In this RSA 2010 presentation, Enrique Salem argues that the proliferation of ubiquitous connectivity, cloud services, mobile devices, and social networking forces organizations to adopt an information‑centric view of security. He cites the 2010 State of Enterprise Security survey (2,100 CIOs/CISOs) showing that 75% of companies experienced a cyber‑attack in the past year and 100% suffered a cyber loss in 2009, with the primary targets being intellectual property, financial data, and customer PII. Salem uses the Hydra attack as a case study of highly targeted, zero‑day exploits that leverage social engineering and backdoors to steal confidential information. He explains why traditional signature‑based defenses are failing—signatures grew from 1.6 million in 2008 to 2.9 million in 2009—and introduces a reputation‑based security model that aggregates data from tens of millions of users, evaluating origin, age, and prevalence to assign reputation scores. The model now holds over 1 billion ratings and processes 177 billion queries per six months, delivering a 15 % detection increase and identifying 500 000 previously unknown threats on day one. Salem warns that attackers are expanding to mobile platforms (e.g., Symbian worm) and that insider threats are rising, making it impossible to know who to trust. He proposes four key actions: (1) move security closer to applications and data, using single‑instance security modules and embedding protection in virtualized and cloud storage (e.g., Filestore); (2) establish an information‑governance model with policies, education, and enforcement; (3) vet cloud providers and enforce SLAs that address data location, access, and protection; and (4) implement robust data‑loss‑prevention tools. The talk concludes that only by embedding security throughout the information lifecycle can organizations regain confidence.
Chapters
Information must be protected. And as much as we tell employees that they can't put information out on the internet, it will happen. And while we can control, perhaps, a little bit of what they say about our companies, what they're not able— what we're not able to do is control what they say about themselves. Now, ubiquitous connectivity, cloud computing, digital devices, and social networking all put information at our finger— at our fingertips. And they're changing how we think about IT. They accelerate the need for us to take an information-centric view to security. And that is the theme of everything that I'm covering. If our organizations are gonna be successful, we need to adopt new approaches to securing, storing, and managing information that are independent of where the information lives or what device it's on or what employee is communicating with other people in the industry or around the world. The other thing that we know is that cybercriminals and hackers are more determined than ever to steal confidential information. These attacks are shifting from being broad-based to being very targeted. Since 2006, we have been predicting that these highly targeted attacks, these silent threats, would go after confidential information. Our 2010 State of Enterprise Security Report where we surveyed 2,100 CIOs, CISOs, and IT managers, came back with some very clear data. Over the last 12 months, 75% of the companies in the survey had had a cyberattack. The same study found that 100% of the survey respondents had experienced a cyber loss in 2009. Now, that loss could have come from an external attacker, a malicious insider, or a well-meaning insider. But we know that the target was always the same. It was information. Now, the top 3 losses they reported: first, the theft of intellectual property; second, they talked about stealing financial data or credit card data; and lastly, they talked about theft of customer PII. But what's dramatic to me is that 100% of the 2,100 companies surveyed said they'd had a cyber loss. Now, we've been saying that these attacks would absolutely become targeted, and Hydra brought that point home. It targeted specific companies across the world and looked for confidential information. It leveraged a zero-day vulnerability in IE and used sophisticated social engineering techniques and tactics to distribute its payload. What we saw was that I am— with malicious links or emails with PDF attachments and malware embedded inside of them was the way that the attackers got into the organization. They also targeted specific individuals inside of specific companies, and a backdoor ultimately made it possible for them to get free access to a lot of the information inside of their targeted companies. And what were they trying to steal? Clearly, it was the intellectual property and information inside of those companies. Our traditional signature-based approaches to security are not keeping up. In 2008, we had to produce 1.6 million signatures. That's more than the previous 17 years combined. In 2009, we had to produce 2.9, almost doubling the previous year. So what we've had to do is come up with a new approach, an approach that we call reputation-based security. The idea is it has to be able to deal with attacks that we've never seen, target— targeting attacks that have been previously unseen. Our reputation-based security will leverage the wisdom, the knowledge of the tens of millions of users that use our products around the world. Reputation-based security is based on a few simple characteristics: origin, age of the program, and prevalence. We bring that together with other information that