The Coalfire Blog

Welcome to the Coalfire Blog, a resource covering the most important issues in IT security and compliance. You'll also find information on Coalfire's insights into the unique cybersecurity issues that impact the industries we serve, including Cloud Service Providers, RetailFinancial Services, Healthcare, Higher Education, Payments, Government, Restaurants, and Utilities.

The Coalfire blog is written by the company's leadership team and our highly-credentialed security assessment experts. We look forward to your comments, so please join the conversation.

The Coalfire Blog

Can we kick the attachment habit?

October 11, 2011, John Rostern, VP, Technology Advisory and Assessment Services

John Rostern

As consumers of messaging services, particularly email, we have become addicted to attachments. This habit has become an easy avenue for mounting cyber-attacks against an organization. In the 2010 Verizon Data Breach Investigations Report, conducted in cooperation with the United States Secret Service, 38 percent of breaches utilized some form of malware and 28 percent employed social tactics.



It is quite typical for email to be used as the delivery vehicle for malware and social engineering to facilitate the design of the email to induce the recipient to open it and the attachment. This attack works because we have conditioned ourselves and our customers, clients, vendors and other third parties to ‘trust’ email as a medium of exchange. It would seem that this trust is not well founded and that the paradigm should be re-examined.

From the perspective of a historical parallel, Cholera epidemics in New York City in 1832, 1848-49 and 1854, killed thousands of people. It led to the founding of the Board of Health in 1866 and the adoption of improved standards for sanitations that eventually eradicated the disease. Treating the individuals during each of the outbreaks had been ineffective and in some cases counterproductive as more people were exposed to the disease. Improving sanitation and overall social hygiene effectively eliminated the root cause of the disease.

The current state of polymorphic malware makes treating the affected systems similarly difficult. The number of malware variants, combined with polymorphic characteristics, makes detection and removal extremely challenging if not impossible. Therefore, the most effective approach may be to eliminate the root cause; in this case, email attachments.

Many organizations have already implemented some form of Document Management System (DMS) or in the broader sense Enterprise Content Management (ECM). A DMS provides a centralized repository that supports several common functions; Check In/Out, Version Management, Search & Navigation and Document Organization. Products such as Documentum, eDocs, NetDocuments and Sharepoint are representative of this class.

Implementing a DMS is a relatively trivial exercise in terms of technology. The products are proven and the underlying infrastructure is common in today’s IT environment.  It should also be noted that security controls around the DMS are critical, but easier to achieve than the traditional model where this same information is scattered throughout the organization. However, changing the habits of the work force will be the most challenging aspect of the project.

There are other advantages in creating a DMS-centric operation for your organization:
 

  1. The DMS provides a central, single version of documents and will help prevent ‘version-it is’ in the creation-review-edit process;

  2. Distribution of sensitive, private or otherwise controlled information can be restricted more easily;

  3. Backup and recovery is simplified by eliminating the end points from the problem;

  4. A centralized DMS repository may facilitate the notification process in response to a data breach;

  5. The organization of the DMS facilitates compliance with eDiscovery requirements, (e.g., litigation hold), in a litigation scenario; and

  6. Creation of a portal for access by known/trusted third parties supports the secure transmission of sensitive information without exposing it to the internet. 

Eliminating email attachments may seem to be a formidable task. However it may be the most realistic means of reducing the threat of malware to the enterprise. So what is stopping you from ‘kicking the habit’?

<< Go Back

Comments
Blog post currently doesn't have any comments.

Post Topics

Archives

Tags

2.0 3.0 access Accounting Agency AICPA Assessment assessments ASV audit AWS AWS Certified Cloud Practitioner AWS Certs AWS Summit bitcoin Black Hat Black Hat 2017 blockchain Blueborne Breach BSides BSidesLV Burp BYOD California Consumer Privacy Act careers CCPA Chertoff cloud CoalfireOne Compliance credit cards C-Store Cyber cyber attacks Cyber Engineering cyber incident Cyber Risk cyber threats cyberchrime cyberinsurance cybersecurity danger Dangers Data DDoS DevOps DFARS DFARS 7012 diacap diarmf Digital Forensics DoD DRG DSS e-banking Ed Education encryption engineering ePHI Equifax Europe EU-US Privacy Shield federal FedRAMP financial services FISMA Foglight forensics Gartner Report GDPR Google Cloud NEXT '18 government GRC hack hacker hacking Halloween Health Healthcare heartbleed Higher Higher Education HIMSS HIPAA HITECH HITRUST HITRUST CSF Horror Incident Response interview IoT ISO IT JAB JSON keylogging Kubernetes Vulnerability labs LAN law firms leadership legal legislation merchant mobile NESA News NH-ISAC NIST NIST 800-171 NIST SP 800-171 NotPetya NRF NYCCR O365 OCR of P2PE PA DSS PA-DSS password passwords Payments PCI PCI DSS penetration Penetration Testing pentesting Petya/NotPetya PHI Phishing Phising policy POODLE PowerShell Presidential Executive Order Privacy program Ransomware Retail Risk RSA RSA 2019 Safe Harbor Scanning Scans scary security security. SOC SOC 2 social social engineering Spectre Splunk Spooky Spraying Attack SSAE State Stories Story test Testing theft Virtualization Visa vulnerability Vulnerability management web Wifi wireless women XSS