1 Raindrop

Logging in the Age of Web Services

Here is the paper I co-wrote with Anton Chuvakin for IEEE Security & Privacy Journal. Among other things we look at the impact of the eventually consistent model's impact on our ability to record and review audit log events. We also use some of Anton's work on event logs and apply them to how to think about security events in Web services. Hopefully there are some ideas that you can apply to building an audit log system for your Web services.

It was a lot of fun to work with someone with thinks as strategically and futuristically as Anton.

Don't Cede the Cloud

Yesterday I posted that I don't want to trust the cloud. Someone asserting the name "Bruce Schneier" responded:

I don't want to trust the cloud, either. Unfortunately, we won't have any choice.

I think this misses the point, the goal is not trust - I don't want to trust the cloud, I have no need to trust the cloud. Instead, the operative question was much better phrased by Brian Snow - if we cannot trust, how can we safely use?

Safe use through building margins of safety into our software is a much more practical, achievable goal than "trust", the last machine I trusted was my 1974 Volvo with 500,000 miles. Since then, I have low expectations on machinery.

Further I reject the notion that security people have to sit passively while developers plow ahead building out the cloud. If we are not rolling up our sleeves, building in margins of safety (SAML, Information Cards, Input Validation, Output Encoding, ...) then we are not doing our jobs and we are a part of the problem not the solution. If you have security skills this is the time to use them.

I have trained thousands of developers and security people on software security, I start my security training class by asking developers "how many years of development experience do you have?" On average there are about 3-5 years experience. Then I ask "how many people have done a one day software security class?" About one hand will usually go up.

So in class of 30 people, we can expect 150 years of programming experience and about one day of software security training experience! Is it just me or should we really give up on this stuff when we haven't even really started trying seriously yet? 

We have only just begun training developers to begin to do the right thing, the languages are immature with regard to safety features, there is a whole host of identity technologies, and new standards. Its like saying in the 1950s "well we'll never cure smog, all cities will be like Los Angeles and no one will be able to breathe. Too bad."  Instead what happened were several changes in the 1960 and 70s that dramatically reduced smog. Why give up on security when we have never even really tried yet?

Don't cede the cloud to an insecure fate by sitting passively on the sidelines, instead seed the cloud with margins of safety - here are some ideas to try this year.

But I Don't Want To Trust the Cloud

Oh no, here we go again, Bruce Schneier says the cloud is nothing new, we have seen this before and we know how to deal with it. Its all just a matter of trust.

Gee, I hate to go Marge Gunderson twice in one day, but Bruce while we all love your efforts publicizing infosec, I'm not sure I agree with you a hundred percent on your security architecture advice, there. I realize its very hard to get prescriptions right in distributed computing security. There is just too much complexity, politics and constraints, but I really do expect security people to get the diagnosis right. What we need to do about certain problems is pretty subjective, but problem statements should be pretty objective. Cloud = mainframe is an example of someone not really thinking things through. Just because we logged into remote computers in high school doesn't mean that a business that runs its data, processes, and people on multiple, federated, domains is the same. Not even close technically and not even in the same galaxy risk wise. So no its not the same.

And furthermore, the problems are neither things we have seen nor are the solutions. The problem is not that "we are logging into a computer that is elsewhere" and the solution is definitely not "trust." I don't want to trust the cloud. 

Even if I wanted to, I couldn't. Transactions and exchanges don't have much to do with trust - I buy insurance, stocks, services and so on, none of this is based on trust. Its based on contracts, roles, responsibilities, obligations, adjudications, cost, accountability and governance.

With another huge new wave of development coming down the pipe in Cloud Computing, we security people can't simply gloss over the hard stuff like governance and accountability (because "we've got it all figured out"), sit around sucking our thumbs while it all gets built out and then complain about the decisions after the fact. that is getting pretty old.

Its much more effective to focus on building security into the systems we design, and operate. I don't want to trust the cloud, I want to build margins of safety.

Update: Don't Cede the Cloud

Next casualty: Your Data

Dear Challenger, Gray & Christmas,

Like your hard chargin' atitude to keep people in their jobs, but to paraphrase Marge Gunderson I'm not sure I agree with you a hundred percent on your career advice, there, Lou  (wsj):

Many corporate perks have gotten the axe as the recession has dragged on. The next casualty: Your vacation.

Most people think that taking a couple weeks away from the office is a good way to recharge the batteries. But employment firm Challenger Gray & Christmas says that in this economy it might also be a good way to get yourself fired.

Technology has made it possible to take the office with you, and Challenger suggests that this is a good idea. Here’s the company’s advice for workers looking to take some time off:

* Don’t go away for two weeks or even one. Instead, take a day or two around a long weekend.

* Make sure there’s a wireless Internet connection wherever you go.

* Bring your laptop, BlackBerry, and important work documents with you.

Is it just me or does laptops + important work documents + poolside daiquiris not seem like a good idea your mind, spirit or data protection?

GloboFederation Wisdom from the Twitterverse

This is too good to leave in the twitterverse, from Paul Madsen or @paulmadsen: 

Globalization- going into a store & most of the stock came from elsewhere 

Federation- going to a site & most data came from elsewhere

In both cases its identity that makes the linkage. As Chris Ceppi told me one time The World is Flat explains federation better than anything else. Going the next logical step, its your identity that tells you the right balance between Lexuses and Olive Trees.

Aneesh Chopra - Its about Cloud and Security

Washington Wire:

President Barack Obama’s pick for the nation’s first Chief Technology Officer, Aneesh Chopra, got one step closer to getting some keys to his new office Wednesday afternoon, when a Senate panel approved his nomination unanimously Wednesday afternoon.

...Democratic Sen. Mark Udall of Colorado asked about the benefits and downsides of “cloud computing” – where data and software is accessed from remote servers – and “what should the Obama Administration do to realize the benefits of ‘cloud computing’?”

“Cloud computing as a number of advantages, including reduced cost, increased storage, higher levels of automation, increased flexibility, and higher levels of employee mobility,” Chopra responded. “The federal government should be exploring greater use of cloud computing where appropriate.”

...Increased use of government geospatial technologies and cybersecurity were on the mind of Democratic Sen. Bill Nelson of Florida, who asked Chopra how he saw his role “in ensuring that we have an effective, national cybersecurity strategy?”

“If confirmed, I would emphasize a research program on ‘game-changing’ ideas in cybersecurity, to find new ideas that might transform the nation’s information infrastructure to be more secure and simpler to understand and use,” Chopra wrote. “The goal is to make it ‘easy to do the right thing, hard to do the wrong things and easy to recover when the wrong thing happens anyway.’”

Pretty reasonable stuff, especially ‘easy to do the right thing, hard to do the wrong things and easy to recover when the wrong thing happens anyway.’, what I have wanted for eons in application security is nothing more or less than a Try...Catch block that enforces a AAA boundary container on any network program. Is that so much to ask? remember how often CGI/PERL driven sites used to crash? Do you think programmers are that much better now? I think we see much greater scale and fewer crashes because of this one simple safety mechanism (plus memory mgmt).

As far as game changing ideas to "transform the nation’s information infrastructure", I am less sold on this, I think we have limited options for solving problems in the infrastructure, and the real opportunities lie in the infostructure.

Schadenfreude in the Cloud

I guess everything is migrating to the cloud, even schadenfreude. Chandler over at The New School blog, coined a new term:

cloudenfreude — Feeling of happiness at watching the discomfort of others, especially senior management, as they accept in aggregate for *aaS the same risks which were easily accepted piecemeal over time for the analgous service internally.

I like it, but one small suggestion, I like to use some (air) quotes when I use words like "internal", as in "its ok, we are running xyz service on a 'trusted', 'internal' network."

Your Cloud Security Model - Physical Access Controls & Background Checks

Kim Cameron blogs on a recent industry panel on (what else?) cloud computing (emphasis added)

There was a lot of enthusiasm about the potential of cutting costs.  The discussion wasn’t so much about whether cloud services would be helpful, as about what kinds of things the cloud could be used for.  A government architect sitting beside me thought it was a no-brainer that informational web sites could be outsourced.  His enthusiasm for putting confidential information in the cloud was more restrained.

Quite a bit of discussion centered on how “compliance” could be achieved in the cloud.  The panel was all over the place on the answer.  At one end of the spectrum was a provider who maintained that nothing changed in terms of compliance - it was just a matter of oursourcing.  Rather than creating vast multi-tenant databases, this provider argued that virtualization would allow hosted services to be treated as being logically located “in the enterprise”.

At the other end of the spectrum was a vendor who argued that if the cloud followed “normal” practices of data protection, multi-tenancy (in the sense of many customers sharing the same database or other resource) would not be an issue.  According to him, any compliance problems were due to the way requirements were specified in the first place.  It seemed obvious to him that compliance requirements need to be totally reworked to adjust to the realities of the cloud.

Someone from the audience asked whether cloud vendors really wanted to deal with high value data.  In other words, was there a business case for cloud computing once valuable resources were involved?  And did cloud providers want to address this relatively constrained part of the potential market?
The discussion made it crystal clear that questions of security, privacy and compliance in the cloud are going to require really deep thinking if we want to build trustworthy services.

The session also convinced me that those of us who care about trustworthy infrastructure are in for some rough weather.  One of the vendors shook me to the core when he said, “If you have the right physical access controls and the right background checks on employees, then you don’t need encryption”.
I have to say I almost choked.  When you build gigantic, hypercentralized, data repositories of valuable private data - honeypots on a scale never before known - you had better take advantage of all the relevant technologies allowing you to build concentric perimeters of protection.  Come on, people - it isn’t just a matter of replicating in the cloud the things we do in enterprises that by their very nature benefit from firewalled separation from other enterprises, departmental isolation and separation of duty inside the enterprise, and physical partitioning.  

First off, we need to get Kim to spend more time in the field ;-P, one of my "favorite" stories came from an early app sec enagagement circa 2000 and we were trying to convince a CISO to scan an web facing app that ran the entire company for vulns, we literally could not get the individual to sign off on a very small piece of work. 

When we probed for why, the response was - "well if we scan the app we may find some things." "yes, ok, we may find some issues in the app that runs the entire business so...what's the problem?" "well then we would need to fix them."

I mean I am sure this sounds crazy, but realistically we're in an industry with a multi-decade record of non-innovation so there is no real reason to assume that most companies are going to roll out a cloud with anything more than "physical access controls & background checks"

What's your favorite story?

Munger Interview with Stanford Law

One more Berkshire note, here is an excerpt from a must read interview with Charlie Munger from Stanford Law.

Grundfest: As we look at the current situation, how much of the responsibility would you lay at the feet of the accounting profession? 

Munger: I would argue that a majority of the horrors we face would not have happened if the accounting profession developed and enforced better accounting. They are way too liberal in providing the kind of accounting the financial promoters want. They’ve sold out, and they do not even realize that they’ve sold out. 

Grundfest: Would you give an example of a particular accounting practice you find problematic? 

Munger: Take derivative trading with mark-to-market accounting, which degenerates into mark-to-model. Two firms make a big derivative trade and the accountants on both sides show a large profit from the same trade. 

Grundfest: And they can’t both be right. But both of them are following the rules. 

Munger: Yes, and nobody is even bothered by the folly. It violates the most elemental principles of common sense. And the reasons they do it are: (1) there’s a demand for it from the financial promoters, (2) fixing the system is hard work, and (3) they are afraid that a sensible fix might create new responsibilities that cause new litigation risks for accountants.  

This situation is very comparable to what happens in when auditors interview infosec. Auditor asks -do you have a firewall? Infosec says yes. Check.

Its too bad but assumptions of yesteryear lead to building things on shaky foundations

Omaha recap

For the second year in a row I attended the Berkshire Hathaway (NYSE:BRK.A) annual meeting, aka Woodstock for Capitalists. This year the group included John Steven, Richard Bejtlich and Andre Durand. You can read Richard's "False Precision" and Andre's "Buffet the Anti-Trump" notes. Here are some of mine:

* First off Warren Buffett and Charlie Munger answered questions for six hours and only presented one slide. (The slide as you might expect was pretty interesting it showed a T bill they purchased in Dec 08 that paid out a *negative* yield in April 09)

* One theme throughout was simplicity. If you need a computer to figure it out then just put it in the "too hard" pile, plenty of money to be made with lower risk doing things you can understand. (one quote I keep on my security checklists is from Buffett - "the sign above the players' entrance to the field at Notre Dame reads 'Play Like a Champion Today.' I sometimes joke that the sign at Nebraska reads 'Remember Your Helmet.'  Charlie and I are 'Remember Your Helmet' kind of guys. We like to keep it simple.)

* Munger said a lot of the new regulations wouldn't be needed if accountants had simply done their job

* Buffett said if he ran a business school there would be two courses 1) how to value a business 2) how to think about markets. You can get most of this from Ben Graham's Intelligent Investor. Instead MBAs are trained on fairy tales like efficient market theory which leads to madness like excess leverage, derivatives and all the rest. As Buffett said "I would have to have to teach efficient market theory. You stand up in class the first day facing all these eager fresh young minds, and you say 'well everything is priced perfectly', what do you do the rest of the semester?"

After the big meeting on Saturday, I spent Sunday morning listening to Tom Gayner and Steve Markel from Markel, I wrote up the notes here. One thing I neglected in the earlier post was Gayner's comments on being careful about bi-modal outcomes. He gave the example of several financial companies and said, well they are trading in single digits now, and there is tremendous upside if they come out Ok. But you don't know what will happen and there is a bi-modal outcome problem where they could be worth $50/share and you could make 8-10x your money or they could be worth zero. It struck me that many of our security architectures have bi-modal outcomes - either things work perfectly or they break wide open, instead we should strive for defense in depth.