we have about the programs, and we can create a reputation. Today, we have over 1 billion reputation ratings. In the last 6 months, we've had 177 billion queries to our reputation database. We believe that this is the only approach today that can be used to detect these highly targeted attacks. And we're seeing great results. We launched in our Consumer 2009 products this new technology, and 1 in every 2 PCs detected a previously unknown threat. That was 500,000 threats on the first day. What we also have seen is that that gave us a 15% increase in detection on the first day. Now, this new technology was designed specifically with Hydra-like attacks in mind. And we believe that these attacks will continue to spread and become much more targeted. Now, while we're using this technology today on a PC platform, it's not just gonna be limited to PCs. It will also help secure a range of mobile devices. Because we know that what attackers do is they target platforms and devices that achieve critical mass. So it's only a matter of time before they'll come after whatever is the latest new technology where information is being stored. In 2009, we saw the first real attacks on smartphones. The sexy space worm basically targeted the Symbian OS platform using a text-based messaging approach to spreading. What we also know is that while these devices are becoming targeted, we're also seeing that there's an increase in the rise of insiders, people who we have come to trust that are stealing information. We're also starting to see that the malicious insiders are being able to embed significant new malware in our environments that can create opportunities not only for information to be exfiltrated out of the organization, but also to create the potential for other future access points to be used. Now, the question I pose to all of you is, how do you know that an individual who sits next to you back in the office or here today is not masquerading as a trusted employee who is only planning when they'll attack? The answer is you don't know. Ultimately, you can never be sure who you can trust. These threats are real, and the trends continue to make it clear that we need to be more careful of the information that we create. Now let's look at the requirements that we're seeing as they change around cloud computing, mobile devices, and social networking. What do we need to do about security? Well, we think that there are ultimately 4 key things that have to happen. The first is we have to move security much closer to the applications and to the data. In a shared infrastructure, it's not sufficient to share— to protect the cloud perimeter, the data center, the server, or the storage array. We have to think about how do we protect the entire environment. In a highly virtualized, multi-tenant environment, What becomes important is we have to think about specific applications. We have to think about the virtual machines. We have to think about the storage volumes that are associated with each individual customer. For example, if today we were to scan every virtual machine to detect if there was any malware, that would potentially bring down the entire server. So there's some simple things that we can do. We can start staggering the scans. We can start thinking about how we create— what we call a single instance security module. That means a single engine. That means a single instance of the content that drives those engines. It means a single set of updates, regardless of how many virtual machines you're currently running on. The goal is to infuse security into the whole virtual infrastructure so it can automatically protect everything that you're doing. Last October, we delivered a new technology that we called Filestore, which is a cloud-based storage product that makes it possible for you to create cost-effective, scalable storage services. But most importantly, we infused it with our endpoint security technology, because it became clear that a storage system without embedded security was ultimately not going to be secure. And these are just examples of how we're moving security closer to the applications, closer to the data. Next, you must have an information governance model. You must define it, you must put procedures in place, and you must educate your org, and most importantly, you have to enforce it. That's easy for me to say and much harder to do. I've talked to lots of CISOs across the world, and what they worry about is that the information that their organizations are creating will be strewn across the internet, and they've ultimately lost control. But they're still accountable for the protection of their organizations. This is a real issue. And so what we've got to do is think about how do we keep the users from doing an end run around the IT organization. We have to have a new approach. So how should we respond? At this point, putting an SLA in place is an important first step. As we vet cloud providers, there's a series of questions that we can ask that allow us to determine if they're gonna take the right steps to protect our information. But what we need to know is where is that information gonna be? Who's gonna have access to it? Where is it? How often is it accessed? And so what we've got to do is put in place the appropriate tools and technology that will allow sensitive information from being removed. Two years ago here at the RSA conference, we spent a lot of time talking about data loss prevention. And that was an important step, but we need to do a lot more.
