5 TECHNICAL SECURITY CONTROLS In this chapter we discuss in more detail the technical controls that are implemented to provide protection against security incidents. This includes the detection, prevention and mitigation of such incidents. There are three main types of control: physical, for example locks on doors and secure cabinets; procedural, for example checking references for job applicants; product and technical controls, for example passwords or encryption. Of these, the product and technical controls are perhaps the most important in terms of information security since they are often the last barrier to illegal or unauthorized activity.
As mentioned in Chapter 4, we deal here with mainly generic controls because the more detailed information about specific controls is outside the scope of this publication. PROTECTION FROM MALICIOUS SOFTWARE Learning outcomes The intention of this section is to provide the reader with the basic knowledge needed to put in place effective controls to manage the risks from malicious software. Once completed, the reader should have an understanding of each of the following concepts. Types of malicious software The topic of malicious software is very large and could easily fill a book of its own.
In this section the barest basics are described and enough information is given to allow the reader to continue their studies elsewhere if they so wish. Malware (from MALicious softWARE), as it is often known, is one of the largest threats to the users and managers of information systems. An understanding of the capabilities of malware and those who write it, along with the controls that are needed to counter that threat, are essential for most information assurance practitioners. A simple definition of malware would be something like: An unauthorised piece of code that installs and runs itself on a computer without the knowledge or permission of the owner.
It then conducts data processing and other operations that benefit the originator, usually at the expense of the system users or the recipient of the output from the malware. The traditional idea of malware is the virus that infects your computer, attempts to spread itself to others, then trashes the contents of your hard disk or displays a message to show that it was successful in infecting your machine. A lot of the early malware did just this. Things have moved on, however, and the main emphasis now is not on ‘spreading chaos while gaining kudos’, it is about money.
The FBI announced that, for the first time ever in 2006, organised crime gangs in America made more money from cybercrime than they did from dealing in drugs. It is big business in many parts of eastern Europe and the far east too. The chances of being caught are much lower than for drugs operations and the sentences, if convicted, tend to be much shorter. The old malware writers wanted you to know that they had succeeded in infecting your machine; now it is changed round completely.
The vast majority of modern writers know that if you realise you have an infected system they have failed, because you will disinfect it. Modern malware can be split into the following major categories depending on their payload. These cannot spread on their own. They need to be attached to another piece of data or program to reach and infect another computer.
They are often triggered by opening an email attachment or executable or received by email or on removable media such as CD or USB stick. The difference between a worm and a virus is that worms contain the code needed to spread themselves without any user action. They will seek out other computers on any networks they can find and can spread very quickly. It is estimated that the Slammer worm infected 90 per cent of the world’s vulnerable computers within 10 minutes of being released.
These are complex software packages that hijack the operating system and attempt to make themselves invisible both to the user and to the software designed to find and remove malware. They are insidious in that they still perform all tasks that the user requests, but they often make copies of sensitive data such as passwords, account details and logins and then send them to another computer, often to enable financial fraud such as identity theft. The idea of the back door is to do just as it says. It provides a means for a third party to access the computer and use it for their own purposes without having to carry out the normal authentication checks.
These can be used to turn the computer into a ‘bot’ (short for robot) that is effectively under the remote control (usually via IRC – Internet Relay Chat – channels) of the attacker. It can then be used to distribute spam or act as part of a distributed Denial of Service attack on a third party that cannot easily or quickly be traced back to the attacker. A common example of this is the use of cookies by websites. Some are designed to be permanent and to track and report the web usage back to a third party without the knowledge of the user.
They can also log keystrokes and look for specific information such as bank account or auction site login credentials. They have been known to install diallers that call premium rate numbers (on modem-connected computers) to generate revenue for the perpetrators. These can also be installed by software that performs a legitimate service, and freeware is often offered as a means of getting a user to install spyware. The Trojan is the hackers’ ‘weapon of choice’ today.
Far more successful attacks use Trojans than any other attack vector. These are often disguised as another piece of software or are hidden inside compromised copies or other programs that users are lured into downloading and running. They often successfully avoid security countermeasures because users tend to have accounts with administrator privileges that allow the Trojan to run. Another very successful infection route is through compromised websites.
