Misconfigured Security Appliances, Basic Missteps Central To Data Breaches: Experts

Misconfigured and poorly maintained firewalls, Intrusion Prevention Systems and other appliances are at least one of the many problems fueling most data breaches, according to a panel of security experts.

In a wide ranging discussion covering everything from threat intelligence and offensive security to basic defenses, software security and compliance, panelists told attendees at the RSA Conference 2013 that many weaknesses are due to the growing complex myriad of security systems deployed in organizations. Many of the systems are not properly tuned for the company's specific environment, they said.

"All the stuff in the enterprise probably works fine if it was implemented properly," Greg Hoglund, an independent consultant who was founder and CTO of HBGary, the firm that was the target of hacktivist group Anonymous in 2011. "In nearly every case, enterprises were not patched, and it was two-year-old exploits used to do the successful attacking."

[Related: 20 Examples Of Wacky, Over The Top RSA Signage ]

Organizations are also failing to conduct a thorough risk assessment to determine the kinds of threats that are likely to target the business. Knowing whether financially motivated cybercriminals, hacktivists or targeted cyberespionage attacks can help companies deploy the proper defenses and allocate resources in the right places, said Joshua Corman, a longtime security expert.

"I want to see sanity and technical specificity," said Corman, director of security intelligence at Akamai Technologies, Inc. "We don't do a good job knowing who our adversary is; we've poorly optimized the basics."

Security professionals at the industry's largest security conference heard the message that big data security analytics could help provide deep intelligence for risk mitigation, attack detection and response. But, integrating massive analytics on top of systems containing gaping holes may not be the most prudent idea, said Corman, Hoglund and two other panelists, Chris Valasek, director of security intelligence at IOActive, and Brian Honan, of BH Consulting, Ltd. Cybercriminals are stepping up attacks, but the vast majority of the successful data breaches are done by non-sophisticated means.

NEXT: Attackers Gain Sophistication, Not Attacks

While the basics in every attack scenario may be different, SQL injection, distributed denial-of-service (DDoS), and phishing are common tools of the trade, the panelists said. Adequately programming network firewalls, log monitoring and auditing applications for coding errors are some of the activities that should be taking place.

"I would start with the lowest common denominator before I start worrying about advanced attacks," IOActive's Valasek said. "There's a reason why the Black Hole exploit kit is so popular, even though it uses all old bugs."

BH's Honan said his firm is seeing cybercriminals using extortion much more than ever before. An attack typically involves targeting a company's remote desktop protocol, exploiting weak and default passwords, he said. Once the attack happens, the cybercriminals get to the system backup and lay low for months before encrypting all the company's data and demanding money for the key, he said. Companies have been able to extort thousands from businesses.

"People pay up quickly, and that's where the money is," Honan said. "Every company we've dealt with, it's a business decision to pay, and they all got their data back."

Security experts tend to be cynical often dismissive of the sophistication of attacks, but Akamai's Corman said the adversary is gaining sophistication, not necessarily the attack. For example, the freely available Metasploit penetration tool can be used maliciously, he said.

"Basic SQL injection is working on us," he said. "A script kiddie gets better every time someone adds a module to Metasploit."

PUBLISHED FEB. 28, 2013