A new survey and report shows strong faith but poor confidence in current data analytics. For example, 70% of respondents to the survey believe that analytics are integral to understanding how products are used; 71% to understanding business performance, and 70% to understanding fraud. But at the same time, only 43% are confident in the analytics insights for risk and security; 38% for customer insights; and just 38% for business operations.

The report, Building Trust in Analytics, follows a survey of 2,165 respondents in 10 different countries undertaken by Forrester Consulting on behalf of KPMG. The results show a clear distinction between understanding the need for and importance of analytics within decision making, and actually trusting the outcome of current analytics.

"Failing to master analytics will not only make it increasingly hard for organisations to compete," comments Paul Tombleson, UK head of data & analytics at KPMG, "but will expose their brands to new and growing risks. Seventy percent of UK executives believe that by using data and analytics they expose their organisations to reputational risk."

KPMG beleives that the low levels of trust might be filtering down from the top of the organization, since nearly half of the respondents do not believe their C-suite executives fully support their organization's data analytics strategy. It goes further to suggest that this may be caused by data analytics' inherent complexity further impacted by a 'human instinct for emotional decision making'.

Missing from the report is any indication of the effect of a shortage in skilled data scientists. Data scientists differ from statisticians by requiring experience in machine learning and algorithms; and without them the essential step towards automated data analytics cannot be made. As long ago as 2012, Gartner predicted a shortage of more than 100,000 data scientists by 2020.

While the KPMG report shows a lack of faith in current business data analytics, data analytics lie behind the latest generation of anti-malware products that often boast 100% detection for both known and unknown malware. The difference between busihness analytics and security analytics is the use of machine learning algorithms to analyse the data -- security has already made the leap from human data analysts to machine learning analytics.

"Just as moving to cloud-based IT represented a huge gain in capability for businesses," said Anup Ghosh, founder and CEO at Invincea, "I expect moving to data analytics-based businesses will represent another quantum leap in how businesses approach the market and run their companies." But, he warned, "Those who don't adopt will likely go the way of brick and mortar bookshops and video rental companies."

The problem is the sheer mass of data that needs to be analyzed. "Machine learning is a way of finding intelligence in the vast amounts of data that is out there. In security, there is far too much data (alerts and raw threat indicators) to be human scalable. In customer analytics, the same applies."

For now, the difference is that 'security' is a defined and bounded subset of business data; but its principles will be applied throughout business. "Data science will develop custom-fitted machine learning algorithms to the needs of the company to answer the questions it is asking," predicts Ghosh. "This will require a new skillset not current in most companies -- data scientists, machine learning specialists, and big data architectects, as well as company leaders who will drive this forward or be left behind."

Kevin Townsend is a Senior Contributor at SecurityWeek. He has been writing about high tech issues since before the birth of Microsoft. For the last 15 years he has specialized in information security; and has had many thousands of articles published in dozens of different magazines – from The Times and the Financial Times to current and long-gone computer magazines.

Previous Columns by Kevin Townsend:

Tags:

Security updates released by Adobe on this Patch Tuesday address one vulnerability in Connect for Windows and nine arbitrary code execution flaws in Flash Player.

Flash Player 23.0.0.207 for Windows, Mac and web browsers, and Flash Player 11.2.202.644 for Linux patch type confusion and use-after-free vulnerabilities tracked as CVE-2016-7857, CVE-2016-7858, CVE-2016-7859, CVE-2016-7860, CVE-2016-7861, CVE-2016-7862, CVE-2016-7863, CVE-2016-7864 and CVE-2016-7865.

All of the issues addressed on this occasion have been reported to Adobe through Trend Micro’s Zero Day Initiative (ZDI) by various researchers, including bo13oy of CloverSec Labs, Archer, Kiritou Kureha, Erisaka Mafuyu, Onoe Serika, Kuchiki Toko and Takanashi Rikka.

Adobe has also informed customers of a Connect update that resolves an input validation vulnerability in the events registration module. The flaw, reported by Vulnerability Lab, can be exploited for cross-site scripting (XSS) attacks.

The issue affects versions 9.5.6 and earlier for Windows, and it was fixed with the release of Connect 9.5.7. Adobe said there was no evidence that any of these vulnerabilities had been exploited in the wild.

A Flash Player vulnerability exploited in targeted attacks was addressed by Adobe on October 26. The flaw (CVE-2016-7855) has been used by the Russia-linked threat actor known as Pawn Storm, APT28 and Fancy Bear.

Attackers leveraged the security hole in combination with a Windows kernel weakness – the Flash Player bug was used to gain control of the victim’s browser process and the Windows bug was exploited to elevate privileges and escape the browser sandbox.

Both Adobe and Microsoft were informed about the vulnerabilities by Google on October 21, but Microsoft only managed to patch the Windows flaw on Tuesday with its monthly security updates.

Previous Columns by Eduard Kovacs:

Tags:

Chancellor Angela Merkel on Tuesday said Russia could try to influence Germany's general elections next year through cyber attacks or disinformation campaigns, after Washington accused the Kremlin of similar meddling in the US vote.

"We are already, even now, having to deal with information out of Russia or with internet attacks that are of Russian origin or with news which sows false information," Merkel, said at a press conference alongside Norwegian Prime Minister Erna Solberg.

Dealing with that was already "a daily task", she told reporters in Berlin.

"So it may be that this could also play a role during the election campaign."

The comments came in response to a question about whether Germany could experience the type of cyber attacks that have plagued the White House race, notably targeting Hillary Clinton's Democratic party.

Washington last month formally accused the Russian government of trying to "interfere" in the election by hacking US political institutions, charges the Kremlin has repeatedly dismissed.

Germany's domestic secret service earlier this year accused Russia of a series of international cyber spying and sabotage attacks, including a case which targeted the German lower house of parliament last year.

Germans are scheduled to go to the polls in September 2017. Merkel has yet to announce her candidacy but is widely expected to run for a fourth term.

Related: Russia Demands Explanation for US Military Hacking Reports

© AFP 2016

Tags:

Google’s Android Security Bulletin for November 2016 patched a total of 83 vulnerabilities in the operating system, one of which was the Dirty COW flaw in Linux kernel that was disclosed a few weeks back.

Discovered by Phil Oester, the flaw was dubbed Dirty COW because it relies on a race condition in the Linux kernel, which could result in the kernel writing data to read-only memory mapping, instead of making a private copy first. The issue is caused by the way the Linux kernel’s memory subsystem handles copy-on-write (COW) breakage of private read-only memory mappings and it can even escape containers.

Tracked as CVE-2016-5195, the bug was found to impact Android devices as well, and security researchers even published exploit codes to prove that. The Dirty COW vulnerability could be exploited to gain root access on affected Android products, and all devices running a Linux kernel higher than 2.6.22 are believed to be affected by the issue, especially with many of them not being patched in due time.

Only a few weeks after the flaw was publicly disclosed, Google released a patch for it as part of the Android Security Bulletin for November 2016, which came out on Monday. According to Google, the vulnerability is resolved on devices running the security patch level of 2016-11-06, which was the third security patch level in the new set of updates.

In its advisory, Google described the vulnerability as an elevation of privilege vulnerability in the kernel memory subsystem, explaining that it could be leveraged by a local malicious application to execute arbitrary code within the context of the kernel. The bug was rated Critical because it could lead to a local permanent device compromise, supposedly requiring a reflash of the operating system to repair the device.

All devices running Android with security patch level of 2016-11-06 include a fix for this issue. In fact, Google underlines that they also have fixes for the issues associated with the 2016-11-01 and 2016-11-05 patch levels.

One of these flaws was a Denial of service vulnerability in Proxy Auto Config (CVE-2016-6723), which could enable a remote attacker to use a specially crafted file to cause a device hang or reboot. Considered only of Moderate severity, the bug was found to affect devices running Android 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, and 7.0.

According to Nightwatch Cybersecurity researchers, the flaw can be triggered to crash a device by downloading a large Proxy Auto Config (PAC) file when adjusting the Android networking settings. The PAC files can be used as part of the network settings configuration to define the proxy servers that should be used for different types of requests.

These text files usually contain a JavaScript function that the web browser can call to determine the proxy server to use, and Android users can indicate a PAC URL to be used to download the file. Because Android doesn’t check whether the PAC file may be too large to load into memory, a Man-in-the-Middle attacker who can intercept the file could replace it with a large one of their own and crash the Android phone.

If the served file is larger than the memory available on the device, all memory is exhausted and the phone halts and then soft reboots. No data should be lost during the soft reboot, but the researchers believe that attackers could leverage the flaw to achieve remote code execution.

However, because the Denial of service bug is mitigated by multiple factors, the likelihood of exploitation is low, the researchers explain. The attack requires the user to configure a PAC file, an attacker to know about that file, and for the file to be served without SSL. Moreover, because Android doesn’t support Web Proxy Auto-Discovery Protocol (WPAD) to retrieve PAC files automatically, the flaw can’t be exploited using a rogue access point or network.

Related: Google Patches 23 Critical Vulnerabilities in Android

Related: Android Root Exploits Abuse Dirty COW Vulnerability

Ionut Arghire is an international correspondent for SecurityWeek.

Previous Columns by Ionut Arghire:

Tags:

As information security professionals, we spend a lot of time thinking about what security products are the highest priority. But as most of these decisions are mired in the nuances and details of the modern enterprise, I’d like to simplify things by bringing us back to a favorite childhood game: What would you bring on a deserted island?

It’s not an easy question to answer in a time when security threats are changing every day in the cat-and-mouse game we’re playing with attackers. For every new threat and attack vector, there is a new company promising the “solution.” This cycle incurs the need for security decision-makers to think about hypothetical scenarios like the “deserted island” in order to prioritize where their budget will provide the most value.

So in choosing just one of these products, we must consider what will protect the widest variety of information in the most effective way—technology that can span a wide, distributed network to block multiple kinds of attacks. There are a few ways to go about this, so security practitioners will always have multiple options when choosing their “deserted island” product.

End-to-end encryption

Securing the largest quantity of information possible means starting with the data itself. Whether the data in question is stored in your physical data center, the cloud or a third-party storage service, effective encryption and its management are central elements to shading it from attackers (not to mention maintaining compliance). This means granular encryption wherever your data is, coupled with tight access control.

Furthermore, encryption pays dividends in the case that you do get breached. With sophisticated enough encryption, even if data is stolen, hackers will find themselves with a useless pile of indecipherable information.

One caveat: the capability to decrypt encrypted traffic for monitoring and management is still crucial. We can’t forget that threat actors often use the same infrastructure we do to obfuscate their malicious payloads. In fact, accordin to a recent survey, nearly half of cyberattacks have been found to use encrypted traffic to avoid detection.

Robust endpoint protection

Vendors across the security industry continue touting the end of the traditional perimeter. Amid this noise, it’s hard to pinpoint who has the best understanding of this issue and, as a result, can provide the best solution for organizations’ ever-growing attack surfaces.

It’s true that the cloud, connected devices and mobility have made it so that the traditional boxed-in enterprise is no longer the norm. Sensitive information now lives wherever it’s being generated and accessed, down to and including a remote PC or a mobile device. Many new smart devices are also being deployed across networks that have poor security controls. Recently, security blogger Brian Krebs’s site was taken down by one of the biggest DDoS attacks enacted by a botnet composed of thousands of poorly protected IoT devices—including routers, security cameras and even printers.

In this light, an effective “deserted island” security solution should have a strong endpoint component if it’s going to protect sensitive information regardless of geographical location or device. Moreover, the endpoints need to be hardened to deter hackers from using them as points of entry and exit as well as gateways for the exfiltration of data.

Interconnected safety measures

Web services and SaaS applications (e.g. Dropbox, Gmail and Slack) have become key pieces of a company’s culture and business operations. Almost every company now relies on them, which means they can also be a point of vulnerability - simply because they become the point at which you lose control over the applications that have access to your business’s information. There’s always the chance that the third-party companies providing web services can be compromised, putting your business at risk in the process.

In this situation, security tools are great and encryption, essential. However, with the growing number of data and endpoints moving freely throughout the enterprise, it is becoming increasingly difficult for security solutions to protect a perimeter with firewalls, IPS/IDS, sandboxes, etc. Endpoint protection and end-to-end encryption are not the end-all to network security issues on their own. More than basic controls, there needs to be increased transparency around service security, user and application behavior and network visibility. Companies deserve to know how third-party providers are using and protecting their data.

Thankfully, we aren’t on a deserted island for which we have to choose only one product to protect online information. But the exercise is important and can help security professionals better prioritize and understand which security products will make the most impact. This level of awareness is essential in an industry where every shiny new toy is cause for both panic and throwing money at the problem. It is impossible to find the cure-all for security issues as we battle creative, intelligent malicious actors. But employing encryption, endpoint protection and ensuring security professionals have a clear understanding of the products available to them is a strong start. There’s a difference between “nice-to-have” security products and “must-have” security products. The “must-haves” are critical to protecting organizations from cyber attacks.

