Login  |  Register  |  Contact
Friday, November 06, 2015

The Economist Hack: Good Intentions, Bad Execution

By Rich

The Economist used a tool on their site to block collect stats and serve ads to visitors using ad blockers. I will avoid diving into the ad-blocking debate, but I will note that my quick check showed 16 ad trackers and beacons on the page. I don’t mind ads, but I do mind tracking.

It turns out that tool, called PageFair, was compromised by attackers to serve malware to Economist readers. The Economist is one of the few publications I still respect, so this made me more than a little sad.

This one is a good learning case. Ryan Naraine and I discussed it on Twitter. Both of us were critical of The Economist’s hack response, Ryan a bit more than me. I see the seeds of good intent here, but flawed execution. Let’s use this as a learning opportunity.

  • Good: They detected the situation (or, more likely, someone else did and told them) and responded within 6 days.
  • Good: They put up a dedicated page with information on the attack and what people should do.
  • Good: They didn’t say “we care very deeply about the security and privacy of our customers”. I hate that crap.
  • Good: The response page pops up when you visit the home page.
  • Bad: The response page only pops up when you visit the home page from certain browsers (probably the ones they think are affected), and could be stopped if you use certain blockers. That’s a real problem if people use multiple systems, or if the attackers decide to block the popup.
  • Bad: They don’t specify the malware to look for. They mention it was packaged as a fake Adobe update, but that’s it. No specificity, so you cannot know if you cleaned up the right badness.
  • Bad: They recommend you change passwords before you clean the malware. VERY BAD. Thanks to @hacks4pancakes and @malwrhunterteam for finding that and letting me know.
  • Bad: They recommend Antivirus, without confirm recommended tools would really find and remove this particular malware. That should be explicitly called out.

It looks like an even split, but I’d give this response a C-. Right intention, poor execution. They should have used an in-page banner (not a popup) and a popup to grab attention. They should have identified the malware and advised people to clean it up before changing banking passwords.

There is one issue of contention between myself and Ryan. Ryan said, “No one should ever rely on free anti-malware for any kind of protection”. I often recommend free AV, especially to consumers (usually Microsoft). It’s been many years since I used AV myself. Yes, Ryan works for an AV vendor, but he’s also someone I trust, who actually cares about doing the right thing and providing good advice.

I don’t want to turn this into an AV debate, and Ryan and I both seem to agree that the real questions are:

  • Would the AV they recommend have stopped this particular attack?
  • Would the AV they recommend clean an infection?

But they don’t provide enough detail, so we cannot know. Even just a line like, “we have tested these products against the malware and confirm it will completely remove the infection” would be enough.

I’m not a fan of blaming the victim, but this is the risk you always face when embedding someone else’s code in your page. Hell, I talked about that when I was at Gartner over 10 years ago. You have a responsibility to your customers. The Economist seems to have tried to make the right moves, but made some pretty critical mistakes. Let’s not lambaste them, but we should certainly use this as a learning opportunity.

—Rich

Summary: Distract and Deceive

By Rich

Today I was sitting in my office, window open, enjoying the cold front that finally shoved the summer heat out of Phoenix. I had an ice pack on my leg because my achilles tendon has been a little twitchy as I go into the last 8 weeks of marathon training. My wife was going through the mail, walked in, and dropped a nice little form letter from the United States Office or Personnel Management onto my desk.

It’s no secret I’m still an active disaster responder on a federal team. And, as previously mentioned, my data was lost in the OPM hack. However, my previous notification was for the part where they hacked the employment information database. This notification is for the loss of all security investigation records.

Which is cool, because I don’t even have a security clearance.

What was on there? Aside from my SSN, every address I’ve lived at (once going back to childhood, but I think the most recent form was only 7 years), most of my jobs, all my relatives, and (I think) my wife’s SSN. I’m not sure about that because I can’t remember exactly what year I most recently filled out that form, but I’m pretty sure it was after we were married.

Here’s the fun part. The OPM just offered me 3 years of identity theft protection. Three. Years. Which I can only assume means my SSN will expire in that time and I’ll be safe afterwards. And it must mean China wasn’t responsible, because they would go after me as espionage, not identity theft. Right? RIGHT?!?

It’s just another example of the old distract and deceive strategy to placate. No one involved in intelligence or security thinks for half a second that ID theft protection for three years is meaningful when an SSN is lost – never mind when it (and all my personal info) is lost to a foreign intelligence adversary. But it sounds good in the press and distracts the many millions of federal workers who don’t work in security and understand the implications. People who trust the government, their employer.

This isn’t limited to the OPM hack – it’s really a shitty playbook for the security industry overall. Been hacked? Call it “advanced and persistent” and then announce you hired a top-tier incident response firm. It doesn’t matter that you used default admin passwords, it’s all about looking like you take security seriously, when you don’t. Well, didn’t.

Really. Look at all the breach announcements from the past couple of years. Cut and paste.

And then there are our security tools. Various point technologies, each designed to stop one particular type of attack during a particular time window. Some of them really work. But we don’t acknowledge that security is really about stopping adversaries (Gunnar Peterson constantly hammers on this), and then the window for that particular tech closes. This throws the vendors into a spin cycle because, let’s be honest, their entire livelihood is on the line.

Distract. Deceive. Lather. Rinse. Repeat.

Admitting failure is hard. Addressing root causes is hard. Realizing something you built is no longer as valuable as it once was is even harder. Hell, we here at Securosis once spent two years and a couple hundred thousand dollars building something that we had to walk away from because the market shifted. That was cash out of my personal pocket – I get it.

This isn’t a security industry problem, it’s basic human behavior. I don’t have an issue with someone covering their ass, but when you deceive and distract to protect yourself, and put others at greater risk?

Not cool.

On to the Summary:

Webcasts, Podcasts, Outside Writing, and Conferences

Favorite Securosis Posts

  • Rich: Incite 11/4/2015 – The Taper. I’m training for my first marathon right now. Well, second time training, because I got stomach flu the week of my planned first and had to miss it. My entire life right now is focused on starting my taper on December 6th.

Other Securosis Posts

Favorite Outside Posts

Research Reports and Presentations

Top News and Posts

Blog Comment of the Week

This week’s best comment goes to Guillaume Ross, in response to Why I design for one cloud at a time.

It’s weird. Companies that never thought twice about getting locked into Windows as a platform, now super concerned to have code calling S3!

—Rich

Thursday, November 05, 2015

CSA Guidance V4 Content on GitHub

By Rich

A while back we announced that we were contracted by the Cloud Security Alliance to write the next version of the CSA Guidance. This is actually a community project, not us off writing by ourselves in a corner. The plan is to:

  1. Collect feedback on version 3.0 (complete).
  2. Post outlines for the updated domains and collect public feedback.
  3. Post first drafts for the updated domains and collect more feedback.
  4. Post near-final drafts for the last feedback, then complete the final versions.

I’m happy to say the content is now going up on the project site at GitHub. The first draft of the architecture section is up, as is the outline for Domain 5 (data governance). Things will start moving along more quickly from here.

The best way to use GitHub at this point is to submit Issues rather than Pull Requests. Issues we can use like comments. Pull requests are actual edits we would need to merge, and they will be difficult to handle at scale, especially if we don’t get consensus on a suggested change.

I will periodically update things here on the blog, but you can watch all the real-time editing and content creation on GitHub.

—Rich

Wednesday, November 04, 2015

DevOpsed to Death

By Adrian Lane

Alan Shimmel asks have we beat “What is DevOps” to death yet? Alan illustrates his point by using the more-than-beaten-to-death, we-wish-it-would-go-away-right-now of Chuck Norris meme. Those of us who have talked about DevOps for a while are certainly beginning to tire of explaining why it is more than automation. But Alan’s question is legit, and I have to say the answer is “No!” We are in the top of the second inning of a game that will be playing out for years.

I know no amount of coffee will stifle a yawn when practitioners are confronted with yet another DevOps definition. People who are past simple automated builds and moving down the pathway to continuous integration do not need to be told what DevOps is. What they need help with is practice in how to do it better. But DevOps is still a small portion of the IT and development community, and the rest of the folks out there may still need to hear it a dozen times more before its importance sinks in. There are very good definitions, which do not always resonate with developers. Try getting a definition to stick with people who believe they’ll be force chocked to death by a Sith Lord before code auto-deploys in an afternoon – not an easy task.

To put this into context with other development trends, you can compare it to Agile. Within the last year I have had half a dozen inquiries on how to start with Agile development. Yes, I have lost count of how many years ago Agile and Scrum were born. Worse, during the RSA conference this year, I discussed failed Agile deployments with a score of firms. Most fell flat on their faces because they missed one or two of the most basic requirements of what it means to be Agile. If you think you will run a development cycle based on a 200-page specification document and still be Agile, you’re a failure waiting to happen. They failed on the basics, not the hard stuff.

From a security perspective I have been talking about Database Activity Monitoring and its principal use cases for the last decade. Still, every few months I get asked “How does DAM work?” And don’t even bother asking Rich about DLP – he gets questions every week. We have repetitive strain injuries from slapping our foreheads in disbelief at the same basic questions; but firms still need help with mature technologies like encryption, firewalls, DAM, DLP, and endpoint security. DevOps is still “cutting edge” for Operations at large, and people will be asking about how DevOps works for a very long time to come.

—Adrian Lane

Why I design for one cloud at a time

By Rich

Putting all your eggs in one basket is always a little disconcerting. Anyone who works with risk is always wary of reducing options. So I am never surprised when clients ask about alternative cloud providers and try to design cloud-agnostic applications.

Personally I take a different view. Designing cloud-agnostic applications is like building an entirely self-sufficient home because you don’t want to be locked into the local utilities, weather conditions, or environment. Sure, you could try, but the tradeoffs would be immense. Especially cost. The key for any such project is to understand the risk of lock-in, and then select appropriate techniques to minimize the risk while still providing the most benefit from the platform you are using.

The only way to really get the cost savings and performance advantages of the cloud is to design specifically for the cloud you are working on. For example use their load balancers and auto scale groups rather than designing your own. (Don’t worry, I’ll get to containers in a second). If you are building or bringing all your own software to the cloud platform, at a certain point, why move to the cloud at all? Practically speaking you will likely reduce your agility, resiliency, and economic benefits.

I am talking in generic terms, but I have designed and reviewed some of these deployments so this isn’t just analyst handwaving. For example one common scenario is data transfer for batch analysis. The cloud-agnostic way is to set up a file server at your cloud provider, SFTP the data in, and then send that off to analysis servers. The file server becomes a major weak point (if it goes down, so does everything), and it likely uses the the cloud provider’s most expensive storage (volumes). And all the analysis servers probably need to be running all the time (the file server certainly does), also racking up charges.

The cloud-native approach is to transfer the data directly to object storage (e.g., Amazon S3) which is typically the cheapest storage option and highly resilient. Amazon even has an option to transfer that data into its ridiculously cheap Glacier long-term storage when you are done. Then you can use a tool like Lambda to launch analysis servers (using spot instance pricing, which can shave off another 40% or more) and link everything together with a cloud message queue, where you only pay when you actually pump data through.

Everything spins up when data appears and shuts down when it’s finished; you can load as many simultaneous jobs as you want but still pay nearly nothing when you have no active jobs.

That’s only one example.

But I get it – sometimes you really do need to plan for at least some degree of portability. Here’s my personal approach.

I tend to go all-in on native cloud features (these days almost always on AWS). I design apps using everything Amazon offers, including SQS, SNS, KMS, Aurora, DynamoDB, etc. However…

My core application logic is nearly always self-contained, and I make sure I understand the dependency points. Take my data processing example: the actual processing logic is cloud-agnostic. Only the file transfer and event-driven mechanisms aren’t. Worst case, I could transfer to another service. Yes, there would be overhead, but no more than designing for and running on multiple providers. Even if I used native data analysis services, I’d just ensure I’m good at documenting my logic and code so I could redo it someplace else if needed.

But what about containers? In some cases they really can help with portability, but even when using containers you will likely still lock into certain of your cloud provider’s proprietary features. For example it’s just about suicidal to run your database inside containers. And containers need to run on top of something anyway. And certain capabilities simply work better in your provider than in a container.

Be smart in your design. Know your lock-in points. Have plans to move if you need to. Micro or mini services is a great design pattern for knowing your dependency points. But in the end if you aren’t using nearly every little tweak your cloud provider offers, you are probably spending more, more prone to breakage, and slower than the competition who does.

I can’t move my house, but as long as I hit a certain square footage, my furniture fits just fine.

—Rich

Incite 11/4/2015: The Taper

By Mike Rothman

As I mentioned, I’m running a half marathon for Team in Training to defeat blood cancers. I’ve raised a bunch of money and still appreciate any donations you can make. I’m very grateful to have made it through my training in one piece (mostly), and ready to go. The race is this coming Saturday and the final two weeks of training are referred to as the taper, when you recover from months of training and get ready to race.

This will be my third half, so by this time in the process I’m pretty familiar with how I feel, which is largely impatient. Starting about a month out, I don’t want to run any more because my body starts to break down a bit after about 250+ miles of training. I’m ready to rest when the taper starts – I need to heal and make sure I’m ready to run the real deal. I want to get the race over with and then move on with my life. Training can be a bit consuming and I look forward to sleeping in on a Sunday morning, as opposed to a 10-12 mile training run. It’s not like I’m going to stop running, but I want to be a bit more balanced. I’m going to start cycling (my holiday gift to myself will be a bike) and get back to my 3x weekly yoga practice to switch things up a bit.

The Taper

The taper is actually a pretty good metaphor for navigating life transitions. Transitions are happening all the time. Sometimes it’s a new job, starting a new hobby, learning something new, relocating, or anything really that shakes up the status quo. Some people have very disruptive transitions, which not only shake their foundations but also unsettle everything around them. To live you need to figure out how to move through these transitions – we are all constantly changing and evolving, and every decade or so you emerge a different person whether you like it or not. Even if you don’t want to change, the world around you is changing, and forces you to adapt. But if you can be aware enough to sense a transition happening, you can taper and make things more graceful – for everyone.

So what does that even mean? When you are ready for a change, you likely want to get on with it. But another approach is to slow down, rest a bit, take a pause, and prepare everyone around you for what’s next. I’ve mentioned the concept of slowing down to speed up before, and that’s what I’m talking about. When running a race, you need to slow down in the two weeks prior to make sure you have the energy to do your best on race day. In life, you need to slow down before a key transition and make sure you and those impacted are sufficiently prepared.

That requires patience and that’s a challenge for me and most of the people I know. You don’t want to wait for everyone around you to be ready. You want to get on with it and move forward, whatever that means to you. Depending on the nature of the transition, your taper could be a few weeks or it could be a lot longer. Just remember that unless you are a total hermit, transitions reverberate with those around you. It can be a scary time for everyone else because they are not in control of your transitions, but are along for the ride. So try to taper as you get ready to move forward. I try to keep in mind that it’s not a race, even when it’s a race.

–Mike

Photo credit: “graff la rochelle mur aytre 7” originally uploaded by thierry llansades


Thanks to everyone who contributed to my Team in Training run to battle blood cancers. We’ve raised almost $6,000 so far, which is incredible. I am overwhelmed with gratitude. You can read my story in a recent Incite, and then hopefully contribute (tax-deductible) whatever you can afford. Thank you.

The fine folks at the RSA Conference posted the talk Jennifer Minella and I did on mindfulness at the 2014 conference. You can check it out on YouTube. Take an hour. Your emails, alerts, and Twitter timeline will be there when you get back.


Securosis Firestarter

Have you checked out our new video podcast? Rich, Adrian, and Mike get into a Google Hangout and… hang out. We talk a bit about security as well. We try to keep these to 15 minutes or less, and usually fail.


Heavy Research

We are back at work on a variety of blog series, so here is a list of the research currently underway. Remember you can get our Heavy Feed via RSS, with our content in all its unabridged glory. And you can get all our research papers too.

Building Security into DevOps

Building a Threat Intelligence Program

Network Security Gateway Evolution

Recently Published Papers


Incite 4 U

  1. Getting started in InfoSec: Great post/resource here from Lesley Carhart about how to get started in information security. Right up at the top the key points comes across loud and clear: you need to understand how things work to hack them (or defend them). YES! That’s why a degree in security is useful, but the reality is that students coming out of these programs aren’t ready because they don’t know how everything works. That takes a few years in the coal mines, so you need to grow folks to meet demand, but it’s a multi-year investment. You can’t just send them to a SANS class and figure they’ll be ready to take on sophisticated adversaries. The other point right up front is on passion about security. It’s not a 40-hour-a-week job (not even in France), and it’s thankless. So if you don’t really like it, it’s a slog to do security for years. If you have folks who are interested in getting into our little area of the world, have them read this post. – MR

  2. Infinite primes, wasted: Remember back in high school, when your teachers said “Math is important!” You muttered under your breath, “When am I ever going to use this stuff? Combinatorials? Prime numbers? Never again!” Well guess what? Your math teacher was right. J. Alex Halderman and Nadia Heninger, in How is NSA breaking so much crypto?, offer a plain english explanation of how nation-state hackers are likely able to eavesdrop on HTTPS sessions. They go on to discuss the economics, and the incentives for governments to invest in crypto hacking hardware to keep pace with networks and technology. Because of a common implementation failure in the use of prime numbers – using the same ones every time – the NSA and other nation-states can leverage a few hundred million in custom hardware to crack the majority of secured sessions – and what’s a few hundred million between friends (or enemies). The brute force cracking is not rocket science, nor is the discovery of the simple mistake in usage of prime numbers, but combined they allow determined parties to eat ‘secure’ sessions for lunch. – AL

  3. Mobile + Pr0n = Pwn: I highlighted this link in last week’s Friday Summary, but it’s worth a broader discussion: porn sites are the top mobile infection vector. Mostly because it’s about pr0n. HA! But that brings up a good point about the path of least resistance. Attackers find ways to figure out the easiest way to achieve their mission, and folks who use tablets and phones to consume adult content are pretty low-hanging. No pun intended, but the key points here are that malvertising is a key attack vector now and some sites are going to be more careful about it, and that porn sites probably aren’t among the best of them. So what to do? Abstinence? Just say no? As Nancy Reagan turns over in her grave, the answer is to make sure you are following the same practices you follow on your PC devices. Don’t click on stupid links, and make sure your device is patched and up to date. – MR

  4. Fast pass to replacement: In the last two weeks Mastercard has launched the MasterPass Mobile App with full tokenization of credit cards (i.e., PAN) through the MasterPass Digital Enablement Service – a fancy name for their tokenization gateway. This is important as they are directly linking issuing banks to mobile apps like Android Pay, Apple Pay, and Samsung Pay. In The EMV Migration and the Changing Payment space we explained that EMV cards are almost trivial in the bigger picture. The transition to mobile is where the real security benefits will be derived. And here is we will see full end-to-end tokenization and merchants no longer getting access to card numbers. The road will continue to be bumpy for a while, as card-not-present fraud forces banks to reissue cards (and reissue them again), and consumers are forced to sit on their phones (if you’re like me) explaining to their bank that they are putting another new credit card number into Apple Pay, and asking why the $@#! the bank can’t automate this process! The answer in both cases is fraud, which will continue to escalate until this migration to more secure (i.e., mobile) platforms, which can help combat both card cloning and card not present fraud. – AL

  5. Patience is hard: Most of the folks in your organization aren’t security people. Sure you can bust out the platitudes like “security is everyone’s job” and other such puffery, but the reality is these folks have demanding jobs, and security isn’t in their job descriptions. So how long does it take them to become aware? Sometime between forever and forever? The news isn’t that bad, but it will take time and repetition, with some gamification and possibly some public shaming, for everyone to get the picture. And there will always be those ‘special’ folks who won’t ever get it, but you have to tolerate them (and clean up their messes) because they are too important. Maybe show them the article linked above about mobile and porn – I’m sure that has never been an attack vector for these folks. – MR

—Mike Rothman

Tuesday, November 03, 2015

Million Dollar iOS Exploit? Maybe.

By Rich

I wrote an article over at TidBITS today on the news that Zerodium paid $1M for an iOS exploit.

There are a few dynamics working in favor of us normal iOS users. While those that purchase the bug will have incentives to use it before Apple patches it, the odds are they will still restrict themselves to higher-value targets. The more something like this is used, the greater the chance of discovery. That also means there are reasonable odds that Apple can get their hands on the exploit, possibly through a partner company, or even by focusing their own internal security research efforts. And the same warped dynamics that allow a company like Zerodium to exist also pressure it to exercise a little caution. Selling to a criminal organization that profits via widespread crime is far noisier than selling quietly to government agencies out to use it for spying.

In large part this is merely a big publicity stunt. Zerodium is a new company and this is one way to recruit both clients and researchers. There is no bigger target than iOS, and even if they lose money on this particular deal they certainly placed themselves on the map.

To be honest, part of me wonders whether they really found one in the first place. In their favor is the fact that if they claim the exploit, and don’t have it, odds are they will lose all credibility with their target market. On the other hand, they announced the winner right at the expiration of the contest. Or maybe no one sold them the bug, they found it themselves in the first place (this is former Vupen people we are talking about), so they don’t have to pay a winner but can still sell the bug, and attract future exploit developers with the promise of massive payouts. But really, I know nothing and am just having fun speculating.

Oh what a tangled web we weave.

—Rich

Get Your Marshmallows

By Rich

Last week we learned that not only did Symantec mess up managing their root SSL certificates, but they also botched their audit so bad Google may remove them from Chrome and other products. This is just one example in a long history of security companies failing to practice what they preach. From poor code development practices to weak internal controls, the only new thing in this instance is the combination of getting caught, potential consequences, and a lack of wiggle room.

Watch or listen:


—Rich

Friday, October 30, 2015

Summary: Edumacation

By Rich

For those who skip the intro, the biggest security news this week was the passage of CISA, Oracle’s… interesting.. security claims, more discussion on encryption weirdness from the NSA, and security research getting a DMCA exemption. All these stories are linked down below.

Yesterday I hopped in the car, drove over to the kid’s school, and participated in the time-honored tradition of the parent-teacher conference.

I’m still new to this entire “kids in school” thing, with one in first grade and another in kindergarten. Before our kids ever started school I assumed the education system would fail to prepare them for their technological future. That’s an acceptance of demographic realities, not any particular criticism. Look around your non-IT friends and ask how many of them really understand technology and its fundamental underpinnings? Why should teachers be any different?

As large a role as technology plays in every aspect of business and technology, our society still hasn’t crossed the threshold to a majority of the population knowing the fundamentals, beyond surface consumption. That is changing, and will continue to change, but it is a multigenerational shift. And even then I don’t think everyone will (or needs to) understand the full depths of technology like many of us do, but there are entire categories of fundamentals which society will eventually fully integrate – just as we do now with reading, writing, and basic science.

Back to the parent-teacher conference.

During the meeting one teacher handed us a paper with ‘recommended’ iPad apps, because they now assume most students have access to an iPad or iPhone. When she handed it over she said “here’s what our teachers recommend instead of ‘Minecraft’”.

What?!?

This was a full stop moment for me. Minecraft is one of the single best screen-based tools to teach kids logical thinking and creativity. And yet the school system is actively discouraging Minecraft. Which is a particularly mixed message because I think Minecraft is integrated into other STEM activities (they are in a STEM school), but I need to check. The apps on the list aren’t terrible. Some are quite good. The vast majority are reading and math focused, but there are also a few science and social studies/atlas style apps and games, and everything is grade-appropriate. There are even some creativity apps, like video makers.

On the upside, I think providing a list like this is an exceptionally good idea. Not every parent spends all day reading and writing about technology. On the other hand, nearly all the apps are, well, traditional. There’s only one coding app on the list. Most of the apps are consumption focused, rather than creation focused.

I’m not worried about my kids. They have been emerged in technology since before birth, with an emphasis on building and creating (and sure, they also consume a ton). They also have two parents who work(ed) in IT, and a ridiculously geeky dad who builds Halloween decorations with microcontrollers. As for everyone else? Teachers will catch up. Parents will catch up. Probably not for must of my kids’ peers, but certainly by the time they have children themselves. It takes time for such massive change, and it’s already better than what I saw my 20-year-old niece experience when she ran through the same school district.

I still can’t help but think of some major missed opportunities. For example, I was… volunteered… to help teach Junior Achievement in the school. It’s a well-structured program to introduce kids to the underpinnings of a capitalist society. From participating in Hackid, it looks like there is huge potential to develop a similar program for technology. Some schools, especially in places like Silicon Valley, already have active parents bringing real-world experience into classrooms. It sure would be nice to have something like this on a national scale – beyond ‘events’ like the annual Hour of Code week.

And while we’re at it, we should probably have a program so kids can teach their parents online safety. Because I’m pretty sure most of them intuitively understand it better than most parents I meet.

On to the Summary:

Webcasts, Podcasts, Outside Writing, and Conferences

Other Securosis Posts

Favorite Outside Posts

Research Reports and Presentations

Top News and Posts

—Rich

Wednesday, October 28, 2015

The Economics of Cloud Security

By Rich

I have talked a lot about this, but I don’t think I’ve ever posted it here on the blog.

I am consistently amused by people who fear moving to the cloud (and by people who take random potshots at the cloud) because they are worried about a lack of security.

The reality is that cloud providers have a massive financial incentives to be more secure than you. To provide you a rock-solid foundation to build on – and as always, you are free to screw up whatever you want from there. Why? Because if they have a major security failure, it will lose them business, and could become an existential event (an asteroid-vs.-dinosaur type event).

Look at it this way:

  • In your own organization, who bears the cost of a security breach? It is almost never the business unit responsible for the breach, but instead almost always paid for out of some central budget. So other priorities nearly always take precedence over security, forcing security teams to block and tackle as best they can. Even the organization itself (depending a bit on the nature of the business) almost never places IT security above priorities such as responding to competitors, meeting product cycle requirements, etc.
  • At a public cloud provider, security is typically one of the top 3 obstacles for obtaining customers and growing the business. If they can’t prove security, they cannot win customers. If they can’t maintain security, they most certainly can’t keep customers. Providers have a strong and direct financial motivation to place security at the top of their priorities.

I am not naive enough to think this plays out evenly across the cloud market. I see the most direct correlation with IaaS, largely because those providers are fighting primarily for the enterprise market, where security and compliance are deeper requirements. PaaS is the same way at major IaaS vendors (which is incredibly common), and then prioritization drops off based on:

  • Is it a developer-centric tool, or a larger platform?
  • Does it target smaller or larger shops?

SaaS is pretty much the Wild West. Major vendors who push hard for enterprise business are typically stronger, but I see plenty of smaller, underresourced SaaS providers where the economics haven’t caught up yet. For example Dropbox had a string of public failures, but eventually prioritized security in response – and then grew, targeting the business market. Box and Microsoft Azure targeted business from the start, and largely avoided Dropbox’s missteps, because their customers and economics required them to be hardened up front.

Once you understand these economics, they can help you evaluate providers. Are they big and aimed at enterprises? Do they have a laundry list of certifications and audit/assessment results? Or are they selling more of a point tool, less mature, still trying to grab market share, and targeting developers or smaller organizations? You cannot quantify this beyond a list of certifications, but it can most certainly feed your Spidey sense.

—Rich

Monday, October 26, 2015

Hybrid Clouds: An Ugly Reality

By Rich

In my recent paper on cloud network security I came down pretty hard on hybrid networks. I have been saying similar things in many presentations, including my most recent RSA session. Enough that I got a request for clarification. Here is some additional detail I will add to the paper; feedback or criticism is appreciated.

Hybrid deployments often play an essential, yet complex, role in an organization’s transition to cloud computing. On the one hand they allow an organization to extend its existing resources directly into the cloud, with fully compatible network addressing and routing. They allow the cloud to access internal assets directly, and internal assets to access cloud assets, without having to reconfigure everything from scratch.

But that also means hybrid deployments bridge risks across environments. Internal problems can extend to the cloud provider, and compromise of something on the cloud side extends to the data center. It’s a situation ripe for error, especially in organizations which already struggle with network compartmentalization. Also, you are bridging two completely different environments – one software defined, the other still managed with boxes and wires.

That’s why we recommend trying to avoid hybrid deployments, to retain the single greatest security advantage of cloud computing: compartmentalization. Modern cloud deployments typically use multiple cloud provider accounts for a single project. If anything goes wrong you can blow away the entire account, and start over. Control failures in any account are isolated to that account, and attacks at the network and management levels are also isolated. Those are typically impossible to replicate with hybrid.

All that said, nearly every large enterprise we work with still needs some hybrid deployments. There are too many existing internal resources and requirements to drop ship them all to a cloud provider. Applications, assets, and services designed for traditional infrastructure which would all need to be completely re-architected to operate correctly, with acceptable resilience, in the cloud.

Yes, someday hybrid clouds will be rare. And for any new project we highly recommend designing to work in an isolated, dedicated set of cloud accounts. But until we all finish this massive 20-year project of moving nearly everything into the public cloud, hybrid is a practical reality.

Thinking about the associated risks, bridging networks and reducing compartmentalization, focuses your security requirements. You need to understand those connections, and the network security controls across them. They are two different systems using a common vocabulary, with important implementation differences. Management planes for non-network functions won’t integrate (traditional environments don’t have one). Host, application, and data security are specific to the assets involved and where they are hosted; risks extend whenever they are connected, regardless of deployment model. A hybrid cloud doesn’t change SQL injection detection or file integrity monitoring – you implement them as needed in each environment.

The definition of hybrid is connection and extension via networking; understanding those connections, how the security rules are set up on each side, and how to ensure the security of two totally different environments works together, is the focus.

—Rich

Friday, October 23, 2015

How I got a CISSP and ended up nominated for the Board of Directors

By Rich

About two years ago I was up in Toronto having dinner with James Arlen and Dave Lewis (@myrcurial and @gattaca). Since Dave was serving on the (ISC)2 Board of Directors, and James and I were not CISSPs, the conversation inevitably landed on our feelings as to the relative value of the organization and the certifications.

I have been mildly critical of the CISSP for years. Not rampant hatred, but more an opinion that the cert didn’t achieve its stated goals. It had become less an educational tool, and more something to satisfy HR departments. Not that there is anything inherently wrong with looking for certifications. As an EMT, and a former paramedic, I’ve held at least a dozen or more medical, firefighting, and rescue certifications in my career. Some of them legally required for the job.

(No, I don’t think we can or should do the same for security, but that’s fodder for another day).

While I hadn’t taken the CISSP test, I did once, over a decade earlier, take a week class and look at becoming certified. I was at Gartner at the time and the security team only had one CISSP. So I was familiar with the CBK, which quickly disillusioned me. It barely seemed to reflect the skills base that current, operational security professionals needed. It wasn’t all bad, it just wasn’t on target.

Then I looked at the ethics requirements, which asked if you ever “associated with hackers”. Now I know they meant “criminals” but that isn’t what was on paper, and, to me, that is the kind of mistake that reflects a lack of understanding as to the power of words. Or even the meaning of the word, and from an organizations that represents the very profession most directly tied to the hacker community. Out of touch content and a poorly written code of ethics wasn’t something I felt I needed to support, and thanks to where I was in my career I didn’t need it.

To be honest, James and I teamed up a bit on Dave that night. Asking him why he would devote so much time to an organization he, as a hacker, technically couldn’t even be a part of. That’s right about the time he told us to put up or shut up.

You see Dave helped get the code of ethics updated and had that provision removed. And he, and other board members, had launched a major initiative to update the exam and the CBK. He challenged us to take the test, THEN tell him what we thought. (He had us issued tokens, so we didn’t pay for the exam). He saw the (ISC)2 not merely as a certification entity, but as a professional organization with a membership and position to actually advance the state of the profession, with the right leadership (and support of the members).

James and I each later took the exam (nearly a year later in my case). James and I each approached the exam differently – he studied, I went in cold. Then we sent feedback on our experience to Dave to pass on to the organization. We wanted to see if the content was representative of what security pros really need to know to get their jobs done. While I can’t discuss the content, it was better than I expected, but still not where I thought it needed to be. (There was one version back from the current exam).

Over that time additional friends and people I respect joined the Board, and continued to steer the (ISC)2 in interesting directions.

I never planned on actually getting my CISSP. It really isn’t something I needed at this point in my career. But the (ISC)2 and the Cloud Security Alliance had recently teamed up on a new certification that was directly tied to the CCSK we (Securosis) manage for the CSA, and I was gently pressured to become more involved in the relationship and course content. Plus, my friends in the (ISC)2 made a really important, personally impactful point.

As a profession we face the greatest social, political, and operational challenges since our inception. Every day we are in the headlines, called before lawmakers, and fighting bad guys and, at times, our own internal political battles. But our only representation, speaking in our name, is lone individuals and profit-oriented companies. The (ISC)2 is potentially positioned to play a very different role. It’s not for profit, run by directors chosen in open elections. The people I knew who were active in the organization saw the chance, see the chance, for it to continue to evolve into something more than a certification shop.

I submitted my paperwork. Then, the same day I was issued my certification, I found out I was nominated for the Board. Sorta didn’t really expect that.

Accepting wasn’t a simple decision. I already travel a lot, and had to talk it over with my wife and coworkers (both of whom advised me not to do it, due to the time commitment). But something kept nagging at me.

We really do need a voice. An organization with the clout and backing to represent the profession. Now I fundamentally don’t believe any third party can ever represent all the opinions of any constituency. I sure as hell have no right to assume I speak for everyone with ‘security’ in their title, but without some mutual agreement all that will happen is those with essentially no understanding of what we do will make many of the decisions that decide our future.

That’s why I’m running for the Board of the (ISC)2.

Because to play that role, the organization needs to continue to change. It needs to become more inclusive, with a wider range of certification and membership options, which better reflect operational security needs. It should also reach out more to a wider range of the community, particularly researchers, offensive security professionals, and newer, less experienced security pros. It needs to actually offer them something; something more than a piece of paper that will help their resume get through an HR department.

We also need to update the code of ethics and drop the provision to “protect the profession”, since that can easily be seen as defensiveness in a profession that, I feel, should be publicly self-critical. And the code of ethics should account for the inherent conflicts when you discover serious security issues that pit public trust against the desires of your employers or principals. And no, there is no easy answer.

And in terms of certification, I’d like to see more inclusion of hands-on requirements and opportunities. All my paramedic and firefighter training included both didactic and practical requirements.

For those of you who are eligible, I’m not going to ask for your vote. You need to decide for yourself whether everything I just shared represents your views. For those of you wondering why the heck I got a CISSP and decided to run for the Board, now you know. I can blog and speak and write as many papers as I want, but none of those will actually advance the profession in any meaningful way. Maybe joining the (ISC)2 won’t either, but I won’t know until I try.

—Rich

Chewie, We’re Home

By Rich

Every week, we here at Securosis like to highlight the security industry’s most important news in our Friday Summary. Those events that not only made the press, but are likely to significantly impact your professional lives and, potentially, the well-being of the organization you work for.

Ah, who am I kidding, let’s talk Star Wars.

If you didn’t know a new trailer for The Force Awakens was released this week, you can’t be reading this statement, because you are either deceased (like a parrot) or currently imprisoned in an underground bunker by a religious fanatic who is feeding you nutritional supplements so he/she can harvest your organs and live for eternity. I can’t imagine any other legitimate options.

Stick with me for a minute – I really do have a point or two.

Like many of you, Star Wars played an incredibly influential role in my life. The first film hit when I was six, and it helped form the person I would eventually become. I know, cheesy and maybe weird or nerdy, but as children we all grab onto stories and metaphor to develop our own worldview. For some of you it was religion (that is pretty much the purpose of the Bible), or a book series, or a blend of influences. For me, Star Wars always stood far above and beyond anything else outside the direct guidance of my parents.

Martial arts, public service, a love of aviation and space, and a fundamental recognition of the importance of helping and protecting others all trace back, to some degree, to the film series. Perhaps I would have grabbed onto these principles anyway, but at this point that experiment’s control group vaporized decades ago.

I have, perhaps, an overconfidence in the new film. I’ve already bought tickets for opening night and the following day, and could only stop tearing up at the trailer through intense immersion therapy. Unlimited bandwidth FTW.

There was a fascinating article in the New Yorker this week. The author admitted a love for the original trilogy, but claimed now that we are adults, there is no chance for a new entry to create the same wonder as the originals did for thousands (millions?) of children in theaters. That the new films must, of necessity, be for children, as adults are no longer of generating such emotions.

You know, pretty much what you would expect The New Yorker to publish.

The day I no longer believe a story can make me feel wonder is the day I ask Reverend Billy to finally remove my dead heart and implant it in that goat that makes our cheese (in the bunker, keep up people). Maybe the new film won’t hit that lofty goal (although the trailer sure did), but you can’t close your mind to the possibility. Okay, maybe Star Wars isn’t your thing, but if you no longer believe stories even have the potential to engender childlike joy, that’s a loss of hope with profound personal implications.

I’m also fascinated to see how Star Wars changes for my children. Already the expanded universe is creating a different relationship with the canon. Growing up I only had Artoo and Threepio, but they now have Chopper (from Rebels, a really great show) and BB-8. My two year old is already obsessed with BB-8 and insists my Sphero toy sit next to him when he watches TV. When the battery runs out he likes to tell me “BB-8 sad”.

They will never experience things the way I did. Maybe they’ll love it, maybe they won’t, that’s up for them to decide (after my meddling influence). But there is one aspect of the new films that, as a parent, endlessly excites me.

The prequels weren’t merely bad films, they did nearly nothing to advance the story. They gave us the visuals of the history of Vader, and a few poorly retconned story beats, but they didn’t tell us anything material we didn’t already know. There was no anticipation between the films, not like when Empire came out and my friends and I spent 3 years debating if Darth was Luke’s father, or if it was merely another Sith lie.

In two months we get to see an entirely new Star Wars that continues the story that started nearly 40 years ago. And, though I’m really just guessing here, I’m pretty sure Episode VII is going to end in a cliffhanger that won’t be resolved for another two to three years, if not the full six years to finish this next trilogy.

My children will get a new story that will play out over a third of their childhood. Not some movies based on some existing books, however well written and popular. Not a television series they see every week or can marathon on Netflix. Three films. Six years. So popular (just a guess) that they extend Star Wars’ already deep influence in our global consciousness. The ending unknown until my entire family, the youngest now eight or nine (not two), the oldest bordering on a teenager, sits together in the theater as the lights dim, the curtain peels back, and the familiar fanfare blasts from the speakers.

No, maybe I won’t ever feel the same as that day in 1977 when I sat next to my father and that first Star Destroyer loomed above our heads. I’m older, capable of far more emotional depth, with an ever greater need to escape the responsibilities of adulthood and the painful irrationality of the real world. Knowing that my children sitting next to me are building their own memories, and are experiencing their own wonder.

It’s going to be so much better.

On to the Summary:

Webcasts, Podcasts, Outside Writing, and Conferences

Securosis Posts

Favorite Outside Posts

Research Reports and Presentations

Top News and Posts

—Rich

Wednesday, October 21, 2015

Incite 10/21/2015: Appreciating the Classics

By Mike Rothman

It has been a while since I’ve mentioned my gang of kids. XX1, XX2 and the Boy are alive and well, despite the best efforts of their Dad. All of them started new schools this year, with XX1 starting high school (holy crap!) and the twins starting middle school. So there has been a lot of adjustment. They are growing up and it’s great to see. It’s also fun because I can start to pollute them with the stuff that I find entertaining.

Like classic comedies. I’ve always been a big fan of Monty Python, but that wasn’t really something I could show an 8-year-old. Not without getting a visit from Social Services. I knew they were ready when I pulled up a YouTube of the classic Mr. Creosote sketch from The Meaning of Life, and they were howling. Even better was when we went to the FroYo (which evidently is the abbreviation for frozen yogurt) place and they reminded me it was only a wafer-thin mint.

horse teeth

I decided to press my luck, so one Saturday night we watched Monty Python and the Holy Grail. They liked it, especially the skit with the Black Knight (It’s merely a flesh wound!). And the ending really threw them for a loop. Which made me laugh. A lot. Inspired by that, I bought the Mel Brooks box set, and the kids and I watched History of the World, Part 1, and laughed. A lot. Starting with the gorilla scene, we were howling through the entire movie. Now at random times I’ll be told that “it’s good to be the king!” – and it is.

My other parenting win was when XX1 had to do a project at school to come up with a family shield. She was surprised that the Rothman clan didn’t already have one. I guess I missed that project in high school. She decided that our family animal would be the Honey Badger. Mostly because the honey badger doesn’t give a _s**t_. Yes, I do love that girl. Even better, she sent me a Dubsmash, which is evidently a thing, of her talking over the famous Honey Badger clip on YouTube. I was cracking up.

I have been doing that a lot lately. Laughing, that is. And it’s great. Sometimes I get a little too intense (yes, really!) and it’s nice to have some foils in the house now, who can help me see the humor in things. Even better, they understand my sarcasm and routinely give it right back to me. So I am training the next generation to function in the world, by not taking themselves so seriously, and that may be the biggest win of all.

–Mike

Photo credit: “Horse Laugh” originally uploaded by Bill Gracey


Thanks to everyone who contributed to my Team in Training run to battle blood cancers. We’ve raised almost $6,000 so far, which is incredible. I am overwhelmed with gratitude. You can read my story in a recent Incite, and then hopefully contribute (tax-deductible) whatever you can afford. Thank you.

The fine folks at the RSA Conference posted the talk Jennifer Minella and I did on mindfulness at the 2014 conference. You can check it out on YouTube. Take an hour. Your emails, alerts, and Twitter timeline will be there when you get back.


Securosis Firestarter

Have you checked out our new video podcast? Rich, Adrian, and Mike get into a Google Hangout and… hang out. We talk a bit about security as well. We try to keep these to 15 minutes or less, and usually fail.


Heavy Research

We are back at work on a variety of blog series, so here is a list of the research currently underway. Remember you can get our Heavy Feed via RSS, with our content in all its unabridged glory. And you can get all our research papers too.

Building Security into DevOps

Building a Threat Intelligence Program

Network Security Gateway Evolution

Recently Published Papers


Incite 4 U

  1. The cloud poster child: As discussed in this week’s FireStarter, the cloud is happening faster than we expected. And that means security folks need to think about things differently. As if you needed more confirmation, check out this VentureBeat profile of Netflix and their movement towards shutting down their data centers to go all Amazon Web Services. The author of the article calls this the future of enterprise tech and we agree. Does that mean existing compute, networking, and storage vendors go away? Not overnight, but in 10-15 years infrastructure will look radically different. Radically. But in the meantime, things are happening fast, and folks like Netflix are leading the way. – MR

  2. Future – in the past tense: TechCrunch recently posted The Future of Coding Is Here, outlining how the arrival of APIs (Application Programming Interfaces) has ushered in a new era of application development. The fact is that RESTful APIs have pretty much been the lingua franca of software development since 2013, with thousands of APIs available for common services. By the end of 2013 every major API gateway vendor had been acquired by a big IT company. That was because APIs are an enabling technology, speeding integration and deployment, and making it easy to leverage everything from mobile to the Internet of Things. And don’t even bother trying to use cloud services without leveraging vendor APIs. But the OWASP Top Ten will not change any time soon, as traditional web-facing apps and browsers still provide too many attractive targets for attackers to forsake them. – AL

  3. Cheaters gonna cheat: Crowdstrike published some interesting research recently, discussing how they detected the Chinese hacking US commercial entities, even after the landmark September 25 agreement not to. Now, of course, there could have been a lag between when the agreement was signed and when new marching orders made it to the front lines. Especially when you send the message by Pony Express. Turns out there are things like email, phones, and maybe even these newfangled things called “web sites” to make sure everyone knows about changes in policy. But did you really expect a political agreement to change anything? Me neither. So just like cheaters are gonna cheat, nations states are gonna hack. – MR

  4. Stealing from spies: Hackers have figured out how to uncloak advertising links embedded in iFrames by exploiting the relationship between two frames. For those of us who think iFrames are an attack vector themselves, it’s no surprise that this dodgy means of tracking users and supporting ad networks was cracked by bad (worse?) guys. The good news is that it does not expose any additional user information, but it does allow attackers to manipulate ad clicks. Most tricks, hacks, and sneaky methods of scraping data or force user browsers to take action were pioneered by some marketing firm to game the system. The problem is that dodgy habits are endemic to how many very large companies make money, so we get hacked solutions to compensate for the hacks these firms leverage to satisfy their own profit motive. Until the economics change, hackers will have plenty of ‘features’ from ad, social, and analytics networks to exploit and profit. – AL

  5. A cyberinsurance buffet: Warren Buffett has done pretty well by sticking to things he can understand. OK, maybe that’s the understatement of the millennium. His Specialty Insurance business getting into underwriting cyber policies seems to run counter to that philosophy. He wouldn’t even invest in tech companies, but now he’s willing to value something that you pretty much can’t value (cyber-exposure). Of course it’s not Warren himself writing the policies. But all the same, and maybe it’s just me, but it is not clear how to write these policies – even the best defenses can be breached at any time by sophisticated attackers. I’m happy to hear explanations, because I still don’t get this. – MR

—Mike Rothman

Tuesday, October 20, 2015

re:Invent Yourself (or else)

By Rich

A bit over a week ago we were all out at Amazon’s big cloud conference, which is now up to 19,000 attendees. Once again it got us thinking as to how quickly the world is changing, and the impact it will have on our profession. Now that big companies are rapidly adopting public cloud (and they are), that change is going to hit even faster than ever before. In this episode the Securosis team lays out some of what that means, and how now is the time to get on board.

Watch or listen:


—Rich