Tina Slankas presented at the Phoenix ISSA chapter this week on use of patterns for building security programs – slides can be downloaded here (PDF). The thrust of her idea was to use patterns – think design patterns if you like – for putting together control frameworks to define security efforts. Tina stated she was using the definition of ‘pattern’ in a very broad way, but the essence was reusable constructs for managing different aspects of enterprise security. For example: how identity management will function at a high level, and how will it fit with other systems.
As a software developer or architect, patterns are invaluable for object-oriented programming, helping model complex ideas as a collection of simple patterns. To be honest, I abandoned the idea of secure design patterns for software architecture pretty much when I first got involved with security. I could not articulate security into the patterns, be they behavioral or structural. Maybe that was just my lack of skill at the time, but it felt like the complexities of how to secure code were beyond pattern descriptions. What was compromised was not as interesting as how it was compromised, and it usually turned out to be a process or protocol that got abused. It was the bits flowing between different patterns, or the ones left undefined, that I worried about. Trust relationships. Assumptions. Identity. Avoiding things like replay attacks. Repudiation. The problem space felt process-oriented, not object-oriented.
But in terms of a control or management framework for IT systems, reusable patterns are an interesting idea. They help with consistency across multiple sites/deployments. They offer a layer of abstraction – you don’t care if the problem is solved by a firewall, a WAF, or DLP, so long as the required controls are in place and meet the requirements. Your could represent the entire PCI specification as a set of patterns. Unless you have a huge infrastructure to manage, I’m not clear how practical this is – but I am interested in the idea of security patterns. I remain skeptical of its value for secure code development, but I see its value for security program management.
On to the Summary:
Webcasts, Podcasts, Outside Writing, and Conferences
- Rich’s TidBITS post: Do You Need Mac Antivirus Software in 2013?
- Gunnar’s Dark Reading post: What Is It You Would Say That You Do Here?
- Adrian’s Dark Reading Post on DB Threats and Countermeasures.
Securosis Posts
- $50K buys how much FDE?
- Java Sucks. Again.
- Most Consumers Don’t Need Mac AV.
- Integration vs. Segregation.
- DDoS: Distributed, but not evenly.
- Incite 1/9/2013: Never Lost.
- Detection vs. Protection and the Game of Words.
- ENISA BYOD FTW.
- Pwn Ur Cisco Phone.
- Understanding Identity Management for Cloud Service: The Solution Space.
- Prove It to Use It.
- Bored? Set up your own CA.
- Internet Explorer 8 0-Day Bypasses Patch.
Favorite Outside Posts
- Adrian Lane: Hardening Sprints. What are they? Do you need them? I’m a big fan of the occasional hardening sprint to let each developer fix one thing that bugs them, to pull stuff out of the security bucket list, or to otherwise do quality control.
- James Arlen: Nather’s Law of Policy Management.
- Mike Rothman: State sponsored attack: a howto guide. For a change, Rob Graham is lampooning the prevailing wisdom. He’s very good that that.
Project Quant Posts
- Malware Analysis Quant: Index of Posts.
- Malware Analysis Quant: Metrics – Monitor for Reinfection.
- Malware Analysis Quant: Metrics – Remediate.
- Malware Analysis Quant: Metrics – Find Infected Devices.
- Malware Analysis Quant: Metrics – Define Rules and Search Queries.
- Malware Analysis Quant: Metrics – The Malware Profile.
- Malware Analysis Quant: Metrics – – – Dynamic Analysis.
Research Reports and Presentations
- Implementing and Managing Patch and Configuration Management.
- Defending Against Denial of Service (DoS) Attacks.
- Securing Big Data: Security Recommendations for Hadoop and NoSQL Environments.
- Tokenization vs. Encryption: Options for Compliance.
- Pragmatic Key Management for Data Encryption.
- The Endpoint Security Management Buyer’s Guide.
- Pragmatic WAF Management: Giving Web Apps a Fighting Chance.
- Understanding and Selecting Data Masking Solutions.
Top News and Posts
- Adobe fixes Flash Player and Microsoft patches IE 10 to update its built-in version.
- Under the hood of the cyber attack on the U.S. Banks.
- Facebook, Yahoo Fix Valuable $ecurity Hole$.
- Zero-Day Java Exploit Debuts in Crimeware.
- Does Your Alarm Have a Default Duress Code?
- How PCI Standards Will Really Die.
- Enhancing Certificate Security.
Blog Comment of the Week
Remember, for every comment selected, Securosis makes a $25 donation to Hackers for Charity. This week’s best comment goes to Bert Knabe, in response to Prove It to Use It.
You mean you don’t believe it?! It’s from a government official! They never lie!
Comments