Scott Gainey is the Senior Vice President and Chief Marketing Officer at SentinelOne. Gainey is leading a highly focused team tasked with building SentinelOne’s brand, while helping organizations make the critical transition to next-generation endpoint protection. Gainey has over 19 years of experience in information security, data center and cloud computing, storage systems, and enterprise networking. Most recently, Gainey served as the VP of Marketing at Palo Alto Networks. In his role he led the company’s global messaging, including product and solution marketing, industry marketing, community engagement, and demand generation. Prior to Palo Alto Networks Gainey led marketing for Cisco’s security business. Before Cisco he held various leadership positions at Xsigo Systems (bought by Oracle), NetApp, Veritas, and Sun Microsystems.

Previous Columns by Scott Gainey:

Tags:

A vulnerability in OAuth 2.0 could result in an attacker being able to sign into a victim’s mobile app account and take control of it, security researchers have discovered.

In a recently published research paper (PDF) that was also detailed at the Black Hat Europe security conference, three researchers from the Chinese University of Hong Kong demonstrate the prevalence and severe impact of the vulnerability. According to researchers, 41.21% of the 600 top-ranked Android apps that use the OAuth2.0-based authentication service from Facebook, Google, and Sina, are vulnerable.

Because of the widespread use of OAuth 2.0-based Single-Sign-On (SSO) services for 3rd party websites, the security researchers say, major Identity Providers (IdPs) such as Facebook, Google, and Sina, have adapted OAuth 2.0 to support SSO for 3rd-party mobile apps on their social-media platforms. However, because of differences in system environments, “the original OAuth 2.0 protocol becomes under-specified.”

Specifically, IdPs have developed home-brewed extensions of OAuth2.0-based Application Programming Interface (API) to support SSO of 3rd-party mobile apps in their platforms, but the operational requirements of such adaptations aren’t always documented or taken into consideration.

The authentication process is complicated, relying on the interaction between the 3rd-party (client-side) mobile app, the client-side IdP app, the 3rd-party app’s backend server, and the IdP server. The issue emerges when the data that the mobile app server receives from the other involved entities isn’t properly validated.

“The root cause of this vulnerability is a common, but misplaced trust in the authenticating information received by the 3rd party app’s backend server from its own client-side mobile app, which in turn, relies on potentially tampered information obtained from the client-side mobile app of the IdP,” the security researchers explain.

To demonstrate the security flaw, the researchers created a remote exploit that allows an attacker to sign into a victim’s mobile app account via OAuth 2.0 without requiring interaction from the victim. The researchers demonstrated the attack on the Android operating system, but they explain that iOS applications are vulnerable as well.

The security researchers also explain that some of the insecure implementations of OAuth2.0 include cases where the backend server doesn’t check if the received user-id is bound to the issued OAuth access token; the mobile app doesn’t verify IdPs’ digital signature of the user identity profile; the mobile app retrieves the user information from the mobile device and passes it to the backend server as identity proof.

While analyzing mobile applications that use OAuth 2.0, the researchers discovered that 41.21% of them are vulnerable, and say that they put over a billion users at risk. Impacted programs include apps for travel planning, hotel booking, chatting, dating, finances, downloading, shopping, and browsing, though media players are also affected. The total number of downloads of vulnerable apps already exceeds 2.4 billion.

“After signing into the victim’s vulnerable mobile app account using our exploit, the attacker will have, in many cases, full access to the victim’s sensitive and private information which is hosted by the backend server(s) of the vulnerable mobile app. For some of these mobile applications, the online-currency/ service credits associated with the victim’s account are also at the disposal of the attacker,” the researchers say.

The researchers suggest that IdPs should provide 3rd-party application developers with clearer and more security-focused usage guidelines for their OAuth 2.0-based SSO APIs. Backend server of a mobile app should trust only information exchanged with the IdP server directly; IdPs should issue private user identifier on a per-mobile-app basis; and IdPs should conduct or insist on more thorough security testing of 3rd party mobile apps, the researchers also say.

Related: Google to Revoke OAuth 2.0 Tokens Upon Password Reset

Related: Enterprises Warned About Risky Connected Third-Party Apps

Ionut Arghire is an international correspondent for SecurityWeek.

Previous Columns by Ionut Arghire:

Tags: