3 ms·
The apache struts vulnerability is easy enough to detect -- java runs programs it shouldn't. If a bigcorp like that doesn't have a nextgen av to detect that,exe
by badrabbit 8y ago
The apache struts vulnerability is easy enough to detect -- java runs programs it shouldn't. If a bigcorp like that doesn't have a nextgen av to detect that,executable logging+SIEM correlation would have done the trick.
They detected the traffic after the tls inspection box was fixed, that was the box that deteced it not the point of entry from what I understand. Regardless, TLS inspection has it's place (this is why you can't have end-to-end cryto in a corporate environment).
From my experience, most bigcorps do IT like it's still 2009. There is so much architectural bloat,bureaucracy and unseen system complexity,it reduces security controls to mere cosmetic theatrics.
It's like having a 200ft tall,50ft thick iron wall around your castle with 100k foot soldiers armed with the best weapons and training. The problem is that your soldiers(IT staff) can't act fast due to bureaucracy and half of the duties are someone else's problem due to over-segregation of duties. Your fancy wall(security solutions and controls) is neat but there are holes wide enough to fit ten people all over it.
In the end the enemy is complexity. You can't solve that by adding more security vendors,solutions and staff which is exactly what everyone seems to be doing.
- blunte 8y agoWorking at companies like this, you come to realize that they are so insulated in their special (monopolistic or almost) positions that they become blind to anything other than quarterly earnings per share. On the rare case that something does blow up badly enough that executives must leave, they are still almost permanently cemented at their tier. So they just migrate to another poorly run large company to focus on their own short term gain. Applying logic to this scenario doesn't work. It's really about balancing cost-benefits. Since the costs to being an idiot are very low once you reach a certain level, the downsides can be completely forgotten in pursuit of the upsides.
- p0rkbelly 8y ago"Nextgen"AV would not have caught this. AV is still AV and looking at executables and binaries. Exploiting a vulnerability does not fit that bill. This incident had nothing to do with a 'virus'. Now many tools that include AV, say Crowdstrike, may have caught this...but AV is on the low-end of the hierarchy of needs when it comes securing your assets, especially servers. Much more so for Linux. AV is more of an end-user issue where they want to download files and execute them.
- badrabbit 8y agoCrowdstrike,Carbonblack,windows atp,etc... Are "nextgen av". You can call them by their self proclaimed category as well.
- p0rkbelly 8y agoCarbon Black and Crowdstrike were traditionally EDR platforms. Crowdstrike had no AV capabilities until last year. They have now morphed into the EPP category as per Gartner. They are a now a suite of tools, where AV is just a single part of it that is the least important. Any beyond that, "NextGen AV would have caught this" is the original premise. Nextgen tools were not needed. All they had to do was patch a well known Vulnerability within a period of MONTHS. You can buy the fancy tools. If you can't do the basics, they are worthless.
- badrabbit 8y agoYeah but you'll always have unpatched vulns or 0days. You should patch but you should also account for when patching isn't enough. Sometimes servers get missed. Some places even have forgotten servers that aren't part of asset management. Some places don't have asset management. The fancy tools are not a onse size fits all solution just like patching and goof security hygeine isn't.