1 Raindrop

IOS/Lynn: Worst of Both Worlds

For years we have heard that the strengths of open source is that "with enough eyes all bugs are shallow"; and the downside of open source is that attackers can also see the source. The plus side of closed source is that attackers cannot see the code; but the downside is that the public cannot audit or insert their fixes and patches.

Last Nov, on Taosecurity, I made the point (related to the Source Code Club) that:

"If we accept the arguments from the closed source community about their products being more secure due to lack of availability of source, then once the source becomes available [like the releases we have seen recently] we have the worst case from both scenarios. Source available to the attackers, but which has not been audited by the community and is not patchable except through the vendor.

If we take the view that the publicly reported sources available represent the tip of the iceberg, then there are even more risks to running software which is only patchable and audit by a single, centralized source."

Richard Bejtlich's rejoinder to this was:

"I agree with this sentiment. Other reasons I prefer using open source includes the ability to see just how a program works, the chance to modify a program to suit my needs, and the fact that individual programmers are held personally accountable when CVS and other systems track their code check-in actions. (I believe this promotes higher-quality code as opposed to a closed binary with no one's name on it other than the vendor's.)"

Taosecurity is also commenting that the outcome of legal wrangling on this Lynn case will have wide implications for the security industry going forward.

O Sherlock Where Art Thou?

Linked from Neal Stephenson's brief recap of the collision of security and societal factors speech at CFP 2000. Isolation from and lack of integrated detection and response are chief enemies of security. Same as it ever was. I guess we should not be surprised that Sherlock Holmes was an advocate for IDS and monitoring systems.

It was an ideal spring day, a light blue sky, flecked with little fleecy white clouds drifting across from west to east. The sun was shining very brightly, and yet there was an exhilirating nip in the air, which set an edge to a man's energy. All over the country-side, away to the rolling hills around Aldershot, the little red and grey roofs of the farm-steadings peeped out from amidst the light green of the new foliage.

"Are they not fresh and beautiful?" I cried, with all the enthusiasm of a man fresh from the fogs of Baker Street.

But Holmes shook his head gravely.

"Do you know, Watson," said he, "that it is one of the curses of a mind with a turn like mine that I must look at everything with reference to my own special subject. You look at these scattered houses, and you are impressed by their beauty. I look at them, and the only thought which comes to me is a feeling of their isolation, and of the impunity with which crime may be committed there."

"Good heavens!" I cried. "Who would associate crime with these dear old homesteads?"

"They always fill me with a certain horror. It is my belief, Watson, founded upon my experience, that the lowest and vilest alleys in London do not present a more dreadful record of sin than does the smiling and beautiful country-side."

"You horrify me!"

"But the reason is very obvious. The pressure of public opinion can do in the town what the law cannot accomplish. There is no lane so vile that the scream of a tortured child, or the thud of a drunkard's blow, does not beget sympathy and indignation among the neighbours, and then the whole machinery of justice is ever so close that a word of complaint can set it going, and there is but a step between the crime and the dock. But look at these lonely houses, each in its own fields, filled for the most part with poor ignorant folk who know little of the law. Think of the deeds of hellish cruelty, the hidden wickedness which may go on, year in, year out, in such places, and none the wiser. Had this lady who appeals to us for help gone to live in Winchester, I should never have had a fear for her. It is the five miles of country which makes the danger."

"The Adventure of the Copper Beeches" by Sir Arthur Conan Doyle

The Gap Between Desire and Reality

I remember hearing a keynote at Blackhat by Richard Thieme some years ago, in the talk (which, typical of Richard, was mind expanding) he told a story of a commander in Vietnam who would assess the battlefield, sorting events and outcomes into four categories: things that are going well, things that were not going well, things that were going poorly, and things that were not going poorly. Through this analysis he worked to identify points of leverage through which he could act.

Why am I recounting this story now? The point is: don't wait for some far off distant security paradise to improve your systems and software security. Analyze the problems, yes, for example, a working (and widely distributed) implementation of what Anderson described over 20 years ago would be very helpful. Every security professional has there own particular wish list for how to best improve security, this is a valuable exercise to identify gaps. However, what is needed is next is pragmatic incremental, evolutionary steps to improve current with current realities in tools, technologies, and personnel. Design security architectures that work towards larger goals, but provide improved security given these realities. For example, wishing that AAA products manage security for all software is not going to make it so, the real question is how to deal with the fallout that those tools are not omnipresent.

Luckily, there is a fair body of work in security that takes this pragmatic approach including:

• Mission Critical Security Planner, by Eric Greenberg
• Inside the Security Mind, by Kevin Day
• Low Carb Security, by Marcus Ranum

The above work gives in the trenches reality to frame security discussions, and drive designs from both a top down and bottom up views. The larger vision is critical, security won't get where it needs to get without some focus on this, but the vision is the begining of the journey.

Service Oriented Security Architecture Draft

The draft version of my Service Oriented Security Architecture paper is here. The paper discusses key software security architectural concerns and design considerations. Feedback is welcome!

Vector Addition for Identifiers Considered Useful

Paul Madsen parses Kim Cameron's 4th Law of Identity "Directed Identity" to identify the Vector Addition for Identifiers.This post underscores the value of understanding relationships in defining identity, complex distributed systems including federation scenarios where servers are both identity providers and consumers illustrate this point, security-focused Use Cases have utility in articulating these relationships in the development process.

Security standards: What about detection and response?

The industry is inexorably moving towards interoperable security standards, I cannot help but recognize that these standards (which have great utility) are almost exclusively focused on protection mechanisms, and not on detection and response mechanisms. If we assume that security must encompass protection, detection, and response can we expect future versions of standards to address the latter two? Or will this be the last mile left to developers and vendors as protection mechanisms historically were? Who will champion WS-Anasazi?

Beyond the Perimeter

The Jericho Forum is a group that driving the security conversations and analysis beyond the notion of simply securing perimeters. This interview has some background (comprised of 50 Global 200 CISOs)  on the organization and its goals. The Jericho Forum is a project under the Open Group umbrella and as such it is technology and vendor agnostic which is only appropriate in this space. The roadmap includes developing a meta-architecture, requirements/ontology, solutions, models, management and monitoring, as well as communicating the deperimeterisation (note: Brit spelling intentional) concept to a wider audience. So far, the project has conducted presentations and briefings that are begining to address the latter goal. Awareness is critical since as the Jericho presentations tell us:

"We are too busy putting our fingers in the dyke to notice that the dam has already been breached"

Jericho is looking at four phases of Deperimeterisation:

"Phase 1
Now: Move outside the perimeter
Move non-corporte items outside the corporate perimeter and enable Internet connected working.

Phase 2
Soon: remove hardened perimeter
Pervasive authenticated process, transport encryption

Phase 3
Near future: No perimeter
Connection level authentication, data level encryption

Phase 4
Future: Data level authentication
Data inherently secure and will only operate in validated secure environments by authorised people"

While these may seem far off different goals, and we can also argue about what the right path and outcomes are, my takeaways are as follows: 1) Jericho is doing the community a huge service by highlighting these issues and exploring these concepts in an open way. And 2) It is exciting that we are now getting to a stage where we have enabling protocols and standards to actually realize some/all of these goals.