The afternoon sessions of InformationSecurityAsia2007 were exceptional. Dr. Keith White, APAC Security Services Director of Alcatel-Lucent, Australia described how they partnered with Cloudshield to process security events in a distributed SEM environment. Topics covered included edge processing, content/context based routing and event processing. After Keith’s excellent presentation I had a chance to speak with him about white-box event processing engines and strategic partnerships.
The next session was really interesting (session info), highlighting a similar situation – the criminals are far ahead of black-box SEM processing engines; and this is readily demonstrated in the emerging domain of extrusion detection. For those not familiar with this term, extrusion detection is the network traffic inverse of intrusion detection. In intrusion detection systems the focus is on the detection of threats from the outside of the network, to the inside of the network.
However, what happens when criminals implant malware, covert tunnels (for example HTTP tunnels or ICMP tunnels), and malicious bot networks inside of organizations, and the detection challenge shifts to detecting outbound traffic from malicious users, malware, and botnets? This form of criminal activity is evolving so fast that the models to detect extrusions are being formulated and tested in near real-time. This is where CEP can help.
Imagine a high performance, declarative programming framework that can be used to implement extrusion detection models created by experts, like the cybersecurity experts gathered together at InformationSecurityAsia2007. On top of that, visualize a design time studio environment that allows these same experts to graphically express their extrusion models in design time, avoiding most of the overhead of code development. CEP and ESP engines are ripe for assisting security engineers detect the exploding commercialization of criminal extrusions, where, for example, bot hearders can rent their botnets from $350 to $1000 USD per day.
I spoke to a number experts at InformationSecurityAsia2007 about CEP and I was pleased to learn that they have been considering CEP and ESP engines, including open source software (i.e. Esper) as well as commercial offerings. We are considering collaborating on a new Center-of-Excellence that combines CEP/ESP engines with extrusion detection models. Please contact me directly if you would like to participate.
We live in complex times. Complex times require complex event processing.
More coming from InformationSecurityAsia2007 ….