A few weeks ago I was invited to the offices of Kyrus Tech, which is a start-up company run by a former colleague of mine from government. Kyrus (adapted from Caerus, the Greek deity of luck and opportunity) does both government and commercial work in digital forensics, reverse engineering and vulnerability research, but I was there specifically to hear about a new tool they have developed called Carbon Black, which has many potential uses, but threatens to be particularly disruptive in the incident response space.
When you think about how incident response is performed today, you know there is room for improvement. It is largely a lot of data collection activities that are carried out in order to find out what happened after the fact. Almost all of this activity is designed to try to answer a key question: What sort of evil ran on a given host and what did it do? Numbers vary based on your source, but the cost of dealing with an intrusion can quickly run into six and even seven figures if the scope of the problem is large enough. That doesn’t include the cost of complying with breach notification laws, the expense associated with improving/upgrading/changing your security architecture and solutions and so on.
Carbon Black gets to the heart of the matter by telling you exactly what executes on a host, and if it made any changes to the file system (when the final release candidate is ready it will also tell you if an executable opened up a network connection and if it made any changes to the Registry) . If this approach to identifying suspect activity sounds familiar it is because that’s basically how a lot of malware works: get in, get persistent, phone home and/or exfiltrate data. You can query your systems based on file name, hash or other attributes, bracket your search in a given time period (down to minutes if you need to), and re-order your query – much like an Excel pivot table – to answer different questions with the same subset of data. I’m not describing what they showed me justice, I’d recommend joining the Carbon Black Ning group to view several short use-case-based videos.
There is a lot to like about Carbon Black, but two things stick out in my mind as being important. The first is that it is small and simple. It does a few things very well, which stands in stark contrast to so many tools that seem to want to add just one more feature. In fact the guys at Kyrus made a point to say that they had created a “sensor” not another “agent,” and at 100kb I think that’s a fair description.
The second is that it is not just a security tool. If you know exactly what is happen on your hosts, you know exactly what your software “inventory” is doing (or if it is even being used). You can tell if you are in compliance with a range of regulatory requirements (patches up-to-date? unauthorized software running?). Carbon Black is a tool the entire C-suite can use, not just the CISO.
Those who are interested in testing Carbon Black should join the Carbon Black Ning group and a link to download an executable will be forthcoming. The current Beta version will send host data to Kyrus for storage and processing, so it’s best to use in a lab or virtual machine if your organization has PII issues. The guys at Kyrus tell me that when the Alpha version is ready both a paid model (all logs stay within your network) and free model (logs come back to Kyrus) will be available.
