Everything Under The Sun: Detecting No-ware

Thursday, January 21, 2016

Detecting No-ware

Ron Gula (left) with Jeff Salkin before appearing on Your Money and Business on Maryland Public television.

Anyone who has a connection to the internet is aware of the need for cybersecurity solutions. We frequently look to those companies which have expertise in protection of sensitive information for products to protect our prized computers and our identities. Ron Gula, who has expertise in cybersecurity and a reputation for outside-the-box thinking, was one of the co-founders of TENABLE NETWORK SECURITY back in 2002. Located in Columbia, MD, and three other locations around the world, Tenable is one of the leading providers of continuous network monitoring, along with managing security vulnerabilities.

Now CEO of Tenable, Mr. Gula discusses no-ware, any security attack that is accomplished without malicious software. The biggest issue with no-ware is that it is extremely hard to detect, since its only indicators are a configuration change or a rule change. Generally no-ware invades networks through back doors or creating rules changes that allow someone to bypass firewalls easily and that are easily utilized by most penetration testers.

The way to be able to detect no-ware is to utilize continuous network monitoring. This allows you to know what's normal communication format, what usually is on the network, various assets present on the network, and what normal input and output looks like. The monitoring drills down to what normal configuration exists on the network and normal user activity. With this type of detailed monitoring, it becomes easier to detect those backdoor changes that produce misconfigurations that allow easy access to the network and data infiltration.

So, Tenable's continuous monitoring lets systems identify when that extra port hole is open, when an extra process is running, or malicious activity, that is disguised as normal administrator activity, is accessing what is supposed to be secure data.

Tenable educates its users and others through online webinars.

So, in essence, no-ware is a system change to configurations that allow access to the system network without inserting detectable software. If you aren't aware that your system is vulnerable this way, you won't be able to detect it.