[EB100510] Evelyn del Monte: Context-Aware and Adaptive Security

“ Context Aware and Adaptive Security” - The Future of Information Security Evelyn P. Del Monte Enterprise Manager [email_address]

The Issue of Security

Static Network Security Physical Security = Network Security

Heartland Data Breach Exposes 100 Million Accounts Lawsuit Filed Over CardSystems Data Breach Hannaford Breach May Have Exposed Millions to Fraud USDA Admits to Massive Data Breach; 63,000 Affected WellCare Flubs Data Privacy for 10,000 Georgians Commerce Bank Database Hacked Advance Auto Data on 56,000 Customers Exposed WellPoint Data Breach Affects 128,000 Clients Hackers Tap Western Union ; 20,000 Affected Hacker Infiltrates UCLA ; Data on 800,000 Stolen Network Breaches are Common…

Typical Consequences Associated With Network Security Breaches:
Lost revenue
Lost productivity
Regulatory fines
Class-action lawsuits
Damaged reputation
Customer erosion
...and Costly

Static defenses simply aren’t good enough. It is no longer sufficient in an environment that is highly dynamic, multisourced and even virtualized. Dynamic Network
Dynamic threats
- Many treats are “unknown” and “un-knowable”
- Many treats emerged daily and even hourly
Dynamic networks
- New and changing devices, operating systems, services, protocols, and ports
- New vulnerabilities
- New and changing users

The New Approach “ Context-Aware Adaptive Security”

KEY FINDINGS:
Context-aware security is the use of supplemental information to improve security decisions at the time the decision is made, resulting in more-accurate security decisions capable of supporting more-dynamic business and IT environments.
Context information that will be relevant to security decisions is not limited to
environmental context and will include context information from multiple sources .
Application awareness , identity awareness and content awareness are all examples of the broader shift to context-aware and adaptive security infrastructures.
In static IT infrastructures, ownership became a proxy for trust. This model no longer works. Every element of our enterprise computing stack needs to be treated with a degree of uncertainty and skepticism . Binary trust will be replaced with a paradigm of “trustability.”

Context-aware and adaptive security will be the only way to securely support the dynamic business and IT infrastructures emerging during the next 10 years .
D efend D iscover D etermine “ Context-aware and adaptive security” STRATEGIC PLANNING ASSUMPTION (Source: Gartner - May 2010) By 2015, 90% of enterprise security solutions deployed will be context aware.

Why Context, Why Now? All these layers encompass physical or logical entities (objects) – packets, machines, applications, services, users, groups, transactions and so on. Information security can be thought of as the enforcement of a series of policies (in other words, a set of security policy enforcement points) to enable action between different entities in an IT stack, with the goal of protecting the confidentiality, integrity, availability, authenticity and accountability of the information and workloads being handled among them.

Security decisions occur when an entity at any layer on the left side wants to take an action on an entity on the right side.

For example:
Can this IP address talk with this other IP address? This type of policy is traditionally enforced by network firewalling.
Can this user load and run this unknown application? This type of policy is traditionally enforced by antivirus and application whitelisting software.
Can this user access this content? This type of policy is traditionally enforced by access control and digital rights management mechanisms.
Can this input be accepted by this application? This type of policy is traditionally enforced by application-level firewalls (such as a Web application or a database firewall).

In static IT infrastructures, ownership became a proxy for trust. Because we owned and controlled most of the pieces, information security policy enforcement points were typically only placed at the perimeter between something we owned and something we didn’t own (and, therefore, didn’t trust). This model of trusting “us” (we own it, we control it) and not trusting “them” (they own it, they control it) and placing security policy enforcement points only where we had a handoff between us and them has worked reasonably well, but is coming under extreme pressure. This model fails in a world where we increasingly don’t own all the pieces of our business and IT infrastructures.

6 trends are driving the need for adaptive, context-based security:
Mobilization
Externalization and collaboration
Virtualization
Cloud computing
Consumerization
Industrialization of hackers

Real-Time Context Leads to Measures of Trustability Every element of our computing stack will need to be treated with a degree of uncertainty and skepticism. Security decisions that were largely black and white, and where policies were set statically inadvance, become decisions with a multitude of shades of gray made dynamically at the time the request is made. Instead of perceived absolute trust (which we never really had), we will shift to a paradigm that embraces variable levels of trustability – adaptive and context-aware security policy enforcement mechanisms that help us answer the real question: “ Do I have enough trust in the entities involved to take the requested action at my current level of risk tolerance and given the current context to allow the action to take place?”

For example: “ This user wants to execute this financial transaction – should this be allowed or not?” Adaptive and context-aware security infrastructure would look at the context of the request before allowing or denying the request.
Is the device trustable?
Is the network connection trustable?
Where is the device currently located?
When was the last access?
How strong was the authentication credential used?
What time of day is it?
Does the transaction requested fall within historical patterns of being normal?
To enable faster and more-accurate assessments of whether a given action should be allowed or denied, we must incorporate more real-time context information at the time a security decision is made . This is the heart of adaptive and context-aware security.

Examples of Context-Aware, Adaptive Security Infrastructure Today
Identity and Access Management
Data Protection
Network access control (NAC)
Next Generation Intrusion prevention systems (IPSs)
Endpoint protection platforms (EPPs)
Secure Web gateways (SWGs)

RECOMMENDATIONS:
Context awareness helps make security an enabler , not an inhibitor, of dynamic business requirements. Begin the transformation to context-aware and adaptive security infrastructure now.
Use the framework provided in this research as a way to evaluate security offerings for their capability to incorporate richer context information at the time of a security decision.
Question security vendors on their specific road maps for application, identity and content awareness, as well as the ability to incorporate other types of context information into their policy enforcement decisions.
Remove hard-coded and static security policies fromapplications and other systems, and move them to externalized security policy enforcement points capable of consuming real-time context information.

Thank you

[EB100510] Evelyn del Monte: Context-Aware and Adaptive Security

by Computerworld Philippines on Oct 05, 2010

Accessibility

Categories

Tags

Upload Details

Usage Rights

1 Embed 74

Statistics

[EB100510] Evelyn del Monte: Context-Aware and Adaptive Security — Presentation Transcript