Research

So I am finally home for a few weeks, coinciding with the kids starting school. As usual I grab my messenger bag first thing in the am and head out on my nomadic journey. With about 10 local Starbucks with Google WiFi, I am typically in one of those. I get faster Internet at Starbucks than I do at home (57mbps down FTW). It does make me a little more predictable, so that’s a bit alarming. But I’ll trade 50mb downloads for the anemic DSL speeds of AT&T WiFi every day of the week. After a long day of reading tweets, drinking coffee, and trolling the team in our chat room, I come home to see the kids outside with a bucket. Yes, they were challenged to the Ice Bucket Challenge, an awareness campaign originated by Pete Frates – a former Boston College baseball player – suffering from ALS that has gone viral over the past week. There is a great ESPN profile of Pete and the challenges of ALS. NFL coaches and players, celebrities, families, and evidently school-age kids are dumping buckets of ice water on their heads. Though to be candid, I was kind of annoyed. Most of the celebrities and sports stars mention ALS and talk about the cause – if only for a few seconds. But do these kids even know why they are doing it? I asked, and they had no idea. So I saw a teaching moment. I dictated that before any ice water was dumped, they would need to understand about ALS and commit to not just dousing themselves, but to giving money to the cause. After extracting a $20 commitment each, and making sure they read the online description of the disease, they dumped the water. And all was right in the universe. Then I remembered that I saved the fantastic “A Football Life” episode on Steve Gleason because it was awesome and inspiring. The former New Orleans Saint suffers from ALS, and that show documented his life and his adventure climbing Machu Pichu. Yes, I forced the kids to watch that too. I am good with viral campaigns. I’m ecstatic that this campaign has increased donations to research for an ALS cure tenfold. That is awesome. And it would be even more awesome if everyone who dumped a bucket of ice water on their heads actually understood why they were doing it. Then instead of just being funny, it would be educational as well. –Mike PS: The picture above is Bill Gates (yes, that Bill Gates) doing the ice bucket challenge. Click here to see the full clip in all its animated GIF glory. Photo credit: “Bill Gates ice bucket challenge” originally uploaded by Waseem Ashraf The fine folks at the RSA Conference posted the talk Jennifer Minella and I did on mindfulness at the conference this year. You can check it out on YouTube. Take an hour and check it out. Your emails, alerts and Twitter timeline will be there when you get back. Securosis Firestarter Have you checked out our new video podcast? Rich, Adrian, and Mike get into a Google Hangout and.. hang out. We talk a bit about security as well. We try to keep these to 15 minutes or less, and usually fail. August 18 – You Can’t Handle the Gartner July 22 – Hacker Summer Camp July 14 – China and Career Advancement June 30 – G Who Shall Not Be Named June 17 – Apple and Privacy May 19 – Wanted Posters and SleepyCon May 12 – Another 3 for 5: McAfee/OSVDB, XP Not Dead, CEO head rolling May 5 – There Is No SecDevOps April 28 – The Verizon DBIR April 14 – Three for Five Heavy Research We are back at work on a variety of blog series, so here is a list of the research currently underway. Remember you can get our Heavy Feed via RSS, with our content in all its unabridged glory. And you can get all our research papers too. The Security Pro’s Guide to Cloud File Storage and Collaboration Additional Security Features Core Security Features Overview and Baseline Security Introduction Leveraging Threat Intelligence in Incident Response/Management Quick Wins The (New) Incident Response & Management Process Model Threat Intelligence + Data Collect = Responding Better Really Responding Faster Introduction Trends in Data Centric Security Deployment Models Tools Introduction Use Cases Understanding Role-based Access Control Advanced Concepts Introduction NoSQL Security 2.0 Understanding NoSQL Platforms Introduction Newly Published Papers The 2015 Endpoint and Mobile Security Buyer’s Guide Open Source Development and Application Security Analysis Advanced Endpoint and Server Protection Defending Against Network-based DDoS Attacks Reducing Attack Surface with Application Control Leveraging Threat Intelligence in Security Monitoring The Future of Security Security Management 2.5: Replacing Your SIEM Yet? Defending Data on iOS 7 Incite 4 U The path of least resistance: Clearly the easiest way to pwn an organization is just to find some Windows XP and use old malware. In our App Control paper we said there are a bunch of reasons XP may still exist in your environment. But if you still have unpatched XP you just suck at operations and security. Again, there are some mitigating circumstances (perhaps you cannot patch), but then you need some kind of whitelisting on the device to lock it down. Seriously – it’s 2014, folks. MSFT is trying their best to stop supporting the product. It’s time to upgrade. – MR Form letter: “Company {name} was the victim of unauthorized access to our customer systems, and attackers stole {number} of credit cards between {date1} and {date2}. Company {name} said: ‘Our customer’s trust is a top priority, and we’ve taken steps to address the {vulnerabilityXXXXXx10^3} and help law enforcement catch those naughty, malicious evil-doers that are now looting your bank account. As an added precaution we will make available {worthless-service} to protect your identity, and ask all of our customers to reset their passwords ASAP.’” There you go: an open source breach letter

Everyone wants to be special. When I’m chatting with a company that doesn’t fit the typical profile for a state-sponsored attacker target, sometimes they seem disappointed. I certainly don’t mean to hurt their self-esteem, but the reality is that most businesses just don’t have anything of interest to a nation state. For the most part, I would have included healthcare in that group. It’s hard to see how Beijing could use the flu diagnosis of John Doe. Although that’s a pretty myopic view – healthcare shops hold a lot of personal data. You know, Social Security numbers, addresses, birth dates, and other stuff useful for identity theft. Reuters is reporting on the Community Health breach, which impacted 4.5 million patients. Both Mandiant and Crowdstrike traced the attack back to a specific nation-state affiliated hacker group. The sexily named “APT 18” has been in action for a while, usually targeting human rights groups and chemical companies. On the surface an advanced attacker targeting a healthcare shop is counter-intuitive, but given the multi-phase and staged attacks used by nation-states it makes sense. The attackers can use this information to more effectively target employees with phishing messages to gain a foothold in their real target. So the moral of the story is that you need to think three or four steps ahead to understand the real mission behind many of these attacks. Odds are Community Health was a means to an end, so they could target a big company or ten with information gleaned from the hospital. Though the only way you will be able to really connect the dots is through a forensic view of the eventual data breach. Have we talked about incident response lately? Yeah, maybe it’s time to make sure your IR/M process is where it needs to be. Photo credit: “Emergency room” originally uploaded by KOMUnews Share:

Just in case you felt it was only you as the CISO who had an overwhelming amount of stuff to do, it’s not. This mind map on the Security Advisor Alliance site should bring that message home. And this is the best quote: The initial branches could also be expanded to include many other priorities for a CISO. Yeah, no wonder you can’t see the forest for the trees. So what do you do? You could try to be Pragmatic to get things going. You need to make sure you are setting the expectations properly about what you will do – and more importantly what you won’t. Also be very candid about the resources you will need for success. So take a look at the mind map and note the things you are doing now (perhaps not as well as you need to) and the things that have been on the list for a while, which you never seem to get to. Clear you mind and then be honest with yourself about whether your priorities are aligned to achieve successful outcomes for your organization. If so you should feel good. For maybe 5 minutes – then get back to work. This list doesn’t get done by itself. If not, it’s probably time to blow up what you have been doing. Doing the same stuff and expecting different results is crazy. So take the opportunity to recalibrate and communicate new priorities, and start tracking them. Yes, easier said than done. But in the face of an overwhelming number of tasks and responsibilities, you need to prioritize fiercely and make sure your limited time is spent on the stuff that matters. Starting right now… Photo credit: “71/365 – Uh-oh” originally uploaded by Josh Connell Share:

Over the past year or so we have done a bunch of research into denial of service attacks, at both the application and network levels. Tactics are one thing, but we usually start with adversary analysis. You know: who wants to pop your environment and steal your stuff. Or maybe just knock you down so you can’t get up. Not that this is news, but shakedown via DDoS is still alive and well. And even the mass media is catching on, as evidenced by this BBC article. This quote from the CEO of CloudFlare describes the attack is language even I can understand. In the physical world, you could think of it as a sit-in, or if you had all of your friends going to a store, fill the entire space and not actually buy anything. So what do you do? Do you pay the ransom? I suspect many organizations do. Over and over again. Can you fight? Yup. There are a ton of services out there that can help defend you against a DDoS. Some are enterprise-capable, with all sorts of networking kung fu to move traffic into their scrubbing centers at the onset of the attack. Others provide this service as part of a CDN or performance optimization service. Either way, if you have an important site that can’t go down, you need to make sure you protect it from 21st century mobsters, doing the 21st-century equivalent of throwing a brick through your window. How you doin’? Photo credit: “The Godfather” originally uploaded by Alex Eylar   Share:

One of the noteworthy activities coming out of BlackHat/DEF CON was the open letter to the auto industry from I am the Cavalry espousing 5 principles for making the computers in cars safer – before someone gets hurt. As our pal Josh Corman says in a CSO article on the initiative: “This initiative is not only about finding bugs,” Corman said. It’s about building relationships between researchers, industry and government, which is much harder, he said. [sic] It is indeed all about the relationships. Researchers (most notably Charlie Miller and Chris Valasek) have hacked the crap out of cars, because all these fancy car tech systems are just computers with WiFi and/or Bluetooth. Egads! Of course they can be hacked. The question is whether auto makers will get ahead of the issue. The principles are pretty straightforward. Things like building security in, having independent researchers try to break it, updating software remotely, and isolating important stuff (such as the steering system and power train). This isn’t brain surgery and some auto makers (notably Tesla) are hiring teams to do a lot of this research on their own cars. I applaud the efforts of the Cavalry and other organizations which work to build these relationships and progress based on mutual interest, without an adversarial relationship. There was a bunch of trolling on Twitter earlier this week, which was largely about the futility of these movements. Just because it’s hard doesn’t mean it’s not worth doing. Of course security will get better in cars and other areas where connectivity is expected (like medical devices). It can happen via productive discussions with organizations like the Cavalry. Or it can happen after someone dies, when Congress gets involved to grandstand and hijack the conversation. The choice lies with industry. We’ll see how it goes. Photo credit: “cavalry charge” originally uploaded by The U.S. Army Share:

A couple weeks ago we went to see the kids at camp on visiting day. They have so much fun, learn new skills, and grow as individuals at camp – despite being away from the watchful eyes of their parental units. Go figure – let your kids spread their wings, and they do. One of the new skills both XX2 and the Boy tried out was waterskiing. So during visiting day they get to show off for the folks. So we walk down to the lake, and have a few minutes before the kids get into the water. I sit down in a nice white gazebo next to the lake. Up flies a butterfly to perch on the rail right next to me. It’s basically just staring at me. No fear. No need to go anywhere else. Just hanging out. I bust out my camera and take a few pictures. The butterfly doesn’t move. My dad comes over and takes a few pictures – butterfly still doesn’t move. I don’t think much of it, and then we go see the kids ski. XX2 even gives us a wave as she motors on by. The Boy does get up on the skis. For about 4-5 seconds. Guess he can work on that some more next summer. Then I was at Black Hat last week, and it was crazy how much the conference has changed over the past 5 years. The hallway booths are now an exhibit hall. The audience is much larger, and now a bunch of senior security folks show up as well. It reflects the crazy growth of the security business. Though it seems many hands-on practitioners still attend, which is the key to maintaining the show’s value. During my meetings at Black Hat I was constantly talking about the change that is coming to security. We have been thinking a lot about what the future of security looks like, and we have some ideas. We will be right on some things, and wrong on others. But things will change. That much I can guarantee. On Monday we put the kids back on the bus for another year of school. Lots of change happening at school as well. The twins are now broken up into 4 groups this year, with different teachers to specialize by subject. And there is a new principal in the elementary school, so no telling what else will change. Then I can reflect on my own physical and mental evolution over the past few years. Lots of change there too. You seeing a theme here? The only constant is change. Then the butterfly from visiting day flew back into my consciousness. Butterflies represent change. Starting life as a caterpillar, molting, and then emerging as a butterfly: a perfect representation of everything. Constantly changing and growing into something new. You cannot stop change. Just like you cannot force a caterpillar to remain a caterpillar. You can resist but that will not end well. Change always wins. So embrace it. Lean into it. Don’t fear it. Treat every change as an opportunity to grow. Because that’s what it is… –Mike Photo credit: “Butterfly eye – canon 550d” originally uploaded by @Doug88888 The fine folks at the RSA Conference posted the talk Jennifer Minella and I did on mindfulness at the conference this year. You can check it out on YouTube. Take an hour and check it out. Your emails, alerts and Twitter timeline will be there when you get back. Securosis Firestarter Have you checked out our new video podcast? Rich, Adrian, and Mike get into a Google Hangout and.. hang out. We talk a bit about security as well. We try to keep these to 15 minutes or less, and usually fail. July 22 – Hacker Summer Camp July 14 – China and Career Advancement June 30 – G Who Shall Not Be Named June 17 – Apple and Privacy May 19 – Wanted Posters and SleepyCon May 12 – Another 3 for 5: McAfee/OSVDB, XP Not Dead, CEO head rolling May 5 – There Is No SecDevOps April 28 – The Verizon DBIR April 14 – Three for Five March 24 – The End of Full Disclosure Heavy Research We are back at work on a variety of blog series, so here is a list of the research currently underway. Remember you can get our Heavy Feed via RSS, with our content in all its unabridged glory. And you can get all our research papers too. The Security Pro’s Guide to Cloud File Storage and Collaboration Additional Security Features Core Security Features Overview and Baseline Security Introduction Leveraging Threat Intelligence in Incident Response/Management Quick Wins The (New) Incident Response & Management Process Model Threat Intelligence + Data Collect = Responding Better Really Responding Faster Introduction Trends in Data Centric Security Deployment Models Tools Introduction Use Cases Understanding Role-based Access Control Advanced Concepts Introduction NoSQL Security 2.0 Understanding NoSQL Platforms Introduction Newly Published Papers The 2015 Endpoint and Mobile Security Buyer’s Guide Open Source Development and Application Security Analysis Advanced Endpoint and Server Protection Defending Against Network-based DDoS Attacks Reducing Attack Surface with Application Control Leveraging Threat Intelligence in Security Monitoring The Future of Security Security Management 2.5: Replacing Your SIEM Yet? Defending Data on iOS 7 Incite 4 U If I ran the zoo: Dan Geer provided keen insight on several critical computer-related public policy debates during his keynote at BlackHat last week, and posted his full full talk. On net neutrality he provided the simplest – and sanest – solution I have heard to date. Dan suggests making network carriers choose to be either just a telco passing bits, or an ISP working at the content layer. If they are inspecting content, then they can decide what to throttle (such as Netflix), but that requires accepting liability for content as a “content carrier”. On the other hand, bit pushers neither throttle nor inspect – they just let the content flow. Dan put his considerable

It happens every couple years. Some vendor is really pissed at their placement in the Magic Quadrant, and they decide to sue Gartner and make it right. Inevitably the suit involves the words pay to play, and the vendor thinks they will be the company to make things right in the world. They will get justice for all those companies relegated to the loser niche quadrant. They will unmask the evil analysts for the shakedown artists they are. The latest is NetScout, who filed a suit recently claiming all sorts of stuff. “Gartner is not independent, objective or unbiased,” NetScout claimed in its lawsuit, “and its business model is extortionate by its very nature. Its substantial success is due to the worst kept secret in the IT industry: Gartner has a ‘pay-to-play’ business model that by its design rewards Gartner clients who spend substantial sums on its various services by ranking them favorably in its influential Magic Quadrant research reports and punishes technology companies that choose not to spend substantial sums on Gartner services.” Of course they are wrong. On a number of fronts. First the pay to play angle. Rich covered that a while back, so go see his arguments. Secondly, the MQ is Gartner’s opinion. An opinion can be biased. It can be wrong. It can be anything. None of those things are illegal. But maybe NetScout already knows this. What if they know this is a battle they cannot win? Maybe they don’t expect to win a legal verdict. They should be worried about winning deals in the field, and how a poor placement in the MQ impacts that. This legal action might actually be cover for their reps. Let me explain a bit. When you have to deal with a crappy MQ, you go into spin mode quickly. You have to distribute information to your sales force and partners about why Gartner is wrong. How they missed things and don’t understand the market. It’s a big pain in the butt, and it has sales folks running scared because they know every competitor will be using Gartner and the MQ to put their company into a box. But what if your sales reps could go to customers, saying they vehemently disagree with Gartner’s findings. So much so that they felt forced to legal action. Would that help? Will it make a difference? The biggest issue is generally getting your sales force to tell a consistent message, so having everyone talk about the suit certainly gets everyone on the same page. And better to come off as aggressive and willing to fight for leadership, rather than embarrassed and defensive. Some customers will respond well to that, and keep NetScout in the deal. A lot of others can’t give less of a crap, and will toss them out because in their organization it’s too hard to buy products without the MQ stamp of approval. NetScout was going to lose all those latter deals anyway – now maybe they stand a chance in the others. Though probably not. So what will happen? NetScout will lose the suit. In fact it will likely be dismissed with prejudice, and NetScout will likely have to cover Gartner’s legal fees. Because how can you win a lawsuit over someone’s clearly stated opinion? It’s not like they are making libelous statements. But NetScout might see a net gain because they will stay in deals longer. At least some deals. And if they close one deal they would have lost, they are likely to cover their legal fees. So maybe they are smart and looking at this suit as a sales & marketing expense. Or maybe they are knuckleheads who actually expect some kind of favorable outcome from this legally nonsensical suit. Either way, they got a lot more folks talking about NetScout. Public relations for the win! Photo credit: “Sue the Bastards” originally uploaded by Lloyd Doppler Share:

At Black Hat last week, it became apparent just how mainstream our little part of the world has become. And it’s not so little any more, either. When 2 of the top 5 articles on cnn.com are related to cyber we have hit the big time. But that also means promoters and other shysters will start showing up in even greater numbers to capitalize on the media hype machine looking for any kind of news to drive page views. So when the Internet blew up Monday with news of 1.2 billion credentials and a crapton of emails being stolen, everyone in the business just shrugged. What’s another billion stolen credentials between friends, right? Thankfully not everyone was at Black Hat, and some reporters who actually report questioned the findings. Here is an awesome and more detailed post unveiling the over-promotion and tactics underlying the findings. It seems like something Greg Evans 2.0 would do – including bigger numbers. And thankfully folks jumped on the protection racket offer to charge folks $120/year to ‘protect’ them, whatever that means. You also gotta love the way this guy tried to get folks to share their passwords to check if they were stolen (h/t to HD Moore for that one). LOL. The song remains the same. Don’t believe everything you read. Don’t be surprised when more and more shysters start showing up to get their 10 minutes in the sun. And the mass media will continue to provide and fuel the engine. They certainly won’t let the truth get in the way of a few million page views. Photo credit: “Troll” originally uploaded by Doug Wildman Share:

There is no free lunch. We need to be reminded of that over and over again. Apparently the Australian government wants to mandate telcos store customer data for 2 years. This is ostensibly to combat terrorism. The telcos don’t like this, so their PR spinsters are talking about how this would cost $500-700M/year, and those costs would be passed onto consumers to the tune of about $100/year. They even referred to this as a “surveillance tax”. FUD-tastic! Got to hand it to those spinsters – they know how to create a frenzy. Even better, the government is trying to extinguish the flames with calming statements like: “the public should not be concerned that there’s going to be gross misuse”. and even better: “I cannot understand why it is correct for all your privacy to be invaded for a commercial purpose, and not for me to do so to save your life,” ROFL. It is not okay for our privacy to be invaded by anyone. I guess these guys never learned that two wrongs don’t make a right. And then they have the voice of reason, who happens to be a dude indicted by the US for leaking info on the NSA. This guy mentions that collecting and retaining all that consumer data creates a huge and irresistible target for hackers. No kidding. What could possibly go wrong with any of this? At least I got my belly laugh in this Thursday morning. Photo credit: Shepard Fairey in London: Big Brother Is Watching YOU originally uploaded by tim rich and lesley katon Share:

We have talked a lot about how this cloud thing and the associated DevOps revolution will fundamentally reshape security. Probably not tomorrow, or even the day after that. But before you know it, everything you thought you knew about security will have changed. Rich documented a bunch of our thinking in his Future of Security paper, so you can start there. As with most new disruptive innovations, there are likely other folks already where you want to be – it is good to learn from them. So I was very interested in slides from Zane Lackey (who used to run security engineering for Etsy), from his talk on how to build a modern security engineering organization. A few key points from his presentation: Etsy pushed code into production up to 30 times a day. They surfaced security information to everyone, not just security folks. Communication is key to getting folks to work with security, rather than working around security. Expand your team by offering bug bounties. Use penetration tests to figure out how hackers will achieve their goals – not to just prove that your app can be pwned. Overall it is a good deck, which serves as a good reminder that our world is changing. Understand how, or wait to get run over. Share: