Research

It’s been over a month since I wrote an Incite. It’ is the longest period of downtime since I joined Securosis. I could talk about my workload, which is bonkers right now. But over the years I’ve written the Incite regardless of workload. I could talk about excessive travel, but I haven’t been traveling nearly as much as last year. I could come up with lots of excuses, but as I tell my kids all the time, “I’m not in the excuses business.” Here’s the reality: I needed a break. I have plenty to write about, but I found reasons not to write. There is a ton of stuff going on in security, so there were many interesting snippets I let fly right on by. But I didn’t write it, and I didn’t really question it. What I needed was what my Tao teacher calls a pause. You could need a pause for lots of reasons. Sometimes you have been running too hard for too long. Sometimes you need to change things up a bit because the status quo makes you unhappy. Sometimes you need some space to recalibrate and figure out what you want to do and where you want to go. Of course, this could be for very little things, like writing the Incite every week. Or very big things. But without taking a pause, you don’t have the space to make objective decisions. You are reading this, so obviously I am writing the Incite. So during my pause, it became clear that the Incite is an important part of what I do. But it’s bigger than that. It’s an important part of who I am. I have shared the good and the not so good through the years. I have met people who tell me they have experienced what I write about, and it’s helpful for them to commiserate – even if it’s virtual. Some tell me they learn through my Incites, and there is nothing more flattering. But it’s not why I write the Incite. I write the Incite for me. I always have. It’s a journal of sorts representing my life, my views, and my situation at any given time. Every so often I go back a couple years and read my old stuff. It reminds me of what things were like back then. It’s useful because I don’t spend much time looking backwards. It’s interesting to see how different I am now. Some people journal in private. I do that too. But I have found my public journal is important to me. The pause is over. I’m pushing Play. In the coming months there will be really cool stuff to share and some stuff that will be hard to communicate. But that’s life. You take the good and the bad without judgement. You move forward. At least I do. So stay tuned. The next few months are going to be very interesting, for so many reasons. –Mike Photo credit: “Pause? 272/265” originally uploaded by Dennis Skley The fine folks at the RSA Conference posted the talk Jennifer Minella and I did on mindfulness at the 2014 conference. You can check it out on YouTube. Take an hour and check it out. Your emails, alerts and Twitter timeline will be there when you get back. Securosis Firestarter Have you checked out our new video podcast? Rich, Adrian, and Mike get into a Google Hangout and.. hang out. We talk a bit about security as well. We try to keep these to 15 minutes or less, and usually fail. March 16 – Cyber Cash Cow March 2 – Cyber vs. Terror (yeah, we went there) February 16 – Cyber!!! February 9 – It’s Not My Fault! January 26 – 2015 Trends January 15 – Toddler December 18 – Predicting the Past November 25 – Numbness October 27 – It’s All in the Cloud October 6 – Hulk Bash September 16 – Apple Pay August 18 – You Can’t Handle the Gartner July 22 – Hacker Summer Camp July 14 – China and Career Advancement Heavy Research We are back at work on a variety of blog series, so here is a list of the research currently underway. Remember you can get our Heavy Feed via RSS, with our content in all its unabridged glory. And you can get all our research papers too. Cracking the Confusion Encryption Decision Tree Top Encryption Use Cases Additional Platform Features and Options Key Management Encryption Layers Building an Encryption Layer Encryption and Tokenization for Data Centers, Servers, and Applications Applied Threat Intelligence Building a TI Program Use Case #3, Preventative Controls Use Case #2, Incident Response/Management Use Case #1, Security Monitoring Defining TI Network Security Gateway Evolution Introduction Newly Published Papers Security and Privacy on the Encrypted Network Monitoring the Hybrid Cloud Best Practices for AWS Security Securing Enterprise Applications Secure Agile Development Trends in Data Centric Security Leveraging Threat Intelligence in Incident Response/Management The Security Pro’s Guide to Cloud File Storage and Collaboration Advanced Endpoint and Server Protection The Future of Security Incite 4 U (Note: Don’t blame Rich or Adrian for the older Incite… They got me stuff on time – it just took me a month to post it. You know, that pause I talked about above.) There are no perfect candidates… There is no such thing as perfect security, so why would there be perfect security candidates? Our friend Andy Ellis, CISO of Akamai, offers a refreshing perspective on recruiting security professionals. Andy focuses on passion over immediate competence. If a person loves what they do they can learn the rest. I think that’s great, especially given the competition for those with the right certifications and keywords on their CVs. Andy also chooses to pay staffers fairly instead of pushing them to find other jobs as their skills increase. Again, very smart given the competition for security staff. The #1 issue we hear from CISO types, over and over, is the lack of staff / recruiting challenge. So you need to find folks in places others aren’t looking, and invest in them – knowing a few will leave for greener pastures at some point.

Last week we saw a security company hit the $2.4B valuation level. Yes, that’s a ‘B’, as in billion. This week we dig into the changing role of money and investment in our industry, and what it might mean. We like to pretend keeping our heads down and focusing on defense and tech is all that matters, but practically speaking we need to keep half an eye on the market around us. It not only affects the tools at our disposal, but influences the entire course of our profession. Watch or listen: Share:

I spend a lot of time on Apple security, more for personal reasons than anything else. They are the tools I use every day, and where I send most of my friends and family to manage their digital lives, so my investment runs deeper than anything financial. I have been the Security Editor over at TidBITS since about the time I founded Securosis, but I am not the only security expert over there. Joe Kissell has himself written books on the topic, and plenty of articles (mostly at TidBITS and Macworld). Joe is currently writing a Take Control book on Mac security. The Take Control series of books are my favorite hands-on instructional guides, and I have used a fair few myself (Take Control is distinct from TidBITS, but closely related and run by the same team). The first two chapters are available free online at TidBITS. The rest of the chapters become available to TidBITS members as Joe writes them. These books run much deeper than the white papers and articles we post on Securosis. The book a soup-to-nuts hands-on guide for nearly everything you need to know to secure your own Mac. Joe and I have talked about combining efforts for a Securosis/Take Control cross-branded version of the content if we can line up a licensee/sponsorship. If you are interested drop me a line. Share:

There seems to something missing for us Securosis folks now that it’s the beginning of March. After some reflection we realized it’s that dull ache in our livers from surviving yet another RSA Conference. The show organizers had to move the conference to April this year, to ensure a full takeover of San Francisco. Regardless of when the conference is, there is one thing you can definitely count on: the DRB! That’s right – once again Securosis and friends are hosting our RSA Conference Disaster Recovery Breakfast. This is the seventh year for this event, and we are considering delivering a bloody head to Jillian’s in homage to Se7en. Maybe that wouldn’t be the best idea – it might ruin our appetites. Though given how big the DRB has become, we probably should consider tactics to cut back – we pay for insane amounts of bacon. Kidding aside, we are grateful that so many of our friends, clients, and colleagues enjoy a couple hours away from the glitzy show floor and club scene that is now the RSAC. By Thursday, if you’re anything like us, you will be a disaster and need to kick back, have some conversations at a normal decibel level, and grab a nice breakfast. Did we mention there will be bacon? With the continued support of MSLGROUP and Kulesa Faul, as well as our new partner LEWIS PR, we are happy to provide an oasis in a morass of hyperbole, booth babes, and tchotchke hunters. As always, the breakfast will be Thursday morning from 8-11 at Jillian’s in the Metreon. It’s an open door – come and leave as you want. We will have food, beverages, and assorted recovery items (non-prescription only) to ease your day. Yes, the bar will be open – Mike gets very grumpy if a mimosa is not waiting for him on arrival (and every 10 minutes thereafter). Remember what the DR Breakfast is all about. No marketing, no spin, just a quiet place to relax and have muddled conversations with folks you know, or maybe even go out on a limb and meet someone new. After three nights of RSA Conference shenanigans, we are confident you will enjoy the DRB as much as we do. See you there. To help us estimate numbers, please RSVP to rsvp (at) securosis (dot) com. Share:

We were invited to run a two-hour learning lab on a topic of our choice this year at the RSA Conference. I suspect it will surprise… no one… that we chose Pragmatic SecDevOps as our topic. This is a cool opportunity – it gives us a double-length session to mix in presentation, hands-on labs, demonstrations, and group activities. I realize some people roll their eyes when they see these buzzwords, but everything we will present is being used in the real world, often at leading-edge organizations. DevOps really is a thing, it really does affect security, and you really can use it to your advantage in super interesting ways. Here is the official description. Pragmatic SecDevOps Date & Time: Wednesday, April 22, 2015, 10:20am-12:20pm Abstract: As cloud and DevOps disrupt traditional approaches to security, new capabilities emerge to automate and enhance security operations. In this hands-on session attendees will learn pragmatic techniques for leveraging cloud computing and DevOps for improving security. Through a combination of demonstrations and exercises we will work through a string of real-world security automations. We are still finalizing what will make the cut but here are some components we are considering including: An updated (and concise) Pragmatic SecDevOps presentation to start the conversation. A lab to automate embedding host security agents in cloud deployments (e.g., Chef/Puppet) and then use them to enforce security policies. A lab to monitor your cloud security management plane. A group exercise to adapt and embed security architectures to leverage new cloud capabilities. This one is interesting because we will be showing off some leading-edge architectures we are starting to see for DevOps and cloud deployments, which not many security people have been exposed to. A security automation group exercise/hands-on lab where we will give you a library of Ruby methods to mix and match for different security functions. That is a ton of content, and we may not get to all of it. I will streamline some of the labs that I normally have people work through manually in training, but we need to push through more quickly. You need to pre-register to attend, and we will run a webcast in the beginning of April so people can prepare and be ready to participate in the hands-on sections. One nice thing about the Learning Labs is that they happen during the main conference – not the day before or at the end of the week. Please feel free to drop us ideas, preferences, or comments below. We already have a lot of the content, but how we piece it together is still very much open to suggestion. Share:

Rich here. Not to get too personal, but I had a dream about being back on ski patrol last night. Of all the rescue things I did, ski patrol was one of the most satisfying. That probably sounds weird, because it means I was more satisfied picking up people who could afford $80 lift tickets than saving people in the inner city. But each activity brings a different kind of satisfaction, and when it comes to ski patrol, it was all about the independence. I worked patrol part time at Copper Mountain for 5 years. We were pseudo-volunteers who would do everything full-timers did, except drive snowmobiles and throw bombs. Although some of us did get certified to drive (to ferry athletes and photographers at special events) and we could go out on avalanche control – just not light the boom-boom things. Patrol is a physically demanding job. You don’t turn laps all day; if you aren’t on a work mission (fixing trail markers, setting safety gear, etc.), you hang out in one of the patrol buildings until you hear the dispatcher ring the cowbell. Yes, more cowbell. Someone would then snag the 1050 (injured person), get details, grab a rig (toboggan), and go find the patient. It’s all solo after that. You ski (or in my case snowboard) to the patient, assess them, treat them, load them, and then take them to the base to either release or send to the clinic. Help is always available via radio if you need it, such as having a second person grab the tow line on the rig in really nasty conditions (usually a cross-slope traverse on ice), or if you hit CPR levels of badness, but otherwise it is a solo deal. I loved working the back bowls. They were physically much tougher, but the environment was amazing. The main patrol building was called Motel 6, at around 12,000 feet. Just getting to it usually involved a hike. It wasn’t very large, but held a table, couch, and small kitchenette area. If you worked there, you wore an avalanche beacon and carried a shovel. Directly across the bowl from 6 was The Dumpster: two lift shack halves welded together with some crash pads on the floor and walls to sit on. Getting to The Dumpster took about 45 minutes and involved hiking the entire ridge around, topping out over 12,500’. The year I lived in Phoenix and flew back to work weekends… that hurt. One of my most memorable calls was my first solo mission out of 6. Some guy injured his leg down near the bottom. Getting to him with the rig was easy, but getting out more complex. It involved multiple “Doo pulls”. Our snowmobiles were all Ski-Doos, and for a Doo pull, the driver would throw you a tow rope. You cannot safely tie it onto the rig, so you get in between the horns (handlebars) and wrap the end of the rope around one grip in such a way that it will only stay while you keep a firm hold on it. Then you handle steering. Fall, and you will probably get run over before momentum (or your head) stops the rig, after the rope drops off. So I got towed out of the bowl, boarded the patient to my next pickup point, towed up to a better spot to reach the mountain base, and then followed the runs all the way down. It took well over an hour, on a hill I could ride top to bottom in under 10 minutes. I don’t completely understand why this was so much more satisfying than working the ambulance or even a complex, multi-day mountain rescue. Perhaps because there are few cases in emergency services where you can honestly say you were responsible for saving someone. It is almost always a team effort, and real saves are rare. But on patrol I remember the time we were sweeping the hill at the end of the day and I found a girl who had just crashed on one of the big jumps. She wasn’t only unconscious, but she wasn’t breathing. I repositioned her head, opened her airway, and she was fine with a mild concussion. My call. My patient. My strength and skills tested, with an expectation that I wouldn’t need help beyond the occasional tow if gravity wasn’t there to help. Teamwork is deeply satisfying, but it is also nice to know you can handle things yourself. On to the Summary: Webcasts, Podcasts, Outside Writing, and Conferences Adrian on NoSQL security. Gunnar quoted extensively by SearchSecurity on breached companies growing profits. Securosis Posts Firestarter: Cyber vs. Terror (yeah, we went there). Favorite Outside Posts Mike: Gartner: Sony breach is a new breed of attack that needs new responses. Oy! The hyperbole is killing me. Invest in staff and training and you can avoid the problems. Good luck with that. Rich: Oracle extends its adware bundling to include Java for Macs. As I said on Twitter, I don’t think anyone familiar with how Oracle treats enterprise customers is surprised by this. James Arlen: Honest review – CSI:Cyber. Ian Amit, the CyberZohan, makes some remarkably good points about the agonizingly painful CSI:Cyber. More people who think that staring at a console makes for a rewarding career – that is good. And it’s always good to have Dr. Janosz Poha around for when Cyber-Vigo the Cyber-Carpathian comes out and tries to scare Cyber-Avery. JJ: What Successful People Do Within the First 10 Minutes of the Workday. Productivity FTW. Mortman: Intuit Failed at ‘Know Your Customer’ Basics Dave Lewis: The Globe adopts encrypted technology in effort to protect whistle-blowers Research Reports and Presentations Security and Privacy on the Encrypted Network. Monitoring the Hybrid Cloud: Evolving to the CloudSOC. Security Best Practices for Amazon Web Services. Securing Enterprise Applications. Secure Agile Development. Trends in Data Centric Security White Paper. Leveraging Threat Intelligence in Incident Response/Management. Pragmatic WAF Management: Giving Web Apps a Fighting Chance.

Last week the US Director of National Intelligence said cyberattacks are a greater risk than terrorism. This week we debate what that means, and whether terminology is getting so muddled that it becomes meaningless. Plus we rip into Rich’s post claiming security people need to stop thinking of themselves as warriors, and start thinking like spies. Watch or listen:   Share:

Rich here. These days it is hard to swing a cyberstick without hearing a cybergasp of cyberstration at the inevitable cyberbuse of the word “cyber”. To be clear, I think ‘cybersecurity’ is not only an acceptable term, but a particularly suitable one. It is easy to understand and covers aspects of IT security the term “IT security” doesn’t quite describe as well. There are entire verticals which think of IT security as “the stuff in the office” and use other terms for all the other technology that powers their operations. But snapping cyber onto the front of another word can be misleading. Take, for example, cyberwar and cyberwarrior. We are, very clearly, engaged in an ongoing long-term conflict with a myriad of threat actors. And I think there is something that qualifies as cyberwar, and even cyberwarriors. Believe it or not, some people with that skill set work in-theater, under arms, and at risk. But when you dig in this is more a spy’s game than a warrior’s battlefield. Defensive security professionals are engaged more in counterintelligence and espionage than violent conflict, especially because we can rarely definitively attribute attacks or strike back. Personally, as Han Solo once said, “Bring ‘em on, I’d prefer a straight fight to all this sneaking around”, but it isn’t actually up to me. So I find I need to think as much in terms of counterintelligence as straight-up defense. That’s why I love some of the concepts in active defense, such as intrusion deception – because we can design traps and misdirection for attackers, giving ourselves a better chance to detect and contain them. Admit it – you love spy movies. And while you probably won’t get the girl in the end (that’s a joke for whoever saw Kingsman), and you aren’t saving the world, you also probably don’t have to worry about someone sticking bamboo under your fingernails. Until audit season. I have some family in town and ran out of time to do a proper summary, so I shortened things this week. Favorite Securosis Posts Mike: Summary: Three Mini Gadget Reviews… and a Big Week for Security Fails. I like Rich’s reviews. For stuff that I likely won’t get because I’m not a techno-addict. Other Securosis Posts Cracking the Confusion: Encryption Decision Tree. Ticker Symbol: Hack – Updated. Favorite Outside Posts Adrian Lane: The Great SIM Heist. Good story. I think it’s hard for a lot of people to fathom that this type of stuff really happens. Truth is stranger than fiction! Mort: Transcript: NSA Director Mike Rogers vs. Yahoo! on Encryption Back Doors Mike: What APT Is. Bejtlich uploads a piece he wrote for TechTarget a few years ago. A good reminder of what the APT actually is – not what the marketers tell you it is. Pepper: Cybergeddon: Why the Internet could be the next “failed state” Rich: Attribution is the new black…what’s in a name, anyway? Private companies need to stop this. It is becoming an embarrassment to our profession. Gemalto Officials Say SIM Infrastructure Not Compromised. Bullshit. US offers $3m reward for arrest of Russian hacker Evgeniy Bogachev Research Reports and Presentations Security and Privacy on the Encrypted Network. Monitoring the Hybrid Cloud: Evolving to the CloudSOC. Security Best Practices for Amazon Web Services. Securing Enterprise Applications. Secure Agile Development. Trends in Data Centric Security White Paper. Leveraging Threat Intelligence in Incident Response/Management. Pragmatic WAF Management: Giving Web Apps a Fighting Chance. The Security Pro’s Guide to Cloud File Storage and Collaboration. The 2015 Endpoint and Mobile Security Buyer’s Guide. Top News and Posts Secrecy around police surveillance equipment proves a case’s undoing How the NSA’s Firmware Hacking Works Bypassing Windows Security by Modding One Bit New Cache of Snowden docs A 14-year-old hacker caught the auto industry by surprise Share:

This is the final post in this series. If you want to track it through the entire editing process, you can follow along and contribute on GitHub. You can read the first post, and find the other posts under “related posts” in full article view. Choosing the Best Option There is no way to fully cover all the myriad factors in picking a specific encryption option in a (relatively) short paper like this, so we compiled a visual decision tree to at least get you into the right bucket. Here are a few notes on the decision tree. This isn’t exhaustive but should get you looking at the right set of technologies. In all cases you will want secure external key management. In general, for discreet data you want to encrypt as high in the stack as possible. When you don’t need as much separation of duties, encrypting lower may be easier and more cost effective. For both database and cloud encryption, in a few cases we recommend you encrypt in the application instead. When we list multiple options the order of preference is top to bottom. As you use this tree keep the Three Laws in mind, since they help guide the security value of your decision. Once you understand how encryption systems work, the different layers where you can encrypt, and how they combine to improve security (or not), it’s usually relatively easy to pick the right approach. The hard part is to then architect and implement the encryption technology and integrate it into your data center, application, or cloud service. That’s where our other encryption research can be valuable, and the following reports should help: Understanding and Selecting a Key Management Solution Pragmatic Key Management for Data Encryption Understanding and Selecting a Database Encryption or Tokenization Solution Defending Cloud Data with Infrastructure Encryption Understanding and Selecting a Tokenization Solution Understanding and Selecting Data Masking Solutions Share:

There is a ticker symbol HACK that tracks a group of publicly traded “Cyber Security” firms. Given how hot everything ‘Cyber’ is, HACK may do just fine – who knows? But perhaps one for breached companies (BRCH?) would be better. For you security geeks out there who love to talk about the cost of breaches, let’s take a look at the stock prices of several big-named firms which have been breached: Sony 11/24/14 28.3% S&P 500 11/24/14 2.2% Home Depot 9/9/14 31.3% S&P 500 9/9/14 6.4% Target 12/19/13 23.8% S&P 500 12/19/13 16.9% Heartland 1/20/09 250.1% S&P 500 1/20/09 162.7% Apple 9/2/14 28% S&P 500 9/2/14 6% This is a small sample of companies, but their stock values have each substantially outperformed the S&P 500 (which has been on a tear in the last year or so) from the time of their breaches through now. “How long until activist investors like Icahn pound the table demanding more dividends, stock buy backs and would it kill you to have a breach?” Food for thought. Share: