Too Much Zeus, Need Recommendations

It's been a little over three months since I have started the new job.  To be certain, I love it.  I'm really starting to get  my arms around all that goes on (or doesn't) around here.  And while I know I have a daunting task to help guide this place towards becoming more secure; I know I have already taken great strides in moving forward.

I fully admit that there are some pretty basic controls that are not implemented.  If I were an auditor from my previous contracting job, my head would probably explode with some of the findings here.  Some of them are THAT basic.  But, these decisions have been made way in the past, and for the most part fall into the politics/culture category.  It will take a while to get movement on those controls.  Or a decent-sized breach.

All of that said, I was looking through my incident notes for the past month (or so.)  And looking at the fires I put out on a daily basis, I see that I work to eradicate at least one Zeus-infected host a day.  That's an average.  I've given up on remediating the hosts.  I send the IP to our helpdesk and let them get it off the network and reimaged.

In light of the controls that need grassroots work, I'm looking for a solution that I can dump on the client hosts to help combat zero-days, attachments, etc.

One recommendation I have received so far is Invincea.

Are there any potential solutions I should be aware of?

A Day of Updates: both Nessus Client and Burp

It just happens to be one of those days where everything I use has to be updated.  It started with Nessus, when opening my client I was prompted to download and install the new client.  Nessus has moved from 5.2.4 to 5.2.5.

Later, it was on to auditing a small application, and that meant firing up Burp Suite.  Burp notified that it needed to be updated from 1.5.20 to 1.5.21.

So, if you are using those apps, now is the time to update.

PhishMe and Sophos Enterprise

We're starting up a security awareness campaign, where, in part, we will be using PhishMe's service to phish our employees; where falling for the phish will lead to training and education.  PhishMe provided us with the list of all the domains that they own so that we could white-list them in our proxies.  I tested them all, but there were two or three domains I still couldn't reach.

Sophos Enterprise provides a method to explicitly allow connections to specific web sites even if the Sophos proxy would normally block it.  (Exceptions can be added in the Web Control, on the "Website Exceptions" tab.)  Pretty simple.

However, after adding the domains to the exception, there were still two or three domains that I still could not reach.  I didn't want to just exclude those domains from scenarios, as I felt it might limit my choices.  I found that the Anti-Virus and HIPS Policy has a section that addresses domain blocking...and I believe this is if the AV thinks that there is malware on the page.  If you view your "Anti-Virus and HIPS Policy" you will see a section mid-way down the screen titled Web Protection.  If it is on, click the Authorization button at the top of the screen.  Go to the Websites tab, and add the domains you want to white-list.  Bear in mind that the AV will not scan these domains.  Once you hit OK, you should be able to browse the domains.

Is Feedly down or broken? - FIXED

I've been using Feedly to replace my Google Reader, and have liked it a lot so far.  However, I'm trying to log in today, and I cannot get a login page.  All I see at http://feedly.com/index.html is a white screen.  I'm looking at the source, and I can't tell if the page is broken, or something else is going on.  All I see are the meta tags, and a script that appears to force the page to http://feedly.com/index.html.

Other pages appear to work, like About, Help, Community, Publishers and Blog.

Is it me?  Anyone else experiencing this issue?

Edit:
It looks like it was in the new implementation of authentication.  Ok, stand down.  Nothing to see here.

Taking stock

Now that I've gotten into the groove so to speak, I can reflect on what I've seen in the new position.  Here are some of the projects I'm working on.

I have started to build out a security awareness program.  This program is going to focus heavily on phishing, but will also include a monthly email, a blog, and an internal site to check email addresses against data breach datasets.  The monthly emails will feature a unique topic on information security as a method to educate the users.  I started a blog to post information security stories that the user base can learn from and to read about non-mainstream stories.  As for phishing, we'll be making heavy use of PhishMe.

I'm also starting to build a vulnerability management program.  Right now, there are no internal vulnerability scans performed on the user-space. And really, from what I've seen, the external scans (performed by a managed service) are sorely lacking.  For low-hanging fruit, I've purchased a Nessus license and will start working on internal assesses.  I will also start working on the servers, but I know what I will find, and I know it will be very hard to change the culture of non-patching.  I'm afraid of what it will take to make the changes to install a regular patch management program.

The results of my mini-gap assessment have shown me where there are many opportunities to get better.  I plan on using the SANS Top 20 Controls in order clip the low hanging fruit and make improvements.

Right now my most tangible success has been the creation of a "security server" where I'll be able to stage vulnerability scans, pen tests, and other security tasks.  I'm also in the process of building a "scanning" account to be used by the tools such that we should ONLY see this account used during security engagements...any other use may indicate an incident.

Finally, I'm working on information sharing.  I firmly believe that the sharing of information by the Good Guys helps us combat the Bad Guys.  To that end, I started working as our company's representative to one of the sharing resource centers.  Down the line, I hope to get involved with Infraguard as well.

It's been a busy two months....and I only see it getting busier.

New (In)Secure Magazine

I just received notification that the new issue of (In)Secure magazine has been published.

You can get it here.

Blocking Dynamic DNS sites

Going through proxy and DNS logs, I noticed that (as a whole) the company has not been blocking sites categorized as "Dynamic DNS."  I discovered this while reviewing a "security" report that lists the various site activity that would fall into the generic "security" report.  Interestingly enough, no Dynamic DNS sites were blocked.

Dynamic DNS is hosting for sites that do not have static IP address.  Mostly, it is used by three types of users:  hobbyists who do not want to pay for a static IP address for their site; spammers and scammers; and sites that are out rightly malicious.  Bot herders prefer to use Dynamic DNS sites as they can rotate servers in and out of rotation in order to make it more difficult to track down and mitigate.  Further, many times the registrar information for suspicious sites is obfuscated in order to make it harder to find the owners.  There is rarely a business case to allow Dynamic DNS sites.

With those points in mind, I presented the case to block all Dynamic DNS-hosted sites.  If there are truly legitimate sites that users need to access, we can re-evaluate on a case-by-case basis and adjust the filters.  So far, it looks like the decision has been favorable.

Learning Python post updated

Just a quick post:  I've updated my post on Learning Python thanks to the great suggestions from the SANS DFIR list.

The updated post can be found here.

First Day

Today was a great first day, I'm glad I made the move to the new company.  So far, I've learned that most of the security controls are outsourced, managed by many of the big providers.  I think one of our tasks will be to aggregate data from those outsourced providers.

And, it looks like I'll get to go to my first conference, as we will be going to RSA in February.  I'm psyched as I've never really gone to a security conference before.

When the change was made uptown...

Actually, I work downtown.  Or worked.  I'm glad to say that I'm moving on.  While I don't regret the time spent in my current location, the job did not work out.  My co-worker said it best when she was cornered by our Vice President on why I'm leaving:  "Expectations were not met."  Clearly, I learned a lot while I've been here, it has been a rewarding experience. And, I'd do it again, because you learn from every opportunity.  But, I could not see myself here in any number of years.

So, I'm moving on.  I've taken a position where I will be building out a security department for a company.  Basically, I'm on the ground floor.  They have a bunch of controls in place, but very disparate, and not centrally managed.  And, I'm sure when I start gap analysis, I'll find a whole lot missing.  But that's ok, as there will be opportunity to grow and put a stamp on things.  It will good to see the company move in a positive security direction.

Will there be challenges?  I expect it.  I'm sure that there will be lots of pain implementing some of the controls.  And, while I know that there is (some) management buy-in (heck, they created this position) I'm sure there will be tons of operational pushback.

I hope that this means I will be posting more.  Certainly, I will not be posting specifics.  But, I will chronicle the process of building out security in the enterprise.  I'll tell of what works and what does not.  I'll post some reviews of success, and I'm sure there will be plenty of lessons learned.  Finally, you will probably see posts looking for advice or recommendations.