McAfee Prepares for Independence from Intel with Product Announcements and New Branding

Following recent product annoucements from Sophos and Symantec, Intel Security is the latest of the 1st generation endpoint security firms to transition to next gen status with the announcement of machine learning malware detection. With Intel Security, however, a raft of additional product releases makes it clear that 'McAfee' is being set up for its transition back to an independent company under the McAfee name with new branding via new 'McAfee by Intel" logo.

Intel Security's Wednesday announcement includes no less than 10 new product releases that feature organically developed capabilities. Noticeably, these include a high number of current advanced buzz-word approaches to security: machine learning; integration, automation and orchestration; CASB; threat intelligence sharing; and APT and zero-day threat prevention. 

The McAfee name has had a ping-pong history but demonstrates remarkable resilience. It started life in 1987 as McAfee Associates, named after its founder John McAfee. In 1992 it merged with other companies to become Network Associates. It 2004 it restructured and became known as McAfee again. In 2010 it was bought by Intel and became first McAfee Security and then, in 2014, Intel Security. On September 7, 2016, Christopher Young, SVP and general manager of Intel Security, announced: "we are creating a new corporate entity, to be named McAfee."

The new announcements are clearly timed with the new emerging McAfee. Intel hasn't put it so bluntly, but Young told SecurityWeek, "The enhanced integrated architecture announced today delivers on the strategy we outlined at last year's FOCUS to simplify the threat defense lifecycle and innovate. Delivering on our strategy will continue to guide us as we transition to a new independent McAfee. These new offerings are the foundation for our future and will continue to be built upon as we move forward."

The new products combine to provide Intel Security's unified defense architecture, enabled by four key integrated systems. These are Dynamic Endpoint; Pervasive Data Protection; Data Center and Cloud Defense; and Intelligent Security Operations. 

The Dynamic Endpoint includes infection isolation by monitoring and intercepting post-malicious process actions; and machine learning analysis able to detect zero-day malware "in near real-time". Integration of the endpoint and the web gateway "prevents over 97% of zero-day malware before reaching the endpoint"; and 'real-time advanced threat protection' allows admins to access threat context in real-time during investigations.

Intel Security's Pervasive Data Protection extends security outside of the traditional perimeter to enable cloud-driven business. The approach taken is to unify SaaS, CASB, DLP and encryption to offer what McAfee calls "the industry's broadest solution across endpoints, networks and cloud-based services all centrally managed." The Cloud Application Governance application "features Cloud Access Security Broker (CASB) technology", and is currently available as a beta. How well this will measure against Gartner's four pillars of a CASB (visibility, threat protection, compliance and data security) remains to be seen.

The integrated Data Center and Cloud Defense system comprises Cloud Workload Discovery; threat intelligence sharing and unification; and integration and orchestration. The first provides deep visibility across public and private clouds. The second shares threat detection intelligence across the data center to allow corrective actions. The third enables "orchestration of security efficiently and more easily."

The Intelligent Security Operations system comprises abilities for malware detection; improved visibility and investigation; and incident response services. The intention, says Intel Security, is together with the other services to provide "a closed loop threat defense lifecycle framework that makes it easy to integrate, monitor and orchestrate security solutions."

The final part of Intel Security's announcement is the beta release of an SDK for the McAfee Data Exchange Layer (DXL). McAfee itself has a long association with open source software, and has now declared its intention to open source DXL with a new OpenDXL initiative. DXL is McAfee's connection fabric provid8ing a secure, real-time method of uniting data and actions across multiple applications from multiple vendors, as well as internally developed applications. 

In a separate blog post, Barbara Kay, Intel Security's senior director of strategic marketing, explained, "The SDK enables a unified model for integrating software vendors' best ideas with in-house developed and legacy systems to turn an unwieldy, unsustainable set of tools and data sets into a system that functions in real time and is easier to build, test, and maintain consistently. It reduces the error, disruption, and change that create vulnerability up front and over the business' life."

Kevin Townsend is a Senior Contributor at SecurityWeek. He has been writing about high tech issues since before the birth of Microsoft. For the last 15 years he has specialized in information security; and has had many thousands of articles published in dozens of different magazines – from The Times and the Financial Times to current and long-gone computer magazines.

Previous Columns by Kevin Townsend:

Tags:

Monitoring network activity is key to securing any production environment. Keeping tabs on the activities of the users, applications and the devices enables operators to ensure expected and normal operations. Monitoring also allows problems to be detected and corrected before damage can occur. 

However, not all networks are created equal. Monitoring industrial control system activity is difficult for two reasons. First, they use different protocols than IT networks. Second,  separate protocols are used for performing data-plane and control-plane activities: 

Data-Plane: sometimes referred to as the user plane, carries the user-data traffic. The data-plane is used by the HMI and SCADA applications to communicate process parameters and physical measurements between the human operator and the industrial equipment (I/Os).

Control Plane: carries the control information. In industrial networks the control-plane activities including all the engineering activity related to the maintenance lifecycle of industrial controllers, such as any read/change of: controller firmware, control-logic, configuration settings, or state. It also includes the administration and operations traffic. [Note that the term ‘control-plane’ is a general networking term, and isn’t related to the control layer of the Purdue Model or controllers in ICS networks]

The protocols used for data-plane activities, are those used by HMI/SCADA applications to communicate with control-devices. These protocols which include MODBUS, PROFINET, DNP3 and more, are well known and fully documented. 

However, many are unaware of the fact that in ICS networks the control-plane activities use different protocols - a separation that does not exist in IT networks! 

Unlike the data-plane protocols, control-plane protocols are vendor specific proprietary protocols that are mostly unknown, undocumented and often unnamed. This is because they were designed to be used only by the vendor’s engineering software tools. But over the years, other tools that utilize these protocols have been developed and can be used for control-plane activities and changing critical industrial controllers.

While many companies are concerned about cyber threats to their operations, most do not understand the difference between data plane and control plane protocols. Fewer understand the implications of the use of proprietary vendor specific protocols  for control plane activity therefore don’t monitor them leaving a dangerous security gap in their networks. 

The Importance of Monitoring Control-Plane Activities

Unlike the Data Plane which contains information relating to the systems’ process parameters (i.e. current temperature in a tank, or the RPM of a turbine), core functions are carried out via the control plane. These include changes to controller logic, firmware uploads/downloads and configuration changes.

Industrial controllers (PLCs, RTUS, DCS) are critical devices that are responsible for the entire process lifecycle in industrial environments. They are proprietary computers provided by vendors like Rockwell Automation, Siemens, GE, Schneider Electric and others.

In IT networks, activities like changing a server configuration or the software code it executes, are highly privileged activities. They can only be executed by a select group of users, typically systems administrators. Hackers need to compromise privileged access credentials in order make operational changes on an IT network.

In contrast, industrial controllers do not have any authentication mechanisms or encryptions mechanisms. This enables anyone with network access to access these critical devices and make changes to their configuration and logic, changes that can lead to severe operational disruptions. These can range from process glitches to major leaks of dangerous materials, physical catastrophes, and even explosions. Therefore, when adversaries want to cause operational damage — they target industrial controllers via the control plane. 

To make things worse, control plane activities aren’t logged or registered anywhere - not on the device, or the Historian, or any other component in the ICS network. This allows adversaries to hide their actions  and remain undetected until the physical damage is detected.

The combination of these shortcomings - lack of authentication mechanisms, access controls, change logs and the ability to monitor changes - may come as a surprise to those in the IT community. Unfortunately, it’s a fact. 

Contrary to what many believe, attacking industrial controllers using control plane activities doesn’t require special expertise. Basic knowledge of control system engineering is enough.

Protection Starts with Visibility

Industrial organizations — especially those involved with sensitive manufacturing processes or critical infrastructures — are paying close attention to ICS cybersecurity incidents that can disrupt operations while causing physical and financial damage.

Since most threats to ICS systems occur in the control plane, it is essential to monitor these activities. Protecting ICS networks begins and ends with gaining visibility and control over control plane activities.

Easier said than done, because (as I mentioned earlier) the protocols for the controllers are mostly proprietary and undocumented.

Fortunately, new ICS network monitoring technologies that focus on the control-plane protocols can provide early detection of reconnaissance activities, such as requests to read the controller firmware or logic from an unknown laptop, or requests to list open ports on a controller. Such activities may indicate the presence of a malicious actor seeking to compromise the system.

Monitoring the control-plane activities in industrial networks will also identify attempts to tamper with control devices in real-time, allowing ICS cyber security professionals to quickly respond and prevent, or at least minimize, damage to operational systems.

Finally, monitoring control plane activities provides a full audit trail of actions executed by employees, contractors, and integrators that have unfettered access to ICS networks. This audit trail also helps supervise insiders’ activities and enables detection of unauthorized changes and human error.

Related: ICS Networks at Risk Due to Flaw in Schneider PLC Simulator

Barak Perelman is CEO of Indegy, an industrial cyber-security firm that improves operational safety and reliability for industrial control networks by providing situational awareness and real-time security.

Previous Columns by Barak Perelman:

Tags:

A new survey published by Accenture shows that the twin security conundrums of increasing security breaches despite increased security spending, and high security confidence despite a high level of breaches, are both alive and well. These conclusions are drawn from a survey of more than 2,000 enterprise security practitioners across 15 countries in organizations with annual revenues in excess of $1 billion.

Accenture's report on this survey, Building Confidence: Facing the Cybersecurity Conundrum published Wednesday finds that 75% of the respondents are confident in their security strategies while a similar number describe security as 'completely embedded' in the corporate culture.

Despite this confidence, the same respondents faced an average of 106 targeted attacks every year, with as many as one in three being successful. This implies a disconnect between belief and reality, and a potential misunderstanding of today's threats and possible solutions.

For example, as many as half of the respondents said that given extra budget, they would 'double-down' on their existing spending priorities; that is, spend more on what isn't really working. For example, 58% of respondents would strengthen their perimeter controls despite the frequency and apparent ease with which those perimeters are breached.

Accenture believes that organizations need to pivot their actions to address the internal threat arising when the perimeter is covertly breached. More than half of the respondents said that it takes months to discover a sophisticated breach, while one-third admitted that these breaches are only discovered by external agencies, such as law enforcement or external security researchers. Accenture believes that organizations need to improve their ability to monitor and detect actions and activity inside the perimeter. 

"Cyberattacks are a constant operational reality across every industry today and our survey reveals that catching criminal behavior requires more than the best practices and perspectives of the past. There needs to be a fundamentally different approach to security protection starting with identifying and prioritizing key company assets across the entire value chain," said Kevin Richards, managing director of Accenture Security, North America. "It is also clear that the need for organizations to take a comprehensive end-to-end approach to digital security - one that integrates cyber defense deeply into the enterprise - has never been greater."

Accenture's survey highlights the conundrums of spend and breach, and confidence and failure, but doesn't explain them. SecurityWeek asked Richards for his thoughts. He suggests that one method of closing the gap on the cybercriminals would be to become as efficient at sharing threat data as the criminals have become at sharing vulnerability and exploit data. "It is beginning," he said; but it needs to improve.

The apparent over-confidence in the effectiveness of security controls despite the continuing and increasing volume of breaches is complicated. There could be an element of what is known as the 'optimism bias' -- the tendency to believe that bad things only happen to other people. However, Richards also believes it to be a side-effect of board-level awareness of security. Leadership awareness is good; but it means that security practitioners are increasingly asked to explain security issues to the board.

Since it is difficult, and potentially career-threatening, to tell the CEO that despite all the money spent on security the organization remains at risk, there is a natural tendency to put a positive slant on the true situation. This is a problem that most CISOs readily accept: the difficulty in communicating genuine information to the board.

There is nothing new in Accenture's advice on solving the conundrums. "To succeed, CISOs have to step beyond their comfort zones and materially engage with enterprise leadership," says the survey report. "Doing so will require them to speak the language of business to make the case that the security team is a critical pillar in the battle to protect enterprise value." But what the survey does show is that CISOs and C-Suite have not yet solved the difficulties inherent in this good advice.

Related: Attend SecurityWeek's 2017 CISO Forum

Kevin Townsend is a Senior Contributor at SecurityWeek. He has been writing about high tech issues since before the birth of Microsoft. For the last 15 years he has specialized in information security; and has had many thousands of articles published in dozens of different magazines – from The Times and the Financial Times to current and long-gone computer magazines.

Previous Columns by Kevin Townsend:

Tags:

Are you considering a public cloud? It gives you flexibility and scalability; but more often than not, its concept of shared responsibility demands the customer be responsible for securing the hardest part - the data itself.  

Please join Armor, Microsoft and SecurityWeek today at 11:30AM to learn how the combination Azure and Armor provides the complete cloud solution: flexibility, scalability, security and compliance.

During this interactive webinar we will discuss:

Register Now

Can't make the live webinar? Just register now and we will email a link to watch on demand

Tags:

A new report highlights the high number of users still operating outdated Windows operating systems and unsupported browsers. This represents a huge threat to the organizations whose users access company networks from insecure laptops and home computers within the growing adoption of BYOD policies.

Duo Security reports that 65% of its clients' Windows users are still running Vista, and that tens of thousands are still on XP (now 15 years old, unsupported, and with around 700 known vulnerabilities of which 200 are rated as high to critical). On top of this, while Chrome is the most popular browser, 20% of Internet Explorer users are running a version that has reached end-of-life status and do not receive security patches. For the XP users, as many as 88% are still using Internet Explorer 8.

Duo Security is a trusted access provider offering multi-factor authentication to its customers. As part of this service it is required to collect telemetry from the users -- often resulting in a greater knowledge of what is connecting to its customers' networks than those customers themselves. Duo's new report, The 2016 Duo Trusted Access Report: Microsoft Edition, is based on an analysis of that telemetry.

Michael Hanley, director at Duo Labs, is a firm believer that users should always operate the latest and greatest offerings -- and he is a strong supporter of Windows 10. "There are a lot of advanced features that exist in Windows 10 which is arguably the most secure and strong operating system Microsoft has produced," he told SecurityWeek. "But the problem is getting users off the legacy versions."

He used the out-of-box settings of Vista as an example. "Windows 7 does not set you up as securely as does Windows 10. Users tend to start from a secure configuration with 10; but not with 7 -- and the danger is that users have never configured 7 to be secure. My opinion is that a lot of people aren't doing the basics -- like automatic updates (or else they'd be on 10 or at least a more secure browser)" he suggested.

He admitted that legacy apps could be behind the continuing use of IE8. "The problem here is that if the company app only works with IE8, users will comply, but then run IE8 as their standard browser rather than just for the legacy app. This presents a significant exposure," he warned: "first for the user, and then for the company. It implies that such companies have assumed that the cost of upgrading the app to work with the latest browser is more than the cost of a breach -- but I would argue the opposite. A breach is probably far more costly in the long run than taking $50,000 to update some legacy application so that users can access it with Chrome or Azure and IE11." In effect, he added, "Many companies are encouraging their users to make unsafe security choices and then drive with those on a daily basis. That's troubling. 20% of users are on an unsupported and unpatched browser; and that's pretty bad."

To illustrate the effect he suggests looking at healthcare and ransomware. "From our own studies, healthcare customers have 4 times as many XP boxes as the financial sector. That illustrates why ransomware attacks have been so successful against healthcare. The bad guys go where they know they will succeed without a lot of effort."

Duo customers do have options. Not only is Duo aware of the insecure connections, it can respond to them. "Customers can do nothing; they could detect those users still using old software and tell them to upgrade; or they could block those users from gaining access unless and until they upgrade," said Hanley. 

"I would say that companies should, at the minimum, invoke the second option. Here at Duo we are insistant that our own users are up to date -- we actually do use that third blocking option. We forbid anybody from using anything other than the latest and greatest software before they can access our own internal systems."

Kevin Townsend is a Senior Contributor at SecurityWeek. He has been writing about high tech issues since before the birth of Microsoft. For the last 15 years he has specialized in information security; and has had many thousands of articles published in dozens of different magazines – from The Times and the Financial Times to current and long-gone computer magazines.

Previous Columns by Kevin Townsend:

Tags:

The Dirty COW vulnerability in the Linux kernel that was revealed late last month can’t be mitigated with the help of containers, security researchers have discovered.

The flaw (CVE-2016-5195) relies on a race condition in the kernel, between the operation that performs writes to copy-on-write (COW) memory mappings, and the one that continuously disposes of that memory. When the race condition appears, the kernel might end up writing data to read-only memory mapping, instead of making a private copy first.

Proof of concept (POC) exploit codes that leverage the vulnerability have already started to emerge, including some targeted at Android devices. These POCs revealed that one can write to read-only files, and that root access could be achieved, and even how to break out of a container.

Aqua Security Software researchers explain that the available POCs focused on privilege escalation inside the container, but that it is possible to run code inside a container, from a non-root user, to write data to a “protected” file on the read-only volume the container was mounted on.

Aqua’s Sagie Dulce explains that even users with root privileges shouldn’t have write access to a mapped read-only volume in a container, let alone a non-root user. However, Dirty COW makes it possible for data on the host to be manipulated from within the container.

Next, the researchers tested their code in a container with user namespace, as a non-root user inside the container. When running with user namespace, the root user inside the container is mapped to a non-root UID (a non-privileged user) on the host. The test revealed that, even if the user in the container was non-root and it shouldn’t have root on the host, the code would still write to the “protected” file on the host.

“In conclusion, when it comes to kernel vulnerabilities, you can't be too careful. Containers still share the same kernel, which when exploited has the potential of jeopardizing other containers or the underlying host. We saw that a simple POC, which was not meant to break out of a container, could still modify data on the host,” Aqua’s researcher notes.

Others too have discovered that containers such as Docker can’t keep systems safe from Dirty COW. Paranoid Software explains that they decided to exploit the vDSO (virtual dynamic shared object) feature in Linux, because this small shared library is automatically mapped by the kernel into the address space of all user-space applications.

A POC available on GitHub uses Dirty COW to modify the clock_gettime() function in the vDSO memory space for all callers, not just the running process. “Once the race condition is triggered, and the shellcode executes, it will send you a root shell,” Paranoid Software’s Gabriel Lawrence says. The researchers published a video demonstrating the exploit.

“I'm particularly interested in demonstrating escaping out of Docker simply because I think many people overestimate what is required. Kernel exploits are rarer than user space escalations, but they are not without example - and understanding that even with the separation offered by the kernel features that make containers possible, it's possible to get past them with a kernel exploit,” Lawrence notes.

Related Reading: Disrupting the Disruptor: Security of Docker Containers

Ionut Arghire is an international correspondent for SecurityWeek.

Previous Columns by Ionut Arghire:

Tags: