IT Security; hobby, hindrance or hegemony?

Shake it up Wednesday

Props to Wade from an old email...

Security bingo from funsec

http://www.crypto.com/bingo/pr

Monitoring and visibility, old'y but a...

From :http://www.schneier.com/crypto-gram-0107.html#5

"Without monitoring, you're vulnerable until your security is perfect. If you monitor first, you're immediately more secure."

"Monitoring should be the first step in any network security plan. It's something that a network administrator can do today to provide immediate value. Policy analysis and vulnerability assessments take time, and don't actually improve a network's security until they're acted upon."

"It's specious logic for a CIO to decide to wait until his network is stable, he understands his security, and all his patches are up to date. It'll never happen. Monitoring's best value is when a network is in flux -- as all large networks always are -- due to internal and external factors."

From the ensuing comments:

"However if you insist on war as the metaphor, here are two thoughts along those lines. First, the war, if that is what it is, is surely a guerrilla war. The entities being attacked are large, visible, slow-moving and part of the power structure. They have much greater resources than the attackers, but no effective way to apply them. The attackers and few, dispersed, hidden and have few resources. But what they have is the free choice of when and where to attack.

To fight guerrillas it is necessary to a) identify them; i.e., distinguish them from civilians and b) control some resource that is essential to their survival. Given the Internet as it exists today, I don't see much hope of doing either of these. If the authorities decide to employ broadly targeted, draconian measures, they will find like the British in America and the Americans in Vietnam, that the collateral effects on innocent civilians are simply unacceptable.

My second thought about hacking as war is that the situation can be compared to that in many wars, but most especially the American Civil War. While some people were busy fighting and dying, war profiteers made fortunes selling rotten food, unserviceable uniforms and non-working weapons. With a market full of snake oil security, bug-ridden applications and vendors who are more interested in suing or prosecuting people who reveal security problems than fixing them, this seems like the kind of war we are in."

Nice segway to this post by Bejtlich re: Schneier and Cyberwar;
http://taosecurity.blogspot.com/2007/04/taking-fight-to-enemy-revisited.html

ROI or NPV?

If you understand the acronyms above, maybe have a trek over here : http://financialcryptography.com/mt/archives/000939.html

otherwise you may want to move quickly on :)

Time to think the unthinkable

So the problem as quoted many times before is, "how to demonstrate that
security practices are both working and effective?".

As in most production network and system footprints, the goal posts,
risks and processes are ever moving and changing. How do we measure
security and track a risk management program effectively without making
comparison to some baseline or standard configuration?

The answer is we don't. There isn't any and there never will be for
*your* IT footprint.

So, you ask, what can we measure when trying to prove the unprovable?

The answer lies in making a comparison to something, but to what? Other
organisations perhaps? Too tough it seems, as they don't have nor share
relevant data or reports for obvious reasons. Each IT footprint and
business is built on similar building blocks but is fundamentally
different as the "superorganism" morphs, grows and responds to different
traffic and needs constantly.

What is required is a clone. A sometimes inferior and sometimes superior
clone of the organism. A test subject if you will.

I am not talking about development systems or sub-models of the organism,
but a live fully functional version of the entire entity, which can
assume many states at a whim.

With todays focus on virtualisation and seemingly never ending
processing and storage, surely we could construct a clone of our
business residing all in memory on a single or distributed platform.
This is what we would perform change management upon and measure
against. Think of it, not as a "honey-net", but a "honey-org".

Yeah, yeah, needs X memory and won't be perfect, but better than nothing
and the "honey-org" could be constantly updated from the live management
systems.

With a form of total information awareness we could build a clone of our
systems, nodes and processes - exclusively in software, running on
lower spec hardware perhaps. Here, only time becomes the key factor.

Using something akin to enterprise management systems the information
and images could be gathered to build a clone of our organisation or
enterprise in as much detail as possible which would facilitate a form
of testing that would see us able to demonstrate what would, and does
happen, if certain policies or changes are not enforced.

Three, is the magic number. A production network, a clone network, and
whatever other development or model systems are required.

This would not address physical security in tandem with virtual
security, nor would it be able to fully simulate all users or business
processes, but it is what we are approaching with products like Cisco's new provisioning platforms, Opnet's modeler and risk management via Skybox. The ability to then generate traffic and incidents is also required. SmartBits, IMix, VA and fuzzing till your heart's content including session replay all in one go? Easy huh?

The main problem today is we don't know enough about our environments.
We need to know more. We need to build a fully virtual infrastructure to fully understand our real infrastructure. We may be still quite some
distance away, but in extrapolating the possible futures, this seems to
me to be the only way of demonstrating the "what if" scenarios!

Open up the virtual infrastructure to the net. Offer up your virtual
systems to the bad guys. Transparency is the key both for the bad guys
and the good guys if we really want to make progress. Perhaps.

In theory this is what we pretend to do with "Change Management" today, though the results are more often than not guessed at, divined from experience and faith and are totally subjective.

Yes it is time to slow down the rate of change, make a copy, offer it up
or strip bits away from our clone to see where and how the security
dollars are really being spent. Gimme' a clone, drop it in the lions
den, and I'll give you, at least in part your ROSI(Return on Security
Investment).