Research

I had a little back and forth with rybolov in the comments on my military post, and he introduced me to something called the Business Reference Model right out of some government publications and NIST 800-60. Kicking ass, as only a Guerilla CISO can, he responded with two great blog posts showing how we can steal from this model and adapt it to the enterprise world. On the surface (haven’t had time to dig in yet) it looks like an interesting way to help align business priorities, data classification, and security priorities. While I’m not a fan of complex models, I’m a big fan of anything that can help bridge the language divide between the business and IT. Check out his posts here and here. Share:

For those of you who don’t know, this is a blog with an editor. Chris Pepper is a long-time friend, UNIX wizard, web host, and tech writer himself. You can track his work at Extra Pepperoni, his somewhat-recently revamped blog. Chris is also one of the most in-depth Mac guys I know, and has submitted 1300 bug reports to Apple, many for Mac OS X 10.5 (the next version of the Mac operating system). They aren’t all “bugs” in the traditional sense, but when you peel off that shrink wrap from your colorful operating system upgrade, the odds are really darn high that the software you install will be better thanks to Chris. To boost his ego a little, when I was at DefCon I met up with a support guy at Apple who knew Chris from his bug reports and blog. Share:

Mr. Rothman was concerned that Mr. Hoff may, perhaps, have a little too much spare time on his hands. I’ve seen Senior Hoff at work, and he definitely isn’t winning any Slacker of the Year awards. I personally have a theory that he’s really just the earthly expression of a multidimensional being beyond our comprehension. Chris definitely outdid himself on this post. A short excerpt, (Read to the cadence of ‘Twas the Night Before Christmas) Remember when firewalls were firewalls, my friend? it suggested our security problems would end. They promised the perimeter breach to abate, but alas became products we just loved to hate. The attackers got smarter, and the exploits malicious, the perimeter’s holes made the threatscape pernicious. Sadly the breaches were never quite stopped, whilst we measured our value in per packets dropped! (read the rest here) Share:

If you read the security blogs, you may have seen that I have a stalker- Rob Newby over at IT Security, The View From Here. Rob’s a data security weenie like myself. Rob just left Spain to return home to the UK for a new job with Ingrian (database encryption). Congrats Rob, and glad to see you happy and healthy in your home nation again… Share:

There’s been a lot of debate lately on quantitative vs. qualitative risk, frameworks, models, metrics, certifications, standards, and all sorts of other organizational junk we seem to burden ourselves with. Oh, I’m no better, having authored a risk management framework, data security hierarchy, and similar tools in my past. At times, I step back and realize we’re losing the big picture in this morass of acronyms and long documents with words like “Section 248, Subsection B, Paragraph A, Revision 42”. While I hate to knock my own industry off its pedestal, we sometimes forget that we are just the complex implementation of a very basic need. Thus it’s time to dumbify security and kick it old skool. Here’s my n-step guide for the perfect, basic, security program: Figure out what’s important, and why: We often get wrapped up in pet projects, personal biases, or other distractions. When you look at your business, what’s really important, and what can you live without? Yes, I’m over-simplifying, but that’s the point of this post. I’ve seen n-degree complex risk analyses that still fail to capture what’s important. You’ll use those models later, but at some point just take a step back and really look at what could hurt you in a big way. That’s the most important stuff, and it deserves more attention than everything else. Decide if anyone stands to gain by stealing it or breaking it: Just because it’s important to you doesn’t mean it’s important to anyone else. In this step, just ignore the noise of the constant background threats (what my friend Richard Stiennon calls background radiation) and focus on directed threats- where someone has something financial to gain. Know how it’s protected: What security is in place? Figure out where the holes are: There are always holes; where are they? How hard are they to find and use? Back in physical security days we’d walk around the facility before an event, figure out all the ways in… including obscure ones like climbing buildings (those Dead Heads are seriously dedicated), and how hard they’d be to take advantage of. Block the holes, until it’s too expensive to block the holes: At this point you know your priorities, you know the threats, and you know the weaknesses. Now it’s just a matter of layering security until risk is reduced to an acceptable level. That’s all we do. We figure out what’s important, what the risk is to it, and how to best reduce that risk. Every single one of you reading this knows that, but we still get so wrapped up in agendas, frameworks, internal politics, and compliance that we sometimes forget we’re just there to help the business take the greatest amount of risk it wants to take, in the safest way possible. I don’t care what complex risk/security framework you’re using… stick to the basics. Know what’s important, have a rough idea of how much it’s worth to you, and drop in enough layers until you think it’s protected well enough. All those complex models should be tools to help you achieve the basics, not the other way around. We protect stuff, pure and simple. Yes, you still need metrics and frameworks, but you can’t define security as just a bunch of metrics and checklists. I also highly recommend a good 12 step program… Share:

Just a day after I talked about how it takes sustained failures for consumers to leave a company and go to a competitor, we have an example where switching isn’t really an option. Over at Dark Reading we learn that Phizer has suffered it’s third employee privacy breach in a row. At least they’re doing the “right” thing by involving law enforcement and offering credit monitoring. I suspect, since these made the press, they’re also improving security. That said, you have to feel for the employees who don’t have much of a choice to go anywhere “more” secure. Actually, neither do you. The last time my info was breached was at the student healthcare center at the University of Colorado. My SSN was stolen out of old records. How about you? I suspect every one of you has personal data sitting around old healthcare providers, never mind financial institutions, retail stores, government databases, old utilities providers, and subscriptions to “those” services under fake names, still billed to your real credit card. You no longer have a relationship with these providers (or one you can’t sever), yet they still represent a real risk to your security. Market forces can’t fix this one. Share:

Back when I started this blog one of the only security blogs I knew about was Martin McKeay’s Network Security Blog. As can happen in the blogging community, Martin and I eventually got in touch and developed a friendship. Heck, anyone I’ve gone drinking with in 3 different cities in less than a year is definitely a friend. With my return to blogging last week Martin invited me to join him on his podcast- as a guest host, not a guest. You can check it out here, or subscribe through iTunes. This week was mostly an introduction and our first attempt at joint podcasting. We spend a little time talking about point of sale terminal security, and a bit more time talking about the value of a CISSP certification (Martin changed my opinion a bit while we were recording). I have a short introduction on communicating with executives, and the podcast finishes up with an interview Martin did with Winn Schwartau. We’re planning on doing more of these, so please send your feedback. We know this week clocks in a little long, and we already have some ideas to improve the format. Check it out here: Network Security Podcast, Episode 75 Share:

I haven’t met Richard Bejtlich yet, but I have a feeling we’d get along just fine. We’re both fans of the History Channel, have backgrounds in martial arts, love the show Human Weapon (martial arts AND the History Channel!), and have a background in the military (four years on a Navy ROTC scholarship, but I ended up becoming a paramedic instead of going active duty). That said, I have to slightly disagree with his latest post where he criticizes Jay Heiser, my friend and former colleague, for being “anti-military”. As usual, I’ll be my slimy self and take a position just between my associates. I think I lived in Boulder, Colorado for too long or something – it made me go all soft. Jay’s original article discusses how we, in non-military information security, need to leave the military mindset behind. Military defense models are great for the military, and (as Richard’s post demonstrates) often contain some extremely valuable principles and techniques we can translate into non-military security. The problem with trying to follow military principles too closely is that they don’t translate well in two dimensions: The Mission: The mission of the military is dramatically different than that of most private businesses. The military is completely defined by the mission of defending the nation, from culture, to org structure, to every policy and procedure. That mission also creates a unique risk profile that doesn’t translate well to the civilian world. Sure, on the Internet we’re all targets, but when you combine the mission and risks of the military it drives policies and procedures that will be very different than what we civvies need. There’s overlap, but the devil is in the details and trying to push military models in commercial enterprises nearly always fails (unless we stick to very abstract levels, as Richard does in his post). The Culture: Human behavior doesn’t change, but one of the most powerful aspects defining behavior is culture. All organizations have a culture, whether they want it or not. I define culture as the instinctive behavior of employees; within an organization it’s what someone does without thinking. The military culture is one of the most powerful in existence, defining everything from haircut, to dress, to speech patterns. It’s been fourteen years since I left the Navy (and I was only active for summer training), and people can still tell. Civilian corporate culture is wildly divergent from military culture, and this limits the effectiveness of many military solutions to security problems. We still have a lot we can learn from the military (and law enforcement, for that matter), and shouldn’t throw out the bath water out with the baby, but we need to pay better attention to which lessons we bring over, and increase the rigor of how we translate those for private enterprises. Some examples? Defense style data classification doesn’t work outside of defense/intelligence/government. Certification and accreditation are a waste of time and resources (probably for the government as well as the rest of us, but that’s for another post). Common Criteria below EAL-5 doesn’t provide any significant value in assessing the security of a product. I’ll keep telling budding information security pros to learn history, read Sun-Tzu, familiarize themselves with the Orange book, and study military principles, but it’s equally important to show them where these models don’t work in the private sector, why, and how to translate them into something effective for us civilians. Share:

Over at the Network Security Blog, Martin’s been doing a great job of putting the CISSP certification (Certified Information Systems Security Professional for you non-security-geeks) in proper context. I’m not the biggest fan of the CISSP any more; I think it’s outdated and commoditized. It’s no longer the gold standard of security certifications because the world around it has changed too quickly. These days, there’s no “single” security career track, and the CISSP is diluted from attempting to remain the One Ring that Certifies Them All. Not that it’s worthless. It can give a new security prospect a reasonable grounding in some of the basics. But where it used to be a Master’s (or maybe Bachelor’s) degree, it’s now a high school diploma. About 4 years ago we didn’t have many CISSPs on our team at work, and my boss suggested I give it a shot for some professional development. I took one of those week-long intensive courses, and walked out realizing that taking the test would be, for me, a waste of time. Not that I didn’t learn anything, but I’d obviously hit the point in my career where it wouldn’t give me any advantages. I wasn’t going to learn anything else by preparing for the test (except how to pass the test), and I was in a position where the CISSP after my name wouldn’t make a difference for any job I’d ever apply for. If you’re just getting started, or need it for the resume, a CISSP still has some value. In some places we’ve hit the point where not having it is more of a career obstacle than boost. That doesn’t mean it will help you do your job better. Which is sad. Edited: Almost missed Rothman’s comments on the subject; one on-point paragraph instead of my drawn out story. Sigh. Share:

Stepping between Hoff and Curphey. Consumers always lie in surveys and claim that if a company loses their credit card or other personal info, they’ll go someplace else. In reality, they almost never do. Why? The pain of switching to a different vendor/store/service/whatever is almost always greater than that of the fraud, even when there is fraud. When it comes to credit cards the only pain is that of reversing a charge. Real ID theft is a lot rarer. We also tend to assume someone tightens the ship after a big breach, making them more secure. We’re nice people, and tend to give someone a pass on the first mistake. If TJX customers started suffering fraud on a regular basis due to negligence on the part of TJX, I bet sales would drop. Your security only needs to be good enough to avoid giving your customers more pain than that of buying from someone else. Share: