Research

Well, we finally know how Pfizer lost all those employee records. An employee installed P2P file sharing software on her laptop, and probably shared her entire drive. Oops. I bet I know one person that’s eating alone in the corporate lunchroom. We originally talked about this a few weeks ago. I’d like to remind people of my Top 5 Steps to Prevent Information Loss and Data Leaks. Securing endpoints is number 5. I hate having to clamp down on employees with harsh policies, but limiting P2P on corporate systems is in the category of “reasonable things”. (thanks to Alex Hutton for the pointer) Share:

Sigh. Again. More Jericho? Yep. Can’t let Hoff go without a retort, not after this. I’d like to quote my last post for a moment: I suppose Jericho”s goals are admirable, but I can”t help but feel that they”re stating the blindingly obvious and doing a piss poor job of it. For those of you not familiar with Jericho, take a quick gander over here. Basically, they”ve been advocating “de-perimeterization”; pushing people into new security architectures and dropping their firewalls (yes, they really said to trash the firewall if you go back and look at some of their original press releases). Now Hoff’s criticism of said post: The Mogull decides that rather than contribute meaningful dialog to discuss the meat of the topic at hand, he would rather contribute to the FUD regarding the messaging of the Jericho Forum that I was actually trying to wade through. … I spent my time in my last post suggesting that the Jericho Forum’s message is NOT that one should toss away their firewall. I spent my time suggesting that rather reacting to the oft-quoted and emotionally flammable marketing and messaging, folks should actually read their 10 Commandments as a framework. Quick reminder that the platform really used to be about getting rid of the perimeter. I’m a huge data security wonk, and even I think we’ll always need a perimeter, while also building better controls into the data. If you want to look, this is one of their better early presentations. It’s not too bad. But I’m an open minded guy, so I’ll drop the past and move into the present. Let’s look at the 10 commandments (Chris, I’m stealing your image to save typing time):  1. Agree. Security 101. 2. Agree, common sense. 3. Agree, seems obvious. 4. Agree, in an ideal world, we can get better and should strive towards it but not rely on it. 5. Agree, any company with a laptop is implementing this already.  6. Agree, designed a model for this back in 2002 (I’m not sure I can share it, need to check with my former employer). 7. Agree, was part of that model, and we’re already seeing some of this today. 8. Agree, see federated identity. Nothing new. 9. Agree, this could be interesting but I think it needs a lot more development. 10. Agree, but again, pretty basic. 11. Agree, no one would disagree. Chris, this messaging needs more refinement and a lot more meat. A lot of it isn’t revolutionary, yet much of the Jericho press coverage is sensationalistic and impedes their ability to get the message to the audience. They’ve built up so much baggage that they need to really work on the messaging. Quotes like this one don’t help the cause: The group admits “deperimeterisation” isn”t the most catchy phrase to explain multiple-level security, but Simmonds calls it an “overarching phrase” that “covers everything”. So what is it? According to the Jericho Forum, it is a concept that describes protecting an enterprise”s systems and data on multiple levels using a pick”n”mix of encryption, inherently secure computer protocols and data-level authentication. At the same time, it enables the free flow of secure data wherever and whenever it is needed, in whatever medium and between dissimilar organisations — such as banks and oil companies, for example. This kicks against the notion of security via a network boundary to the internet. You asked me to: Repeat after me: THIS IS A FRAMEWORK and provides guidance and a rational, strategic approach to Enterprise Architecture and how security should be baked in. Please read this without the FUDtastic taint: It isn’t the FUD in the framework that’s the problem. It’s the FUD in the press quotes, and the lack of meat in the guiding principles (the commandments aren’t really a framework). I’m happy to retract my suggestion to focus on using market forces to pressure vendors. Better yet, I’m happy to contribute to the dialog. I’ve been doing it for years, and intend to keep doing it. Take a look at my Data Security Hierarchy (which is now dated and I’m working on a new framework which is much more specific). Also look at Dynamic Trust if you can find it at Gartner (again, can’t release material I don’t own). … Spend a little time with Dr. John Meakin, Andrew Yeomans, Stephen Bo er, Nick Bleech, etc. and stop being so bloody American 😉 These guys practice what they preach and as I found out, have been for some time. I’m happy to. I’m happy to spend as many hours as they’d like talking about specific models and frameworks for improving security and protecting data. You set up the meetings and I’ll be there. Data security is here today, but harder than it should be, with some big clients out there implementing the right models we can make life easier for the rest of the world. But I disagree that they’ve refined the messaging enough yet. Too much obviousness; not enough specifics to back the really cool ideas; way too much FUD still in the press. That’s basic communications, and it needs work. I’m happy to help. You know where I am. Just shine your Stupendous Signal into the clouds and I’m on my way. Share:

Martin’s recruited me to co-host indefinitely, and I think we’re finally working out the kinks. This one is all over the map but there were some interesting things to talk about: Show Notes: Loren’s review of last week’s podcast – We answered a question from Loren in the podcast, which Rich answered on the blog but I accidentally deleted. Honest. Rich’s TD Ameritrade poll– What do you think the real culprit for the compromise was? Analysing the TD Ameritrade Disclosure TD Ameritrade’s 6 million customers hit with security breach Introducing Security Mike’s Guide to Internet Security – Good news, Mike Rothman doesn’t look at all like the guy on the cover of this book. More good news, this is an idea I think will benefit a lot of people The Ghost in My FileVault Tor madness reloaded My interview with Shava Nerad, the Executive Director of the Tor Project – Anyone interested in hearing an update from Shava? I’m sure she’d be willing to come on the show again. Tell-All PCs and Phones Transforming Divorce – Sorry if this is behind a NYT paywall, even though they’ve stated they’re going to tear it down soon. Tonight’s music: Got to have a Job by Little Charlie and the Nightcats Network Security Podcast, Episode 77  Share:

TD Ameritrade issued a press release Friday with another nugget of information in it. TD AMERITRADE Holding Corporation (NASDAQ:AMTD) has discovered and eliminated unauthorized code from its systems that allowed access to an internal database. The discovery was made as the result of an internal investigation of stock-related SPAM. Making conclusions off press releases and news articles is a fool’s exercise, but I’m a fool and I like to exercise. This tidbit could indicate malware, possibly from an endpoint. The focus on SPAM also seems to support more of a malware than SQL Injection. Either way, don’t forget to check out our survey and make your own best, uninformed, guess. On the bright side, it looks like they are handling the situation aggressively, notifying early, and so far the focus is on email addresses, not financial info. Share:

Big Bad Mike Rothman over at Security Incite just announced a new program he’s launching next months for consumers. Mike told me about this a while ago, and I think it’s a great idea. Here’s an excerpt from the announcement that I think summarizes why we need something like this (emphasis added): If you like it, then it’s too hard The fact is, since you are a security professional, there is a high likelihood that you’ll hate it. It’s intentionally simple. It’s not designed for you. It’s not even Security 101. It’s kind of like Security Kindergarten. It’s secure, but it’s not complicated. Unfortunately the two are not mutually exclusive at this point. The sad truth is that anything too complex isn’t going to get done. I had to intentionally get rid of the buzzwords and vernacular that dominate our security conversations. Soccer Moms don’t care about zombies or IP spoofing. It’s designed for your family and/or your neighbors. Those folks that annoy the crap out of you by asking you to spend your weekends cleaning up the mess they made during the week. Security Mike’s Guide is not about making sure that the world class researchers can’t break into their home networks. It’s about making sure the script kiddie neighbor cutting his teeth doesn’t manage to break into your network and get at your Quicken file. Or find your “private” pictures (ask Vanessa Hudgens about that). I plan on sending my family his way. We’re all tired of supporting their messed-up PCs and Macs, and I’m more than happy to outsource this to Mike. He also has a new, family-friendly blog over at http://securitymike.blogspot.com/ (Okay, the Macs all seem to be working fine.) Share:

It sweeps across a defined field of fire and launches its (un)deadly projectile at anything that invades it’s defined perimeter (3 feet). Bender is just there for moral support. When he’s sober. (Yeah, I’m a geek. But I have a black belt, so it’s okay.) Share:

There’s been a bit of debate lately between the quantitative and qualitative camps of the risk management world. The good news is that both camps recognize the need for an organized way to approach risk, rather than the “wave your hands and prognosticate” approach that’s been so popular over the years. I’ve spent a lot of time looking at risk over the past seven years or so, and as an emergency responder have spent about 17 years of my life making risk decisions in high-stress environments on a regular basis. I’ve been looking at risk from both the IT security perspective and the Enterprise Risk Management (ERM) perspective. I’m a firm believer that you need a risk management framework, and a firm believer that most of them suck ass. Don’t even get me started on the COSO ERM framework. The problem with most risk management frameworks is that they either focus on checklists that don’t reflect reality, or the kind of quantification that magically turns guesses into statistically (in)significant numbers. Quite a few were written by big consultancies just to drive huge and endless risk assessment projects. Your risk management framework should help you make an informed risk decision, without becoming a giant hellish time-suck. Here are a few key things I look for when evaluating a risk framework: It’s driven by the risk tolerance decided by executive management: Face it, unless you’re on the Board of Directors, you work for someone else (the Board technically works for the shareholders, but we know that’s a load of crap in modern business). It’s up to the Board and executive management to define the risk tolerance of the enterprise. If they don’t do this, it’s impossible for anyone else to make an informed risk decision. It combines quantitative and qualitative risk in a consistent manner: One of the biggest failings of any risk framework is either ignoring the quantitative or the qualitative, or forcing false numbers onto qualitative assessments and tolerance. The best risk registers I’ve seen combine quantitative and qualitative measurements together in a scaled approach. For example, we can list out from acceptable to unacceptable the amount of credit risk our organization is willing to accept, and rate ranges on that scale from one to five. We can also describe something qualitative, like our reputation, and apply the same one to five scale rating. Put them in a grid and we can now directly compare the two. It allows domain experts to evaluate risks in their domain: I despise any risk model that has someone other than a domain expert decide how to evaluate risks in their domain. I spent thirteen years with Rocky Mountain Rescue; I can make a risk decision (often quantitative) involving a complex rescue on a cliff face in the blink of an eye that would take a physicist months, and they’d still probably get it wrong. Your infosec grunts can probably make great risk decisions in their domain, but probably suck at risk outside their area of expertise. Your risk model should reflect the skills of domain experts, not those of a person writing a checklist. It supports communication between domain experts and the business: Just as you don’t want a risk manager overriding the risk analysis of a domain expert, you don’t want a domain expert making enterprise risk decisions outside their domain. That genius infosec dude (or chick) has no idea how much credit or legal risk is acceptable. One problem with domain experts is seeing the big picture; they often struggle to place their risk within the context of the overall enterprise. The framework should support communications between the two- so the higher ups understand the relative risk from within a particular domain, without having to know the particulars of that domain. Domain experts can make optimized on the job decisions, yet understand where they fit in within the overall enterprise. Essentially, we’re solving four key problems: Having no executive guidance on what level of risk is acceptable. Relying too much on either the quantitative or the qualitative, to the exclusion of the other. Not allowing domain experts to make the risk decisions they’re best at. Not effectively communicating this risk so management can make informed decisions, nor giving domain experts the ability to place their risk in context. Oh, and there’s one more: making this all so fracking complicated that no one can possibly understand it and still get their job done. Have I found a framework I like? Absolutely, because I wrote it. If you’re a Gartner client go take a look at the Gartner Simple Enterprise Risk Management Framework. I designed it to be a practical tool that meets the requirements i talked about above- practical, driven from the top, decisions made by the experts, and consistent communications from top to bottom. And less than twenty pages, which I think is a record in the world of risk. I wish I could post it here, but it’s not my property. I know a lot of you have access and I’d be interested in your feedback. But whatever framework you use, let’s just remember the basics. Risk is decided at the top, not everything is quantitative, not everything is qualitative, and the best risk decisions are made by domain experts, who are worthless if they can’t communicate to the rest of the business. Share:

Looks like we’ve had another data breach. TD Ameritrade is now notifying 6.3 million customers. If we use my ridiculously low estimate of $2 per notification, they just erased $12.6M from the books. I can think of a lot of good security technologies (and people) that cost less. I’m being a bit of an ass and there are probably good people there, but we still can’t excuse these incidents. They’re also doing the right thing and paying for an ID theft investigation on top of their own internal investigations. According to Dark Reading we know: The company uncovered the malicious code in one of its databases during an audit, which is part of a stock spam investigation. Sources familiar with the breach said the code is not unlike the code used to steal data on 1.3 million users at Monster.com. Based on that one line, I’d lay odds on SQL injection. But let’s take a poll (this is really just an excuse to test my new polling system): [poll=2] TD Ameritrade also said: The brokerage firm says it is confident that it has identified the method in which the information was stolen and has taken the appropriate steps to prevent it from recurring. I really hope they release this information to help the rest of us make informed decisions. Share:

My title, but must-read content at Daring Fireball. Remember, the media companies are trying to condition you into paying more for every piece of content you use. More money for every device, every viewing, every time you make a mix tape with those perfect songs to bring back your lost love. Heck, the RIAA is actively petitioning to pay artists less (if at all) for ringtones and other uses of the artists’ content, so it’s not like your favorite drug-deprived musician is missing out on getting a fix meal when you buy these things. Just say no, people. Fair use lets you rip your own songs and convert them. Exercise your rights or lose them. Now back to your regularly scheduled security paranioia… Share:

Richard Stiennon was in town last night, so I took him out for everyone’s favorite local Mexican food. No, it’s not obscene, it’s a normal place with an amusing name. I just like dragging all my security friends there so they have to turn in expense reports with “Pink Taco” on them. Don’t worry Greg, we’ll get you a hat… Share: