
Vulnerability Management in a Data Warehouse
Have you ever been asked, “How long has that vulnerability been in our systems?”
Have you ever wondered if your patch management process is keeping up with the number of new vulnerabilities being identified? Keep reading… More [...]
Too Many Regulatory Standards, Only One Tool Please
About every two years, I indulge myself with a new laptop. This time, I waited almost three years and will be retiring my old Dell XPS M1330 for a new Alienware M15x. I wanted raw horsepower for virtual machines in a laptop format and was not as concerned about battery life (since I carry an iPad for notes and email) or weight since I travel with a Targus TSB700 rolling backpack.
I started collecting all of the software I needed to rebuild my system and realized I have a quite a few solutions to install in order to meet my day-to-day work requirements. This includes everything from Microsoft Office 2010 and Nero 10, to all the solutions eEye offers and of course, gigabyte upon gigabyte of virtual machine sessions. This made me think about how many of these solutions are now bundles and suites compared to the standalone products of years ago. MS Office 2010 contains all the programs I need from word processing to presentations, and Nero, all the tools I could ever need to create promotional DVDs, website videos, and even system backups. As these tools add more features, they cover additional areas required by me for daily work in lieu of even more and more point solutions.
As solutions add more features, consider this example: a recent presales Request For Proposal (RFP) queried all the different regulatory standards and assessment standards we are able to support. These include out-of-the-box assessments, dedicated reports, flexible dashboards and best practices to help automate these processes. After a few minutes of digging around, I compiled this short list (not really short):
- SCAP – Security Content Automation Protocol
- CVE – Common Vulnerabilities and Exposures
- CVSS – Common Vulnerability Scoring System
- OVAL – Open Vulnerability and Assessment Language
- XCCDF – The eXtensible Configuration Checklist Description Format
- CCE – Common Configuration Enumeration
- CPE – Common Platform Enumeration
- STIG – Security Technical Implementation Guides
- IAVA – Information Assurance Vulnerability Alert
- FDCC – Federal Desktop Core Configuration
- USGCB – The United States Government Configuration Baseline
- CIS – The Center for Internet Security
- PCI – Payment Card Industry Security Standards Council
- HIPAA – The Health Insurance Portability and Accountability Act
- GLBA – The Gramm-Leach Bliley Act
- SOX – Sarbanes-Oxley Act
- ITIL –Information Technology Infrastructure Library
- COBiT – Common Objectives for Information and related Technology
- FERC-NERC – Federal Energy Regulatory Commission
- ISO – International Organization for Standardization
- MASS 201 – Commonwealth of Massachusetts 201
- NIST 800-53 – Recommended Security Controls for Federal Information Systems and Organizations
- BugTraq – Bugtraq
I realized after creating the list, that while many vendors offer point solutions for some of these standards and regulations, eEye offers all of these in one solution: Retina. For the same reason we use MS Office as a comprehensive tool for daily operations, Retina provides a single comprehensive tool for unified vulnerability management and meets the most common regulatory standards facing businesses today.
Now, if I had to go back and find point solutions for each, my cost would skyrocket and my learning curve would ramp up exponentially. I have seen companies use one solution for PCI and another for Configuration Compliance and Benchmarks (FDCC, CIS, USGCB, etc.). And many use a third solution for internal vulnerability assessment (rarely the same vendor due to cost), a fourth for patch management, and maybe even a fifth for any government requirements like STIGS and IAVAs or special projects.
There are many standards out there and so many different requirements, it is no wonder that security costs are rising and users are required to work harder to meet these regulations. To address this problem, eEye can provide a solution to these initiatives in a single tool and lower the cost of ownership. Wouldn’t you benefit from a single tool that can solve these requirements verses the alternatives?
PCI DSS 2.0
Yes its PCI time again.
PCI DSS 2.0 has just completed final review and is expected to come out next month. As indicated in the summary of changes document , there are no major changes expected. Refinements to better align standards, provide clarifications, increase merchant flexibility, and additional guidance on specific technologies including virtualization and web applications are expected (For example Requirement 2.2.1 will be clarified to further define the “one primary function per server” as it relates to virtualization).
Some of our customers were anticipating that the PCI severity levels were going to change. In fact, Requirement 6.2 is being adjusted to allow for a risk-based vulnerability assessment process so that those vulnerabilities with the highest ranking are addressed first, versus just patching everything within a 30 day period. This lends itself well to both Retina’s existing risk scoring capabilities and integrated patch module being released next month.
The updated standards are to be issued in final form on October 28th and are to be in effect on Tuesday, January 11, 2011. We continue to wait to see what PCI delivers in the way of details, and will rework our standard PCI reports to align with any changes to the 12 Requirements, shortly after it is released.
As a shameless plug, I should also mention that if you are in need of a PCI Approved Scanning Vendor (ASV), eEye is launching this service to our customers over the next several weeks. If you have the need, just contact our sales team.
Configuration Compliance and Regulatory Reporting
In recent years there have been an increasing number of legislated regulatory mandates with which organizations must comply with to prove the confidentiality, integrity and availability of information stored in their systems and provided through external parties. After reading various whitepapers, websites and other articles that loosely use the terms “PCI, HIPAA, SOX, CIS, NIST, ISO, CIS, COBiT, FISMA, and FDCC”, heads can start spinning. Like many of our customers and Retina users, I am not an auditor or a lawyer, but am constantly bombarded with these acronyms on a weekly basis. The acronyms listed above can be loosely broken down into three categories, or sets of instructions, which help organizations meet their compliancy and security goals: Regulations, Frameworks and Benchmarks.
In some cases the lines between the three can be blurry, but understanding their intent and relationship to one another can help you understand how these pieces can fit together to support an overall security and compliance program.
Regulations are legal restrictions created, governed and publicized by government administrative agencies. Regulations typically do not prescribe detail on how to perform, configure, or manage IT systems, but they clearly indicate the goals a security and compliance program must meet. Examples of these regulations are Sarbanes-Oxley, HIPAA, GLBA and Basel II (Europe). Several states are now requiring compliance to the Data Security Standard (DSS) . This standard outlines a set of international security requirements for safeguarding cardholder data. To comply with PCI DSS, organizations must also perform steps as known as validation requirements , which includes a requirement of quarterly scanning by a PCI approved scanning vendor.
Frameworks provide a defined support structure in which a project can be organized and developed. Frameworks are designed to provide a complete security program for an organization. These frameworks may be implemented to support the goals of multiple regulations, and often recommend that hardening best practices, or benchmarks, be used for technical protections. Examples of frameworks include: ITIL, CobiT and COSO, NIST 800-53, and ISO 17799 / 27002.
Benchmarks are often used to measure and monitor common elements related to the security and IT infrastructure known as “general computer controls”. Benchmarks outline a set of criteria (some of which may be mandatory), voluntary guidelines, and best practices. Whereas frameworks offer nonspecific goals, benchmarks offer prescriptive guidance over tests and settings that should be used to harden the IT environment and protect IT assets against specific risks. Examples of standards include vendor/customer best practices, CIS, FDCC, and DISA checklists.
The task of demonstrating adequate implementation, management, and monitoring of computer and detailed security controls is a challenge. Given the demands of our customers, we have enhanced the Retina scan engine and will soon be releasing a configuration compliance module that will provide drag and drop functionality for over 50 benchmarks spanning Microsoft, CIS, NIST, FDCC and others. This will allow customers to automate the vulnerability and compliance scanning over general computer controls that may be shared across multiple regulations and laws. This will allow organizations to monitor compliance to meet internal security goals. We will be also releasing reporting packs that include SOX, HIPAA, PCI, GLBA, NIST, FERC, MASS 201 that will map the controls being monitored back to the regulations and laws for which our customers need to report.
Get more information regarding eEye’s Compliance and Regulatory solutions >>
The Importance of Web Application Scanning
The art of hacking a computer, operating system, and application has evolved over time. What was once seen as relatively simple hacks have been suppressed due to various intrusion prevention mechanisms developed by network security companies. Breaching a company’s perimeter to gain direct unauthorized access to an organization’s network is not as simple as it used to be…or as simple as some people think. Modern networks include multiple firewalls, network vulnerability assessment scanners, intrusion prevent products, and endpoint protection solutions all defending critical infrastructure. Restricted by these defenses, hackers have been aggressively testing other ways to breach corporate and government networks.
Even with the best security plans and technology, hackers have identified holes in the most common infrastructure, one of which until relatively recently, organizations did not consider: Web Applications. According to The Web Application Security Consortium 99% of web application are not compliant with PCI DSS standard requirements, and 48% of web applications are not compliant with criteria of ASV scanning by PCI DSS. By design, many web applications are publicly available on the internet and are designed to market and service business transactions for organizations and fall under these regulations. This provides hackers with direct and easy access to your business, and provides virtually unlimited attempts for them to test their hacks against your application. Since the revolution of using the internet for conducting business, organizations have been able to connect seamlessly with suppliers, customers and other business related associates. This has now left many applications exposed to a plethora of previously unknown security risks such as SQL Injection, Cross Site Scripting etc.
Web applications are now one of the biggest threats to an organizations security. Inherently they are much more difficult to defend versus traditional applications that benefit from the security infrastructure that has been already deployed. In order to detect and properly defend against web application threats you must first have the capability to identify these vulnerabilities. This includes performing web application vulnerability assessment scanning.
By definition, web application scanner is an automated vulnerability assessment solution that crawls a website (either automatically or has been trained) looking for vulnerabilities within web apps. The solution analyzes all web pages and files that it finds, and builds a structure of the entire website. The scanner then performs automated checks against security vulnerabilities by launching a series of common web attacks and analyzes the results for vulnerabilities.
Considering the overall process, and complexity of modern web applications, here are a few important features to consider:
- The ability to crawl a website regardless of technology and analyze the results.
- Merge traditional (operating system and application) and web application vulnerability assessment data in one report to reveal the current overall security posture for a system.
- Provide reports with actionable details such that administrators and developers can correct the flaws in a timely manner
The best way to identify web application security threats is to perform web application vulnerability assessment. The importance of these threats could leave your organization exposed if they are not properly identified and mitigated. Therefore, implementing a web application scanning solution should be of paramount importance for your organizations security plans in the future.
For additional information, read Chris Silva’s blog regarding Mass Infection via SQL Injection and how web application vulnerability scanning can protect you from such thing: Mass Infection via SQL Injection
