Research

“Hi, my name is Adrian, and, uh … I am a technologist” … Yep. I am. I like technology. Addicted to it in fact. I am on ‘Hack A Day’ almost once a day. I want to go buy a PC and over-clock it and I don’t even use PCs any more. I can get distracted by an interesting new technology or tool faster than a kid at Toys R Us. I have had a heck of a time finishing the database encryption paper as I have this horrible habit of dropping right down into the weeds. Let’s look at a code sample! What does the API look like? What algorithms can I choose from? How fast is the response in key creation? Can I force a synch across key servers manually, or is that purely a scheduled job? How much of the API does each of the database vendors support? Yippee! Down the rabbit hole I go … Then Rich slaps me upside the head and I get back to strategy and use cases. Focus on the customer problem. The strategy behind deployment is far more important to the IT and security management audiences than subtleties of implementation, and that should be the case. All of the smaller items are interesting, and may be an indicator off the quality of the product, but are not a good indicator to the suitability of a product to meet a customers need. I’ll head to the technologist anonymous meeting next week, just as soon as I wrap the recommendations section on this paper. But the character flaw remains. In college, studying software, I was not confident I really understood how computers worked until I went down into the weeds, or in this case, into the hardware. Once I designed and built a processor, I understood how all the pieces fit together and was far more confident in making software design trade-offs. It’s why I find articles like this analysis of the iPhone 3GS design so informative as it shows how all of the pieces are designed and work together, and now I know why certain applications perform they way they do, and why some features kill battery life. I just gotta know how all the pieces fit together! I think Rich has his addiction under control. He volunteers to do a presentation at Defcon/Black Hat each year, and after a few weeks of frenzied soldering, gets it out of his system. Then he’s good for the remainder of the year. I think that is what he is doing right now: bread board and soldering iron out, and making some device perform in a way nature probably did not intend it to. Last year it was a lamp that hacked your home network. God only knows what he is doing to the vacuum cleaner this year! A couple notes: We are having to manually approve most comments due to the flood of message spam. If you don’t see your comment, don’t fret, we will usually open it up within the hour. And we are looking for some intern help here at Securosis. There is a long list of dubious qualities we are looking for. Basically we need some help with some admin and site work, and in exchange will teach you the analyst game and get you involved with writing and other projects. And since our office is more or less virtual, it really does not matter where you live. And if you can write well enough you can help me finish this damned paper and write the occasional blog post or two. We are going to seriously look after Black Hat, but not before, so get in contact with us next month if you are interested. We’re also thinking we might do this in a social media/community kind of way, and have some cool ideas on making this more than the usual slave labor internship. As both Rich and I will be at Black Hat/Defcon next week, there will not be a Friday summary, but we will return to our regularly scheduled programming on the 7th of August. We will be blogging live and I assume we’ll even get a couple of podcasts in. Hope to see you at BH and the Disaster Recovery Breakfast at Cafe Lago! Hey, I geek out more than once a year! I use microcontrollers in my friggen Halloween decorations for Pete’s sake! -rich And now for the week in review: Webcasts, Podcasts, Outside Writing, and Conferences Rich and Martin in Episode 159 of the Network Security Podcast. Rich wrote an article on iPhone 3GS security over at TidBITS. Favorite Securosis Posts Rich: Adrian’s post on the FTC’s Red Flag rules. Adrian: Amazon’s SimpleDB looks like it is going to be a very solid, handy development tool. Other Securosis Posts Electron Fraud, Central American Style Project Quant Posts Project Quant: Partial Draft Report Favorite Outside Posts Adrian: Jack Daniel’s pragmatic view on risk and security. Rich: Techdulla with a short post that makes a very good point. I have a friend in exactly the same situation. Their CIO has no idea what’s going on, but spends a lot of time speaking at vendor conferences. Top News and Posts Get ready for Badge Hacking! RSnake and Inferno release two new browser hacks. I want to be a cyber-warrior, I want to live a life of dang-er-ior, or something like that. A great interview with our friend Stepto on gaming safety. The Pwnie award nominations are up. The dhcpclient vulnerability is very serious, and you shouldn’t read this post. There is another serious unpatched Adobe Flash/PDF vulnerability. George Hulme with some sanity checking on malware numbers. Medical breach reports flooding California. Blog Comment of the Week This week’s best comment comes from Bernhard in response to the Project Quant: Create and Test Deployment Package post: I guess I’m mosty relying on the vendor’s packaging, being it opatch, yum, or msi. So, I’m mostly not repackaging things, and the tool

First, a bit of a caveat. Andrew Jaquith of Forrester is an excellent analyst and someone I know and respect. This is a criticism of a single piece of his research, and nothing more. Over at the Forrester Security Blog today, Andrew posted a change of policy on their use of two important data security terms. In short, they will now be using the term Data Labeling instead of Enterprise Rights Management: So, here’s what Forrester will do in our future coverage. The ERM (enterprise rights management) acronym will vanish, except as a “bridge” term to jog memories. In the future, we will practice “truth in labeling” and call this ERM thing data labeling. Unfortunately, this is a factually incorrect change since data labeling already exists. I agree with Andrew that ERM is a terrible term – in large part because I’ve covered Enterprise Risk Management, and know there are about a dozen different uses for that acronym. Personally, I refuse to use ERM in this context, and use the term Enterprise DRM (Digital Rights Management). Enterprise Rights Management is a term created to distinguish consumer DRM from enterprise DRM, in no small part because nearly everyone hates consumer DRM. The problem is that data labeling is also a specific technology with an established definition. One we’ve actively criticized in the past. Andrew refers back to the Orange book: Here’s what the Orange Book says about data labeling: “Access control labels must be associated with objects. In order to control access to information stored in a computer, according to the rules of a mandatory security policy, it must be possible to mark every object with a label that reliably identifies the object’s sensitivity level (e.g., classification), and/or the modes of access accorded those subjects who may potentially access the object.” Sounds just like what what ERM is doing, no? No – the difference is under the covers. Data labeling refers to tags or metadata attached to structured or unstructured data to define a classification level. Labels don’t normally include specific handling controls, since those are handled at a layer above the label itself (depends on the implementation). DRM is the process of encrypting data, then applying usage rights that are embedded in the encrypted object. For example, you encrypt a file and define who can view it, print it, email it, or whatever. Any application with access to decrypt the file is designed to respect and enforce those policies… as opposed to regular encryption, which includes no usage rights, and where anyone with the key can read the file. This shows the problem with consumer DRM and why it always breaks – in an enterprise we have more control over locking down the operating environment. In the consumer world, the protected file is always in a hostile environment. Since you have to have the key to decrypt the file, the key and the data are both potentially exposed. Labeling and DRM may work together, but are distinct technologies. You can label an individual record/row in a database, but you can’t apply DRM rights to it (I suppose you could, but it’s completely impractical and there isn’t a single tool on the market for it). You can apply DRM rights to a file without ever applying a classification level. I asked Andrew about this over Twitter, and our conversation went like this (Andrew’s post is first): @rmogull Really? Do you think “ERM” is actually a useful name for that category? Want to discuss alternatives? @arj I use “Enterprise DRM” I also hate ERM and refuse to use it. @rmogull Makes sense. Want to send me an e-mail (or do a blog post) critiquing the post? I’m a pretty good sport. I think we are on the same page now, and thank Andrew for bringing this up, and being willing to take some gentle lumps. Share: