1 Raindrop

Mobile Security Back to the Future

Martin Fowler has a post on Cross Platform Mobile. One of the main challenges for Mobile development is dealing with different Mobile OS versions. Back in the day, OS version was a big deal for developers. We got away from this in large part with the Web (yes I know that a tremendous amount of code get written to support different browsers, but OS and particularly Mobile OS drag in a lot of other dependencies).

The Cross Platform dream has been around a long time, the most famous example of this sword being pulled from the stone was Java. And its worked out reasonably well, but can we expect anything like this in Mobile especially given the fierce (dare I say 80 & 90s esque) competition?

Martin Fowler's advice on Cross Platform Mobile is summed up as - "don't do it" due UI, usability and other issues. There is an additional challenge to Cross Platform Mobile which is that the security models are not alike. iOs, Android, and others each contain unique access control models, ways of dealing with sensitive data, attack surface, exception handling, network security, distribution code signing and so on. The flavors of these are very much OS dependent. This requires OS specific policies and security mechanisms. These are deployed and managed separately for each OS and so from a security perspective there is not a Cross Platform model that is available at all. iOs keychain is useless in Android, Android's permissions model is useless in iOs. No one anywhere can hablo security Esperanto.

I would expect and hope that we'll some more standardization in Mobile web services like Salesforce.com demonstrated with their oauth Android implementation, but I am not optimistic on the Mobile OS.

**

Secure Coding Training Class: Mobile AppSec Triathlon

Do you have what it takes to complete a triathlon on three vital topics in the mobile world: Mobile application security, web services security, and mobile identity management?

Come join two leading experts, Gunnar Peterson and Ken van Wyk, for the first Mobile App Security Triathlon, in San Jose, California, on November 2-4, 2011.

 

One in a billion

ONE IN A BILLION: A BOY'S LIFE, A MEDICAL MYSTERY its an amazing story of early stage DNA sequencing technology's impact on a family; that story is wonderfully told, and the Milwaukee Journal Sentinel beat out WSJ, WaPo and other big boys with this story to win the Pulitzer. I recommend reading all three parts when you have time. 

There is one part that is very relevant to infosec, as the doctors search for a cause or cure to the mystery disease

"One of the problems is: Without a therapy, do you want a diagnosis?" asks Walter Gilbert, an emeritus professor at Harvard who shared the 1980 Nobel Prize in chemistry for developing a method of sequencing DNA.

"It's a cost issue. Will somebody pay for it? For insurance to pay, it's not enough that the patient wants it or the doctor wants it, but the insurance company has to agree that it's useful in some way."

The inter-related parts of testing, mechanisms and incentives are right out of Ross Anderson's Security Engineering framework

 

Often the challenges in dealing with security findings is not that we don't know how to fix something, its that there might not be a practical way to deploy a fix. Incentives (often economic) drive people's priorities to address policy matters, implement fixes and conduct additional testing, but its a balancing act to get the right allocation across each of these activities.

Limits of Regulation

Last week, at the Twin Cities IANS conference, Marcus Ranum said that "security is not science, its voodoo. The auditor comes in and you sacrifice a chicken." There are limits to this approach's  effectiveness over time.

WSJ reports that Florida is one of three states where interior decorators must be licensed before they hang a single painting or arrange a couch in an office, home or school. There are now attempts to deregulate this industry, but these attempts have met with predictable push back from entrenched interests:

 

That possibility has the state's licensed interior designers ruffled. They've hired Ron Book, one of the state's most influential lobbyists, to fight the bill. And they've stormed legislative hearings to warn of the mayhem that would ensue if the measure passes.

Among the scenarios they've conjured: flammable carpets sparking infernos; porous countertops spreading bacteria; jail furnishings being turned into weapons.

The thought of "someone in my position that thinks they know what they're doing because they watched HGTV for two weeks scares me," licensed interior designer Terra Sherlock said at a hearing in March.

Another licensed designer, Michelle Earley, argued that use of the wrong fabrics in hospitals could spread infection. By deregulating, she told lawmakers, "what you're basically doing is contributing to 88,000 deaths every year," citing a study by the Centers for Disease Control and Prevention on deaths from hospital-acquired infections.

...

Interior design "sounds like this simple hanging curtains on a wall," said Ms. Earley in an interview. But "it only takes a couple things to go wrong for people to lose their lives."

So there you have it - infosec clearly does not own a monopoly on FUD! People who attempt to operate these design businesses without certification are subject to fines and other disciplinary actions.

What I find fascinating about the story is the ability of incentives to drive behavior that is completely out of whack with reality. In Infosec we see audit and regulations driving behavior on a daily basis, and its not all bad, but it would be helpful if the policy makers take care to align the regulations to what matters.

On a related note: Lenny Zeltser looks whether compliance helps or hinders security

My favorite line in the CSA Guidance

Is this:  “A portion of the cost savings obtained by Cloud Computing services must be invested into increased scrutiny of the security capabilities of the provider, application of security controls, and ongoing detailed assessments and audits, to ensure requirements are continuously met”

There's no question that some companies can save a lot of money by using Cloud services. But saving money on paper versus the real world is two different things.

If you find a way to save some money via Cloud ask yourself:

* what capabilities are you going to use to Verify identity, access and data to and  from the Cloud?

* what Visibility do you have into the identity, access and data to and from the Cloud?

The answer in both of these cases almost guarantees that your organization requires new technologies for Verifying identity (such as STS and XACML PEP) and for Visibility (such as Monitoring services and Gateways). They will need to be mapped to the Cloud providers that you are working with as well. 

So given the hypothetical $100 cost savings, some portion of that $100 savings needs to be invested in Verification and Visibility capabilities. Otherwise the cost savings are as illusory as cardboard desks.

Arggh! The Price of Piracy

Value Line has an interesting commentary on the current Pace and Price of Piracy  

"Acts of piracy have been increasing rapidly in recent years. Attacks on ships rose from 300 in 2008 to over 450 in 2010. Most of the increase (95%) is due to the activity of Somali bandits in the western Indian Ocean.  Through the first two months of 2011 there were 12 hijackings just in the Gulf of Aden, (directly off the coast of Somalia), compared to 52 in all of 2011. And the criminals have been extending their reach throughout the Indian Ocean, using captured modern vessels as mother ships for operations; the nerve. On March 1st, Somali pirates were holding 30 ships, including two oil tankers, and 660 seafarers hostage for ransom according to the EU anti-piracy task force."

In addition to creating a much more dangerous environment for seafarers, the article estimates the cost of piracy at $7-12 Billion/year.

Enforcement and security are difficult because the US Navy is spread thin. The courts are not much use, because the laws that govern piracy are outdated (Sea robbery laws from the 17th century) and irrelevant (can only prosecute if the robbery is successful!).

In addition to the legal issues, its not clear what the roles and responsibilities should be

The question of jurisdiction is also a sticking point. To illustrate, where should legal proceedings take place concerning a freed vessel in the Gulf of Aden that is owned by a Dubai company, but registered in Panama, carrying a cargo from Brazil, captained by a Pakistani, and crewed by Ghanaians, Egyptians, and Bangladeshis?  Very few vessels are under U.S. flag due to tax reasons. Most cases of piracy in international waters have ended up in Kenya, which does have a developed justice protocol. But that court system is now overwhelmed and turning away new cases.

And the pirates have high economic incentives to continue on despite the risks, the local economy not offering anywhere near the earning potential compared to the average $5m ransom payout.

What happens in the end from a developed world perspective is that the shipping companies are looking at various ways to fight back, and continue to increase spending on security and insurance. These costs then get indirectly passed onto the end consumer.

Its clear that infosec is inhabiting a similar world of asymmetric engagement, unclear jurisdictions, and economic incentives. 

Upcoming Talks and Training

I have two talks and public training to announce

I am doing the keynote - a security state of the union - at IANS Twin Cities Information Security Forum on April 13.

In Colorado am teaching a Cloud Security workshop at Cloud Identity Summit and speaking at the conference as well.

Forecast Calls for 7-8 Atlantic Hurricanes in 2011

According to Tropical Storm Risk, we can expect 7.5 Hurricanes to be precise, this goes along with 14.2 projected Tropical Storms & 3.6 Intense hurricanes on the Atlantic this year. All are above 61 year norms but below 2010 season

Of course, just like in "cyber"security people overfocus on the possible threats instead of worrying about assets. Weatherman swinging from a telephone pole beats nerd with balance sheet every time.

This leads to crazy behavior, such as the state of Florida who know no insurer wants to write a policy without getting paid to take on this risk. So what happens? The state of Florida steps in to underwrite policies through Citizens Insurance. Citizens Insurance is estimated to have more than $240 billion dollars in risk exposure if Florida is hit by a "century storm". Citizens' reserves is  currently approximately $15 billion.

While "once in a century" probabilities strike me as pretty theoretical (like 7.5 hurricanes this year), the $240b exposure strikes me as anything but.

False precision in probabilities leads to deceiving yourself that you know the odds and are taking a calculated risk. In fact, risk is permanent loss not a probability. In Florida's case a single storm can turn their economy into Greece (minus $225 Billion) in a 24 hour period.

Time would be better spent on fixing the balance sheet rather than guessing on probabilities.

Its the same in infosec, who cares if its APT, malicious insider, malicious outsider, fraud or a robot trader. The assets you need are the assets you need. That's our job to find cost effective ways to protect them. Obsessing about whether its 7 hurricanes or 12 matters little if 1 is enough to wipe you out.

Obsessing about whether "insiders" or "outsiders" are the biggest threat, if your supply chain and customers are spread out everywhere and if your enterprise is connecting everything to everything else, well then does your security architecture reflect this? Or only your risk models?

Infosec comes up a new threat du jour every year, now its APT, but the same people obsessing about this are the same people who have not improved username/password authentication or anything else in the runtime, but keep "discovering" new threats.

What might this mean in infosec? Applications, data and identity are the DNA of the business, how are these insured? What margins of safety regardless of threat have you built around them?

The "I know" and "I don't know" schools of security architecture apply here. "I know" should focus on identifying and protecting assets, "I don't know" applies to threats. In terms of resources, its better to eschew spending time on fixating on what you don't know. Simply accept you don't know and operate accordingly, instead focus on survivability of what you know.

Bad Bidding Bots

For the third time in twelve months there is some public evidence of reliability issues on major exchanges.

Last May it was the Flash Crash, which I need to point out - did not get ascribed to malice. However, it did point out the overall fragility of the system. 

People in general and security people in particular overfocus on threats. From an engineering standpoint it does not matter if its mailicious or accidental. The catalyst could be the mafia or it could be Homer Simpson falling asleep on his keyboard. If rm -r makes your data go bye-bye, then its not a matter of intent, its a matter of how resilient your system is.

 

Then in October we had the Nasdaq attack. And now we have another public report

Data Guru Battles BotTraders:

Hunsader theorizes that one new algorithm appears to be trading E-mini S&P 500 Futures (they're a fraction the size of standard S&P futures contracts) at the Chicago Mercantile Exchange. The algo alters the prices of related instruments, like index-based the SPDR S&P 500 (SPY) exchange-traded fund and underlying Standard & Poor's 500 stocks and options -- creating arbitrage opportunities; when it's active, the bid-ask spread on SPY as traded on Nasdaq's Philadelphia exchange sometimes widens from a penny to a dollar. The spreads on the SPY stay within a penny on other exchanges.

And, says Hunsader, the algorithm instantly buys or sells enough E-mini contracts to trade through the top three levels of the electronically displayed order book in about 50 milliseconds. He detected the trading pattern on 18 days in March. The CME had no comment.

Another algorithm, says Hunsader, changes order sizes at the top of the order book in about 20 to 40 stocks on Nasdaq for a few milliseconds several times a day. Each stock is traded anywhere from 2,000 to 4,000 times a second, double to quadruple the norm. The activity floods the quote system with trade data, but so far seems to cause no harm. On March 16, the CQS saw peak-volume traffic hit warp speed: a record 390,000 messages per second for all stock symbols between 11:01 a.m. and 11:02 a.m. (A year ago, such volume would have swamped the CQS, as peak capacity was 200,000 messages a second.) At 11:01:48 a.m. -- the peak of the weird trading -- 10.5% of the quotes on CQS were locked or crossed, meaning that the bid exceeded the offer. The next second, it was 13%. Usually, about 3% of trades are crossed.

These trading systems has particularly nice features for the attacker - ability to automate bots and to monetize. With the markets moving to high frequency trading it gives plenty of room for malicious actors to operate in.

 

Looking Backwards from the Future

The Wall St Journal reported on a set of studies to see if people would turn from spenders to savers if they looked through VR at their older self. What would your older self want you to do? Buy that humungous TV or put some money away for a rainy day?

For some perspective, China's saving rate is close to 50%,while the US hovers close to zero percent.  This study showed that people's willingness to save increased when looking at their future selves. Jim Rogers has a great practice on saving - when you think of buying something today, simply multiply its cost by twenty to see how much it will be worth down the road when you are retired. A dinner out is "only" $75, but would you still go out to eat if you figured the cost at $1,500? Warren Buffett pithily sums this up as - do I really need a $300,000 haircut?

Enterprise investment in security is quite similar, the near term returns and cost avoidance are hard to clarify for security pros and easy to pass on for managers, but what if you look back at yourself dealing with a security event? Would that change your thinking about the right investments to make today?

For my part, I see very little difference in the mindset of planning and saving for a rainy day and planning and investing for security event.

There is one twist in the enterprise though - the never-ending reorganizations! For individuals thinking about retirements its mainly a when not an if. But in the enterprise, where re-orgs every six months are the norm, the manager is not able to view themselves dealing with a breach because the person sitting in the chair will be someone else! 

I have heard it said that you should never write a project plan that extends over six months because by then the sponsors and management will be gone (note - I think this fact more than anything else is responsible for the success of agile methods). This is particularly problematic for security where some longer term view is required in design and architecture.

Incident response plans can be a good source of the looking backward from the future view, use the security events in those planning exercises to see what you'll wish you had had in place. Hint: logs.