The Learning Process Seem Hard .....

Once again mis-issued certificates are in the news. I would like to be able to say that this will not happen again but it seems that not enough people are willing to learn the history of Identity Management to begin to implement mitigation means that would reduce the impact of these events.

This time around it was an Indian Government Agency, NIC, that was in control of the issuing CA. Part of the process did work here in that the Indian Government's Auditing reacted fairly quickly to the issue and revoked the Issuing CA and for now has no plans to put that CA back online. That being said the work that Google and Yahoo will have to do to ensure that vulnerable browsers and Operating Systems take the correct action to mitigate the risk is not insignificant. On top of that we do also have the case that we are not sure that Google and Yahoo were the only ones affected ... at least not yet.

The timing of this for me is quite interesting as I am currently working with a client who is looking at options for certificate based authentication, both privately rooted and publicly rooted. They will use a hosted service but I was very insistent that they make sure to implement smart card based authentication for all administrators and then to ensure to implement practices and policies of log reviews to ensure that the known administrators are adhering to policy.

Sounds simple doesn't it? Implement a stronger means of authentication for RAs and LRAs and then review the issuance logs, which can be done automatically. So given this why are people not doing this? Yes some are but there are still many issuing CAs out there that allow RAs and LRAs to login with userid/password.

If you are a corporate or organizational Security Officer I encourage you to do a couple of things:

• If you operate a CA or operate an RA/LRA for a hosted or public CA service then implement strong authentication for the credentials used in the issuance process. If your CA vendor does not support that ... CHANGE VENDORS
• If you operate RAs or LRAs ensure that you run checks on a regular (preferably daily) basis to ensure your RA/LRA personnel are not compromised. This could be fully automated through scanning of logs
• If you have not gone through the Trusted Root stores that are used within your environment you should have that task looked into and clean the roots that you do not use.

Again these are not difficult things but my experience tells me that these things are not being completed across the board. If you want to stay off the front page of technical blogs and magazines I would suggest that taking some of the points above and start to implement them.

Again - history is a wonderful teacher .... but you need to understand history and how that history affects what you do

Is the Energy Sector Really a Cyber Target?

For years we have heard about cyber warfare - whether it was the categorization of cyber Pearl Harbor or the cyber equivalent of 9/11. Over the last couple of years we have definitely seen the increase in targeted attacks. Some of them generated in Western Nation States while others have been generated in Middle Eastern, Eastern European or Asian nation states. we have even seen, what appears to be, pure cyber-criminal attacks that have targeted resources to manipulate (banks and their transactions) as well as data to sell. The most recent case that has come to our attention is the 5 year odyssey that is now known as Red October.

What has been interesting is that some of these attacks have been built to be very targeted against industrial control systems. People are familiar with the term if they have looked at Flame or Stuxnet. In the case of Stuxnet it very much was a part of a larger operation to leverage the industrial control systems to halt the use of centrifuges. What many people do not realize is that these same control systems are implemented every where. Power plants, manufacturing facilities, water filtration and gas pipelines and the list goes on.

So what we have is a target in a broad environment space that is proven to be attackable. So what does it take to attack these systems? Well an understanding of what type of system is implemented and then basically access to the internet to get the command and control language that is used within the system. Some would say that it is not that simple and that is largely correct as I need to get at the system and these are within environments that are protected by firewalls etc.

That last statement is the false sense of security that we seem to have lived behind for quite some time. DHS recently released a report that indicated that 40% of cyber attacks were against the energy sector. An example was the discovery of advanced viruses/malware at 2 US energy plants late last year. Both of the attacks were apparently delivered through the same mechanism that was used to deliver Stuxnet (so not only are people re-using the code they are re-using the methods). One can surmise that the two plant attacks could have been prevented by following some very basic security procedures, including up to date software and not carrying drives between enclaves without safety mechanisms in place.

It is this last point that becomes the slap in the face to all of us. Congress has repeatedly refused to provide requirements for security for critical systems. There is the attitude that the government should not be telling private industry what to do. I do not necessarily disagree with the sentiment in most cases but we are not dealing with most cases here. There are many critical infrastructure segments but lets focus on energy here. If proper secure protocols are not followed the attacks against the energy sector will continue to be successful and to greater and greater degrees. Yes that is bad for he energy sector because of reputation and and actual financial loss but guess what I am using electricity now to write this blog. You are using it to read it. Your bank is using it to perform transactions that allow economic active to flow. Hospitals are using it to keep people alive. Of course I could go on. It is time that we recognize what has been demonstrated to be true and it is time it is responded to. If Congress cannot pass a "Here is how you fix the problem bill" then lets look to California and their data loss bills and pass legislation that is not prescriptive about how to protect your infrastructure but hold the companies HIGHLY accountable for not properly protecting their infrastructure. There is just too much at risk.

Stepping off the soap box.

Where do I start looking?

This past weekend I was lucky enough to get to hear some great conversations and presentations. It was part of my company's (Entrust) annual conference. The many conversations were with colleagues, partners and customers. The presentations that stood out were from customers, all saying what wonderful things we have done to help them but two in particular stand out that were more general. These two were talks given by Michael Chertoff (former head of DHS) and John Adams (former head of CSE, sort of NSA in Canada for those that need a basic explanation of CSE). Both men have a wonderful breadth of experience and a great view of what is needed to help protect the nations better.

Both men presented an interesting view of things and they certainly have the experience to be able to support their views. Their stories of how things were uncovered are beyond entertaining - the stories truly are frightening when it comes to what could have happened.

Given their experiences in very different environments they did have fairly common views as to what is needed:
- mitigation is key
- layering security is critical to achieve this
- there is no silver bullet
- you cannot protect the network - you must protect the data
- identity is single most valuable asset
- security challenges start with the individual

When one starts to look at these elements it can be broken down to items that apply specifically to businesses but also items that carry across both business and individuals. One important element of that is education. We need to do a better job of educating people with the elements of security that they need to be aware of and address themselves. We do this fairly well in medium to large businesses as to how they protect data with strong passwords and changing them often; keeping security software current; and managing patch updates. What we do not consistently do is to carry those ideas to end users in their homes. End users should not be using the same userid and password on all accounts. Grades of passwords are an effective way of reducing risk. One view that was shared was that 80% of security issues can be addressed by patch and password management. I am not sure that is measurable but certainly we could mitigate a lot of elements with these guidelines.

To re-enforce the above idea, in his discussion former Secretary Chertoff presented an interesting analogy - for some environments security is like an M&M - it has a hard shell but some soft, good eating on the inside. This goes directly to the idea that if users do not effectively manage their security they can create this false sense of security. "I have Microsoft Security Essentials - I am good". This view certainly does not address the password breach issue.

The idea of common userid/passwords across multiple applications at different assurance levels also challenges the implementation of your identity as your most valuable asset. Today too many of us use our email address and password as the login mechanism for a variety of applications, including things like online shopping, access to medical records and other applications. This opens users to phishing attacks that expose more than just access to email accounts but also to this potentially sensitive and possibly damaging information. We need to do a better job at making people aware of these things.

So the title of this post was "Where do I start looking?". Well maybe we need to start with looking at what we do ourselves and how we teach our children and friends about what is important to do when it comes to computer security. I know my kids are aware - are yours?

- Posted using BlogPress from my iPad

Location:Ellis St,San Francisco,United States

International Strategy in Cyberspace

I consider myself a fortunate person. Of course that starts with a wonderful and supportive family (it would be nice for the kids to get part-time jobs so they can contribute to that college education ..... but that aside) but for me I enjoy my work. It gives me some great opportunities and I do not mean just the traveling but it gives me opportunity to be involved with people who make a difference.

Today I was in a meeting of a group that I became involved with over a decade ago that was doing some great work on Critical Infrastructure Protection. That group morphed over the years, and in particular after the creation of DHS, into a group that focused on economic security. Now that may not have sounded all that interesting to many people 7 or 8 years ago but now with the importance of the cyber world to our economy .... things get a bit more interesting now.

Today David Edelman from the National Security Staff was there to discuss the White House's document on International Strategy in Cyberspace. This paper had input from lots of people including many that I had worked with that decade ago, including Dan Hurley from NTIA and Howard Schmidt, who a decade ago was with Microsoft and of course now is at the White House. The document itself is an interesting document and I saw in it and in the discussion a lot of ideas that Richard Clarke (some would say one of Howard's predecessors) had brought out in Cyber War.

I will likely mention this paper again in the coming week as it is interesting but I wanted to focus for a minute on one thing that David brought up - the idea of the Nationalistic Internet. In the paper the administration promotes an open and interoperable cyberspace. The nationalistic Internet is of course not that. When you think of the nationalistic Internet you can think of China and the restrictions it has placed around information and companies operating there. Another example is the recent discussions coming out of Iran speaking of an Iranian Internet. This view of controlling the citizenry through what they have opportunity to see is certainly not what was thought of oh so many years ago when people like Vint Cerf started to think about how to extend what was being done in closed communities out into a bigger world.

Now there are definitely times when we want to know where information is coming from and who is gaining access to it but generally speaking having access to a broad set of information so that we can evaluate sources and ideas around a single topic before we make a decision sounds like it would lead us to a better place. Restricting information, in most cases, is simply wrong. I say most cases as there are sets of information, things like child pornography, that should never be available.

Of course we also need to be careful because we do need to understand that the internet is not solely about information it has become a major commerce tool. Restricting access or sites at a national level changes some of that paradigm as well and overall success and growth of commerce without broad access will in the long term be limited.

The paper is a great starting point for the discussion on how to successfully use the Internet as a tool for growth, both economic and social. Tying this paper into what is being done in the US with NSTIC makes it even more interesting and I will talk about that over the next few days.


- Posted using BlogPress from my iPad