Technology & Innovation

Facebook thwarts intruders

January 23, 2013

Global

January 23, 2013

Global
Our Editors

The Economist Intelligence Unit

_____________________

Defenders of today’s corporate networks should put barriers in front of hackers—but get out of the way of employees. So says Facebook, the social-networking giant, which in January 2012 began an overhaul of its approach to network security. The company decided to emphasise network monitoring and rapid response to attacks while minimising onerous security controls that might slow employees.

The social network that Facebook has created lies at heart of the consumerisation trend, but like every other company today it is juggling the business benefits and security challenges that consumerisation brings. Facebook’s effort involves a major rethink of “intrusion detection”, security systems that gather vast amounts of data from network devices and sensors and sift through them for signs that a break-in is underway.

The company’s strategy starts with an analysis of the steps hackers must take when they break into a corporate network, and then focuses on detecting those activities and quickly disrupting them. This approach has significantly improved Facebook’s ability to quickly quash attacks in the last six months, it says, citing a diminishing success rate for internal and third-party “penetration testers” hired to defeat its systems.

The security overhaul was prompted by the social networking company’s mounting concern about the growing threat from increasingly aggressive and sophisticated hackers, believed by many experts to be backed and bankrolled by nation-states hungry for valuable intellectual property. In recent years, hackers have successfully infiltrated scores of prominent firms in industries like technology, energy and defence. Attackers were bypassing billions of dollars of security infrastructure with apparent ease, proving to Facebook’s security team that the old model of locking down networks with preventive controls was broken.

The challenges of increasingly sophisticated attackers and difficult-to-defend networks are pushing many security departments to rethink how they approach information security. While some are reorienting to focus on securing their most valuable information, Facebook says it could not go this route: all of its data are sensitive, and a hack of any kind would spark a media firestorm and lead to enormous reputational damage.

Facebook concluded that its best way forward was to stop attacks—an obvious goal, but one much easier said than done. That required doubling down on intrusion-detection technologies, which have been around for years but tend to be unreliable due to the difficulty of finding attack signals in a sea of network data. According to Mandiant, a US intrusion-response firm, only 6% of the victim companies it worked with in 2012 discovered the break-ins themselves, while 94%were notified by an outsider, often law enforcement. Hackers monitored these companies’ networks for a median 419 days before detection.

To improve its capabilities, Facebook hired John “Four” Flynn, who previously built the intrusion-detection group at Google that was responsible for uncovering the infamous 2009 Aurora attacks. He began by ensuring that Facebook was collecting data that were likely to reveal a hacker taking the specific steps required during a break-in—beginning with reconnaissance and moving through attack delivery and ultimately to theft of data. Mr Flynn says the stages comprise a “kill chain”, and if you break any link in the chain, you kill the attack.

Reorienting intrusion detection towards hacker tactics makes the technologies much more effective, Facebook says, so much so that the company feels comfortable keeping security controls that would affect employees to a minimum. “This is new territory,” Mr Flynn says. “Make no mistake, we are actually inventing the field, and I’m really proud of what we’re doing as a company.”

Facebook’s system is a home brew constructed from a combination of commercial software, open source tools—including Hadoop for handling “big data”—and code written by its own software engineers. “Vendors really are just not cutting it at all,” Mr Flynn says. “Intrusion detection is a complicated beast, and it involves a number of different components,” which no single software company makes or is able to manage. “We’re finding ourselves writing the glue and the intelligence
on top of things.”

Facebook declined to discuss whether it has filed any patents related to this work or whether it has any intent to commercialise the software it has created.

Security experts say intrusion detection and prevention are key ingredients as the network-security paradigm shifts. Facebook is “probably on the forefront in that space,” says Jamil Farshchi, senior business leader of planning and initiatives at Visa and former information security chief at Los Alamos National Laboratory. “I think that’s demonstrably where the industry is going in the future … It gives you a more flexible, robust way to be able to identify and respond to things, instead of just blocking every single thing under the sun.”

To block malicious attackers, Facebook has developed its ability to rapidly respond to potential intrusions. This includes leveraging its understanding of how people normally use its computer systems to detect activity that is abnormal and should be automatically blocked. To do this, Facebook makes use of technologies it originally created to protect members’ accounts. For instance, to battle user-account hijacking, the company developed a tool that alerts Facebook members when a new PC or mobile device tries to access their account and helps them take action if it wasn’t them attempting to log in. That technology now also watches for misuse of Facebook employee accounts on company systems and challenges potential impostors.

The company has also sought to limit intrusions by financially rewarding “white hat” hackers who find vulnerabilities in its systems that “black hat”, or malicious, hackers could exploit. And it seeks to deter attacks by working aggressively to identify, track down and, if possible, prosecute hackers and other malcontents. The company has won record judgments against spammers and in January 2012 helped put an end to years of virus attacks by a Russian group known as the Koobface gang by publicly naming and shaming its members.

Facebook argues that at a minimum, their aggressive public posture reduces attacks by common cybercriminals. It hopes an aggressive behind-the-scenes technology posture can save it from the extraordinary ones too.

Enjoy in-depth insights and expert analysis - subscribe to our Perspectives newsletter, delivered every week