SANS Report Says Organizations Focusing On the Wrong Security Threats 98
yahoi writes "Companies around the world are leaving themselves wide open to Web- and client-side attacks, according to a new report released today by the SANS Institute that includes real attack data gathered from multiple sources. SANS found that most organizations are focusing their patching efforts and vulnerability scanning on the operating system, but they're missing the boat: 60 percent of the total number of attacks occur on Web applications, and many attacks are aimed at third-party applications such as Microsoft Office, and Adobe Flash and other tools. Exacerbating the problem, they're taking twice as long to patch Microsoft Office and other applications than to patch their operating systems."
OpenBSD vs Linux (Score:5, Insightful)
I had this discussion -- and yes, it was civil -- on deadly.org a while ago. Pointing out that web servers were like the circus coming to town. Setting up Linux was like using strong wooden poles to hold the tent, and using OpenBSD was like using steel poles.
Neither really mattered because people who wanted to cause trouble would simply be slitting the fabric (the apps) or cutting the ropes. Thus, a lot of the nit picky little stuff that OpenBSD fanboys focus on vs Linux doesn't really matter. The issue isn't Linux or OpenBSD or Windows, it is now mostly .ASP, .PHP and other homebrew web code where people didn't sanitize input, do bounds checking, etc.
Re:Most type of exploit is 'other' (Score:2, Insightful)
SANS' Ullrich says patching third-party applications isn't easy. "Third-party applications can be tough. There's no good system" for patching them, he says. The key is inventorying third-party Web applications, which the report shows are a major attack vector, Ullrich says.
It's called apt. It's already widely deployed in Debian and Ubuntu, and has been for a long time. The problem is solved.
The problem is in job responsibility (Score:5, Insightful)
As a long time sysadmin and also as a programmer, I know that sysadmins generally try to draw their line of responsibilities or at least what they will take care of just below the "user installed software" level. I do have general knowledge of some of these applications and know which ones have vulnerabilities, but I usually ask that the programmer or user of the software maintain it. Although they seldom do and then ask for help when something gets hacked.
Perhaps the responsibility for these apps should be in the hands of the sysadmin as well, but the number of apps you have to maintain as you go up to that level increases exponentially. Plus, since they are usually not part of the OS, your OS company is not going to provide you with an easy way to maintain them, so you either need an application administrator or you need to train the programmer/user. Companies probably don't see the point.
Insecurity Experts (Score:2, Insightful)
Always telling you what you're doing wrong, never telling you how to do it right.
How do you serve up the content and services end-users expect without the security risks?
Simple answer: You can't.
Unless you're writing your own operating system and rolling your own PDF viewers and office suite and publishing your own flash-like plug-in that no one will ever want to install, you'll end up running around like a chicken with it's head cut off every once in a while because of fucking adobe, fucking bill, fucking Linus 20 years ago, fucking java, etc.
You can extend this to hardware too if you want.
You never really know what that network card is doing, do you?
But at the end of the day, we have to get shit done. "Safety first" in construction is a farce. Getting the job done is first. Getting the job done right and on time is second. Safety's third. Maybe.
The same goes for security in the computer world. We cover the biggest holes and keep our ears open. But our primary goal is making shit available to the end-user.
I'm going to get shit from nerds claiming that I HAVE to be 100% secure. Fuck them. I HAVE to get the job done. My being 98% secure isn't very far from their being 99.99% secure.
Patching all the usual suspects (Adobe, Java, Office, the OS) certainly falls in the "should be done regularly and diligently" category. But as stated above, I understand why it doesn't always happen, (and it's not just due to incompetence).
A report saying what people are doing wrong isn't helpful. A report saying "these fuckers are always problematic - here's a practical solution" would be much more useful.
Re:OpenBSD vs Linux (Score:3, Insightful)
when PHP gets popped (is there really any other culprit these days?), the OS is still untouched
So what?
Today, the PHP service that got popped was running on the... PHP server. Is the OS important when someone snarfs up your web app and all data it had access to?
Are you keeping unnecessary sensitive data on your PHP server? I hope not, but sure.. MAYBE it would be protected if your OS was secure.
In your analogy, it's like the tent poles of the "windows" tent are made of cardboard tubes... they might hold up due to the imbalance of newly torn cloth, or they might not.
You're completely missing the point. If someone tears through your tent, its game over, circus down. Nobody gives a damn about tearing your poles down, they have better ones at home.
duh? (Score:3, Insightful)
Patching Windows is the main focus because it is the best bang for the buck. There are many tools to automate this process (Active Directory, Group Policy, SUS). There are no tools to automatically discover XSRF, XSS, and Injection attacks in your custom web apps, then write patches for them, then deploy and manage those patches. That's orders of magnitude more expensive.
When you have limited resources, you will just go for the lowest-hanging fruit. Obviously.
Re:Insecurity Experts (Score:4, Insightful)
The problem is that while there are solutions, they often won't be considered for various reasons...
There are expensive patch management systems for windows, but they are often extremely expensive and typically complex to manage.
There is the option of moving to linux, where on any modern distro it's easy to keep all your applications up to date with patches, but people are either locked in to windows applications, afraid to try something new or simply have no knowledge of linux.
I would say that the benefits are a lot more than the 1.9% you mention, and if done correctly actually requires *less* work... I keep a small network of linux boxes fully up to date and spend very little time doing so, while other people managing a similar sized windows network tend to lag behind badly (especially on third party apps). I have the package manager update its package list daily, and alert me if theres any needed updates.
Re:Permits and Inspectors (Score:3, Insightful)
A lot of the "professionals" are fairly incompetent, and you can bet that big vendors (especially ms) would corrupt the process to ensure that you can only be licensed if you only install their products.
I've found through the years, that enthusiasts who taught themselves, learned through experience and had a genuine interest in computing tend to be very good at what they do, whereas people who attended training courses and got certifications generally were only interested in the money they could earn from a career in computing, and are often stumped by something that wasn't covered on their course.
The latter kind of people are also extremely averse to learning anything new, and will want to remain in the bubble they were originally taught while the former will actively seek out new technologies to experiment with and learn about.
I have found that the course-taught people will typically believe what vendors tell them and never question it, if a vendor tells them a product is good/secure they will assume it is, and won't do proper research on how to harden it or what else might be a better option.
And they won't seek out anything that isn't advertised to them, this is why there is such a huge problem with unpatched third party apps as the article states, these people don't even realise there is a problem because there aren't any vendors heavily marketing a "solution" for it.
Having requirements like you specify is likely to do more harm than good.