It is estimated that one in three websites contains malware of some sort. Trojans can download themselves without the user having to click on any buttons or links on the page. Simply going to an infected web page can be enough. More and more groups, criminal and otherwise, are writing increasingly sophisticated Trojans to attack computers in order to extract data, particularly via web protocols, where the malware scanning technology is often much weaker than the email countermeasures.
This is the means by which a Trojan is often downloaded to a computer running the viewing browser. Modern web applications use active code such as Flash, Java, ActiveX and even mime headers to perform complex tasks within the web page to ‘enhance the user experience’. There is no question that they are good at this, but they are also good at installing malware on the target computer. If the right level of security is not set in the browser policies, the compromised code will install and run itself on the target without the user having any knowledge of it happening.
A typical attack is where a banner advert runs on a well-respected and heavily used website, with the code for the banner being supplied by a third-party advertiser. The attacker subverts the third party and adds the Trojan into the banner code. People view the website, thinking it trustworthy because of the reputation of the organisation, little realising that the advertising hosted there is busy trying to infect their computer. The payload of an active content/Trojan can be any of the forms of malware described in this section.
Whatever the type, detecting a piece of malware on a computer is a cause for concern and should be investigated without delay. It should also be noted that malware is actively and very widely spread; it is not a case of if you receive some malware, but when and how often. It is almost inevitable. Zero day exploits No matter how good and comprehensive the defences that are in place, there is always a possibility that a new form of attack can get through them.
Hackers talk about ‘zero day exploits’. These are ones that have yet to come to the attention of the companies selling anti-virus and firewall products, so they have not issued an update to detect and remove them. In theory these exploits can get past the scanning engines because they are not on the ‘stop’ list that the updates contain. Some products are better than others in spotting types of behaviour and their analytical tools can identify many new versions of malware because they exhibit behaviour that is known to be unacceptable or has similar code to that found in other known malware.
There is even a trade in zero day exploits, with hackers selling the knowledge to others. Some zero day exploits for the latest version of a very well-known PC operating system were on sale for US$400 not long after the beta version was released. Routes of infection Most of the routes have already been mentioned in passing but a more comprehensive description is provided here. Any piece of media that has been out of your control or supervision should be considered suspect – CD, DVD, USB stick and so on.
It should be scanned for malware, ideally on a stand-alone, ‘sheep-dip’ computer before being allowed into an operational computer. It may have been infected by any system with which it has interacted before it reaches your system. Even CDs that come with a magazine or as part of a special promotion should not be trusted. Do not assume they have been properly checked before mass production.
These have been issued containing malware on more than one occasion in the past, causing much embarrassment for the organisation giving them away. USB sticks are another source of infection. Malware can use them to travel from one system to another. The most common routes today are via email, as an attachment or a macro in a document or even disguised as another file type, and through websites, as described above.
Worms can propagate across networks, wide or local area, and may spread through unprotected systems. It is also possible for malware to infect your system through a wireless networking connection, Bluetooth or infrared port. Do not have these enabled unless you require them at the time and have a malware scanning application that protects those ports as well as the standard ones. If these functions are never used, don’t even install the device drivers for them if you can avoid it.
Smartphones and the increasingly complex software available for these types of devices, be they phones, MP3 players, tablets, iPads or similar, all have the capacity to be infected, some more easily than others. The idea that any one operating system is secure has also been shown to be false in recent years. The attractiveness of infecting one operating system or manufacturer’s goods over another is often simply a matter of price – is it worthwhile to put in the effort to infect this type of device? With an increase in the numbers of staff being allowed to ‘bring your own device’ (BYOD), where staff may use their own technology to undertake their work, there is also an increase in the risk to corporate IT infrastructures. The detail of providing security for these systems is beyond the scope of this book, but it can be very demanding and expensive.
Depending on the level of security required and the risk appetite of the company (how safe your company’s information needs to be), there may be a decision to be made whether or not to allow these devices to be used at all for any official business purpose. Malware countermeasures The countermeasures required to detect and defeat malware depend on the configuration of the systems and networks to be defended and continually need to be updated to deal with the latest threats.