1 Raindrop

Don't Trust. And Verify.

I have a new paper in the current IEEE Security & Privacy Journal, called "Don't Trust. And Verify." It describes a Security Architecture Stack for the Cloud. It covers some of the ground that I discussed in my keynote at Cloud Identity Summit. 

There are four patterns that I see as key for Cloud Security: Gateways, Monitoring Services, Security Token Services and PEP/PDP. 

I think that using patterns is a different way to approach security architecture from how its normally done. There are certainly other technologies, patterns and processes that are vital to Cloud Security, but I see these four as essential - not because they give us a magic way to trust the cloud, but rather because they give us a way to verify.

Oh, and one more thing, in the recent multi billion dollar spate of security company acquisitions, one of the reasons inevitably given by the acquiring company was more focus on Cloud and mobile security. But most of those acquisitions do not address the aforementioned patterns in any great detail, so there is a lot of opportunity for the security industry to improve going forward.

Reconcile This

I had to check the date to make sure that it was't 1995 when I read this: 

The survey of IT pros and C-level executives from 450 Fortune 1000 companies -- commissioned by FishNet Security -- also found that 45 percent say firewalls are their priority security purchase, followed by antivirus (39 percent), and authentication (31 percent) and anti-malware tools (31 percent).

And what threats are these IT Pros and C-level execs concerned about?

Nearly 70 percent say mobile computing is the biggest threat to security today, closely followed by social networks (68 percent), and cloud computing platforms (35 percent). Around 65 percent rank mobile computing the top threat in the next two years, and 62 percent say cloud computing will be the biggest threat, bumping social networks.

Let's see what do mobile computing, social networking, and cloud computing all have in common? Oh yes, they all bypass the firewall's "controls"!

How do you reconcile spending on something (firewalls) that does not address any of your top threats? This dichotomy is infosec's biggest problem. We have plenty of good controls and processes to use, what we don't have is enough talent in infosec to integrate them and put them to use. 

The reason infosec has such a focus on infrastructure and network security has nothing to do with those being the primary threats, its because that is the background of most people in infosec. The infrastructure mindset is hardwired into enterprise infosec culture to the point of blinding themselves to their own recognized threats.

How does this get reconciled? Apparently, its not reconciled by the majority of infosec practitioners, but it does get reconciled; it gets reconciled by threats who feast on this yawning gap between firewall theory and threat reality. At least infosec got one part right:

The respondents were fairly fatalistic about breaches: more than 90 percent of the respondents expect the number of data breaches to increase, and nearly 60 percent expect theft or loss of mobile devices to make up the majority of breaches. Around 54 percent say organized cybercrime would be the source of most breaches, and 52 percent, accidental data exposure.

Well done. I concur, breaches will increase and the reason they'll increase is every dollar you spend on last decade's threats is a dollar you don't spend making the criminals' life harder. I wonder if the infosec managers who spend so many dollars on firewalls get holiday cards from organized crime?

Two Things that Everyone in Infosec Agrees WIth

Infosec is a seemingly fractious bunch, but there are two things you can basically get almost everyone in the industry to agree with:

1. They should never, ever have to justify themselves to the business with a ROI case

2. They need more money from the business and don't understand why it is so hard to get

Architecting the Ultimate Control Point

Over on Dzone, on Wednesday, October 13, I am doing a webinar on Architecting the Ultimate Control Point. We'll cover Security Policy Lifecycle, Decentralized Access Control, Defensive Programming with a Security Gateway, and externalizing Security Policy (impact on Dev, QA, Audit)

Monitoring up the Stack

Over at Securosis, there is an ongoing series called Monitoring Up the Stack, which examines how security monitoring can be achieved to collect and feed meaningful data to SIEM/Log Management platforms. I have four posts:

• Application Monitoring Part 1, Part 2
• Identity Monitoring
• User Activity Monitoring

The posts show some ways retrieve what I regard as a gold mine of data for security incident responders, namely the message data that flows through the applications and access control infrastructure. The apps and identity systems have one thing you can't get from network monitors - context. Thanks to Mike and Adrian for their many contributions throughout.

Confirmation Bias in Assessments

Here is a story from the St Paul Pioneer Press Roach-infested St Paul Restaurant in Danger of Closing for Good: 

A roach-infested University Avenue restaurant that likely sickened at least two patrons has been given another week while city officials consider closing it for good.

Veteran inspectors said the repeat public health violations at Kim Huoy Chor Asian Cuisine, at 1664 University Ave. in St. Paul, since the owner took over in 2007 amounted to the worst sustained conditions they've ever documented.

But following a tearful apology from the owner, a plea from a former city council member and a lone holdout on a short-staffed city council, no action was taken Wednesday evening, leaving open the possibility that some accord could be reached.

After dozens of inspections, city health inspectors recommended the harshest — and rarest — of sanctions for Kim Huoy Chor: Shut the place down.

"It's horrendous," said Bill Gunther, environmental-health manager for the city. In his 39 years with the city, Gunther said, he could recall only one other restaurant — a fast-food joint more than two decades ago — being recommended for closure.

City council members said they were grossed out by photographs taken during numerous inspections that showed rat droppings, dirty dishes piled waist-high on the floor — and on top of food ready to be served — and numerous cockroaches, live and dead.

One caption to a photo of a soggy box reads: "Cream cheese wontons in cardboard box that previously held raw chicken wings." Numerous such food storage and handling "critical violations" were documented. While roaches and rat poop make for better headlines, Gunther and other health officials note that improper food handling and storage is at least as dangerous because it can cause food-borne illnesses.

But there were critters, too. Assistant City Attorney Rachel Tierney said a "cockroach infestation" was confirmed by repeat sightings of roaches of all ages on numerous occasions. "Live roach in cup," read one photo caption. Inspectors observed cooks picking and wiping their noses and continuing to prepare food and clean surfaces, reports state. The city received two reports of patrons being sickened after eating there.

I know that reporters don't write their own headlines, and pardon for saying so, but I don't think the danger is that it might be closed, I think the danger is not that its closed, but rather that it stays open.

The point of an assessment is to evaluate against objective criteria - not to pass everyone. If no one ever fails, why have the test at all? Also, what message does it send to the other places if no one is ever closed down. Among the many smart things that PCI DSS creator did, when they launched the standard was to show they were serious with Cardsystems. It got everyone's attention. I also like the rule in California where the assessment scores are posted in the restaurant.

Notes & Observations on a Marginally Stable System

Last Friday (10/1/10), the SEC issued their report on last spring's Flash Crash. The Flash Crash led to, among other things, blue chip stalwarts like Procter & Gamble trading under $40, down from around $55 in a matter of minutes.

The parallels with what we see in infosec are stark, and there is a lot to be learned here. To add some context to the lessons learned in the SEC report and to examine  what the report hits and misses, this is quite a well reasoned post (emphasis added):

<snip>

3) Waddell-Reed is basically a widows and orphans mutual fund manager that was trying to hedge an $81 billion equity position. So it is not like they were some wild eyed speculator using 100 to 1 leverage or doing naked shorting. What they were doing was 100% legal, 100% moral, 100% rational and probably prudent.

4) The SEC report should have come out directly and said they every single firm and exchange they investigated was acting legally, morally and rationally in their own self interest. The SEC did not directly say it, but the implication to the public is that Waddell-Reed is somehow the bad guy in the flash crash. ABSOLUTELY NOT TRUE. In fact, what the SEC should have said to the public was that there were NO bad actors involved at all. The markets were working 100% like people intended them to work. Nothing irrational about them at all.

5) The SEC did NOT lay out a definitive action plan to prevent another flash crash from occurring. The reason for this is simple. They have NO plan. The markets have changed dramatically in structure over the last decade or so. In the “old days” when all trades were physically done on the NYSE, you could easily have fixed a problem if it occurred in the markets.

6) These days, there are countless exchanges and “dark pools” where trading occurs. The NYSE specialists are now called “designated market makers.” In the old days, they single handedly had responsibility for maintaining an “orderly market” in issues there were responsible for. These days, there are really NO substitutes for specialists. The High Frequency Traders fill that role some of the time, but as we learned during the flash crash, they can and will simply stop trading if they feel it is in their best interest. Even if the Designated Market Maker wanted to maintain an orderly market, how can he do it on the non-NYSE exchanges and dark pools?

7) The SEC did get one aspect correct. Trading is best described as a marginally stable system. What we learned is that it is relatively easy to have the system go unstable and out of control. Think of a jet fighter flying 100 feet off the ground at Mach 1. If something goes wrong, you get a large earth crater in a few milliseconds. That is kind of what our markets have evolved to. Incredibly high speeds with not much margin for error.

8) If the SEC was honest and upfront with the masses, here is what they would say. “Welcome to 2010. This is how markets now work. We can not reasonably guarantee another flash crash will be prevented. Matter of fact, we suggest you plan on them as a normal part of the investing landscape. But don’t worry, we believe they have NO long term impact on the fundamentals of equity investing. If stocks irrationally flash crash again, they will shortly go back to their correct, rational prices.”

9) As a practical matter, I don’t know how to put the genie of “stable” markets back into the bottle. While it is theoretically possible to do, there is so much money involved, I can’t imagine rolling back the clock. Stated differently: “Dorothy, we are NOT in Kansas anymore. Tapping your ruby red slippers together three times will NOT take us back to the stable markets of Kansas.”

</snip>

The whole post is well worth reading, and the author's statements of how a network evolves ring true. The actors in the network evolve, the use cases on the network evolve, but do the safety and security mechanisms evolve in parallel? In this case as in so many others, its clear that the emergent behavior exposed the lack of safety in the system, even when the actors were not intentionally acting out of malice. 

Networked actors are increasingly reliant on both the networked system and the behaviors of the actors. As new use cases are layered on top of the network, the behaviors of the other players matters. One way to protect yourself is to leave aside the theory of exogenous risk in a network (like roulette where the other player's behavior does not matter) and instead remember the risks we deal with are endogenous risk in our networks (like poker where the actions of the other players impact the outcome).

Another way to protect yourself is to heed the SEC that this is a marginally stable system at best so design for failure and build margins of safety.

Simian Security Arms Race

I am always interested to find examples of arms races in security, here is a recent one. India has hired langur monkeys to protect the Commonwealth Games from other SImians that run wild in Delhi.

 

"Because they are large and fierce, langurs are often used in India to keep other monkeys in check in public places.

The New Delhi Municipal Council said it will put langurs on duty outside several venues starting Wednesday.

"We have deployed 38 langurs and it is a very effective way to scare away the common monkeys," NDMC spokesman Anand Tiwari told Reuters. "We take these langurs on rent. Their trainers accompany them and once the assignment is over, they return home.""

Hopefully this will work, but the FT is cautious in its editorial Monkey Business:

This tactic has limits. If the langurs slip their handlers and run amok, the answer will not be to reach for the next size up: that route ends with the proverbial 800lb silverback. At some point, man must re-engage with ape.

Past human-ape collaboration has reflected well on all involved. Intrepid chimps have ventured into space. Apes of a thespian bent have cut a dash on the big and small screens. And others have forged careers as painters, albeit of an abstract school. Works by a chimpanzee named Congo, whose fans included Dali, Picasso and Miro, sold for a five-figure sum.