Research

On January 25th I’ll be giving a ZDNet webcast (sponsored by Oracle, but objective content, as always!) on database security resolutions for 2008. I’m taking a bit of a different approach on this one; the presentation is targeted at both database administrators and security professionals. Yes folks, I’ll be bridging the great divide. (I used to be a DBA, so I know a little of what I’m talking about). For each of the resolutions we’ll discuss the implications for both sides- what does the DBA need to do? How about the security admin? Here are the Top 5 Resolutions with a little descriptive text. Let me know what you think, and if you have a better suggestion and I use it I’ll make sure you get full credit in the webcast… Identify, and classify, databases with sensitive information: one of the biggest database security issues we face is just figuring out where the heck our databases with sensitive content are in the first place. If you think you know, you’re probably wrong. I can’t tell you how many calls I’ve been on with clients where the application, database, and security admins in the room each think they have a good idea and are proven wrong within 30 minutes. We’ll discuss how to locate these systems and prioritize them for later remediation. We’ll also discuss tools that can help with the process (generically- I’m not pushing any products). We’ll also discuss how security and database teams can work together on the process, and where their mutual interests overlap (killing rogue DBs). Implement database configuration and vulnerability management for your highest-priority systems: no, not all at once. And while tools help, you can also do much of it manually. We’ll talk about the roles of configuration and vulnerability management, who is responsible for what, and how teams can work together. Yes, it’s basic, but not something that everyone has down, and like making that annual resolution to lose 5 pounds, it’s worth revisiting every now and then. Enforce separation of duties between DBAs and security: now we’re getting into the more interesting stuff. As much as we trust DBAs and security, when sensitive information is concerned (especially regulated information) we have to… enforce that trust. We’ll talk about the different ways to to this, and how to implement it without interfering with anyone’s ability to get their jobs done. While DBAs might not be happy with this change in trust, security pros have a large burden- to start learning how to protect databases they won’t manage (SoD works both ways). Start Database Activity Monitoring (or at least better auditing): no surprises to those of you who read this site. I’m a huge fan of DAM. We’ll talk about using it for separation of duties, for security, and even for regular old database tuning. Control ad-hoc access: I hear from a LOT of clients that ad-hoc query access by users is out of control, often on data users shouldn’t get near outside a business application. Here we’ll talk about how DBAs and security managers can team up to end this bad habit, without pissing off the entire business. For once, compliance will be your friend. Bonus Resolution: Start paying attention to web applications and connection pooling: I’ll save this one for the webcast. Over time I’ll cover most of these issues in blog posts as well. Let me know what you think. Are your database security resolutions any different? Am I just full of my usual $#%^? I’ll post the webcast details when I get them; the registration page should be up later this week. And don’t forget to pass it on to your DBA friends… < p style=”text-align:right;font-size:10px;”>Technorati Tags: Oracle, Database Security, Database Activity Monitoring, Compliance, Separation of Duties Share:

This one comes to us thanks to Rob: http://www.wired.com/politics/security/news/2008/01/dreamliner_security And I quote: Boeing’s new 787 Dreamliner passenger jet may have a serious security vulnerability in its onboard computer networks that could allow passengers to access the plane’s control systems, according to the U.S. Federal Aviation Administration. The computer network in the Dreamliner’s passenger compartment, designed to give passengers in-flight internet access, is connected to the plane’s control, navigation and communication systems, an FAA report reveals. … Gunter wouldn’t go into detail about how Boeing is tackling the issue but says it is employing a combination of solutions that involves some physical separation of the networks, known as “air gaps,” and software firewalls. Gunter also mentioned other technical solutions, which she said are proprietary and didn’t want to discuss in public. I can’t imagine anything so insanely stupid as to allow any physical connection between the control system and the passenger side of the network. Haven’t we learned anything over the past 30 years? We can never fully predict how a system like that will behave. I’m not even talking terrorist scenarios; all it takes is one accidental denial of service glitch to, well, you know. I think I’m going to go play some video games or something now. Share:

Have a security question? Want a straight answer? Even if you’re not a geek? I get a random assortment of security questions on a fairly regular basis and it seems like a good time to open the blog up a little more to covering what you’re interested in, not just what I feel like rambling about. I’m thus starting a new series of posts- “Ask Securosis”. Once a week I’ll put up a post soliciting questions. You can either email me your question, or put a response in the comments. I’ll pick one a week to answer and try and pop it up on Fridays. If I can’t answer the question, I’ll find someone who can. Questions can be anything security related- from the simple (what should I use at home?) to the complex (what’s your recommended architecture for xxx). You can stay anonymous in the comments, and if you email me I won’t reveal your identity unless you want me to. And now for our first answer… Share:

Our first question comes from Tom, who is security minded but not a full-on security geek: “In my Dlink 4300 there is functionality to log fire wall rules to a outside logging server (I’ve seen this functionality in my old WRT54G’s as well). At the same time Linux has logging functionality that you can setup to receive outside log messages. How do I get my dlink/linksys/brand X router to talk to my Linux at server and log all of the messages? Looking at firewall logs is a great way to get your feet wet with security. For the home user I’m not convinced it adds a lot of security, but it will be extremely educational. It won’t take long before you drop Wireshark onto your network and really start digging into traffic. The D-Link outputs logs using syslog to any compatible syslog server. The exact configuration will vary depending on your internal network structure and which version of Linux you are using, but here’s a general overview to get it running. A number of home routers/wireless access points support this functionality. Set up your Linux server Start syslogd, and make sure it’s configured to run on startup (“chkconfig –list syslog”?). You will probably need to adjust your syslogd configuration file before it will work properly- this varies based on which version you’re running, but a quick Google search should give you what you need; likely you need to add “-r” somewhere (/etc/sysconfig/syslog on Red Hat based systems). Wikipedia is a good place to start. If you have a firewall on your Linux box, make sure UDP port 514 is open to your home network (/etc/sysconfig/iptables on Red Hat based systems). On your D-Link router, go into DHCP settings and assign a permanent address to your Linux server. Otherwise, its IP address will probably change when it reboots. You’ll probably need the MAC address of your Linux server, which you can get by running ifconfig from a shell. Some D-Links make this really easy and you can lift the address right from the screen where you assign permanent addresses. If it’s not feasible, you might just want to configure your Linux server with a static address – if you do, make sure it’s not in the DHCP scope assigned by your router. Now, on your router go start logging, and enter the IP address of your Linux box. Give it a little while, then see if you have any log entries (depending on how your configured things in syslog.conf). And that should be it! I know this isn’t totally detailed, but it really can vary a lot depending on what you’re running, and I don’t have everything on my end to test it. The most common mistakes are leaving the syslog server on a dynamic IP address, filtering the traffic, and bad syslog configurations. Pepper adds: You can do all this with a Mac too – I send Linksys WRT54G & AirPort Extreme logs to mine. Share:

Credit monitoring services, especially those from the credit agencies themselves, leave a bad taste in my mouth. I find it unconscionable that I need to pay to gain access to personal information on me that affects my life at the deepest levels. In our modern society, a good credit rating is as important for our future safety and stability (and sex, to be honest) as a sharp spear and 20/10 vision were to early man. It sucks, but money makes the world go round and we can’t feed Maslow without it (nor can most of us afford homes without good credit). I started using credit monitoring services long before identity theft was a big issue. Back then, reports were never free and credit scores weren’t in as wide use. I wasn’t paranoid or prescient, I’d just managed to screw my credit up so badly in college that I wanted to know exactly what I needed to clean up. It would probably still be screwed up if it weren’t for online banking; I’m really bad about using the mail. When free reports were mandated by the government I kept with the monitoring service for two reasons- to gain access to my credit score, and for identity theft monitoring. And monitoring is not protection- I may be able to detect new activity on my credit report within 1-3 days, but by that time the damage might be done. Along comes Debix. The government has mandated that credit services allow consumers to place “locks” on their reports. No, this won’t stop the bank from reporting you as late, but it does mean they can’t open a new account tied to your record without explicit permission. Being a bunch of wimps beholden to big money, the government only mandated they lock (place a “fraud alert” on) your record for 90 days. For the same price (or less) as credit monitoring, Debix will place a lock on your record and renew it automatically every 90 days. They link the lock to their call center, and when a creditor calls to verify that you really want to open the account the call center routes it to up to three numbers you provide. This has the added advantage of keeping your phone number off your record. (Full disclosure: I was given a free preview, so I didn’t pay for the service. But it’s cheaper than the credit monitoring service I’m dropping). Pretty cool- kind of like anti-exploitation for identity theft. They also insure you and provide a few other features. They are a direct competitor of LifeLock, but LifeLock’s been in the news a bunch here in Phoenix for some… irregularities… that make me uncomfortable with the company. I do like seeing inquiries on my credit report, but I can get that for free on a quarterly basis rather than needing it instantly. Debix is $4/month cheaper than my monitoring was, and blocks unwanted activity. I like that. Share:

I just posted on switching to Debix, and it reminded me there’s something I keep forgetting to cover. When reading the news, both mainstream and industry, I’m appalled at the abuse of the term “identity theft”. And don’t get me started on vendor marketing materials. Identity theft is a serious crime with potentially severe repercussions for the victim. It’s when a bad guy uses your personal information, often including Social Security Number, to use your identity for nefarious purposes. It’s most often financial, taking out new credit (which never gets paid), but can include fake ID cards (and thus driving/criminal records), passports, and more. Yes folks, there are bad guys with stolen IDs who get caught by the cops, use the fake ID, get bail, and run for it- leaving you with a nice bench warrant out in your name (really rare, but it happens). A former co-worker once applied for a new mortgage and the bank asked him about the one in default. Oops. That’s identity theft. (BTW- this is a problem far more endemic in the US than most other nations. They don’t rely on a single, not-secret-secret-number (SSN) to manage credit, making ID theft more difficult). Credit card fraud is serious, but not nearly as serious. That’s when someone steals your credit card number and uses it to make fraudulent purchases. Nearly every credit card in the world (but not debit cards- for those you need to check with your bank) includes fraud protection. You, the consumer, are not liable for the fraud if you identify and report the erroneous charges. You don’t bear the costs of getting a new card if you need one. Merchants and banks (but not the credit card companies, of course) bear the costs of credit card fraud, not you. That’s why I don’t care that my wife shops at TJX- we know to monitor our bills and if something happens we won’t be liable. Both are crimes, but in protecting yourself it’s important to understand the difference. As a business I worry quite a bit about credit card fraud since I could bear the cost (if I accepted credit cards). As a consumer I worry more about ID theft. Share:

Sears isn’t having much luck these days. First, they install spyware on their customers’ computers. If you “join the Sears community”, they install a proxy on your computer and intercept all web traffic. Ugly, ugly, idiocy. Now, it turns out they have a major logic flaw on their website. As reported by Brian Krebs at Security Fix, anyone can see anyone else’s purchase history with just their name, address, and phone number. Have those white pages handy? It seems to cover both online and offline purchases. If you’re not paying attention to logic flaws in your databases and applications, this is a great example. While it’s good to make life easy for your customers, it’s bad when you make it easy for your next door neighbor to figure out if you really bought those new hedging shears that coincidentally look just like the ones they lost out of their shed last month. This exploit was easily preventable with just a modicum of thought and the most cursory security review. Sears is too big a company to make this kind of mistake. And the spyware? Sheer stupidity by someone in marketing is my guess. Maybe they and whoever screwed up at Sony BMG went to the same marketing school. Share:

Wow. It’s 2008. How did that happen?!? When I was younger I couldn’t wait for the future. What geek can? We all grew up on entirely too much science fiction; far more of which is now reality than I expected (other than the space program; hello? NASA? Anyone home?). Now that I get older I realize that while the future is great in concept, the reality is eventually I won’t be around for it anymore. Every year is a smaller fraction of life, and thus every year passes relatively more quickly. Aw hell, I’m far too young to be thinking about garbage like this. As 2007 closed many of us pundit types devoted our time to looking at current trends and predicting the next few years. If you’ve been following me and Hoff at all, you also know some of us are always thinking about how we can do security differently. Not that we’re doing it “wrong” today, but if you don’t look for what’s next you’ll always be playing from behind. One big trend I’ve been seeing is the shift towards anti-exploitation technologies. For those who don’t know, anti-exploitation is where you build in defenses to operating systems and platforms so that when there is a vulnerability (and there will be a vulnerability), it is difficult or impossible to exploit. Java was my first introduction to the concept at the application level (sandboxing), and Vista at the operating system level. There’s no single anti-exploitation technology, but a bunch of techniques and features that work together to make exploitation more difficult. Things like ASLR (library/memory randomization), sandboxing, and data execution protection. Most of the anti-exploitation focus today is on operating systems, but conceptually it can be applied anywhere. One of my big concepts in Application and Database Monitoring and Protection (ADMP) is building anti-exploitation into business and (especially) web applications. I’ve even converted from credit monitoring to credit protection (via Debix) for anti-exploitation against identity theft. There was a lot of focus in 2007 on vulnerability scanning and secure coding. While important, those can never solve the problems. The bad guys will always find some vulnerabilities before we do. Our programmers will always make exploitable mistakes- no matter how much we hammer them with training and the code with tools. When designing security controls we must assume vulnerabilities will exist and we won’t always identify and mitigate them before they are discovered by attackers. Not that anti-exploitation is some mystical perfect remedy; it too will fail, but the goal is for it to fail slowly enough that we are able to discover, detect, and mitigate vulnerabilities before they are exploited. You’ll be hearing a lot more about anti-exploitation at all levels of the industry over the next few years, especially as we start seeing it outside of operating systems. It’s the one thing that gets me jazzed that we might be able to get a leg up on the attackers. Share:

I was debating about writing anything personal about 2008, but after reading Mike’s Security Incite today I figure a little personalization on the site won’t hurt. If you’re not interested in what I’m up to professionally and personally, this is a good post to skip. 2007 was a very intense year. I built a new house, moved, quit my job, traveled all over the freaking place, and tried my best to cling to a personal life. At times I was elated, completely burned out, inspired, bored, physically fit, and old fat and lazy. It was a heck of a year, and all in all I enjoyed it thoroughly. I’m not one for resolutions, but I’m really looking forward to 2008 and have some specific goals. Business-wise, Securosis is going better than I ever expected. I wasn’t one of those analysts that believed my own hype and assumed the world was just begging for my attention. Leaving a good job with a steady paycheck for nebulous reasons is always a little daunting, but after 4 full months on my own things are cruising along and at times I can barely keep up. I need to thank all of you for the support- from readers and commenters to paying customers. I’m well diversified in my client base (vendors, end users, and investment types), and the kinds of projects I’m engaged in. And I’m having a blast. There’s a lot on tap for 2008. I’ll be pumping out more free whitepapers through SANS- mostly focused on data and application security, with a few I hope to co-author on other topics. I have a bunch of speaking engagements lined up, and will promote those more heavily as they get closer (including RSA). If all goes well, I might even be able to self publish a book on data security before the end of the year. I’ll also continue to write over at Dark Reading, TidBITS, and other publications as opportunities come up. I’m already ecstatic about the consulting projects that are coming up- it’s been a long time since I did project-based work and I really enjoy digging in deeper on things (everything from product assessments to data security strategies). My main goal is to accomplish all of this while maintaining a good work/life balance. I’ve let that slip in the past, especially when I was an analyst. As far as I know we only have one shot on this planet and I don’t intend to spend it stressed out and working all the time. And, to be honest, the quality of work suffers if you aren’t happy. Personally the year is going to start a little rough- I have to get shoulder surgery to repair a SLAP tear. I’m a very physically active guy and it’s been torture to restrict my activities since I hurt it at the end out August. I even quit my martial arts training- can’t throw a punch. I’ll be on restricted duty for 3-6 months, and probably won’t be 100% for a year. On the upside, it gives me an excuse to return to base training, rebuild from the past years of abuse on airplanes, and enjoy some of my other hobbies. I have some woodworking projects in mind, want to finish wiring the house, and finally finish unpacking from the move. Maybe it’s selfish, but in 2008 I plan on having fun, helping others, making a living, and enjoying life. When you get down to it, what else is there? Share:

If you read this blog, odds are today and tomorrow you’ll be responsible for “fixing” the computers of your extended family. It’s also a great excuse to get you some much-needed web browsing time if the family conversations get boring. Here’s my (very short) checklist: Make sure they’re behind some sort of NAT firewall/home router. Anything that keeps them from being directly connected to the Internet. Do a quick check to make sure it isn’t forwarding any ports to internal addresses. A cheap $50 router/wireless access point alone will stop most worm/network attacks. If they don’t have one, you now have a convenient excuse to visit Fry’s Electronics or your local Circuit Buy. Back up their photos onto an external hard drive or CD/DVD. For many people, nothing else really matters. This should get you out of any idle chit-chat, and no one needs to know you’re reading Slashdot and drinking a beer in the back room. You can milk this one for as long as needed, and it comes across as being more helpful than just watching sports. Check to see if Windows is updated. If it isn’t, assume they are infected. If they don’t have SP2, buy them a new computer. Run a quick scan for any obvious spyware/malware. I ask if the computer’s been running slow lately; that’s a good indicator. Otherwise just download one of the free tools and give it a run. If their AV suite is out of date, and they use the computer for more than the most simple of tasks, assume it’s infected. At this point I will usually load up a free suite of tools (AVG Free, whatever anti-spyware is handy, and activate the Windows firewall). This is your time to work on blog entries and maybe Twitter a bit, although if the computer is infected you won’t want to log into any of your accounts. If you need more alone time, stare at the screen and curse occasionally as people walk past. They’ll leave you alone. If you’re pretty sure it’s infected you have a choice. If the computer is old, tell them to buy a new one (preferably a Mac). If it’s current but blasted, tell them to back up important files and nuke it from orbit. If it’s your parents, back up and nuke it yourself. Send someone to buy you better beer (Stone Arrogant Bastard should do) so you can “concentrate” better. Tell your father/uncle/father-in-law/whoever to stop going to “those” sites. When they deny it, show them their cookie files. When they still deny it, close the door to the room and open up the web cache. If they still deny it, blame your 4 year-old nephew and suggest a good child psychologist. If they don’t cave at this point, tell them Crazy Uncle Bobby touched you as a kid; maybe it’s his fault. Turn on their antispam, preferably at the ISP level. This will stop a lot of email viruses. No matter what, tell them you found terrorist child pornography from gambling sites on their system, and inform them to never click on anything in email. This should keep them out of trouble. If you just backup the files, do a quick check, and figure out if you need to nuke it or keep it, that’s enough and only takes a few minutes. Feel free to extend as long as needed based on your particular family dynamics. If your family has Macs, you might need to fake it. They’ll probably catch you. Me? My immediate family has Macs and my wife’s side is local and I fix things as they happen. The good beer is in the fridge and I intend to fully enjoy a couple days of watching sports and making Lego robots with my nieces and nephew. Happy Holidays- see ya in a few days. Share: