2008 Predictions Panning Out

Almost one month ago I wrote Predictions for 2008. They included 2) Expect greater military involvement in defending private sector networks. and 4) Expect greater attention paid to incident response and network forensics, and less on prevention.

Relevant to number 2, today I read Intelligence Chief Proposes Wide Cyber Surveillance, which says:

US National Intelligence Director says government should be able to tap all email, file transfers, and Web searches..

In an interview scheduled to be published in Monday's forthcoming edition of The New Yorker, McConnell offers some insight into his long-awaited draft U.S. Cyber-Security Policy...

To accomplish his plan, the government must have the ability to read all the information crossing the Internet in the United States -- in order to protect it from abuse.

The plan gives government agencies the right to monitor email, file transfers, and even Web searches, according to reports. McConnell's proposals also include reducing the number of gateways between government computers and the Internet from 2,000 to 50, as well as implementing a dragnet to monitor electronic traffic.

Relevant to number 4, today I read
Tech Insight: Incident Response, which says:

Incident response (IR) for many IT shops traditionally has been accomplished by cobbling together tools from various sources with a script-based tool that automates the collection of data from the suspect system. An IR team member or help desk technician is sent to investigate a problem, with a USB thumb drive in hand that contains the collection of tools. The tools are then run, and the output analyzed to detect the source of the suspicious behavior. It’s neither a quick nor efficient process.

All manual incident response is slow response, says Kevin Mandia, president and CEO of Mandiant. A key driver for organizations dealing with incidents, especially those in the financial sector, Mandia says, is speed and minimizing exposure: The IR team must be able to quickly grab information about the incident, determine what’s happening, and respond appropriately to minimize collateral damage...

With new products on the horizon, IT groups looking to streamline their current IR practices or to simply start an IR program for the first time, should keep an eye on evolving products and new releases due out in within the next month.

I plan to visit MANDIANT and HBGary within the next month. I have trial software from Technology Pathways to test. I have a copy of NetWitness Investigator Field Edition in my lab kit now. I have a copies of AccessData FTK 2.0 and Guidance Software Encase Forensic en route. There's a lot happening in the IR and forensic space, so I think 2008 will be a big year.

Comments

Ironwoodtree said…
So what do you think of the NSA plan? Do they have a response plan for all these horrible threats they detect? How are they going to weed out false positives? The plan stinks to high heavens to me.
10:52 PM
Anonymous said…
Wow, talk about a dangerous precedent. I am glad that you bring this to light, because it definitely brings up the fact that the federal wiretapping laws are a little outdated. Nothing personal, but I don't need some government automaton watching me google, whether it is for porn, instructions how to make meth, or explosives. It starts as defense, until we get another right-wing religious nut job trying to force ridiculous notions of morality into office. I have more fear in my government with our president offering weaponry to the very country that it seems most "terrorists" are citizens of (Saudi Arabia) in exchange for oil then I do of some far fetched cyberattack. And hackers collaborated just fine through BBS'es before widespread consumer Internet usage, nothings stopping them from going back to avoid detection. in other words, more wasted tax money.
12:32 AM
John Ward said…
Yeah.... not quite sure how I feel about that one... I don't quite believe the conspiracy theories, but I agree with the notion that I do not welcome military wiretapping civilian communications. As it stands right now, police and federal law enforcement need a judge to approve wiretapping where any "reasonable expectation of privacy" is violated. I don't remember off hand if Internet communications fall into that realm. Even if it does, I don't feel think the military should be immune to those laws, and I definitly do not think they should serve in any law enforcement capacity. That sets us down a slippery slope. I didn't hear any mention of an incident response plan, as the first poster pointed out. But we have a history in this country (at least until the last decade) of not welcoming federal involvement into our daily lives, I have a feeling that the first cases to reach a court as a result of this will see this policy go down the crapper, or at the very least be forced to massive oversight and fall into the government inefficiency we have all come to love.
2:02 PM
Jim said…
Wow. What are they thinking? Might as well just stop allowing envelopes at the post office too.
5:32 PM
Post a Comment

Popular posts from this blog

Zeek in Action Videos

Image
This is a quick note to point blog readers to my Zeek in Action YouTube video series for the Zeek network security monitoring project .  Each video addresses a topic that I think might be of interest to people trying to understand their network using Zeek and adjacent tools and approaches, like Suricata, Wireshark, and so on.  I am especially pleased with Video 6 on monitoring wireless networks . It took me several weeks to research material for this video. I had to buy new hardware and experiment with a Linux distro that I had not used before -- Parrot .  Please like and subscribe, and let me know if there is a topic you think might make a good video.
Read more

MITRE ATT&CK Tactics Are Not Tactics

Image
Just what are "tactics"? Introduction MITRE ATT&CK  is a great resource, but something about it has bothered me since I first heard about it several years ago. It's a minor point, but I wanted to document it in case it confuses anyone else. The MITRE ATT&CK Design and Philosophy document from March 2020 says the following: At a high-level, ATT&CK is a behavioral model that consists of the following core components: • Tactics, denoting short-term, tactical adversary goals during an attack; • Techniques, describing the means by which adversaries achieve tactical goals; • Sub-techniques, describing more specific means by which adversaries achieve tactical goals at a lower level than techniques; and • Documented adversary usage of techniques, their procedures, and other metadata. My concern is with MITRE's definition of "tactics" as "short-term, tactical adversary goals during an attack," which is oddly recursive. The key word in the tacti
Read more

New Book! The Best of TaoSecurity Blog, Volume 4

Image
  I've completed the TaoSecurity Blog book series . The new book is  The Best of TaoSecurity Blog, Volume 4: Beyond the Blog with Articles, Testimony, and Scholarship .  It's available now for Kindle , and I'm working on the print edition.  I'm running a 50% off promo on Volumes 1-3 on Kindle through midnight 20 April. Take advantage before the prices go back up. I described the new title thus: Go beyond TaoSecurity Blog with this new volume from author Richard Bejtlich. In the first three volumes of the series, Mr. Bejtlich selected and republished the very best entries from 18 years of writing and over 18 million blog views, along with commentaries and additional material.  In this title, Mr. Bejtlich collects material that has not been published elsewhere, including articles that are no longer available or are stored in assorted digital or physical archives. Volume 4 offers early white papers that Mr. Bejtlich wrote as a network defender, either for technical or pol
Read more