Unapproved Software

Overview

This should be a part of a three-prong process. First, a FOSS/Non-Standard software request would funnel in either through procurement or via a Service Now request for approval following something along the lines of:

Infrastructure (integrations requirements) Security (Exploitable Code) Legal (Copyright Infringement) Help Desk (Desktop requirements) Installation if approved

The following outlines the process for reviewing requests submitted for the installation of applications, libraries, and modules (software) that is were developed by external parties. Security's role in the process is to determine the susceptibility of the software application to any identifiable exploitation and vulnerabilities.

The security review process involves two fundamental techniques: static analysis and dynamic analysis. The static analysis examines the software without actually running it. Dynamic analysis (also known as behavior analysis) executes the software in a controlled and monitored environment to observe its behavior. Performing static and dynamic analysis together helps identify the real intent and capabilities of the software and can provide a series of technical indicators which may not be achievable by Static analysis alone.

Static Analysis

The static analysis examines the software without viewing the actual code or instructions. It employs different publicly available sources to determine whether a file is malicious, has vulnerabilities, or is exploitable. The analysis utilizes the following Vulnerability Repository sites, providing the software's known name and any other metadata necessary to aid in the assessment.

Vulnerability Repository

• https://cve.mitre.org/cve/search_cve_list.html

• https://www.acunetix.com/vulnerabilities/web/

• https://vuldb.com/?search

• https://www.securityfocus.com/bid

• https://snyk.io/vuln/search

• https://scan.coverity.com/

For example:

Through this process, a request is submitted for Node.js for Serialize-to-js version 0.5.0 for a JavaScript-based application.

The analyst will first attempt to determine what is the latest version available of the requested software.

In this example, going to https://www.npmjs.com/package/serialize-to-js reveals that (at the time this was written) the current version is at 3.1.1.

Reviewing the business justification does not provide any details as to why that specific version is being requested. But before making the determination to deny or approve contingent upon using the latest version, the analyst attempts to determine if the newest version has any known vulnerabilities tied to it. The analyst goes to one of the repositories mentioned above databases for any reported vulnerabilities associated with the software.

• https://www.npmjs.com/search?q=serialize-to-js

  • https://www.npmjs.com/package/serialize-to-js/v/0.5.0

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5954

The analyst notes that based on the version number, there are a few publicly known vulnerabilities. 

Exploitation Database

The analyst continues the analysis by searching for any publicly available exploitation or proof of concept code. Similar to the vulnerability databases, the exploit databases provide a list of working or conceptual techniques, publicly known exploits, 0days, remote exploits, shellcode, etc. that could potentially be used to gain access or conduct any number of other nefarious acts against the organization.

Proof of Concept / Exploitation Code

Any working exploit that can be used against the requested software will be automatically denied by Security.

A working exploit is where a technique, a series of actions, and/or maliciously crafted code can be used against the software with little to no dependencies on exploiting other weaknesses of the software or supporting infrastructure (i.e., system, network, platform.) Whereas proof of concept (POC) are examples to demonstrate the vulnerability is not exploitable unto itself, often depending on a chain of additional vulnerabilities to have occurred before the PoC can actually be exploited. Reference the Decision Matrix (below) for the determining factors for denying or approving a request.

The analyst discovers during their research that this version of the software is susceptible to Remote Code Execution:

• https://snyk.io/test/npm/serialize-to-js/0.5.0

• https://opsecx.com/index.php/2017/02/08/exploiting-node-js-deserialization-bug-for-remote-code-execution/

Dynamic Analysis

Next, the analyst may want to complete a dynamic analysis by running the software to observe its behavior, understand its functionality and identify technical indicators which can be used in detection signatures. Technical indicators revealed with fundamental dynamic analysis can include domain names, IP addresses, file path locations, registry keys, and additional files located on the system or network. Additionally, it will identify communication with potential attacker-controlled external servers for command and control (C2) purposes or attempt to download files. At this stage, it is essential to have a safe environment in which the analyst can run the malware and observe its behavior.

The analyst must have an account in order to utilize the majority of the online assessment tools.

Binary Executable Assessment

• https://www.reverse.it/

• http://sandbox.pikker.ee/

• https://www.hybrid-analysis.com/ (CrowdStrike, Metadefender, and VirusTotal)

• https://analyze.intezer.com/#/analyze

The analyst submits the software binary to an online independently maintained analysis tool such as hybrid-analysis.com. Online solutions such as hybrid-analysis.com and Intezer, is a multi-vector, cloud-based AI/ML platforms designed to analyze executable binaries, and applications against different attributes and vectors by monitoring their behavior. The analyst must have an account in order to utilize the majority of the online assessment tools.

The analyst must have an account in order to utilize the majority of the online assessment tools.

After the behavior analysis is completed, the analyst is given a score of 5% probability that the current version of Adobe Reader is malicious in nature.

Decision Matrix

The following table is used to support the decisions based on the factors identified in the process as outlined above.

Severity Status	Comments	Denied	Approved	Approved with Restrictions
Critical	Zero Day - Exploit (tactics, techniques, code) is publicly identified
High	Zero Day - Exploit (tactics, techniques, code) is not publicly identified
Critical	Vulnerabilities in the current version have been publicly identified, and exploits (tactics, techniques, code) are also publicly available
High	Vulnerabilities in the current version have been publicly identified; however exploits (tactics, techniques, code) does not currently exist
High	No vulnerabilities in the current version have been publicly identified; however, exploits (tactics, techniques, code) are publicly available, and the current version does not address the exploits
Low	No vulnerabilities in the current version have been publicly identified, and no known exploits (tactics, techniques, code) currently exists or publicly available
High	Vulnerabilities have been identified in previous versions have been publicly identified, however, exploits (tactics, techniques, code) are publicly available, and the current version does not address the exploits
Moderate	Vulnerabilities have been identified in previous versions have been publicly identified, and no known exploits (tactics, techniques, code) currently exists or publicly available			Upgrade to the latest available version
High	No vulnerabilities in the current version have been publicly identified; however previous versions have consistently been identified as having vulnerabilities and exploits (tactics, techniques, code) are publicly available
Moderate	No vulnerabilities in the current version have been publicly identified; however previous versions have consistently been identified as having vulnerabilities, but no known exploits (tactics, techniques, code) are publicly available			Upgrade to the latest available version

References

1. https://techbeacon.com/13-tools-checking-security-risk-open-source-dependencies-0

2. https://dwheeler.com/oss_fs_eval.html

3. https://www.computerweekly.com/feature/Threat-assessment-model-Testing-open-source-software-for-security

4. https://zeltser.com/automated-malware-analysis/

Roadmap

Overview

The modern digital enterprise encompasses more than just its internal tech infrastructure. As part of our extended network, we work with hundreds of third-party connections - from channel partners to suppliers and cloud providers. Business functions are no longer constrained within the organization's boundaries and are spread across our dynamic ecosystem. As a result, our workforce, business processes, and partners are empowered by remote mobility, and we're more driven to create solutions leveraging digital capabilities across all its associated users. 

With a seemingly borderless environment, our threat landscape expands, and the volume of risks increases exponentially. We must be proactive in protecting our customer's interests from the ever-evolving tactics used by cybercriminals, state-sponsored hackers, hacktivists, or opportunistic threats. The truth is that it's only a matter of time before we experience a breach, so it is essential that we know and understand the health of our digital capabilities and stay one step ahead of the game.

Our investors, partners, and customers do not expect us to be able to make all malicious actors back down. However, they anticipate that we will make it significantly more difficult. In the event of a breach, people will have higher expectations that we prioritize customer safety and well-being over our gains. Unsuccessful attempts towards data security or inadequate breach response can have severe repercussions, such as class action lawsuits and unwanted investigations by organizations that can investigate our fiduciary responsibilities. 

Roadmap

We have developed an effective cyber security roadmap to ensure we are ready to face the seemingly insurmountable cyber threats. This roadmap includes assessments of our current state and a step-by-step plan for reaching our desired level of security. Here are some areas we are focusing on:

• Network Security: Ensure that all layers of our network, including perimeter and internal networks, are properly secured with technologies such as Next-Generation Firewall (NGFW), Web Application Firewall (WAF), Security Incident and Event Management (SIEM), and External Asset Security Posture.

• Operational Technology Asset Monitoring & Vulnerability Management: Ensure the health of our Supply Chain by supporting infrastructure and Operational Technologies (OT) and connected systems such as programmable logic controllers (PLCs) used in industrial automation, SCADA, and Building Management Systems.

• Secure Remote Access: Provide remote access to Sleep Number resources, data, applications, and desktops for employees, contractors, partners, or customers with two-factor authentication and other controls such as single sign-on or just-in-time access policies.

• Information Technology Asset Monitoring & Vulnerability Management: Monitor our IT assets, such as servers, workstations, routers, and switches, to detect and prevent vulnerabilities or configuration mishaps that could lead to unauthorized access or data loss.

• Network Infrastructure Health & Monitoring: Monitor the health of network infrastructure components such as routers, switches, and firewalls. Implement network detection and response solutions to detect suspicious activities and respond quickly and appropriately to threats.

• Cloud Security Posture: Secure our cloud infrastructure from external threats through technologies such as cloud access security brokers (CASB) or containers, as well as internally, by implementing policies and processes to manage access and ensure security best practices.

• Application Security: Protect applications from cross-site scripting or SQL injection attacks through web application firewalls, secure code development, and training.

• Open Source Software: Monitor open source software for potential zero-day threats and detailed steps on how to address them immediately.

• End Point Protection: Implement an endpoint protection solution to protect devices such as laptops, tablets, and smartphones from malicious threats.

This roadmap will enable us to identify areas of improvement in our business that help save money and increase efficiency. By evaluating the gaps within our business process, workflow and portfolio, we can identify cost-saving opportunities and develop strategies for implementing them. Once the safeguards are in place, experimentation becomes easier and more affordable. With this comprehensive roadmap, we can ensure that our resources are used to their fullest potential while minimizing any costs associated with experimentation or transformation. We can maximize cost savings with the right approach while achieving our desired results.

Security is like the brakes on a car, enabling us to move faster. Safeguards are an integral part of being able to move forward with confidence. 

Conclusion

By taking a proactive approach to addressing identified gaps within our processes, workflows, and portfolios, we can reduce the time it takes to implement real change and accelerate innovation in all aspects of the company. Additionally, understanding the cost associated with experimentation and how to control it can help us ensure that our investments are maximized while lowering overall costs.

By leveraging this comprehensive roadmap, we can make wise decisions based on valuable data, increase efficiency throughout the organization, reduce time to implement solutions, and maximize cost savings. With the right approach, our business processes can be subject to continuous improvement resulting in the more effective use of resources, reduced experimentation costs, and ultimately improved organizational performance.