Research

I just finished up my last of 4 presentations here in Orlando and am enjoying a nice PB&J and merlot here in my room. Too much travel really kills the taste buds for hotel food. Today’s presentation was on data security; the area I’ve been focusing on during my 5 years as an analyst. And when you talk about data security you have to talk about DRM. Enterprise DRM is quite different from consumer DRM, even if they both follow the same basic principles. One of the biggest differences being enterprise DRM is focused on reducing the risk of exposure, consumer DRM on eliminating it (you know, the mythical perfect security). There are a few third party DRM vendors but Microsoft and Adobe are the big elephants in the room. But even those behemoths struggle for more than a workgroup-scale deployment (oh, they may sell seats but few people use it day to day). Which, as we struggle with problems like information leaks, seems pretty weird. I mean here we have a technology that can stop everything from unapproved email forwarding, to printing, to cutting and pasting. Seems pretty ideal, so what’s the problem? All that capability comes with a price- not sticker price, but deep enterprise integration with every single application that needs to read the content. But that’s not the big problem. The big problem is DRM relies on the people creating documents actually remembering to turn on the DRM, then understanding which rights to apply, and then figuring out who the heck is supposed to have all those various rights. I can barely remember my family, never mind which of my far flung coworkers should be allowed to print the doc I just sent them. Thus most DRM deployments don’t make it past the workgroup. Now imagine if the rights were automatically applied, or at least suggested, based on the content of the document. If there’s a credit card number one set of rules is applied. If it’s an engineering plan, or a secret marketing doc (based on the verbiage inside) different rules are set. All based on central policies. Sure, it won’t catch everything, but it’s a heck of a lot better than not doing anything. Hmm… I wonder where we could find a policy based tool capable of taking action based on deep content inspection using advanced linguistic, statistical, or conceptual analysis? Oh yeah- content monitoring and filtering, often called information leak prevention. CMF will save DRM. It will make it viable outside the workgroup by taking everyday decisions out of the hands of overworked employees, while applying central policies based on what’s actually in the files. It won’t work every time, and users will often have to confirm the correct rights are applied, but it’s the only way enterprise DRM is viable. Share:

Thanks to a missing arrival I’m blogging live from the “Analyst Hamster Maze” at Symposium in Orlando. That’s how we refer to the One-on-One area in the Swan hotel- there’s really no other way to describe about 100 temporary booths in a big conference room filled with poorly fed and watered analysts. If you’ve never been to a Gartner conference, any paying attendee can sign up for a 30 minute face to face analyst meeting for Q&A on pretty much anything. I like to call it “Stump the Analyst”, and it’s a good way for us to interact with a lot of end users. (You vendors need to stop abusing the system with veiled briefings and inane “face time”). It does, however, get pretty brutal by day 5. My first meeting today was pretty interesting. The discussion started with SAP security and ended with SCADA. For those that don’t know, SCADA (Supervisory Control and Data Acquisition) is the acronym to cover the process control systems that connect the digital and physical worlds in utilities and manufacturing. These are large-scale systems and networks for controlling everything from a manufacturing floor, to a power network, to a sewage system. SCADA is kind of interesting. These are systems that do things, from making your Cheerios to keeping your electricity running. When SCADA goes down it’s pretty serious. When an outsider gets in (very rare, but there are some cases) they can do some really nasty sh*t. We’re talking critical infrastructure here. SANS seems to be focusing a lot on SCADA these days, either out of good will or (more likely) because it’s hot enough they can make some money on it. I started writing about SCADA around 5 years ago and my earlier work sort of martyred me in the SCADA security world (or with the few people who read the research). These days I’m feeling a bit vindicated as the industry shifts a tad towards my positions. What’s the debate? There’s been a trend for a while to move process control networks onto TCP/IP (in other words, Internet compatible) based networks and standard (as in Windows and UNIX) systems. SCADA developed long before our modern computing infrastructure, and until the past 5-10 years most systems ran on proprietary protocols, networks, and applications. It’s only natural to want to leverage existing infrastructure, technology advancements, standardization, and skill sets by moving to fairly universal platforms. The problem is the very proprietary nature of SCADA was an excellent security control- few outsiders understood it and it wasn’t accessible from the Internet. You know, that big global network, home to the script kiddies of the world. To exacerbate the problem, many companies started converging their business networks with their process control (SCADA) networks. Now their engineers could control the power grid from the same PCs they read email and browsed porn on. It was early in the trend, and my advice was to plan carefully going forward and keep these things separate, often at additional cost, before we created an insurmountable problem with our critical infrastructure. I saw three distinct problems emerging as we moved to TCP/IP and standard platforms: Network failure due to denial of service: if the network is saturated with attack traffic, such as we saw with the SQL Slammer and Blaster viruses/worms, then you can’t communicate with the SCADA systems. Even if they aren’t directly affected- and most have failsafes to keep them from running amok- you still can’t monitor and adjust for either efficiency or safety. The failsafe might shut down that boiler before it explodes, but there are probably some serious costs in a situation like that. I’ve heard rumors that Blaster interfered with the communications during the big Northeast power outage- it didn’t infect SCADA systems, but it sure messed up all those engineer PCs and email between power stations. Exploitation of the standard platform: if your switching substation, MRI, or chemical mixer runs on Windows or Unix; it’s subject to infection/exploitation through standard attacks/viruses/worms. Even locked down, we’ve seen plenty of vulnerabilities in the cores of all operating systems that are remotely exploitable over standard ports via mass infection. Mix your email and web servers on the same network as these things, even with some firewalls in the mix, and you’re asking for trouble. Direct exploitation: plenty of hackers would love to pwn a chemical plant. I know of one case, outside the US, where external attackers controlled a commuter train system on 2 separate occasions. Maybe it was just a game of Railroad Tycoon gone bad a la “War Games”, but I’d rather not have to worry about these kinds of things. Standard networks, platforms, and Internet connectivity sure make this a lot easier. So where are we today? One way to solve the problem is to completely isolate networks. More realistically we can use virtual air gaps, and what I call virtual air locks, to safely exchange information between process control and business networks. Imagine an isolated server, between two firewalls, running TCP/IP on one side and maybe something like IPX (a different network protocol) on the other, with only one, non-standard, port for exchanging information. The odds of traversing to the process control network are pretty darn slim. (For more details check out the Gartner research I wrote on this; I don’t want to violate my employer’s copyright). Thanks to what I hear are some close calls, the industry is taking security a heck of a lot more seriously. The power industry consortium (NERC) issued some security guidelines recently that redefine the security perimeter to include everything connected to the SCADA side. The federal regulatory body, FERC, requires conformance with the NERC standard. Thus if you converge your process control and business networks you have to secure and audit the business side as tightly as the process control side (a much tougher standard). The business costs could be extreme. The result? It’s quite possibly now cheaper to isolate the networks and secure the heck out

Over at the Washington Post, Krebs is reporting that Microsoft is releasing Internet Explorer 7 this month. At first it sounded like it might be released as a security update (part of Patch Tuesday, when Microsoft releases all their security patches every month). Now it looks like it might just be released as a regular old update. I’ve heard IE7 is pretty good, although some of the best security sauce won’t work until Windows Vista ships this year/next year/next decade/centruy/whatever. The usual advantage of IE is that it won’t break all those sites coded specifically for IE, of which there are plenty. These days most of them are internal sites, but there are still plenty of external websites that don’t play nice with other browsers. The problem with IE7 is that it’s a MUCH better browser than your current version of Internet Explorer, much more standards compliant, and much more secure. In other words, it will probably break stuff. My guess is IE7 will probably go out this month, but not as part of Patch Tuesday. It will still be branded as a security update and the faster consumers get it in their hands the better. It’s a significant update and could really help reduce some of the browser security problems floating around. It’ll probably break some corporate apps, but you enterprise IT guys hopefully won’t let this spread internally until you’ve tested it. As for your personal browsing- get it. As soon as it’s released. Download it for grandma. I still prefer Firefox and Safari (sorry, Mac only), but IE7 is more than an incremental improvement. Share:

I’m packing up my bags and heading down to Orlando for the Gartner Symposium and IT Expo. It’s a busy year, with 3 presentations and a panel: Tuesday, 8 am: Oracle, SAP, and Beyond: Securing Major Enterprise Applications Tuesday, 3:15 pm: Enterprise Risk Management, the Benefits of Risk (panel) Wednesday, 8:30 am: Content Monitoring and Filtering: Vendor Choices, User Issues Wednesday, 3:15 pm: Keeping Regulators and Customers Happy with Data Security The data and application security pitches are getting a bit stuffed and should keep you geeks happy. I think this might be my 6th Orlando Symposium, which is a bit frightening. If any of you are down there and want to meet up for a beer just drop me a line… Share:

Despite living in Boulder Colorado for 16 years I’m neither a hippie nor a conspiracy theorist. I don’t use patchouli oil, wear a beanie, or ingest any mood-altering substances you can’t buy in a grocery store. I don’t think the Masons control our destiny, black helicopters molest cattle, or the NSA monitors all our communications. Oh, really? Okay, but the cattle thing definitely isn’t real. Except maybe in Nebraska, but that’s not the CIA, not that there’s anything wrong with it… Anyway, what I’m saying is that I’m fairly skeptical, if a tad on the D side of the political game. But after seeing Fox (and the AP) on this Foley Congressional page thing, I’m really starting to wonder. Wikipedia defines information warfare as: Information warfare is the use and management of information in pursuit of a competitive advantage over an opponent. Information warfare may involve collection of tactical information, assurance that one’s own information is valid, spreading of propaganda or disinformation among the enemy, undermining the quality of opposing force information and denial of information collection opportunities to opposing forces. Information warfare consists of three broad goals. Controlling the opponent’s access to information, securing your own lines of information (and communication), and using disinformation to create confusion, control opponent actions, and, basically, control the brains of the conflict (including civilians). I’ve never been a fan of Fox news. Actually, I’m not the biggest fan of any news station these days, and refuse to watch local news (unless I’m on it, of course). But I always figured even Fox has a shred of objectivity. And they can’t really be in some big conspiracy with the GOP and Diebold, can they? It’s just about ratings, isn’t it? If you’re only a tad paranoid, their latest actions just might sound like information warfare. As the scandal around Representative Mark Foley hit the news cycle Fox repeatedly identified him as a Democrat. Huh? Yep- as reported on BoingBoing Fox news identified, on screen, Mark Foley as a Democrat, not a Republican. Since probably very few Americans can tell you how many representatives are in Congress, never mind who they are and their party affiliations, it might, just might, lead some to believe that it’s the Dems running around hitting on underage boys. (from BoingBoing.net) That, my friends, is a classic use of information warfare. At least if it’s on purpose, but since there have been three reports, no corrections, and one instance was on a show recorded hours before air, it’s reasonable to assume that if it’s not on purpose, there’s a distinct lack of contrition over such a major mistake. So let’s look into the security implications, since this is a security site. The mass media has more power to sway public opinion than any other single source of information. Disinformation is a core principle of information warfare. Spammers use it to pump stock prices. Hackers use it to access your systems. Competitors set up false blogs to ruin your corporate reputation. Heck, some vendors try and leverage us industry analysts in their information warfare strategies. All of this is a form of information warfare, we’re just not always willing to admit it. Information warriors know that compromising mass media is one of the single most effective techniques, as long as you don’t get caught. All it takes is a few seeds of doubt to sway public opinion. If those seeds are true, it’s just good public relations; if they’re false, it’s information warfare. The best information warfare takes a kernel of believable truth, like some Congressman hitting on an underage employee, and salts it with just the slightest disinformation, like mistakingly listing him as a member of the wrong party in on-air graphics. Outright lies are rarely as effective as the slight lemon twist because without a foundation of credibility they are immediately dismissed by the mass majority. Disinformation is most effective when most of it is just information. Which brings us back to Fox. One mistake I could accept; these things happen. I could even understand that same mistake multiple times in the same broadcast. But different times, in different broadcasts, including prepared material? That stretches credibility. Bias in media is pretty bad, but hard to eliminate. Outright disinformation? Now that’s classic information warfare. Besides, we all know Democrats stick with inte s. At least they’re over 18… Share:

For those that don’t know, VeriChips are implantable RFID tags “for people”. That way you can be tagged and tracked like cattle or Gillette razors. Convenient, I guess. Anyway, here’s a great article on the Make blog on cloning VeriChips. So much for using these to separate identical twins. I see this as one of those “good news/bad news” kind of things. The good news is the bad guys don’t have to chop your arm off to steal your identity. The bad news is VeriChips totally blow. Or is that the good news? I’m easily confused. Share:

Pete Lindstrom just posted a missive in support of the TSA. Pete makes some good points about the limitations of policy- while you always need hard rules, you also always need exceptions and judgement. In the information security world, we talk about the difference between “policy decision points” and “policy enforcement points” to express the different functions. In most computing environments, the PDP and PEP start off combined in a small set of instances but then get separated as networks grow while some central authority still wants to coordinate security efforts. The good news for security folks is that systems allow us to have the best of both worlds. PDPs can (basically) handle as many conditionals as you want — systems will scale and always make the same decision based on the same set of assumptions. I guess what I am saying is ridiculing airline security without understanding the monumental challenges they have is getting old. They’re PEPs, for crying out loud. Sure, I hate it as much as everyone else when they take my toothpaste, but it is only toothpaste. Get over it. Pete identifies one of the most difficult problems in security of any type, from IT security, to physical security, to law enforcement. No blanket policy can effectively deal with every circumstance, yet exceptions are difficult to evaluate and can lead to failure. When I managed a physical security organization this challenged us daily. Our conclusion was to start with strict policies and supervision, but as employees gained experience give them more freedom for individual decision making. Supervisors played the role of mentors, helping decide who was ready for more freedom and who needed strict monitoring. In the end I had an incredible team (some who read this blog, feel free to comment) capable of handling very dynamic situations with minimal direct supervision. Cops, firefighters, paramedics, doctors, lawyers, electricians, and so on all work in pretty much the same way. It took me years to develop the judgement to make accurate, split-second decisions where there were policy gaps. Ask any of my physical security friends- early on I tended to fail in favor of always following policy. It created as many problems as it solved, requiring greater supervision. The world isn’t black and white, even when it is. How is this relevant to Pete’s points? Two ways. First, bad policy is bad policy. I don’t ridicule TSA employees, but it’s our job as security experts to identify policies that don’t improve security but increase costs. Pete doesn’t discuss the policy creation point, or the need for feedback from enforcement points to creation points to maintain effective policies. The second is that over-reliance on policy enforcement points results in security failures. Policies can’t account for all situations, can’t manage appropriate exceptions, and don’t adapt for new threats. My suggestions is the government develop more effective policies and stop treating airport security as a single enforcement point. I’ve written about it here and here. Create a hierarchy of TSA employees, beyond screeners, and embed security deeper into the aviation system in a less intrusive way. I applaud the employees who are willing to deal with all the a$$holes running through airports. Screening is hard, thankless labor. But we need to look a little higher, and thus improve security while decreasing inconvenience and reducing costs. Share:

Statement from SecureWorks: SecureWorks and Apple are working together in conjunction with the CERT Coordination Center on any reported security issues. We will not make any additional public statements regarding work underway until both companies agree, along with CERT/CC , that it is appropriate. I’ve been told Maynor is no longer speaking at ToorCon. I’m disappointed, but it’s obvious there’s now something going on with CERT. I stand by my statements that Maynor and Ellch are responsible security researchers that helped advance Mac security. At this point, I don’t have any other comments, this has dragged on far longer than it deserves. My Mac is more secure today thanks to Dave and John. That’s the most important result of this entire debacle. I expect we’ll all eventually learn more, but as of now this is officially buried. Update: Ou is still headed to ToorCon and has some other points. I really doubt there will be any legal action, everyone wants this dog dead, but it will be interesting to see what happens at ToorCon. Share:

This is just too good. A friend who recently moved from the business side to the IT side just reported this. They work at a large hospital. A significant portion of the clinical staff never changed their default passwords, which just happened to be the same as their login. Convenient, eh? Nice to see HIPAA at work. But this is the best part. Someone in IT “made a configuration mistake” and everyone was forced to update their passwords. The help desk has been taking calls all week. Seems most of the users remember their new password, but still can’t get in. You ask why dear readers? Because they are now entering their new passwords as their user names, and their password. Yes, they all assumed that their user names and passwords are always the same, and changing one automatically changes the other. Huh. Think about that one for a minute. I suppose it makes sense in some kind of warped way. If it makes you feel better, this is in the surgical unit. Share:

I read an interesting article by Brian Krebs over at the Washington Post on ID theft. Brian did a little hunting on some underground IRC channels and witnessed a large amount of stolen personal data being exchanged, then went out and talked with around two dozen victims. One of his more interesting tidbits was that a bunch of the credit card numbers were being used to purchase background checks from Internet sites like USSearch.com. These sites purport themselves as “people finders” for such seemingly innocent needs as collections, finding that old college friend, making sure your nanny doesn’t have a criminal record, or tracking down all the places where your ex-wife might be hiding. Yeah, not everyone uses these things to find former roommates who stiffed you $50 in long distance. I decided to pony up and run a check on myself to see how bad these are. My conclusion? We need regulation. Badly. It’s yet another case where seemingly innocent pieces of public information have tremendous consequences when aggregated and correlated on the scale of the Information Age. I set just one basic rule- what could I find on one site using nothing more than my name. Some sites let you search on SSN, but since that’s supposedly secret (probably not hard to find) I restricted myself to name only. I ended up at PublicBackgroundChecks.com since it was slightly cheaper. All the services range from about $9.99 for a simple address lookup, to $60 for a background check including criminal records. I decided on the $40 ‘background check without criminal records check’ since I’ve had my record cleared enough to know I’m clean. It wasn’t worth the $20 to me just to see if my speeding tickets were on there. It wasn’t all accurate, but it’s close enough to get my attention. Here are some highlights: Probably 85% of the addresses I’ve ever lived at. It missed 3 from my first two years of college, but caught everything else. Age and DOB Parent’s names and addresses. My sister wasn’t listed as a relative for some reason. Possible associates with their address history- based on concurrent address information. It caught my stepfather (deceased), 3 long-time roommates, and the entire family of one of my landlords. Schools, mail drops, banks, and storage lockers near known addresses. Property ownership and appraised value for my last two residences. I’m only on the mortgage for one of them, and there was another listing of the previous owner on that one, with no date range. Historical phone numbers for current, last previous, childhood, and one random residence. I think the system struggles with date ranges and it didn’t find any of my real phone numbers except… Internet domain registrations- including registrar info which included an old address. It nailed some old domains, but didn’t include Securosis. Owners, about a dozen neighbors (with phone/address), and other residents (with phone numbers) for those addresses it provided details on. I still don’t know why it didn’t do this for every address. A bunch of other (accurate) empty searches: Overall it was fairly accurate, and probably 70% complete. It only identified two of my phone numbers, neither current, one about 17 years old. It’s more than enough information to track me down, and everything you’d need to start some identity fraud other than my SSN. In times of old all this information was available, but scattered across the written files or proprietary databases of potentially hundreds of agencies and sources. Neighbors, associates, historical phone numbers, local banks and storage facilities weren’t the most available pieces of information without some legwork. And then I think of all the other sources out there on me that I didn’t check- everything from Google, to credit checks (easy to obtain illegally), to the large data aggregators like ChoicePoint. One of these vendors once showed me their law enforcement tool for tracking individuals- imagine all the information I listed above, of higher accuracy, visually accessed in a real-time three dimensional browser. Within seconds you could track the personal relationships, based on public records, of anyone in the US with just a name and date of birth (also easy to find). Some data aggregators can correlate across financial, public, and criminal records. Scott McNealy once infamously stated, “You have zero privacy anyway, get over it”. He’s half right. Nearly every shred of our privacy is gone to anyone with a web browser and less than $100, but that doesn’t mean we should accept it. Aside from the social implications the fraud implications alone demand some sort of action. While these records are public, and on their own fairly innocuous, once aggregated and correlated the value increases exponentially. Don’t believe me- go pay your $40 and see for yourself. Next step in my research- start tracking these companies down and see how many are just public fronts for a few of the big names. I don’t know the answer, but have my suspicions. Share: