New HPL TR: Security Analytics – Risk Analysis for Incident Management Processes

A new HP Labs Technical Report has been recently released called “Security Analytics – Risk Analysis for an Organisation’s Incident Management Processes”. It is currently available online here.




The abstract of the HPL TR follows:

“This document is an example of the type of report an organisation would receive at the end of a HP Security Analytics engagement. The focus is on the analysis of the security risks and performance of the organisation’s Security Incident & Events Management (SIEM) Processes and related Security Operation Centre (SOC)’s activities. HP Labs carried out the underlying R&D work in collaboration with HP Enterprise Security Services and involved analysis of processes, probabilistic modeling, simulation and “what-if” analysis for some of HP’s key customers. The outcome of this was a set of case studies from which we have been able to create this more general anonymised report illustrating the richness of the risk assessment and “what-if” analysis that has been carried out.

The lifecycle management of security is critical for organisations to protect their key assets, ensure a correct security posture and deal with emerging risks and threats. It involves various steps, usually carried out on an ongoing, regular basis, including: risk assessment; policy definition; deployment of controls within the IT infrastructure; monitoring and governance. In this context, Security Incident & Events Management play a key role. Even the best information security practices and investments in security controls cannot guarantee that intrusions – accidental and criminal activities – and/or other malicious acts will not happen. Controls can fail, be bypassed or become inadequate over time; new threats emerge. Managing such incidents requires detective and corrective controls to minimise adverse impacts, gather evidence, and learn from previous situations in order to improve over time. These incident management processes are usually run in the context of a SOC and/or as part of specialised Computer Security Incident Response Teams (CSIRTS), built on top of SOCs.

Even with SIEM in place, a potential major risk for the organisation arises due to delays introduced in assessing and handling known incidents: this may postpone the successful resolution of critical security incidents (e.g. devices exposed on the Internet, exploitation of privileged accounts, deployed malware, etc.) and allow for further exploitation. Another related risk can be introduced by sudden and/or progressive changes of the threat landscape, due to changing economic and social scenarios, new business activities or process failings within the existing IT services. This might create unexpected volumes of new events and alerts to be processed by the security team and as such, introduce additional delays. Hence, it is important for an organisation to understand the risk exposure due to their Incident Management processes, explore potential future scenarios (e.g. changes in available resources or threats landscapes or adoption of Cloud solutions) and identify suitable ways to address related issues, e.g. by introducing process changes and/or making investments in security controls.

HP Security Analytics is uniquely positioned to provide the analysis of the involved risks, explore what-if scenarios and provide decision support for decision makers. This type of Security Analytics assessments is now available as a service, provided by HP ESS.”.



--- Posted by Marco Casassa Mont (here and here) ---

--- NOTE: use this mirror blog if you prefer posting on an external blog site ---

--- NOTE: my original HP blog can be found here ---

New HP Labs Technical Report – Job Design: Providing Strategic Decision Support for Risk Analysis and Policy Definition

A new HP Labs Technical Report has been published called “Job Design: Providing Strategic decision Support for Risk Analysis and Policy Definition” (authors: Marco Casassa Mont, Adrian Baldwin, Simon Shiu, Paul Collins):

“Strategic decision makers need to organize their workforce and define policies on how to allocate roles and rights to individuals allowing them to work effectively for the organization, whilst minimizing security risks. Many organizations have a separation of duty matrix specifying certain toxic combinations of access rights that they generally understand present an extreme risk. These matrices do not always contain some of the less understood or smaller risks. The flip side of the rights allocation problem is the need for an organization to keep systems running under various pressures including reducing headcounts. This tension often leads to a practice of providing skilled individuals with wide access rights to many systems. We describe this tension as the Job Design Problem. That is how to manage the trade-offs between allocating roles allowing for flexibility and the possible security impacts. It is not just a matter of technical "role engineering", access right allocation and Identity & Access Management (IAM) provisioning processes. Decision makers need tools that help them understand how to give guidance and set policies associated with role allocations and mechanisms to enable a debate between various stakeholders within the business, IT and Audit concerning the appropriate level of tradeoff and acceptable risk. In this paper, we aim at making progress in this field by presenting an approach and methodology to provide strategic decision support capabilities for the definition and assessment of policies in the context of Job Design. We focus on a problem provided by an IT department within a large organization, where employees (primarily IT admins and IT support staff) operate on sensitive and critical business systems and services. In this context, security risks are a major concern and need to be fully understood. Depending on the motivations and skills of the workforce, accidental or deliberate misuses of access rights and capabilities might take place and have huge economical and reputational consequences for the organizations. The decision makers (e.g. CIOs, CISOs) need to understand the implications and trade-offs of making job design decisions as wells as investing in additional/complementary controls, such as monitoring/auditing systems, IAM solutions, education or vetting/clearance programs. We describe a decision support solution based on modeling and simulation, to provide this kind of policy-decision support. This is work in progress. We present our current results and next steps.”

--- Posted by Marco Casassa Mont (here and here) ---

--- NOTE: use this mirror blog if you prefer posting on an external blog site ---

--- NOTE: my original HP blog can be found here ---

What is your “Identity Footprint” on the Web?

Very few people actually know what their “Identity Footprint” is (e.g. various pieces of information and details related to them, given away on the web …), especially if they have been exposed for a while to the Internet, have accessed and interacted with various social network services or simply have been involved in web service interactions.

What are going to be the risk induced by these “Identity Footprints”? Could “personal profiles” be inferred from this information at a point to become a threat e.g. enable identity thefts, frauds or simply have future impact on people’s reputation, etc.?

I believe that understanding and managing this kind of risk is going to become a priority in a not so far away future … Its implications are already becoming obvious today, as it is possible to gather reasonable amount of “personal” information on individuals by searching in various sites (e.g. Google, FaceBook, Linkedin, Del.icio.us, Technorati, etc.).

I see an opportunity for researching and developing new identity management services in this space to help people assessing risks and potentially mitigating them (for example, the “Personal Guardian Angel” service, that I described in a previous post, “2012: A Day in the Life of John Webber”).

--- NOTE: my original HP blog can be found here ---

On the Joy of Having Multiple (Digital) Personae …

Having multiple “digital personae” (i.e. identity profiles that provide a different “view” about an individual, depending on the context, service, location, etc.) is undoubtedly useful. Different concerns, roles, interest and priorities can be conveyed in this way and your interactions on the web can be simplified (and in some way “compartimentalised”).

But what about its potential risks? What about the potential correlations that can happens by linking together and analysing your personae (for example the ones you use at works, in social networks - Facebook, LinkedIn, MySpace, in your service accounts, on your blog postings (…), etc). What would be the future consequences?

Having a sort of Personal “Identity Leak” Service providing an overview of your “current situations” and warning you about potential threats and risks would not be bad …

--- NOTE: my original HP blog can be found here ---

Call for Papers: 23rd International Information Security Conference – SEC 2008

The Call for Papers for SEC 2008 (Milan, Italy – September, 8-10, 2008), is now available online:

“The conference seeks submissions from academia, industry, and government presenting novel research on all theoretical and practical aspects of computer security, as well as case studies and implementation experiences. Papers should have practical relevance to the construction, evaluation, application, or operation of secure systems. Theoretical papers must make convincing argument for the practical significance of the results.”

In particular, topics of relevance include topics in the “Identity Management” area:

• Access control
• Electronic frauds
• Anonymity
• Accounting and Audit
• Smartcards
• Data and application security
• Risk analysis and risk management
• Data protection
• Privacy-enhancing technology
• Trust management
• Trust models

Paper submissions are due by January 10, 2008. More details about Important Dates and Committees are also available online.

--- NOTE: my original HP blog can be found here ---