Research

I just posted on switching to Debix, and it reminded me there’s something I keep forgetting to cover. When reading the news, both mainstream and industry, I’m appalled at the abuse of the term “identity theft”. And don’t get me started on vendor marketing materials. Identity theft is a serious crime with potentially severe repercussions for the victim. It’s when a bad guy uses your personal information, often including Social Security Number, to use your identity for nefarious purposes. It’s most often financial, taking out new credit (which never gets paid), but can include fake ID cards (and thus driving/criminal records), passports, and more. Yes folks, there are bad guys with stolen IDs who get caught by the cops, use the fake ID, get bail, and run for it- leaving you with a nice bench warrant out in your name (really rare, but it happens). A former co-worker once applied for a new mortgage and the bank asked him about the one in default. Oops. That’s identity theft. (BTW- this is a problem far more endemic in the US than most other nations. They don’t rely on a single, not-secret-secret-number (SSN) to manage credit, making ID theft more difficult). Credit card fraud is serious, but not nearly as serious. That’s when someone steals your credit card number and uses it to make fraudulent purchases. Nearly every credit card in the world (but not debit cards- for those you need to check with your bank) includes fraud protection. You, the consumer, are not liable for the fraud if you identify and report the erroneous charges. You don’t bear the costs of getting a new card if you need one. Merchants and banks (but not the credit card companies, of course) bear the costs of credit card fraud, not you. That’s why I don’t care that my wife shops at TJX- we know to monitor our bills and if something happens we won’t be liable. Both are crimes, but in protecting yourself it’s important to understand the difference. As a business I worry quite a bit about credit card fraud since I could bear the cost (if I accepted credit cards). As a consumer I worry more about ID theft. Share:

Sears isn’t having much luck these days. First, they install spyware on their customers’ computers. If you “join the Sears community”, they install a proxy on your computer and intercept all web traffic. Ugly, ugly, idiocy. Now, it turns out they have a major logic flaw on their website. As reported by Brian Krebs at Security Fix, anyone can see anyone else’s purchase history with just their name, address, and phone number. Have those white pages handy? It seems to cover both online and offline purchases. If you’re not paying attention to logic flaws in your databases and applications, this is a great example. While it’s good to make life easy for your customers, it’s bad when you make it easy for your next door neighbor to figure out if you really bought those new hedging shears that coincidentally look just like the ones they lost out of their shed last month. This exploit was easily preventable with just a modicum of thought and the most cursory security review. Sears is too big a company to make this kind of mistake. And the spyware? Sheer stupidity by someone in marketing is my guess. Maybe they and whoever screwed up at Sony BMG went to the same marketing school. Share:

Wow. It’s 2008. How did that happen?!? When I was younger I couldn’t wait for the future. What geek can? We all grew up on entirely too much science fiction; far more of which is now reality than I expected (other than the space program; hello? NASA? Anyone home?). Now that I get older I realize that while the future is great in concept, the reality is eventually I won’t be around for it anymore. Every year is a smaller fraction of life, and thus every year passes relatively more quickly. Aw hell, I’m far too young to be thinking about garbage like this. As 2007 closed many of us pundit types devoted our time to looking at current trends and predicting the next few years. If you’ve been following me and Hoff at all, you also know some of us are always thinking about how we can do security differently. Not that we’re doing it “wrong” today, but if you don’t look for what’s next you’ll always be playing from behind. One big trend I’ve been seeing is the shift towards anti-exploitation technologies. For those who don’t know, anti-exploitation is where you build in defenses to operating systems and platforms so that when there is a vulnerability (and there will be a vulnerability), it is difficult or impossible to exploit. Java was my first introduction to the concept at the application level (sandboxing), and Vista at the operating system level. There’s no single anti-exploitation technology, but a bunch of techniques and features that work together to make exploitation more difficult. Things like ASLR (library/memory randomization), sandboxing, and data execution protection. Most of the anti-exploitation focus today is on operating systems, but conceptually it can be applied anywhere. One of my big concepts in Application and Database Monitoring and Protection (ADMP) is building anti-exploitation into business and (especially) web applications. I’ve even converted from credit monitoring to credit protection (via Debix) for anti-exploitation against identity theft. There was a lot of focus in 2007 on vulnerability scanning and secure coding. While important, those can never solve the problems. The bad guys will always find some vulnerabilities before we do. Our programmers will always make exploitable mistakes- no matter how much we hammer them with training and the code with tools. When designing security controls we must assume vulnerabilities will exist and we won’t always identify and mitigate them before they are discovered by attackers. Not that anti-exploitation is some mystical perfect remedy; it too will fail, but the goal is for it to fail slowly enough that we are able to discover, detect, and mitigate vulnerabilities before they are exploited. You’ll be hearing a lot more about anti-exploitation at all levels of the industry over the next few years, especially as we start seeing it outside of operating systems. It’s the one thing that gets me jazzed that we might be able to get a leg up on the attackers. Share:

I was debating about writing anything personal about 2008, but after reading Mike’s Security Incite today I figure a little personalization on the site won’t hurt. If you’re not interested in what I’m up to professionally and personally, this is a good post to skip. 2007 was a very intense year. I built a new house, moved, quit my job, traveled all over the freaking place, and tried my best to cling to a personal life. At times I was elated, completely burned out, inspired, bored, physically fit, and old fat and lazy. It was a heck of a year, and all in all I enjoyed it thoroughly. I’m not one for resolutions, but I’m really looking forward to 2008 and have some specific goals. Business-wise, Securosis is going better than I ever expected. I wasn’t one of those analysts that believed my own hype and assumed the world was just begging for my attention. Leaving a good job with a steady paycheck for nebulous reasons is always a little daunting, but after 4 full months on my own things are cruising along and at times I can barely keep up. I need to thank all of you for the support- from readers and commenters to paying customers. I’m well diversified in my client base (vendors, end users, and investment types), and the kinds of projects I’m engaged in. And I’m having a blast. There’s a lot on tap for 2008. I’ll be pumping out more free whitepapers through SANS- mostly focused on data and application security, with a few I hope to co-author on other topics. I have a bunch of speaking engagements lined up, and will promote those more heavily as they get closer (including RSA). If all goes well, I might even be able to self publish a book on data security before the end of the year. I’ll also continue to write over at Dark Reading, TidBITS, and other publications as opportunities come up. I’m already ecstatic about the consulting projects that are coming up- it’s been a long time since I did project-based work and I really enjoy digging in deeper on things (everything from product assessments to data security strategies). My main goal is to accomplish all of this while maintaining a good work/life balance. I’ve let that slip in the past, especially when I was an analyst. As far as I know we only have one shot on this planet and I don’t intend to spend it stressed out and working all the time. And, to be honest, the quality of work suffers if you aren’t happy. Personally the year is going to start a little rough- I have to get shoulder surgery to repair a SLAP tear. I’m a very physically active guy and it’s been torture to restrict my activities since I hurt it at the end out August. I even quit my martial arts training- can’t throw a punch. I’ll be on restricted duty for 3-6 months, and probably won’t be 100% for a year. On the upside, it gives me an excuse to return to base training, rebuild from the past years of abuse on airplanes, and enjoy some of my other hobbies. I have some woodworking projects in mind, want to finish wiring the house, and finally finish unpacking from the move. Maybe it’s selfish, but in 2008 I plan on having fun, helping others, making a living, and enjoying life. When you get down to it, what else is there? Share:

If you read this blog, odds are today and tomorrow you’ll be responsible for “fixing” the computers of your extended family. It’s also a great excuse to get you some much-needed web browsing time if the family conversations get boring. Here’s my (very short) checklist: Make sure they’re behind some sort of NAT firewall/home router. Anything that keeps them from being directly connected to the Internet. Do a quick check to make sure it isn’t forwarding any ports to internal addresses. A cheap $50 router/wireless access point alone will stop most worm/network attacks. If they don’t have one, you now have a convenient excuse to visit Fry’s Electronics or your local Circuit Buy. Back up their photos onto an external hard drive or CD/DVD. For many people, nothing else really matters. This should get you out of any idle chit-chat, and no one needs to know you’re reading Slashdot and drinking a beer in the back room. You can milk this one for as long as needed, and it comes across as being more helpful than just watching sports. Check to see if Windows is updated. If it isn’t, assume they are infected. If they don’t have SP2, buy them a new computer. Run a quick scan for any obvious spyware/malware. I ask if the computer’s been running slow lately; that’s a good indicator. Otherwise just download one of the free tools and give it a run. If their AV suite is out of date, and they use the computer for more than the most simple of tasks, assume it’s infected. At this point I will usually load up a free suite of tools (AVG Free, whatever anti-spyware is handy, and activate the Windows firewall). This is your time to work on blog entries and maybe Twitter a bit, although if the computer is infected you won’t want to log into any of your accounts. If you need more alone time, stare at the screen and curse occasionally as people walk past. They’ll leave you alone. If you’re pretty sure it’s infected you have a choice. If the computer is old, tell them to buy a new one (preferably a Mac). If it’s current but blasted, tell them to back up important files and nuke it from orbit. If it’s your parents, back up and nuke it yourself. Send someone to buy you better beer (Stone Arrogant Bastard should do) so you can “concentrate” better. Tell your father/uncle/father-in-law/whoever to stop going to “those” sites. When they deny it, show them their cookie files. When they still deny it, close the door to the room and open up the web cache. If they still deny it, blame your 4 year-old nephew and suggest a good child psychologist. If they don’t cave at this point, tell them Crazy Uncle Bobby touched you as a kid; maybe it’s his fault. Turn on their antispam, preferably at the ISP level. This will stop a lot of email viruses. No matter what, tell them you found terrorist child pornography from gambling sites on their system, and inform them to never click on anything in email. This should keep them out of trouble. If you just backup the files, do a quick check, and figure out if you need to nuke it or keep it, that’s enough and only takes a few minutes. Feel free to extend as long as needed based on your particular family dynamics. If your family has Macs, you might need to fake it. They’ll probably catch you. Me? My immediate family has Macs and my wife’s side is local and I fix things as they happen. The good beer is in the fridge and I intend to fully enjoy a couple days of watching sports and making Lego robots with my nieces and nephew. Happy Holidays- see ya in a few days. Share:

When it comes to logging, I won’t even step on the same court as Anton. But a couple weeks ago (while I was on the road, thus the late response) he posted on the options for database logging. It’s a good overview of using native logs and log management vs. network appliances, but he totally misses a third option. Most of the Database Activity Monitoring vendors use additional techniques, including agents, to gain a granularity that’s not supported by most native database logs (or better performance when that granularity exists). This is absolutely critical if you want to monitor SQL-statement activity; a growing security requirement. Log management won’t help you if you want to know which administrator is changing your corporate financials, detect SQL injection attacks, or alert when that call center employee drops a “SELECT CC# FROM Customers” using that ad-hoc query tool your forgot to block. There are MANY cases where log management is enough today, but I think over time we’ll all migrate to needing to know the SQL (and then correlate that with application activity). Share:

Live in Phoenix? Interested in Security? Like beer? On January 10th we’re going to revive SunSec. Keep an eye out here and I’ll post more details when we get them. Tentatively plan for 6pm somewhere in the Old Town Scottsdale-Tempe area. Share:

I have to admit, although Apple’s handling of security issues is often a train wreck, I’m still a big fan of Macs and other Apple products. I covered a lot of the firewall issues on this blog and over at TidBITS, but I was still excited when MacWorld asked me to write an article on using the Leopard Firewall. I really try to walk the middle ground when discussing Mac issues, which can tend to get a little emotional for some people. Some of my security friends accuse me of selling out when I write an article like this, while Mac zealots cry havoc at any criticism of their favorite platform. As with everything, the truth is somewhere in the middle. Apple has a long way to go with security, but we do see them taking some baby steps in the right direction. Trying to beat Apple over the head clearly doesn’t work, so I try and take a reasoned approach to criticism; giving them credit for the work they’ve done while offering specific suggestions for improvements where they fail. The truth is, even with all their faults and the critical vulnerabilities (including 0days) we’ve seen, the average Mac user is safer than the average Windows XP user as they go through their computing days. But we also need to recognize that this won’t hold true as the popularity of the platform continues to grow. We’re seeing the early signs that the bad guys are gaining interest in Macs, and there are flaws in the platform they can eventually use to cause some damage. I suspect that once this starts occurring on a large enough scale, Apple will have to respond and start adopting some of the development processes and security features we see at Microsoft. If only Microsoft would learn a little about usability from Apple… then we’d have a serious fight. Anyway, you can check it out here. Share:

Chris Hoff returned to the podcast this week to discuss the little awareness campaign we cooked up (no, he didn’t really hack me) and talk about the future of security over the next few years. I think this is one of our best episodes ever. If you’re interested in learning how us pundits look at the industry and recognize trends, you’ll want to listen to this one. Chris, Martin, and I really dig in deep on where security is headed and why. As always, you can find it at netsecpodcast.com… Share:

More on this later, but I’m starting to see the data security market splitting along two lines. One focused on protecting content in user workspaces and productivity applications. It’s starting with DLP but moving towards what I call Content Monitoring and Protection. On the other side of data security is protecting content in business applications- from your web application stack to internal applications and databases. I’m starting to call this Application and Database Monitoring and Protection, and Database Activity Monitoring is where it’s starting. Since we need definitions, here’s my first stab for ADMP: Products that monitor all activity in a business application and database, identify and audit users and content, and, based on central policies, protect data based on content, context, and/or activity. For CMP, I’m sticking with my DLP definition (DLP is a terrible term, but I’m not going to fight the market): Products that, based on central policies, identify, monitor, and protect data at rest, in motion, and in use through deep content analysis. Share: