Having just returned from my first Black Hat experience, I can say it was outstanding. From the engagement of the crowd to the quality of the speakers to the controversy of the subject matter, my only regret was leaving after the first day.
The most striking thing to me about Black Hat was something I knew: If a skilled penetration specialist (how about that on your business card?) wants to get into your network, he can and will. Period. All of my conversations with folks in the trade drew that same conclusion. There are an infinite number of ways to compromise your defenses, and some of these folks seem to know every one.
If there is good news, it's that there is little money in causing a network to fail outright anymore. So much of what took place at Black Hat was about getting into a machine under the radar and then using it for malicious intent. So we need to change tactics a bit, meaning you want to make sure that you find out about the issue and figure out a way to minimize the damage before your data is compromised.
First, you need to look at activity on your network. The main objective of today's bad guys is to harvest private information. They can do it in one fell swoop by attacking your databases, or they can get it one user at a time by turning those devices into zombies (otherwise known as bots).
Zombies tend to be reasonably easy to detect, because they do stuff out of the ordinary. Whether it's blasting traffic in a distributed denial-of-service attack, sending spam/phishing e-mails or communicating with unknown domains in far-off lands - if one of your machines is acting strangely, get it off the network and investigate.
You also need to evaluate activity from an application perspective. For a corollary, let's look at banks, which spend a tremendous amount of money on fraud-detection software. This basically looks at every transaction and compares it with an accepted profile of behavior and a baseline of what you typically do. There are analogies in the packaged application world, with tools from Virsa (acquired by SAP), Approva and OverSight Systems, which plug into your ERP system and can flag troublesome transactions.
You also need to make sure your data is safe. Deterring the ability of employees to take data off-site, protecting laptops that hold this information and providing a measure of security on the data stores will ensure that when something happens, you'll be able to react quickly.
One last thought: It's been a long time since anyone was foolish enough to say something is 100% secure (Oracle is unbreakable, right?), and with good reason, because everything can be compromised. If you're not convinced, go to Black Hat next year.
Learn more about this topicNAC, VoIP security draw questions at Black Hat
08/07/06Black Hat: Unpatched flaw revealed in Cisco firewall
08/04/06Black Hat: Researcher creates 'Net neutrality test