Research

‘In our last post in this series we introduced some of the key reasons web application security is typically underfunded in most organizations. The reality is that it’s often difficult to convince management why they need additional protections for an application that seems to be up and running just fine. Or to change a development process the developers themselves are happy with. While building a full business justification model for web application security is beyond the scope of this post (and worthy of its own series), we can’t talk about building a program without providing at least some basic tools to determine how much you should invest, and how to convince management to support you. The following list isn’t a comprehensive business justification model, but provides typical drivers we commonly see used to justify web application security investments: Compliance – Like it or not, sometimes security controls are mandated by government regulation, industry standards/requirements, or contractual agreements. We like to break compliance into three separate justifications- mandated controls (PCI web application security requirements), non-mandated controls that avoid other compliance violations (data protection to avoid a breach disclosure), and investments to reduce the costs of compliance (lower audit costs or TCO). The average organization uses all three factors to determine web application security investments. Fraud Reduction – Depending on your ability to accurately measure fraud, it can be a powerful driver of, and justification for, security investments. In some cases you can directly measure fraud rates and show how they can be reduced with specific security investments. Keep in mind that you may not have the right infrastructure to detect and measure this fraud in the first place, which could provide sufficient justification by itself. Penetration tests are also useful is justifying investments to reduce fraud- a test may show previously unknown avenues for exploitation that could be under active attack, or open the door to future attack. You can use this to estimate potential fraud and map that to security controls to reduce losses to acceptable levels. Cost Savings – As we mentioned in the compliance section, some web application security controls can reduce your cost of compliance (especially audit costs), but there are additional opportunities for savings. Web application security tools and processes during the development and maintenance stages of the application can reduce costs of manual processes or controls and/or costs associated with software defects/flaws, and may cause general efficiency improvements. We can also include cost savings from incident reduction- including incident response and recovery costs. Availability – When dealing with web applications, we look at both total availability (direct uptime), and service availability (loss of part of the application due to attack or to repair a defect). For example, while it’s somewhat rare to see a complete site outage due to a web application security issue (although it definitely happens), it’s not all that rare to see an outage of a payment system or other functionality. We also see cases where, due to active attack, a site needs to shut down some of its own services to protect users, even if the attack didn’t break the services directly. User Protection – While this isn’t quantifiable with a dollar amount, a major justification for investment in web security is to protect users from being compromised by their trust in you (yes, this has reputation implications, but not ones we can precisely measure). Attackers frequently compromise trusted sites not to steal from that site, but to use it to attack the site’s users. Even if you aren’t concerned with fraud resulting in direct losses to your organization, it’s a problem if your web application is used to defraud your users. Reputation Protection – While many models attempt to quantify a company’s reputation and potential losses due to reputation damage, the reality is all those models are bunk- there is no accurate way to measure the potential losses associated with a successful attack. Despite surveys indicating users will switch to competitors if you lose their information, or that you’ll lose future business, real world stats show that user behavior rarely aligns with survey responses. For example, TJX was the largest retail breach notification in history, yet sales went up after the incident. But just because we can’t quantify reputation damage doesn’t mean it isn’t an important factor in justifying web application security. Just ask yourself (or management) how important that application is to the public image of your organization, and how willing you or they are to accept the risk of losses ranging from defacement, to lost customer information, to downtime. Breach Notification Costs – Aside from fraud, we also have direct losses associated with breach notifications (if sensitive information is involved). Ignore all the fluffy reputation/lost business/market value estimates and focus on the hard dollar costs of making a list, sending a notification, and manning the call center for customer inquiries. You might also factor in the cost of credit monitoring, if you’d offer that to your customers. You’ll know which combination of these will work best for you based on your own organizational needs and management priorities, but the key takeaway should be that you likely need to mix quantitative and qualitative assessments to prioritize your investments. If you’re dealing with private information (financial/retail/healthcare), compliance drivers and breach notification mixed with cost savings are your best option. For general web services, user protection & reputation, fraud reduction, and availability are likely at the top of your list. And let’s not forget many of these justifications are just as relevant for internal applications. Whatever your application, there is no shortage of business (not technical) reasons to invest in web application security. Share:

It’s just Martin and myself again this week as we discuss PCI, online identities, telecom immunity, and one wacky data breach. We also spend a fair bit of time talking about our home network setups and Martin’s adventures in protecting his kids from YouTube. I also dig into how I’m using our Drobo and how we manage backups here at Securosis HQ. Network Security Podcast, Episode 130, December 2, 2008 Show Notes: PCI Compliance Services FAQ The End of Online Anonymity – It’s not the end, it’s a change in how we look at it. EFF to fight against telecom immunity in Tuesday hearing – I hope everything went well for Jennifer Granick and friends Cybercrime servers selling billions of dollars worth of stolen information & illicit services Canadian IT exec accused of stealing customer database There is always a back story … – Richard digs into the Canadian IT story Share:

‘It’s official- Arizona Governor Janet Napolitano is President-Elect Obama’s choice for Secretary of Homeland Security. I’ve only been living in Arizona for about 5 years now and have been consistently impressed with Napolitano. She’s a Democratic gove or in a mostly-red state and well respected by everyone except the extreme end of the GOP. Very pragmatic, organized, and level headed. I realize most of you readers aren’t very familiar with her, but as a local constituent she’s a strong choice, known for teaming up with California, New Mexico, and the great nation of Texas to work on plugging some of the federal failures in managing border security. The only loser is Arizona- our Secretary of State will be taking over, switching the state government to single party control with a governor who isn’t really known as a strong leader. Hopefully she’ll rise to the occasion. It’s always an open question how much even the president and cabinet-level positions can change the bureaucracy of our government, but I have high expectations that some of the silliness we’ve seen in DHS- from FEMA to TSA- will slowly be weeded out of the system. As for cybersecurity, it’s still a big question mark. She has experience with border security, law enforcement, and disaster management, but I haven’t noticed IT security to be the biggest priority here in AZ. Can’t win them all… Share:

Happy Monday everyone. This year I broke with tradition and actually ventured outside of the house of Black Friday. We didn’t see too many deals, but I did manage to grab a new rolling tool chest for the garage. That was before I heard about the disgusting hoard of lowlifes that killed some poor temp worker in Long Island because he had the gall to stand between them and a plasma TV at Wal-Mart. That incident represents everything that can go wrong with a capitalist society, and this is the last year I’ll be feeding the beast with any Black Friday purchases. Sorry, that really got to me this weekend. Back to cybersecurity… A friend of Any the IT Guy’s is facing a bit of a problem at work. They are replacing their PC infrastructure and are looking at building out new workstation images with a full load of security tools. One they are looking at are asset recovery/phone home tools. You know, the ones that will register their location (as best they can) if someone loses one or it’s stolen and connected to the Internet again. No surprise, I’m not the biggest fan of these tools. Andy raises a series of questions about them: 1. Just how many systems do actually go missing every year? 2. Are they really missing or are they just not being tracked properly as they are moved, replaced, etc? 3. How many systems can they afford to lose per year before they actually see any real value in this program? 4. Can they replace any other applications with this software? Asset tracking, System Monitoring, etc 5. How much of an investment in infrastructure and personnel resources will be required to manage this program. I prefer to use a simple algorithm to measure their value: IF (cost of tool < ((average number laptops recovered/laptops lost) X (average value of laptop X average number laptops lost))) THEN tool != crap Now the tool in question also sounds like a regular asset management tool that also manages software deployments, inventory, and so on. But if this feature costs extra, or you are looking at a dedicated tool, hit the vendor up with my little algorithm to measure value. Share:

‘Did you buy one of the deeply discounted Plasma Televisions this weekend? How about a new digital camera? How about eBay? No, not something being sold there, but the company itself. Chris O’Brien over at the San Jose Merc speculates on what it would take to buy the auction site as there have been some rumors floating around on this subject, and indirectly points out why cash is king. Meanwhile while the London times claims Microsoft was doing a little Black Friday shopping of it’s own, another rumor that probably will not die until it is no longer a rumor. What the heck, take half off and let the Holiday rush begin! Share:

‘This Sunday’s Arizona Republic picked up Brian Krebs article in the Washington Post about thieves tapping into home equity lines of credit. This is a very interesting, and just because their are people out there who actually still have home equity, but that this is a very simple con with potentially devastating affect. One of which is there was no data theft here, rather the information was mined legally. Second is that when the bank falls for the con, since they believe it was the borrower who made the withdrawal, the borrower has to detect the fraud and provide some form of evidence that it was not they that made the withdrawal. After I read this story, I went out to see what data was available to see if this was possible. Despite a wife who uses this information on a daily basis to perform her job, I was still surprised. The amount and quality of information that is held in public databases, readily accessible to anyone who cares to view it is pretty amazing. If you are not aware of it, when you buy a home, pretty much every piece of information regarding that transaction is logged by the county recorder and placed in the public domain. If you are a homeowner, go out to your county recorders web site and search for the data; your name, address, signature, lender, the amount, possibly the interest rate and a lot of other information as well. Seriously, take a minute and check it out; I think you will be startled as to what you find. Stars, celebrities, politicians along with everyone else. In this particular case there was no data theft theft component in this particular case, rather it was simple and legal data mining for ID theft. They probably were able to cross reference those people who looked like they may have assets with a credit score, and voila, instant target list. A lot of people have had their HELOC, or Home Equity Line of Credit yanked from their banks recently, some amid remodeling projects. Part of the issue is the Banks trying to reduce their exposure on people who are living off their credit lines, but another is this type of fraud. Banks and financial institutions have long had the problem of ‘how do I know its really you’, and thieves often know in advance what the banks ask for in the way of authentication, and either have that information, or a suitable excuse. Had the group in this specific case not been so greedy and tied to move such a large sum of money, I am not sure they would have been caught. And since the perpetrator is able to mask their identity and location, it’s up to the bank’s representative to have enough savvy to not fall for the con. And in that event, it’s trouble for both the lender and hassle for the borrower, so check your statements as this could happen to pretty much anyone. Share:

Hard to believe we’ve been around to post this yet a third time, but here you go. Our list of advice for shopping safely online this year; and we even updated it this time: Yes folks, Black Friday is only days away and the silly season is upon us. As someone born and bred in good old North Jersey (until I could legally escape), land of honey and shopping malls, this is a time so deeply ingrained into my subconscious that I’ve occasionally found myself sleepwalking around the nearest parking lot, looking for our old wood-paneled station wagon. These days, thanks to the wonder of the Internet, anyone can experience the hustle and bustle of the Paramus malls from the comfort of their own home. And to help keep your shopping experience authentic, there’s no shortage of cheats and thieves ready to yank your painstakingly chosen gifts right out of the virtual trunk of your web browser. Of course they might take your house with them, which, even in Jersey (despite the legends) is somewhat rare. In the spirit of safe and happy holidays, Securosis presents our top 6 tips for safe online shopping, simply presented for the technical or non-technical consumer. Some of these tips also apply to the real world for those of you who just can’t restrain the draw to the mall. Spread the fun, and feel free to post your own tips in the comments. Use a dedicated credit card, temporary credit card number, or PayPal account for holiday shopping. Our first tip is also useful for the physical world- still the origin of most credit card fraud. Take your card with the lowest limit and use it exclusively for holiday shopping. Use one you can monitor online, and check the activity daily through the holidays (weekly at a minimum). Make sure it isn’t a debit card, and turn off any automatic payments (so you can dispute any charges before making payments). Keep tracking activity at least weekly for 12 months after the holidays are over, or cancel the card. DON”T USE A DEBIT CARD!!! These don’t have the same protections as credit cards, and you’re responsible for fraudulent charges. As for temporary credit cards or PayPal, read on to our second tip. Only use credit cards at major online retailers; use a PayPal debit account or temporary credit card for smaller shops . Sure, you might get a better deal from Billy-Bobs-Bait-Shop-And-Diamond-Wholesaler.com, but many smaller retailers don’t follow appropriate security practices. Those hosted with a major service are often okay, but few consumers really want to check the pedigree for specialty shops. Instead, create a dedicated PayPal account that’s not linked to any of your bank accounts or credit cards. Credit it with as much cash as you think you need and use it for those riskier online payments. Worst case, you only lose what’s in that account, and you can easily cancel it anytime. Another option, depending on your credit card company, is a temporary credit card number for online shopping. These are single use, or single retailer/session numbers that can’t be used again or leveraged to run up your account. Charges still appear on your same bill and are tied to your main credit card account. Check with your credit card company to see if they offer this service, but most of the major card issuers have it as an option. I like these better than account passwords (e.g. Verified by Visa and Mastercard SecureCode) since they work everywhere, and you don’t have to worry about anyone sniffing them. Never, ever, ever ,ever click on ANYTHING in email. It doesn’t matter if your best friend sent you a really good deal in email. It doesn’t matter if it’s your favorite retailer and you’ve always gotten email offers from them. Repeat after me, “I will never click on anything in email.” No special offers. No Ebay member to member emails. No “fraud alerts” to check your account. No nothing. Ever. Nada. Attackers are getting more and more refined in their attacks, some of which are very hard to distinguish from legitimate emails. Spam waves over the holidays are expected to break records this year. When you see an interesting offer in email, and it’s a business you want to deal with, just open your web browser, type in the address manually, and browse to the item, offer, or account area. Email is the single biggest source of online fraud; never click on anything in email! Update your browser- use Firefox 3.1, IE 7 or 8, Safari 3.2.1, or Opera 9.6. Turn on the highest security settings. Over the past few months or so we’ve seen big updates of all the major browsers to include enhanced security features. Since the Safari update last week, all major browsers include features to help detect fraudulent sites- if you see a warning, shut down the browser and don’t go back to that site. All of these browsers will ask you before installing any software when you visit a site; when shopping, never allow the site to install anything. Either it’s a fraud or they don’t deserve your business. Pay particular attention to plugins to watch video, or free games unless you know it’s a trusted site (both are usually trojans). Most browsers now install with security enabled by default, so we won’t be providing detailed instructions here. Just download them. Now. Then come back and read the rest of this list. We’ll wait. Download and install NoScript for Firefox. This is a free plugin for Firefox that blocks anything from running in your browser that you don’t allow (like Javascript, Flash, and so on). You won’t need it if you just stick with Amazon, but if you use Google to help you find that can’t-miss Drink-With-Me Elmo, you shouldn’t be trolling the Internet without it. If you don’t want it bothering you all the time, at least use it during your holiday shopping and turn it off later.

PayPal announced their Mobile PayPal offering this week. Really nothing new here from a technology standpoint as it leverages existing services and the Verisign/PayPal security key. Why I was interested in the release was the signal that they are putting more resources behind this market. I am still shocked that payment via cell phone did not catch on like wildfire in US. Look at adoption rates of cell phones, SMS, twitter and the like, and I would have bet that payment would have been right there with them. Small dollar, in context, person to person, embedded payments could be easily provided. I saw my first payment via cell phone method in 1996 through one of the major European cell phone providers. Built a system capable of providing ‘micro-payment’ over the phone in 1997. Nada. No interest from the public. Still, it would be far safer for me to pay for that thing I bought on eBay over the cell phone than using the Internet access for whatever hotel I am usually staying in. Need remains, so I am very interested in seeing how customers react to this recent announcement. There are plenty of other companies who offer quality service but struggle with adoption. Startups like Obopay have done a good job in building awareness and vendor relationships (with banks & telecommunications carriers) needed to succeed in this market. But while they may be winning the war with the tiny providers like CellPay, Paymate, TextPayMe and countless others, they are at a disadvantage in a couple of ways. First, these vendors typically build a new payment mechanism, unlike PayPal, who is simply a wrapper on existing infrastructure. Second, even if they do come up with a novel approach, most likely what they have done is build a blueprint for the larger providers as they are not large enough to make a market. After 10 years I think we have proven there is not going to be viral adoption, so the smaller players are going to have a very tough time if PayPal’s offering is adopted by their customers, something neither the banks nor the cell providers have been able to leverage. Now I am off for a long weekend. Have a great Thanksgiving Holiday! Share:

Martin and I are preparing for Thanksgiving, just like everyone else in America right now. I don’t know about you, but that primarily means I have five days of work to accomplish in three days of the week. So we didn’t organize a guest this week- instead we sat down together (1000 miles apart) and talked about some of the stories that caught our attention over the last couple of weeks. It’s a good show, and we’re out of here until after Turkey Day. Have a great Thanksgiving! Network Security Podcast, Episode 129, November 25 2008 Show notes: Security FAIL – But I changed my Twitter password… Gmail Security Flaw PoC Kernel Vulnerability found in Vista Final judgment: SCO owes Novell millions (plus interest) Decreasing security for perceived security – all in the name of compliance Managing Security in Economic Downturns The Julie Amero forensic analysis Share:

When I was with IPLocks in the 2004 time frame, we were exploring the possibility of selling our monitoring and assessment suite into the government. Friends and contacts made introductions, and we began investigating if there was a need for the solution, and if so, how we would approach tackling that type of relationship. While we knew dealing with the government would be tough, we felt that any organization that is sitting on piles of personally identifiable information and literally hundreds of thousands of databases would be a natural fit for our technology. After a few months of analysis process we decided we couldn’t do it. Too much in the way of time and resources, and too much uncertainty about what we needed to do. Going through the process was simply too long and too difficult for a small company like ours to undertake. We had a technology that could solve problems in different branches of the government, but this is not like the private sector where vendor meets customer, product meets need, and we write up a contract. There are far more demands and restrictions, and the more we learned, the more we felt we will missing basic knowledge of all of the steps in the process. Or even what the process was, for that matter, or which systems integrator we should approach, we did not know if we needed to focus on specific branches of the government, nor were we even aware of all of the accreditations and certifications our product would need to go through. The risk was too great and we walked away. This is a common problem and one to be expected. I run into vendors at every trade shows who are in the same boat; a desire and a good technology fit, not a clue as to where to start. A couple years ago, my friend Robert Rodriguez helped found the IT Security Entrepreneurs forum with the intention of tackling this type of problem and provide a way to “bridge the gap” between Federal agencies and private industry. From his perspective he saw both the desire from the vendors side to participate, but also the need from the government side to have security products that were, how do I say this, from the current decade. But the process does not favor this sort of innovation, rather it is the larger firms that can afford the time and resources to last through the effort, with the smaller and mid sized vendors getting filtered out. Smaller firms with innovative technologies typically cannot compete. Various arms of the US Government are supporting this effort to address the problem by offering educational resources and contacts, and the forum’s web site will host much of that information freely to the public. If you are serious about selling to the government, there is also a conference in March dedicated to this topic, and it is well worth the $400 fee. Past events have had a number of very good speakers from the security industry, academia, DHS and the US Military, along with some very eye-opening comments from the behind-the-scenes administrators who run the procurement side of the process. Once you understand the issues from the other side of the table, it makes things a lot clearer about what you need to do and why. Plus a lot of the VC, resellers and system integrators are in attendance, and they help small firms avoid common mistakes, wasted efforts and provide some plain speaking advice on what you need to do to sell to the government. If you have ever sifted through the online tomes of government requirements written in that special form of legal-ese, you know why that is of value. Share: