Research

I was talking with someone recently who rolled out whole-disk encryption to meet a compliance need. Someone told them they needed to encrypt, so they encrypted. They do, of course, automatically log in users so they don’t have to enter their passwords. I asked, “Isn’t password authentication, never mind strong authentication, also a compliance requirement?” “Oh yeah, it is. They all get passwords, they just don’t have to type them in themselves. Someone went down the list for compliance and checked all the boxes, but if you open a PC and turn it on it boots right up and you don’t have to log in. There wasn’t a checkbox for that.” Classic. Simply classic. Share:

Yesterday I published a quick TidBITS article on the QuickTime RTSP vulnerability. It’s a true 0day, with exploit code in the wild and no patch available. At the time, the proof of concept code was only for Windows, but over at Milw0rm it’s been updated to include Macs. The original CERT advisory is here. Windows users can follow the CERT advice to disable QT, but us Macheads don’t have it so easy. My recommendation right now is to watch where you browse, and use Little Snitch or another outbound firewall with application awareness (just blocking port 554 and the UDP ports isn’t enough). I suspect we’ll have a patch soon. This is a great example of why Apple should finish off the new security features of Leopard. I suspect that the combination of QuickTime sandboxing, full ASLR (Library Randomization), and adding outbound blocking to the Application Firewall could stop this exploit before it starts. Anti-exploitation is the future. We’ll always have vulnerabilities, but we can sure make them harder to exploit. Share:

Iron Mountain has lost their fair share of backup tapes over the years. Enough to end up in the headlines more than once, but it hasn’t seemed to affect their business. Heck, they even issued a press release calling for their clients (and everyone else) to encrypt their tapes. According to this article (picked up via SANS NewsBites), after another tape loss leading to a public disclosure the State of Louisiana is switching to an alternate provider and may sue Iron Mountain. Look, we all know mistakes happen and tapes will fall off the backs of trucks. Even in New Jersey. But in cases like this one there is clearly shared responsibility. I’ve heard Iron Mountain isn’t always as diligent about handling tapes as they should be. When you have hundreds, maybe thousands, of trucks roaming the country not every driver will stick to the standard. On the other hand, if you’re playing with Social Security or credit card numbers, and you aren’t encrypting, you’d better make darn sure you have some other risk mitigation in place. Did the Louisiana Student Financial Assistance Commission evaluate and audit Iron Mountain’s procedures? Did they consider the risk of a lost tape? Did they have Service Level Agreements guaranteeing no lost tapes? Iron Mountain clearly has some responsibility, but I suspect there’s nothing in the contract to allow their customers remediation. On the other hand, their customers need to recognize that despite the marketing, Iron Mountain will lose a certain percentage of their tapes. My recommendation is if you’re handling data that, if lost, will land you in the headlines, you need to encrypt it or keep it off the tapes. I get asked a lot about all those tapes in archives, and I think diligent asset management is more realistic than trying to encrypt everything already locked away. If you can’t afford encryption or to change your practices, understand you are implicitly accepting a level of risk. Even if you find someone willing to guarantee you they’ll never lose a tape, when they do it will be your company’s name in the headline and theirs in the second paragraph. Share:

I’ve been a little slow on blogging due to a couple of killer deadlines, but things should be getting back to normal here over the next few days. Much to my surprise, this independent consulting thing is actually working out! This week on the NetSec Podcast, Martin and I asked my old co-worker, Amrit Williams, to join us. Amrit is the CTO of BigFix and blogs over at TechBuddha. It was more an informal discussion on a Saturday morning among a bunch of security geeks than a formal interview, and we took a bit of a holiday flavor with it. As always, full show notes and comments are over at NetSecPodcast.com. Show Notes: The Best Gift for Non-Geeks that isn’t on their list MPAA University ‘Toolkit’ raises privacy concerns – You better believe it does! UK Government in uproar following data loss Network Security Podcast, Episode 85 Time: 46:59 Share:

Author’s Note: This was originally posted last year, but nothing ever changes: Backup Backup Backup Did I say backup yet? Backing up home computers used to be little more than a convenience to keep you from losing some old college papers. These days our entire family histories find life on our unreliable home computers. From digital photos of junior, to financial records in Quicken, to love letters in email, our computers store items in ephemeral 0s and 1s that used to be on paper in a box. Sure, paper isn’t perfect, but I suspect more of us have experienced hard drive crashes than house fires. Backup is really a pain, so I suggest prioritizing your efforts to focus on the most important stuff and to make it easy and seamless for your non-geek friends and family. In many cases your best bet is to get an external hard drive and some basic backup software (I use SuperDuper on my Mac, not sure what’s good these days on PCs, so recommendations in the comments appreciated). A bunch of the external drives now include basic software for free, and you can plug in the drive, install the software, and just check up on it every now and then. For digital photos I’ve started recommending the archive features of Photoshop Elements, Microsoft Digital Image Suite, and the like. The advantage here is they get a photo tool they can use for other purposes, while getting basic photo backup features. I just grabbed Photoshop Elements for my Father-in-Law and a bunch of blank CDs. My plan is, every few months, to burn an archive of his photos on CD and store them over at my place (we live 20 minutes away). No- backup isn’t fun or sexy, but today it’s very very necessary. I hear all too many stories of people losing valuable family photos due to a basic hard drive crash, virus, or whatever. Imagine losing ALL your baby pics, wedding pics, or Grandpa’s 80th birthday pics where he flashed back and called Grandma by the name of his long-forgotten French mistress from WWII inciting immediate, if lethargic, violence. Ah, Family. Good times. You really don’t want to let your family lose their memories, do you? It’s also a good idea to print really valuable photos. The rumors of paper’s demise are greatly exaggerated. No Related Posts Share: Posted Mon, November 26, 2007 8:09am • (7) Comments • Permalink Comments Sat, January 05, 2008 2:13am[…] The Best Gift for Non-Geeks that isn’t on their list […] By Network Security Blog » Network Security Pod Sat, December 01, 2007 12:17pmCobian is fab for PC backups.  Easy to configure and schedule backups.  Can setup pre- and post-backup activities (e.g. shutdown and restart Outlook).  Usual range of backup types.  FREE! DVDs and CDs are good for occasional offline backups but are slow.  USB sticks and drives are faster but less resilient.  Use both types to reduce the risk of loss/failure. Make sure to test-restore your backups to a different disk drive (do NOT overwrite the original in case the backup/restore fails!) and make sure the expected data are all there.  This is especially important when you setup or change configurations. Store backup media securely, not with the machine being backed up or a fire or theft may destroy both.  Small fire safes designed to protect computer media are probably worth the money, even for the ordinary home PC user with valuable photos, emails and other files. G. By NoticeBored Tue, November 27, 2007 11:29pm[…] The Best Gift for Non-Geeks that isn’t on their list […] By Latest Network Security Podcast Up | securosis.com Tue, November 27, 2007 9:56am[…] The Best Gift for Non-Geeks that isn’t on their list […] By netsecpodcast.com » Blog Archive » Net Mon, November 26, 2007 10:28pmI had a hard drive die in my laptop earlier this year and ended up only losing a month or so of photos. But it still killed me. I’‘ve now got SuperDuper set to save me but I need another external drive to backup the backup! I also went through and burned a whole bunch of photos to DVD to put in my longterm archive. With enough space on a spare drive, Carbon Copy Cloner is a nice fast way to quickly restore an expired hard drive. By Erik Mon, November 26, 2007 7:54pmMozy is a simple online backup service for Macs and PCs.  (www.mozy.com)  If you’‘ve got a ton of data the first backup could take a while, but it’s incremental from there and totally automatic. If you’‘ve got more than one computer, you might give network attached storage (NAS) a hard look.  There’s cheaper options out there from the usual suspects in storage, but hands down the coolest and easiest I’‘ve seen is the NAS box from Drobo (www.drobo.com).  At $500 it’s certainly not cheap, but it sure makes NAS a no-brainer.  And the ability to pop bigger drives into the chassis as storage prices plummet while the Drobo takes care of everything is pretty sweet. By Ted J Mon, November 26, 2007 7:52pmI am a huge fan of Acronis for PCs. Scheduled backups, the ability to mount the backup as a drive on your PC to grab a previous version of a file. The ability to make SuperDuper-like complete bare-metal restores. It’s a great program. By rbp If you like to leave comments, and aren’t a spammer, register for the site and email us at info@securosis.com and we’ll turn off moderation for your account. Share:

Uh Oh. According to this article in CRN, encryption vendor Neoscale is insolvent and no longer selling maintenance contracts. NeoScale has stopped selling maintenance contracts for its data encryption appliance, effectively killing the line, while exploring “strategic alternatives” in the wake of the bankruptcy of storage VAR MTI, one of its largest solution providers. That “strategic alternative” could be an acquisition of all or part of the company by storage and security giant EMC (NYSE:EMC), or even Hewlett-Packard (NYSE:HPQ), according to former employees. While the encryption market isn’t nearly as big as most of the world wants you to believe, there should be plenty of business to support a company like Neoscale. My only conclusion is that there were serious execution errors, especially an apparently misplaced reliance on a single channel partner. I’ve heard nothing but good things about the Neoscale product line, but upcoming challenges would have forced them to sell to a larger platform vendor within 2 years. Most users I’ve talked with want their tape encryption integrated into their backup infrastructure (preferably at the drive level). The tape vendors have been quite vocal about their future plans, even if current implementations are extremely limited and harder to implement than Neoscale or Decru. Many mid-sized organizations also have difficulty in justifying the cost of an inline appliance. On the SAN/NAS front, where they also have products, there’s basically no market for inline encryption. The security benefits of encrypting a SAN are minimal; it’s only something you want to do if you’re worried about physical loss of the drives (a real risk, but not one all organizations face). That leaves key management- the mystical market all sorts of pundits and vendors are betting on as the next big thing, yet no one is, you know, actually buying. Neoscale’s key management appliance looks extremely interesting but it’s not something most organizations are interested in today. I’m very skeptical that there will ever be a stand-alone market for uber-key management to rule over everything from backup tape encryption to email encryption. I do, however, strongly believe that there are great opportunities for key management, just not as a stand-alone product. We’ll need key management for all that tape encryption, email encryption, database encryption, and even the occasional SAN or NAS encryption, but it needs to be integrated into that product line. Each kind of encryption solves a different business and security problem, and the key management needs to melt into the infrastructure and be tuned for that specific infrastructure. You’ll use one box to manage your storage encryption, another to manage database encryption, and another for email (or whatever). Some larger organizations might have another box hanging out on the back end for key archiving, but that’s about it. No one wants to manage keys, they just want it built into whatever encryption they’re doing at the time. The best opportunities for external key management will be in areas like database encryption, where the encryption engine is built into the various database products but there are no provisions for central management in a heterogenous environment. In those cases the external product will manage both the keys and the encryption implementation, leaving only the raw encryption to the native engine. But back to Neoscale. The Decru acquisition by NetApp hurt Neoscale badly, since large organizations prefer to work with a more established vendor when product functionality is close enough (which it is). Neoscale needed to sell, but either asked for too much or couldn’t find an interested partner. I’ve heard it was a combination of both. As moderate as the storage encryption market is today, Neoscale clearly screwed up execution so significantly that they are effectively out of business, if CRN is accurate. I’m not sure how they could do that and it raises material questions for any acquirer. EMC, HP, and a few others could clearly benefit from the Neoscale technology and integrate the key management across their product lines. It’s better than RSA’s key management (unless RSA has updated it) and well suited for integrating with their current offerings. EMC gains the added benefit of off the shelf datacenter encryption. I’d also consider Cisco, Seagate, IBM, and a few others as potential buyers. But the real question isn’t the technology, it’s the company. Neoscale’s prospects for rescue now depend entirely on the books- such a sudden demise raises very serious concerns for any buyer. If the financial side makes sense, I think EMC could do well to buy Neoscale and their recent acquisition string shows they have a strong interest in data security. I hope the technology survives- it’s good stuff, but it’s up to the accountants and Neoscale’s Board now… (Rob Newby alerted me to this development, but since he’s a nice guy and a competitor he didn’t feel it appropriate to comment himself). Share:

Based on the comments in my last post on DAM, especially the one from Mike Spiers, I want to make it clear that if you are performing Database Activity Monitoring it should be owned and managed by security. It’s fine for DBAs to manage regular database auditing (unless they’re the auditing target), but DAM is a security-specific tool whose primary benefits are to create separation of duties (from the DBAs) and to give security insight into the database. You might need DBAs to get it integrated with the database and confirm performance, but that’s where their involvement stops. Share:

I’m heading out to San Mateo and possibly Palo Alto next week, with a couple openings Thursday afternoon if anyone is around. Share:

Back in the comments to one of my posts on Database Activity Monitoring, Rani asked the question of who should own DAM? I’m going to expand the question to cover all of database security. This is a pretty tough question we can take in a couple of directions. Out at Oracle OpenWorld last week it was pretty clear that database professionals and security professionals don’t overlap nearly as much as we really need for efficient database security. It’s not a failing of any particular group, just the reality that people who do different jobs have different skill sets, even when they come from the same background. Come January I’ll be having an orthopedic surgeon fixing my bum shoulder, not my dermatologist. Security experts don’t necessarily know the difference between DML or DDL, or how to write an outside join, just as DBAs don’t necessarily know the difference between AES and 3DES. Eventually we’ll have a growing cadre of security-aware DBAs and database-aware security professionals. Until then we need to slice up the functions a bit and I highly recommend cross-training when you can. I’m not saying that long term we’ll have some uber-DBA/security experts running all database security without outside influence, but some of the functions might consolidate a bit once those skills are easier to find. Here’s how I slice it: DBAs are responsible for secure design and configuration of the database management system. A security architect can assist with security design review, but this is an ideal area to increase the security knowledge of the DBA. IT Security performs configuration and vulenrability scanning of the database. Results are passed to the database team for remediation, and if a policy violation can’t be fixed for some operational reason, security and the database team need to come up with a joint risk remediation plan that’s documented as an exception. Native database auditing is the responsibility of the DBAs. Management of those logs can be either security or the database team, depending on the purpose of the logs. If separation of duties is required, security becomes responsible for log aggregation and maintenance. Database Activity Monitoring is another joint process. DBAs are involved with the installation, database-side configuration, and maintenance of any database-resident components. Security owns the DAM tool and its ongoing operation. For this to work well, someone on the security team needs basic database training. In summary, DBAs are responsible for securely designing and configuring their systems, and installing and locally managing (just to keep them running) any database-resident security components that affect the database. Security is responsible for external monitoring and ongoing scanning of deployed systems. This creates a good separation of duties and allows each side to do what they’re best at. It relies on any DBA-installed components sending regular health checks/heartbeats back to security to make sure they aren’t disabled. I realize cross-team responsibilities like this can be difficult, but I don’t see any other better approach. In some cases I’ve seen someone on the database team be designated as being responsible for database security, but just remember you’ll lose separation of duties if that individual also has operational database duties. Share:

As most of you have probably figured out by now I tend to expend a lot of hot air trying to define DLP/CMF/CMP (Data Loss Prevention, Content Monitoring and Filtering, or Content Monitoring and Protection). I often take vendors to task for abusing the terms, since they are just increasing market confusion. As Rothman points out it won’t be me, or any particular vendor, that really defines DLP. Only the market defines the market, although some of us influential types occasionally get to nudge it in our preferred direction. While I took Postini/Google to task for calling regular expressions on a single channel (email) DLP, the dirty little secret of DLP is that probably 80-90% of deployments today rely mostly, or totally, on regex for content analysis. Barely anyone deploys the fancy advanced features that I spend so much time talking about, and that the vendors spend so much time developing. So why do I spend so much time fighting for the purity of DLP? It’s because most organizations, in the long run, will only get a fraction of the value of their investment in terms of risk reduction and operational efficiencies without us pushing the products forward with new features and more advanced analysis. But if all you want to do is detect on credit card and Social Security Numbers, and you find that the false positives are manageable, something with a regex engine is probably good enough for you. At least for now. Share: