Research

Computerworld yesterday reported on a US-CERT advisory for the popular Quickbooks Online Edition. I know it’s popular because I use it. And I’m popular. Aren’t I? Really? Oh… Don’t tell my mom, okay? I just started using QuickBooks Online to run the business side of Securosis. I think it’s a great idea, but they REALLY need to re-think the architecture. IE only ActiveX controls are like totally 1990s. I have to run Parallels to enter expenses (since I’m on a Mac). Web 2.0 guys, it’s totally “in”. Either that, or update QB Pro on the Mac to have all the features of the Windows version, instead of a subset. Like they’re reading this blog. Oh well, that’s what I get for giving them money even though I’m not totally happy with the service. I only have myself to blame. Where’s that shaker of salt again? Share:

Securosis, L.L.C. is a security consulting practice dedicated to thought leadership, objectivity, and transparency. Our consultants have all held executive level positions and are dedicated to providing the highest value strategic consulting available. We provide services in four main areas: Publishing and Speaking: including independent, objective whitepapers, webcasts, and in-person presentations. Strategic Consulting for Vendors: including market and product analysis and strategy, technology guidance, product evaluations, and merger and acquisition assessments. Strategic Consulting for End Users: including product selection assistance, technology and architecture strategy, education, and security management evaluations, and risk assessments. Investor Consulting: including product and market evaluations, available in conjunction with deep product assessments with our research partners. Our clients range from stealth startups to some of the most well known technology vendors and end users. Clients include large financial institutions, institutional investors, startups, mid-sized enterprises, and major security vendors. Securosis is partnered with security testing labs to provide unique product evaluations that combine in-depth technical analysis with high level product, architecture, and market analysis. Share:

Since most of you blog readers don’t care about how I feed myself I don’t intend on using the blog for boring corporate updates, but I’m going to indulge myself for a moment. Securosis, L.L.C. is up, running, and available for any of your security consulting needs. I’ll be keeping the About Securosis page updated with services and programs as I get them more formalized. For now, I’m filling in a good pipeline of project based work, with some webcasts. Although I’m no longer an analyst, I still feel that objectivity is the most important trait I bring to the table. Once my name loses value, this gig is over. To that end any content you see with my name on it was developed in isolation from the vendor community. Not that they’re evil, but I want to minimize any concerns of “selling out” as much as possible. I have some webcasts coming up, and although sponsored by vendors I develop the content on my own, and it’s their option to use it as is, or to walk away from the table. I may not get paid, but in the long run I think it’s the best approach to maintain my “brand”. I’m also lining up some longer-term consulting projects. One thing I’m looking forward to is helping out with some in-depth strategy development and the occasional product evaluation. A downside of being an analyst is you never get to work a project from start to finish, and I’ve missed that from my pre-analyst consulting days. I’m talking with some security research teams to combine my higher-level product/market analysis with their in-depth product testing, which could end up being pretty interesting. Finally, feel free to ping me on email or IM with your random security questions. I’m securosis on AIM, and rmogull on Skype. Have a great day, and thanks for all the early support. Share:

I had a little back and forth with rybolov in the comments on my military post, and he introduced me to something called the Business Reference Model right out of some government publications and NIST 800-60. Kicking ass, as only a Guerilla CISO can, he responded with two great blog posts showing how we can steal from this model and adapt it to the enterprise world. On the surface (haven’t had time to dig in yet) it looks like an interesting way to help align business priorities, data classification, and security priorities. While I’m not a fan of complex models, I’m a big fan of anything that can help bridge the language divide between the business and IT. Check out his posts here and here. Share:

For those of you who don’t know, this is a blog with an editor. Chris Pepper is a long-time friend, UNIX wizard, web host, and tech writer himself. You can track his work at Extra Pepperoni, his somewhat-recently revamped blog. Chris is also one of the most in-depth Mac guys I know, and has submitted 1300 bug reports to Apple, many for Mac OS X 10.5 (the next version of the Mac operating system). They aren’t all “bugs” in the traditional sense, but when you peel off that shrink wrap from your colorful operating system upgrade, the odds are really darn high that the software you install will be better thanks to Chris. To boost his ego a little, when I was at DefCon I met up with a support guy at Apple who knew Chris from his bug reports and blog. Share:

Mr. Rothman was concerned that Mr. Hoff may, perhaps, have a little too much spare time on his hands. I’ve seen Senior Hoff at work, and he definitely isn’t winning any Slacker of the Year awards. I personally have a theory that he’s really just the earthly expression of a multidimensional being beyond our comprehension. Chris definitely outdid himself on this post. A short excerpt, (Read to the cadence of ‘Twas the Night Before Christmas) Remember when firewalls were firewalls, my friend? it suggested our security problems would end. They promised the perimeter breach to abate, but alas became products we just loved to hate. The attackers got smarter, and the exploits malicious, the perimeter’s holes made the threatscape pernicious. Sadly the breaches were never quite stopped, whilst we measured our value in per packets dropped! (read the rest here) Share:

If you read the security blogs, you may have seen that I have a stalker- Rob Newby over at IT Security, The View From Here. Rob’s a data security weenie like myself. Rob just left Spain to return home to the UK for a new job with Ingrian (database encryption). Congrats Rob, and glad to see you happy and healthy in your home nation again… Share:

There’s been a lot of debate lately on quantitative vs. qualitative risk, frameworks, models, metrics, certifications, standards, and all sorts of other organizational junk we seem to burden ourselves with. Oh, I’m no better, having authored a risk management framework, data security hierarchy, and similar tools in my past. At times, I step back and realize we’re losing the big picture in this morass of acronyms and long documents with words like “Section 248, Subsection B, Paragraph A, Revision 42”. While I hate to knock my own industry off its pedestal, we sometimes forget that we are just the complex implementation of a very basic need. Thus it’s time to dumbify security and kick it old skool. Here’s my n-step guide for the perfect, basic, security program: Figure out what’s important, and why: We often get wrapped up in pet projects, personal biases, or other distractions. When you look at your business, what’s really important, and what can you live without? Yes, I’m over-simplifying, but that’s the point of this post. I’ve seen n-degree complex risk analyses that still fail to capture what’s important. You’ll use those models later, but at some point just take a step back and really look at what could hurt you in a big way. That’s the most important stuff, and it deserves more attention than everything else. Decide if anyone stands to gain by stealing it or breaking it: Just because it’s important to you doesn’t mean it’s important to anyone else. In this step, just ignore the noise of the constant background threats (what my friend Richard Stiennon calls background radiation) and focus on directed threats- where someone has something financial to gain. Know how it’s protected: What security is in place? Figure out where the holes are: There are always holes; where are they? How hard are they to find and use? Back in physical security days we’d walk around the facility before an event, figure out all the ways in… including obscure ones like climbing buildings (those Dead Heads are seriously dedicated), and how hard they’d be to take advantage of. Block the holes, until it’s too expensive to block the holes: At this point you know your priorities, you know the threats, and you know the weaknesses. Now it’s just a matter of layering security until risk is reduced to an acceptable level. That’s all we do. We figure out what’s important, what the risk is to it, and how to best reduce that risk. Every single one of you reading this knows that, but we still get so wrapped up in agendas, frameworks, internal politics, and compliance that we sometimes forget we’re just there to help the business take the greatest amount of risk it wants to take, in the safest way possible. I don’t care what complex risk/security framework you’re using… stick to the basics. Know what’s important, have a rough idea of how much it’s worth to you, and drop in enough layers until you think it’s protected well enough. All those complex models should be tools to help you achieve the basics, not the other way around. We protect stuff, pure and simple. Yes, you still need metrics and frameworks, but you can’t define security as just a bunch of metrics and checklists. I also highly recommend a good 12 step program… Share:

Just a day after I talked about how it takes sustained failures for consumers to leave a company and go to a competitor, we have an example where switching isn’t really an option. Over at Dark Reading we learn that Phizer has suffered it’s third employee privacy breach in a row. At least they’re doing the “right” thing by involving law enforcement and offering credit monitoring. I suspect, since these made the press, they’re also improving security. That said, you have to feel for the employees who don’t have much of a choice to go anywhere “more” secure. Actually, neither do you. The last time my info was breached was at the student healthcare center at the University of Colorado. My SSN was stolen out of old records. How about you? I suspect every one of you has personal data sitting around old healthcare providers, never mind financial institutions, retail stores, government databases, old utilities providers, and subscriptions to “those” services under fake names, still billed to your real credit card. You no longer have a relationship with these providers (or one you can’t sever), yet they still represent a real risk to your security. Market forces can’t fix this one. Share:

Back when I started this blog one of the only security blogs I knew about was Martin McKeay’s Network Security Blog. As can happen in the blogging community, Martin and I eventually got in touch and developed a friendship. Heck, anyone I’ve gone drinking with in 3 different cities in less than a year is definitely a friend. With my return to blogging last week Martin invited me to join him on his podcast- as a guest host, not a guest. You can check it out here, or subscribe through iTunes. This week was mostly an introduction and our first attempt at joint podcasting. We spend a little time talking about point of sale terminal security, and a bit more time talking about the value of a CISSP certification (Martin changed my opinion a bit while we were recording). I have a short introduction on communicating with executives, and the podcast finishes up with an interview Martin did with Winn Schwartau. We’re planning on doing more of these, so please send your feedback. We know this week clocks in a little long, and we already have some ideas to improve the format. Check it out here: Network Security Podcast, Episode 75 Share: