Research

I don’t know a single security expert that supports any current implementation of electronic voting. It’s too late for this election, but if we don’t take action before 2008, we might as well kiss what’s left of democracy in the United States goodbye. http://feeds.feedburner.com/~r/boingboing/iBag/~3/44064916/fl_evoting_machines_.html We’re not just disenfranchising a small segment of the population; we’re disenfranchising our entire society. Yes, I really think it’s that bad. At least it will be, if we don’t do something… …and yes- I plan on doing something, but after this election cycle when we can leverage a new Congress, not lame ducks. Share:

I don’t cover industry issues here, but this is just too good to pass up. Sanjay Kumar, former CEO of CA, is sentenced to 12 years and $8M in fines. U.S. District Judge Leo Glasser said though Kumar was not a violent criminal, he “did violence to the legitimate expectations of shareholders.” Prosecutor Eric Komitee said Kumar deserved severe punishment as the architect of an elaborate coverup that was “the most brazen in the modern era of corporate crime.” … After the FBI began investigating the company in 2002, Kumar orchestrated a cover-up that involved lying under oath about the “35-day month” and other frauds and trying to buy the silence of a potential witness, authorities said. Oops. Share:

Now there’s something I need to admit here. Hopefully it won’t scare you courageous readers away. You see, as much as I (and fortunately, my employer) consider myself a security expert it wasn’t exactly my major. Nope, wasn’t computer science either. History, you ask? With a bit of molecular biology? Yep, you got it. So when Pete Lindstrom reminds me that it’s not like voter fraud is new to US elections I have to admit he’s right, and I knew it. Heck, to this day rumors still float around that Joe Kennedy may have been a bit of a proactive campaigner for his son. Ballot stuffing and voter intimidation are fine American traditions with a long and- well respectable isn’t the right word, but a long and something- history. I doubt there’s been a single election in the United States, on any level, from kindergarden class president to the President, that’s escaped some degree of shenanigans. So I will admit that despite my FUD and hand waving, the country won’t come to an end nest Tuesday leaving us all in some whacked out version of Mad Max where we mount staple guns to our Saturns. (Actually, I drive a Ford Escape… hybrid. I did used to live in Boulder and all). The thing is, as cynical, pessimistic, and paranoid as I am after a lifetime of working security and rescue and seeing the worst in human behavior, I still cling to some shred of patriotic optimism that this country is something more. More than what? Just more. I grew up on 4th of July parades, Boy Scouts, and little American flags on our car antennas. I’ve been in some sort of continuous volunteer (or paid) service to this country since I was 16. I’m proud that, on occasion, I still get to wear a uniform (not military- rescue stuff). Thus the hyperbole of my previous post is only the result of a deep desire to see this country live up to its potential. If we all keep rolling over and accepting things like voter fraud, there really won’t be anything left but voter fraud. Fortunately there are plenty of indications that, in this case, we not only have a chance to mitigate the problem, but enough people are becoming aware that we have a problem to incite action. Us security experts do have an important role to play in exposing inherent flaws in current electronic voting systems. This is full disclosure at its very best. E-voting itself isn’t dangerous; just the way we’re doing it now. And all you non-security experts have the responsibility to ask questions and implement change. Kind of the whole democracy thing and all, since it really isn’t dead yet. Just resting. But I hope Pete was kidding and is also worried, because e-voting is different. As with all information technology, it supports a scope and scale of fraud far beyond ballot stuffing or registering dead Civil War veterans. One programming change or glitch can swing elections on entire systems in a nearly undetectable way. A few pre-programmed memory cards can disenfranchise entire districts. If someone is stupid enough to connect these things to the Internet, one good worm or hacker could hand the Presidency to a 19 year old Diebold technician. All those scenarios are very possible. It doesn’t take a conspiracy theory. Election fraud has always existed; now we’re enabling it on the scale of the Internet. But the Boy Scout in me truly believes it won’t happen. Well, more than once. At least not on a national scale. Hopefully. As long as we get off our asses. And yes, keep watching this space. On a separate but related note it looks like Diebold is turning into the Court Jester of voter fraud. According to Slashdot, Diebold is insisting HBO not air a documentary questioning the integrity of voting machines. I’m not the biggest fan of using ROI to justify security expenses, but Diebold probably has a great case that the cost of threatening, suing, and defending themselves from allegations of security flaws is greater than the cost of actually fixing their damn product. Seriously guys, a couple of good security engineers are probably cheaper than all your lawyers and PR flacks. I can refer a few if you want. I just saw the article and it looks like “Hacking Democracy” airs tonight. Knowing HBO it will run like, every hour, for a few months, so I’m off to set the TiVo… Share:

One of the great things about the Internet is that it allows isolated assholes to connect and communicate like never before. Thus Rothman and I, mere professional acquaintances and friendly faces at a few industry events, can engage in deeper dialog, dragging any of our loyal readers down with us. (Mike and I are the assholes, not you guys. Except maybe for Will). I like it when smart guys like Mike push me, it makes for better analysis. I published a little on data security a few weeks ago, and Mike calls for a simpler approach. I thought about it a lot, and it gave me a great idea for a new way to position data security within the data life cycle. The bad news is I’ll be publishing it through Gartner, since that’s sort of what pays the bills. It’s also why I can’t completely expand on what little I wrote here on Securosis, that would be a conflict of interest. The good news is that occasionally Gartner releases some of our research free to the public. Below I’ve pasted the complete text of a press release issued by Gartner a few months ago. It’s based directly on a research note I authored, one of the more popular security notes, that any of you with Gartner seats can go take a look at. It’s not often I can release research, but since this is now public material I should be safe. I’m reprinting the entire press release just to be safe. Here ya go Mike. Not quite as simple as you asked for, but much more direct than the hierarchy- Top five steps to limit data loss and information leaks: Gartner Public exposure of private data is becoming a regular occurrence, but the majority of these incidents can be prevented if companies implement the proper security best practices, according to Gartner. Gartner analysts have identified the top five steps to prevent data loss and information leaks: 1. Deploy Content Monitoring and Filtering (CMF) A CMF solution monitors all outbound network traffic and generates alerts regarding (or sometimes blocks) activity based on inspecting the data in network sessions. CMF tools monitor common channels, including e-mail, IM, FTP, HTTP and Web mail (interpreting the HTTP for specific Web mail services) and look for policy violations based on a variety of techniques. “CMF tools are best at detecting and reducing information loss from accidents, such as e-mailing the wrong file to the wrong person, or bad business process, such as exchanging HR data over an unencrypted FTP connection,” says Rich Mogull, research vice president for Gartner. “CMF won’t stop all malicious activity and can be circumvented by a knowledgeable attacker. Still, most information leaks are the result of these accidents or bad processes, and CMF is evolving rapidly to address more malicious attacks.” 2. Encrypt Backup Tapes and (Possibly) Mass Storage Gartner analysts highly doubt that many of the reported lost backup tapes containing consumer records eventually result in fraud. However, because there is no way to know for sure, companies have to assume exposure anyway. Encryption can ensure that the data will still be safe. “During the past few years, tools have emerged that significantly improve the performance, manageability and simplicity of encryption,” says Mr. Mogull. “For large tape installations, we recommend in-line encryption appliances. For tape drives connected to local systems or servers, companies may want to consider software encryption. Older mainframes may need an in-line appliance with an adapter for mainframe protocols, while new software solutions can take advantage of extra processors or cryptographic coprocessors in more current models.” 3. Secure Workstations, Restrict Home Computers and Lock Portable Storage Workstations and laptops can be a major source of loss, especially when a poorly configured or out-of-date enterprise or home computer is compromised by a virus or worm, and by losing portable storage media, such as a Universal Serial Bus (USB) drive or CD-ROM. “There’s really no excuse for not keeping an enterprise system up-to-date with the latest patches, a personal firewall, antivirus and anti-spyware software,” states Mr. Mogull. “These precautions alone will prevent the vast majority of commonly encountered Internet attacks.” 4. Encrypt Laptops If organizations give employees portable computers, employees will store sensitive data on it. Policies don’t matter: Users will always use the tools they acquire, and sensitive data will always end up in unexpected places. “There is only one tool to protect sensitive information on a lost laptop: encryption, preferably whole-drive encryption from a third-party vendor,” Mr. Mogull says. “Whole-driven encryption, as opposed to file and folder encryption, involves very little user action, protects all data on the computer, and is not vulnerable to the same kinds of recovery techniques that skirt the protections of passwords or other controls.” 5. Deploy Database Activity Monitoring. Most organizations struggle to secure existing databases that are rarely designed with effective security controls. While companies eventually need to encrypt some of the data in their databases, database activity monitoring is a powerful security control that”s easier to implement and more viable than encryption for many types of data. “Database activity monitoring tools observe all activity within a database, record this activity in a secure repository and generate instant alerts for unusual activity,” explains Mr. Mogull. “Through detection of unusual behaviour, database activity monitoring can limit insider misuse of database systems, enforce separation of duties for database administrators and limit certain external attacks, all without affecting database performance.” Additional issues related to the state of the security industry will be presented at the Gartner IT Security Summit, September 18-19, at the Royal Lancaster Hotel in London. www.europe.gartner.com/security Share:

The first flaw isn’t all that interesting (affecting older PowerBooks, and only under certain conditions) but methinks November will be pretty darn interesting: http://blogs.zdnet.com/Ou/?p=359 http://kernelfun.blogspot.com/ http://www.securityfocus.com/brief/344 http://blog.washingtonpost.com/securityfix/2006/11/exploit_released_for_unpatched_1.html http://www.mckeay.net/secure/2006/11/a_month_of_kernel_bugs.html More later, but the nasty ones to watch out for will, I expect, generally be either for wireless drivers (like this one), or file systems (and make nasty USB keys with). Remember, these all run in ring 0 and can do pretty much whatever they want. For the record, I really don’t like full disclosure of 0 days like this, but I suppose it will draw needed attention to a nasty issue. I’d prefer to see it handled more responsibly than dumping code on the Internet. (Updated 9/2: I was reminded that deauthenticating a mac using something like Void11 or KisMac can cause the vulnerable condition). Share:

There’s been a lot of hubbub the past couple of days over Christopher Soghoian posting a tool to let anyone print their own boarding pass. While I’m all for publicizing security silliness, I personally try and avoid things that might invite 2 a.m. non-social visits from the FBI. The thing is, anyone who thinks ID checks and boarding passes provide any security at all to planes (or any public area), shouldn’t be working in security. I spent a lot of time providing security for large crowds and public spaces. ID’s and boarding passes are a weak form of authentication and authorization- one helps you prove who you are, the other that you’re allowed to do something (get on a plane). Combined with other checks (a passenger manifest) they can be reasonable tools to assure you’re allowed to get on a plane. That’s security, but not really the security we all worry about in airports and on planes. They don’t do squat to keep anyone safe. Here’s why. We don’t call them public areas for nothing. Anyone’s allowed in with, at most, just a cursory entrance fee. There’s no significant background check, and any background check short of Top Secret doesn’t really ensure you deserve any kind of trust anyway (and even the value of a TS clearance is arguable). Never mind something as weak as a photo ID and piece of paper anyone can print. In my days we just kept it easy and didn’t trust anyone. We screened the heck out of everyone coming in, and assumed all of them were a security risk. Since you can’t guarantee that anyone with a ticket and ID isn’t a security risk, you assume everyone is a security risk and put the proper controls in place to enforce safety and security. A few computer checks aren’t going to catch a bad guy, Especially when smart bad guys don’t have existing records, and anyone else can easily fake an ID these days. Thus there’s no reliable way to trust someone. Especially with those idiotic “trusted traveler” programs anyone can join (I think they’re just a scam to get a little cash). Thus we screen (effectively, not what’s done today), and provide security inside the terminals, and more security on the planes, and we screen cargo. And… …all the other effective security controls that are, apparently, too expensive to actually implement. It’s a lot easier to pay someone $6/hr and arrest the occasional college student who shows how silly it all is. Share:

  Evilsquirrel Enterprises Announces North American Expansion Leaders in world domination to expand geographic services. Undisclosed HQ, USA, Oct. 31, 2006 – Evilsquirrel Enterprises, the leading provider of world domination services, announced today that they are leveraging their best-in-class international infrastructure to expand into the North American market. As the preeminent world domination specialists, enterprises now have a truly global provider offering unmatched services and support. “Our success at Evilsquirrel is that we listen to our customers,” said Squirrelzilla, CEO of Evilquirrel Enterprises. “Their screams of agony feed our demonic souls and desire to torture and dominate the market. Our victims customers have consistently cried in terror and fear for our expansion into North America. As a customer-focused organization we wanted to ensure our infrastructure, support services, and attack sales force were completely prepared to dominate the North American defenses markets before launching our expansion.” The Only Name in World Domination Evilsquirrel Enterprises is the global leader in world domination; providing unmatched international services for a decade. Their exclusive Fuzzy Technology (TM) and Claws of Death (TM) combine to offer an industry-unique, multilayered, attack-in-depth, solution capable of overwhelming traditional security solutions in record time. The Best Defense Once in place, Evilsquirrel utilizes their patent-pending Stop-Em-Cold (TM) defensive arsenal to stabilize entrenchment and prevent further incursion into their territory. Stop-Em-Cold (TM) defends against all zero day attacks using a holistic solution that integrates the end-to-end synergies in security infrastructure with no false positives. Available Now Evilsquirrel Enterprises’ North American expansion will enter general availability at sunset today. “Don’t worry,” states Frankensquirrel, Chief Scientist and Chef. “Evilsquirrel will be in your location before you know it. Our unparalleled attack sales force recognizes that rapid expansion leads to total market domination, and we’ll be destroying available in your location in record time” # Evilsquirrel Enterprises and the Evilsquirrel logo are trademarks of Evilsquirrel Enterprises, LLC. Use without permission is punishable by torture and death. All other brand or product names are trademarks or registered trademarks of their respective holders. (Happy Halloween! Bonus points if anyone can figure out which real press release I modeled this after.) Share:

Good security will almost always make you compliant (or pretty darn close, not counting all the documentation). Compliance alone will pretty much never make you secure. ‘Nuff said. (Inspired by this from Rothman, who I swear isn’t giving me kickbacks) Share:

The blogoshpere is kind of funny sometimes as we all run around referencing each other constantly, so you’ll have to excuse the “my sister’s best friend’s 2nd cousin twice removed’s boyfriends bookie” path for this post. (Actually, I really dig all our cross referencing, I think it creates a cool community of experts). Everything started with Alex Hutton’s What Risk Management Isn’t post, to which Mike Rothman replied, to which Arthur at Emergent Chaos replied. Follow that? Me neither, so here’s most of Arthur’s post (hopefully he doesn’t mind I lifted so much of it). And if it’s confusing at all make sure you read Alex’s original post: Rothman: But I can’t imagine how you get all of the “analysts and engineers to regularly/constantly consider likelihood and impact.” Personally, I want my firewall guy managing the firewall. As CSO, my job is to make sure that firewall is protecting the right stuff. To me and maybe I’m being naive and keeping the proletariat down, but risk management is a MANAGEMENT discipline, and should be done by MANAGERS. Arthur: I have to disagree here. Risk management in the end is the responsibility of management and as such the final decision belongs to them. But how can I as a manager make the right decision and know that a firewall is protecting the right stuff, if my team isn’t well educated on what the risks are? How am I supposed to make the right decisions if don’t know what the issues are? I need to have a staff of analysts, architects and engineers that I can trust to be regularly analyzing and evaluating the systems, applications and networks, so I can make the right choices or recommendations. I don’t need someone who blindly follows a help desk ticket. I don’t know a single CSO who wants to be micromanaging those sorts of decisions. About 5 years ago I got tasked with writing some research in risk management, and it took me over two years to actually get anything published. It’s like, hard, and stuff. Anyway, I came to the usual conclusions that risk management is stuck in too many silos, too many people focus on numbers of no real validity, management can’t understand detailed risks in a specific area, but domain experts can’t understand or manage risks outside of their domain. (I even ended up authoring a called “The Gartner Simple Enterprise Risk Management Framework” (sorry, my employer owns it so you have to be a client to read it)). The thing is, as these various posts illustrate, risk management falls into silos for a reason. We want domain experts making risk decisions in their domains. After nearly 20 years of various rescue work I can make a snap risk decision in that domain that’s far more accurate than any BS statistical model someone else comes up with. By the same token there’s no friggen way that expertise allows me to make a good risk decision outside that domain. In physical security I was great at managing the crowd safety issues at a concert, but we probably would have gone out of business if I chose the acts. (All Buffett all the time baby). So whatever risk approach you take, you want one where executive management makes overall risk tolerance decisions, but individual domain experts measure risk in their areas of expertise. You want a system that gives you the ability to communicate between management and operations. No manager needs a detailed analysis of the latest RPC DCOM flaw, they just need to know if that could cause problems for the overall enterprise, how bad, and where. So Rothman, Arthur, and Alex are all right. Mangement is responsible for overall risk, but domain experts must be the ones making and measuring risk decisions in their specific areas. Management needs to communicate risk tolerance to the experts in a language they can understand, and those domain experts need to communicate enterprise risks back to management in a way they can understand. Yes, it’s possible and probably easier than you think. It can speed up risk management since you don’t get wrapped up in garbage stats and fake ROI arguments. It just takes a good framework, a little bit of effort, and a few people that know what they’re doing to kick it off. Share:

Jim over at DCS Security (a great new blog) just finished his last in a series of good posts on security layers. He brings up a favorite subject of mine, best practices: Essentially best practices is a bunch of smart (hopefully) guys sitting around in Gartner, Forester, D&T, PWC, E&Y, SANS, and other groups coming to a consensus on which controls cover the closest to 100% for a given threat they are looking at and which are the best controls to put in place. I hate to dash his hopes, but it turns out that’s not really how things work. I break best practices into three categories: Analyst best practices: What us white coat dudes who don’t work for a living come up with as best practices. These are the more aggressive, forward looking best practices that probably don’t reflect your operational realities. Basically, it’s what a bunch of industry experts think everyone should do, not that they (we) actually have to do it. Analyst best practices will make you really fracking secure, but probably cost more than a CEOs parachute and aren’t always politically correct. Maybe 2% of enterprises (and probably far fewer) adopt comprehensive analyst best practices, but a lot of you pick and choose and implement at least a few. Industry best practices: These are the more formal best practices that more closely align to operational realities. ISO standards, the NERC/FERC CIP standards, PCI, etc. More measurable, more auditable, and while hard, more operationally realistic for most organizations. Let’s guess and call it 20% of enterprises, mostly large, that really hit the full spectrum of industry best practices. Thanks to compliance I expect this to rise significantly over the next 2 years. Some industries, like financial services, are better than others. Industry practices never represent the cutting edge, but are the foundstones of a good security program. Common practices: what everyone is really doing: When most people ask about best practices, they really just want to know what everyone else is doing. It’s a dumb approach, but they figure as long as they don’t fall too far behind they won’t get in too much trouble when it hits the fan. Being a follower in security isn’t always the best idea; most crimes are crimes of opportunity. It’s the virtual equivalent of walking around a parking lot and seeing who left their car door unlocked, rather than picking that hot Beemer and figuring out how to bypass all the extra security. But the entire Internet is that big parking lot, and the bad guys can scan anonymously, at will, without anyone noticing them lurking around. Just because someone else is doing something doesn’t make it right. Especially when everyone faces equal threats, never mind some of the industry specific threats. Best practices are not best practices. It’s another term we tend to overuse without really delving into the meaning. Share: