1 Raindrop

Trusting Trust - SaaS Edition

Many of the worst security problems arise when formerly good assumptions change. Robin Roberts summed it up this way - "security systems are built up on assumptions, but you cannot after the fact go back and query the system about the assumptions that were made when it was built."

Tal Klein and colleagues came across an interesting piece of malware which amounts to - when SaaS met Zeus. Banks, of course, are used to coping with malware like this. They have won and lost many battles, but they're actively engaged and ratchet down controls on a daily basis. However, SaaS apps that we increasingly rely on, were never designed for anything remotely like Zeus and other advanced, targeted malware. 

Its not just a design problem, its a use case problem. Banking use cases are pretty straightforward, you do your banking and then go on about your day and back to work. But SaaS is increasingly, your work. Its open all day, sales people live their whole workday in their CRM, developers live in Github. Bank apps are - closed, open and use, and close again lifecycle. SaaS apps are come in in the morning, fire up SaaS apps, leave open all day and then (maybe) close when you leave. There is a lot of attack surface there. 

What's the risk? Hard to say. The example in Tal Klein's post is harvesting contacts, that does not sound as bad as draining bank accounts, but the part that's worrisome is what else is potentially available.

Where does this go next? Its hard to imagine how SaaS vendors can deliver a bank level of security, and harder still to imagine their customers accepting it. The more compelling piece here is the implied weakness in the shared responsiblity model. As Tal Klein says " this isn't a Salesforce vulnerability", there is only so much that a SaaS vendor can do, so even if their controls are upgraded, their customer's security posture is the key determining factor in warding off this attack. Which leads to the heart of the matter, most customers look to SaaS as a way to offload responsibility, but they also need to remember their own systems can be the target.

SaaS security review projects compare SaaS vendors' capabilities using CSA or homegrown checklists, the focus is on the vendor, but what about the consumer's own resiliency to CSRF, Forced browsing and other attacks that use that preestablished mutual trust? Cloud security assessment are not a one way street, both the consumer and the provider's posture and their combined behavior must be factored in.

Trusting trust is not a new problem.There is a difference being trusting and trustworthiness. SaaS assessments look at the trustworthiness of the SaaS vendor mostly in isolation, but the question to ask is whether the end to end system is trustworthy? And practically speaking what can cloud consumers do harden their systems.

There's No Such Thing as Bad Weather Only Bad Clothes

Infosec can, at times, be disheartening. You look at Apple's #gotofail and you think - how did they manage to screw up the most fundamental and oldest security protocol on such a wide scale with such an old bug? On days like that it can feel like, if someone like Apple cannot get the basics right, what chance does an average company have?

But on the other hand, I see company after company, where the security teams are just getting started at looking at what matters - appsec, identity, data. New appsec teams with real tools, real budgets, and real mandates. In terms of actual defensive effort - its early days. People love to tell scary stories about threats and how defenders will always lose and how the problems are overwhelming, but I wonder if most of the problems we have are due to the fact we have not really tried to solve them yet.

Problems that are presented as intractable with all powerful opponents sometimes just need new efforts. Around 60 years ago, the air quality in Los Angeles, was awful, it was seen as an unsolveable problem but smog pollution dropped 98% in the last 50 years. Why? Cleaner fuel, cleaner cars, intelligent regulation.

A few inches of snow is enough to close down many US airports and delay travels for days. But over in Scandinavia, home of eleven months of winter and one month of darn poor sledding, you see track records like Stockholm's Arlanda airport where they have not had to close due to snow in 50 years. Oslo and Helsinki have similar records. 

Think about that. It cold enough that planes need to be deiced starting in August, yet these Nordic airports have better success battling more hostile elements than Atlanta or Minneapolis. Why? Well one answer is they cared and they tried. 

The snow plow drivers basically do not take breaks, colleagues run and hand them coffee so they can keep plowing without getting out of the plow. They take pride in their track record. They practice. Crews run drills against 20 different weather patterns. The airports do not use off the rack technology, they create purpose built tools and design equipment for their specialized requirements, the largest snow blowers in the world, capable of moving one ton of snow a second, and machines that can plow, sweep and blow snow simultaneously.

The Infosec industry has struggled to this point because its been dominated by a "Weather channel" mentality, romanticizing threats, raving about Snownamis. Despite our challenges, I think Infosec at this point is in a good place going forward, where like the smog war in LA we have recognized the problem. Like Nordic airports we are seeing companies revamping tools and processes and digging in for the next phase. Making an effort. As unsettling as it feels when a company like Apple has a bug as bad as #gotofail, its also worth thinking about what infosec may look like once the investments that many companies are making new security teams, tools and processes eventually bear fruit.

"...be aware that the market does not turn when it sees light at the end of the tunnel. It turns when all looks black, but just a subtle shade less black than the day before,"
-Jeremy Grantham, "Reinvesting When Terrified", March 2009

There is a lot to do, can't get started any sooner than right now. No such thing as bad winter weather, only opportunities to improve bad snow removal equipment, dysfunctional teams and processes.

 

Measuring Moats

Whether its a breach, credit card theft, IP copying or something other event, the impact is best conceptualized in terms of how it impacts competitive advantage

Michael Mauboussin shares some ideas on Measuring Moats which is a good way to think about defining security metrics, which events impact the moat?

Businesses have different kind of moats, and so the way to measure business value for a company with moat based on the network effect differs from the measures used on a company whose moat is based on efficient scale. The most valuable security metrics are ones that are tied to the company' competitive advantage.

One limitation here is that plenty of companies have no moat at all. Morningstar rates that out of its coverage universe of around 5,000 companies only 1,033 have a moat. The rating is subjective obviously, but if you are working for an airline (an industry that has been lighting money on fire for a century (see page 13)) it will be hard to measure a competitive advantage. It also isn't simple to see how it will work for non-profits and the like, but for other companies its a useful tool.

As I said in my SIRA talk

"the best work on this is done by Morningstar which pioneered the concept called moats (patterned on Michael Porter's work on competitive advantage)

Morningstar identified five kinds of moats

1. Low Cost producer: better profit margins through lower cost, example Walmart

2. High Switching Costs: disincentive for a customer to switch to competitor leads to customer retention and pricing power example banks or proprietary software

3. Network Effect: virtuous cycle where the network gets more valuable the more people use it example Google

4. Intangible Assets : brands, IP, trademarks, patents, government agreements

5. Efficient Scale: a limited market served by small number of vendors example Lockheed Martin - you only need one nextgen strike fighter supplier

When I teach secure coding to developers, most of the examples we use to say show SQL injection works involve stealing credit cards. So I joke that stealing credit cards is the "Hello World" of computer security, I stole the cards out of the database so now I know how SQL Injection works, but of course this is not the end of the story just like Hello World isn't everything you need to know to write Python.

Businesses that have one of the above types of moats have widely different assets that they require to ensure their moats endure, the old school notion of breach does not pertain directly to most of their competitive advantage, but its more than just IP that's only one type of moat and most businesses don't have IP moats. So the campaigns to be concerned about are the ones targeted at your business' moat and for us to begin to value those that requires at least five different models to analyze across industries.

This is a core lesson - defenders who try to defend everywhere defend nowhere. You have to pick your spots. The two most important things in infosec are Identifying what kind of moat your business has and then defending that moat."

That is also why there is no one, single answer for what to secure, its very industry specific and moat specific - for Pharma its IP and channel. For retail its brand loyalty, efficiency. The things to measure and defend are the those that map to the business' advantage not technical constructs

 

 

Open Letter to Satya Nadella, Re: Mobile Identity

Dear Satya Nadella,

 

Congratulations on your new role. I am excited that the board picked not only a tech CEO, but a middleware guy. There's great, latent power in Microsoft technologies and if middleware people know one thing, its connecting stuff together to create value.

 

I was further heartened by the "mobile first, cloud first" mantra you laid out in your first speech. I know you are busy, but here is one opportunity to consider, and I am pretty confident that customers will appreciate some focus on this issue.

 

The Mobile app everyone is banging the drum for is Office on mobile devices like iOS. However, I think there's another one that unlocks some more interesting use cases. There is no Active Directory for Mobile, and that is creating problems across basically every enterprise.

 

So far the bog standard enterprise response to Mobile has been MDM, a useful but limited management technology. Despite the fact that MDM sells like hotcakes, it provides little value to app developers and does not address identity integration. Enterprises that want to solve identity end to end are left to cobble something together themselves from pieces and parts. Would be better to think more like Boeing assembling purpose built components, but instead Mobile Identity is more Sanford and Son.

 

The industry has collectively been waiting these last five years for an Active Directory for mobile to fill that gap. What if the Active Directory for Mobile was Active Directory? I don't think there are big technical blocking factors to the device management side, and the value on the server/cloud side is a massive integration opportunity waiting to be unlocked.

 

So what are some of the use cases that customers need help with?

 

 

• Mobile identity for users on devices, not just devices
• Local authentication, disconnected mode
• Portability - consistent identity and policy on the device and on the cloud
• Granular access control - not just all or nothing access

Enterprises trying to solve these problems today are using duct tape to solve important security and identity problems, they would benefit from identity systems engineered from an end to end perspective. Its a giant open problem and the incumbents do not have incentives, beyond selling more hardware and ads, to solve it. Would be a great help to enterprises if someone solves it, why not Microsoft?

 

Sincerely,

Gunnar Peterson