Virtualisation lowers certain overheads and increases flexibility and modularity.
Virtualisation does not address SECURITY until whole system images are checksum'ed and rotated in a defensive time-based security method/model, including the abstraction layer and hardware playing a key role in defenses as well.
I have mused over this before here http://bsdosx.blogspot.com/2006/11/machine-and-service-integrity.html
As Theo De Raadt mentions over at http://kerneltrap.org/OpenBSD/Virtualization_Security;
"x86 virtualization is about basically placing another nearly full kernel, full of new bugs, on top of a nasty x86 architecture which barely has correct page protection. Then running your operating system on the other side of this brand new pile of shit. You are absolutely deluded, if not stupid, if you think that a worldwide collection of software engineers who can't write operating systems or applications without security holes, can then turn around and suddenly write virtualization layers without security holes."
On a side note, I'd like to repeat the below, courtesy of me;
"Everything will be a server, client and fast cache. The P2P model will win. It's the only thing that can. More "zeroconf" is needed. There seems to be no margins for error, tolerances or defensive programming anymore. What gives someone the right to call themselves a software "engineer" anyway?"
I'll post shortly on my new idea regarding regulation of business IT and an IT TAX to force enumeration, visibility and accountability.
Some time soon, I'll get back to IT security. Currently I am working in other areas and departments and re-learning about the human side and realities in which we all operate. The disconnect is massive. The cowboys operating in IT Security are very disheartening to me. The idiots and "old-guard" on both sides of the fence worry me. So many people have no clue of the complexity, and will never grok it. We need to simplify and innovate.
We need to regulate our "industry" somewhat without stifling innovation. Perhaps the Universities should take some of the blame in turning out ignorant coders who don't understand networking or security.... perhaps, perhaps not..... it remains to be seen. I can only talk from experience, and my experience in Uni taught me nothing; other than I hated coding and ignored my networking lecturer. I got a degree in Computer Science, I crammed before all exams, some days not even knowing what exam was on that day until I asked my colleagues. All Comp Sci did was pique my curiosity, I might as well have stayed in the Uni bar *all* the time. This might just be my personal version of "learning" at Uni (I like to call it regurgitation), but 99% of my tech was learned on the job ;)
How did I become so bitter and twisted? Am I really? Surely I am an optimist at heart?
Once we see the COMPLEXITY we harken after SIMPLICITY in all matters in life.
Tuesday, November 27, 2007
Sunday, November 18, 2007
Damn straight... but sorta' bendy
From Drazen comes this snippet of a quote from Computerworld interviewing the legendary Frank Abagnale of 'Catch me if you can?' fame:
"Computerworld Staff: Is there anything we can do to make illicit computer-related activity a less attractive pursuit for young people?
Frank Abagnale: There are about four reasons why we have crime to begin with. One of them is, of course, that we live in an extremely unethical society. We live in a society that doesn't teach ethics at home, a society that doesn't teach ethics in school because the teacher would be accused of teaching morality. We live in a society where you can't find a four-year college course on ethics. I have three sons who went through graduate school; only the one who went to law school had a course even offered on ethics. So today you have a lot of young people who have no character, no ethics and they find no problem in defrauding somebody or stealing from somebody or cheating somebody. Until we change that, crime is just going to get easier, faster, more global, harder to detect.
Computerworld Staff: Any thoughts on how we can bring that change about?
Frank Abagnale: I think you need to bring character and ethics back into schools, and you certainly need to bring it back into colleges and universities as part of a curriculum. Only about half of Fortune 500 companies even have a code of ethics or code of conduct. The ones that do have one publish it every five years on an inside page of their annual report to appease their shareholders. So, obviously, there's no big effort out there to bring about that change. Rutgers just finished a five-year study that found that 56% of MBA students cheated.
There are really no con men anymore like there were in my day, because you really don't have to associate with anyone. You don't have to be well dressed and well groomed and well spoken. Everything's done on a computer; there are no witnesses. So even if you know who's doing it, you probably don't have the ability to go capture them. Chances are you have no idea what they look like; they can sit in their pajamas and commit all these crimes."
There seems no mandatory or enforceable cost anymore for performing an act that is detrimental to the health of the net or its component systems. Our super-organism(internet) is being eaten from the inside out while we don't realise nor appreciate the symbiotic relationship we have created between man and machines.
Who is held accountable and how, when we can't even agree upon nor incentivise actions to help protect our immediate and more fragile internetwork, the green planet we call home. I had a few ideas here: Some cud, but I still wonder about the fact that there are too many humans, just ask Mr. Malthus!
"Computerworld Staff: Is there anything we can do to make illicit computer-related activity a less attractive pursuit for young people?
Frank Abagnale: There are about four reasons why we have crime to begin with. One of them is, of course, that we live in an extremely unethical society. We live in a society that doesn't teach ethics at home, a society that doesn't teach ethics in school because the teacher would be accused of teaching morality. We live in a society where you can't find a four-year college course on ethics. I have three sons who went through graduate school; only the one who went to law school had a course even offered on ethics. So today you have a lot of young people who have no character, no ethics and they find no problem in defrauding somebody or stealing from somebody or cheating somebody. Until we change that, crime is just going to get easier, faster, more global, harder to detect.
Computerworld Staff: Any thoughts on how we can bring that change about?
Frank Abagnale: I think you need to bring character and ethics back into schools, and you certainly need to bring it back into colleges and universities as part of a curriculum. Only about half of Fortune 500 companies even have a code of ethics or code of conduct. The ones that do have one publish it every five years on an inside page of their annual report to appease their shareholders. So, obviously, there's no big effort out there to bring about that change. Rutgers just finished a five-year study that found that 56% of MBA students cheated.
There are really no con men anymore like there were in my day, because you really don't have to associate with anyone. You don't have to be well dressed and well groomed and well spoken. Everything's done on a computer; there are no witnesses. So even if you know who's doing it, you probably don't have the ability to go capture them. Chances are you have no idea what they look like; they can sit in their pajamas and commit all these crimes."
There seems no mandatory or enforceable cost anymore for performing an act that is detrimental to the health of the net or its component systems. Our super-organism(internet) is being eaten from the inside out while we don't realise nor appreciate the symbiotic relationship we have created between man and machines.
Who is held accountable and how, when we can't even agree upon nor incentivise actions to help protect our immediate and more fragile internetwork, the green planet we call home. I had a few ideas here: Some cud, but I still wonder about the fact that there are too many humans, just ask Mr. Malthus!
Wednesday, October 31, 2007
Process begets process...
"Time was when we could just re-cable the server ourself, and not have to pay some idiot $100 to move the thing", was heard across the room today in a large clients office, and oh did it ring true... however as organisations mature -> processes place a framework around work carried out and services are measured via uptime and other SLA's....no more adhocracy, only at the wiki level!
Measure.. hmmmmm.. that's a funny word in IT isn't it... 'MEASURE','MEASURE'...M-E-A-S-U-R-E
So I text myself sometimes when particular thoughts cross my mind;
"First you need visibility/surveillance, and then accountability of packets, flows and data objects, then comes valuation of said data objects, services and supporting infrastructure... now we can have meaningful conversations about risk and IT security"
Hmmmmm... sampling, measuring, identifying.... what's your IT footprint? What's the last IT related report you looked at, what did it measure and what did it really say about your organisational IT footprint?
Measure.. hmmmmm.. that's a funny word in IT isn't it... 'MEASURE','MEASURE'...M-E-A-S-U-R-E
# measurement: the act or process of assigning numbers to phenomena according to a rule; "the measurements were carefully done"; "his mental ...
# standard: a basis for comparison; a reference point against which other things can be evaluated; "the schools comply with federal standards"; "they set the measure for all subsequent work"
# how much there is of something that you can quantify
# any maneuver made as part of progress toward a goal; "the situation called for strong measures"; "the police took steps to reduce crime"
# bill: a statute in draft before it becomes law; "they held a public hearing on the bill"
# determine the measurements of something or somebody, take measurements of; "Measure the length of the wall"
# meter: (prosody) the accent in a metrical foot of verse
# quantify: express as a number or measure or quantity; "Can you quantify your results?"
# have certain dimensions; "This table surfaces measures 20inches by 36 inches"
# musical notation for a repeating pattern of musical beats; "the orchestra omitted the last twelve bars of the song"
# measuring stick: measuring instrument having a sequence of marks at regular intervals; used as a reference in making measurements
# place a value on; judge the worth of something; "I will have the family jewels appraised by a professional"
So I text myself sometimes when particular thoughts cross my mind;
"First you need visibility/surveillance, and then accountability of packets, flows and data objects, then comes valuation of said data objects, services and supporting infrastructure... now we can have meaningful conversations about risk and IT security"
Hmmmmm... sampling, measuring, identifying.... what's your IT footprint? What's the last IT related report you looked at, what did it measure and what did it really say about your organisational IT footprint?
Monday, October 15, 2007
Some fun...
Was surfing here, http://xkcd.com/ and added it to my RSS feeds http://syndicated.livejournal.com/xkcd_rss/profile ;) Actually came from the FUNSEC mailing list but my mate Wade had sent me one of the comics before.
Monday, October 08, 2007
'Meta' or 'Metta' security....
Basically I'll let Mr. Bejtlich summarise from his 'Three Wise Men' of security, practically all there needs to be currently known about the state of play in and around the IT Security Industry and IT Security Risk areas. On the shoulders of giants and all that!
http://taosecurity.blogspot.com/search?q=three+wise+men
Dan and Marcus are definetly on my list, though I haven't really read this Ross Anderson guy, however Richard himself is on my list, along with Rob Thomas from Team Cymru.
On another note, to save you signing (or reading about signing up) for tonnes of bullshit, please find below a great 'Point:CounterPoint' from Bruce Schneier and Marcus Ranum. DRM/Copyright.. nah...
Erm, hopefully without getting in trouble and making others spend 5 minutes signing up to read the below, here it is in all it's glory.
Bruce Schneier
Point: To the average home user, security is an intractable problem. Microsoft has made great strides improving the security of its operating system out of the box, but there is still a dizzying array of rules, options and choices users have to make. How should they configure their antivirus program? What sort of backup regime should they employ? What are the best settings for their wireless network? And so on.
How is it possible that we in the computer industry have foisted on people a product that is so difficult to use securely, it requires so many add-ons? It's even worse than that. We have sold the average computer user a bill of goods. In our race for an ever-increasing market, we have convinced every person that he needs a computer. We have provided application after application--IM, peer-to-peer file sharing, eBay, Facebook--to make computers useful and enjoyable to the home user. At the same time, we've made them so difficult to maintain that only a trained sysadmin can.
And we wonder why home users have such problems with their buggy systems, why they can't seem to do the simplest administrative tasks, and why their computers aren't secure. They're not secure because home users don't know how to secure them.
At work, I have an IT department I can call if I have a problem. They filter my Net connection so I don't see spam, and most attacks are blocked before they get to my computer. They tell me which updates to install. And they're available to help me recover if something happens to my system. Home users have none of this support.
This problem isn't going to go away as computers get smarter and users get savvier. Next-generation computers will be vulnerable to different attacks, and next-generation attack tools will fool users in different ways.
This isn't simply an academic problem; it's a public health problem. In the hyperconnected world of the Internet, everyone's security depends in part on everyone else's. As long as there are insecure computers out there, hackers will use them to eavesdrop on network traffic, send spam and attack other computers. We are more secure if those home computers attached to the Internet via DSL or cable modems are protected against attack. The only question is, what's the best way to get there?
I wonder about those who say "educate the users." Have they tried? It's unrealistic to expect home users to be responsible for their security. They don't have the expertise, and aren't going to learn. And it's not just user actions we need to watch; computers are insecure out of the box.
The only way to solve this problem is to force the ISPs to become IT departments. There's no reason they can't provide home users with the same level of support my IT department provides me, or a "clean pipe" service to the home. Yes, it will cost more, and require changes in the law to make this mandatory. But what's the alternative?
In 1991, Walter S. Mossberg debuted his Personal Technology column in The Wall Street Journal with the words, "Personal computers are just too hard to use, and it isn't your fault." Sixteen years later, it's doubly true when it comes to computer security.
If we want home users to be secure, we need to design computers and networks that are secure out of the box, without any work by the end users. There isn't any other way.
Marcus Ranum
CounterPoint: I'm sure that many of the things Bruce points out about computers at some point or another applied to automobiles or any other technologically interesting and complex device. There was a time, in the early days of the automobile, when any idiot could go 75 miles per hour with no requirement for training, safety equipment or sobriety. As Bruce says, eventually that kind of thing becomes a public health issue and then society begins to enforce constraints. Question is, do society's constraints make a difference, or does time cure these ills?
When I was growing up, there was just one kid in my entire high school who had a computer. Today, it seems every kid 8 and older is a Windows sysadmin. And some of them are better at it than you might expect. That's because they grew up doing it, and the human brain appears to be able to integrate amazingly complex tasks as "normal" as long as we're introduced to them early enough. Bruce, I think the problem is not with all the home users--I think it's with the adult home users.
I see the generational distinction most clearly with my parents. My father still writes using an old Underwood typewriter. My mom has adopted a computer, but she's exactly the kind of user you're worried about--she clicks "OK" on anything, and seems to be trying to collect spyware. Thinking about it, most of the generation before mine is pretty uncomfortable with computers, and I was one of the early experimental kids who grew up networking on the ARPANET and BITNET. Does that have something to do with the fact that I have always had a good grasp of the concepts of transitive trust and distributed systems? I think it does; I think the analytic parts of our brains, if given a task early on, are able to make sense out of all kinds of insanely complicated things.
"Educate the user" is an old mantra in security, and its uselessness is one place where Bruce and I agree. I think, though, that building simpler systems is not the answer. The answer is to let the current user population die off! It's going to happen, anyhow.
Forcing ISPs to support home users, or re-engineering computers to be simple enough for us old coots to understand, completely misses the point. At the point where enough customers want simple-to-use Internet terminals, a market will develop. Arguably, it already has--witness the evolution of handheld PDAs and centralized "no spam" managed free email services. The complexity of the Internet and software administration is getting absorbed into the IT infrastructure of Google, Yahoo and MySpace.
I'm not demanding that Detroit make cars that are simple enough for me to repair; I choose to buy vehicles that are usually reliable, and I outsource the repair work to the mechanic up the street. Perhaps what we're doing is shifting complexity around in our lives: I never learned how to fix a transmission, but I can still scratch-bake a firewall with a custom filtering reverse Web proxy in a weekend. I've seen home users who can't manage a Windows XP upgrade, but who can successfully instrument-land a jet fighter.
Bruce, when you and I are old coots sitting on the porch, you'll be amazed to see the current generation of kids nimbly navigating their way through software and system configurations that completely blow our minds. Relax; it's just what progress looks like from our side of the hill. Will the future be more secure? It'll be just as insecure as it possibly can, while still continuing to function. Just like it is today.
http://taosecurity.blogspot.com/search?q=three+wise+men
Dan and Marcus are definetly on my list, though I haven't really read this Ross Anderson guy, however Richard himself is on my list, along with Rob Thomas from Team Cymru.
On another note, to save you signing (or reading about signing up) for tonnes of bullshit, please find below a great 'Point:CounterPoint' from Bruce Schneier and Marcus Ranum. DRM/Copyright.. nah...
Erm, hopefully without getting in trouble and making others spend 5 minutes signing up to read the below, here it is in all it's glory.
Bruce Schneier
Point: To the average home user, security is an intractable problem. Microsoft has made great strides improving the security of its operating system out of the box, but there is still a dizzying array of rules, options and choices users have to make. How should they configure their antivirus program? What sort of backup regime should they employ? What are the best settings for their wireless network? And so on.
How is it possible that we in the computer industry have foisted on people a product that is so difficult to use securely, it requires so many add-ons? It's even worse than that. We have sold the average computer user a bill of goods. In our race for an ever-increasing market, we have convinced every person that he needs a computer. We have provided application after application--IM, peer-to-peer file sharing, eBay, Facebook--to make computers useful and enjoyable to the home user. At the same time, we've made them so difficult to maintain that only a trained sysadmin can.
And we wonder why home users have such problems with their buggy systems, why they can't seem to do the simplest administrative tasks, and why their computers aren't secure. They're not secure because home users don't know how to secure them.
At work, I have an IT department I can call if I have a problem. They filter my Net connection so I don't see spam, and most attacks are blocked before they get to my computer. They tell me which updates to install. And they're available to help me recover if something happens to my system. Home users have none of this support.
This problem isn't going to go away as computers get smarter and users get savvier. Next-generation computers will be vulnerable to different attacks, and next-generation attack tools will fool users in different ways.
This isn't simply an academic problem; it's a public health problem. In the hyperconnected world of the Internet, everyone's security depends in part on everyone else's. As long as there are insecure computers out there, hackers will use them to eavesdrop on network traffic, send spam and attack other computers. We are more secure if those home computers attached to the Internet via DSL or cable modems are protected against attack. The only question is, what's the best way to get there?
I wonder about those who say "educate the users." Have they tried? It's unrealistic to expect home users to be responsible for their security. They don't have the expertise, and aren't going to learn. And it's not just user actions we need to watch; computers are insecure out of the box.
The only way to solve this problem is to force the ISPs to become IT departments. There's no reason they can't provide home users with the same level of support my IT department provides me, or a "clean pipe" service to the home. Yes, it will cost more, and require changes in the law to make this mandatory. But what's the alternative?
In 1991, Walter S. Mossberg debuted his Personal Technology column in The Wall Street Journal with the words, "Personal computers are just too hard to use, and it isn't your fault." Sixteen years later, it's doubly true when it comes to computer security.
If we want home users to be secure, we need to design computers and networks that are secure out of the box, without any work by the end users. There isn't any other way.
Marcus Ranum
CounterPoint: I'm sure that many of the things Bruce points out about computers at some point or another applied to automobiles or any other technologically interesting and complex device. There was a time, in the early days of the automobile, when any idiot could go 75 miles per hour with no requirement for training, safety equipment or sobriety. As Bruce says, eventually that kind of thing becomes a public health issue and then society begins to enforce constraints. Question is, do society's constraints make a difference, or does time cure these ills?
When I was growing up, there was just one kid in my entire high school who had a computer. Today, it seems every kid 8 and older is a Windows sysadmin. And some of them are better at it than you might expect. That's because they grew up doing it, and the human brain appears to be able to integrate amazingly complex tasks as "normal" as long as we're introduced to them early enough. Bruce, I think the problem is not with all the home users--I think it's with the adult home users.
I see the generational distinction most clearly with my parents. My father still writes using an old Underwood typewriter. My mom has adopted a computer, but she's exactly the kind of user you're worried about--she clicks "OK" on anything, and seems to be trying to collect spyware. Thinking about it, most of the generation before mine is pretty uncomfortable with computers, and I was one of the early experimental kids who grew up networking on the ARPANET and BITNET. Does that have something to do with the fact that I have always had a good grasp of the concepts of transitive trust and distributed systems? I think it does; I think the analytic parts of our brains, if given a task early on, are able to make sense out of all kinds of insanely complicated things.
"Educate the user" is an old mantra in security, and its uselessness is one place where Bruce and I agree. I think, though, that building simpler systems is not the answer. The answer is to let the current user population die off! It's going to happen, anyhow.
Forcing ISPs to support home users, or re-engineering computers to be simple enough for us old coots to understand, completely misses the point. At the point where enough customers want simple-to-use Internet terminals, a market will develop. Arguably, it already has--witness the evolution of handheld PDAs and centralized "no spam" managed free email services. The complexity of the Internet and software administration is getting absorbed into the IT infrastructure of Google, Yahoo and MySpace.
I'm not demanding that Detroit make cars that are simple enough for me to repair; I choose to buy vehicles that are usually reliable, and I outsource the repair work to the mechanic up the street. Perhaps what we're doing is shifting complexity around in our lives: I never learned how to fix a transmission, but I can still scratch-bake a firewall with a custom filtering reverse Web proxy in a weekend. I've seen home users who can't manage a Windows XP upgrade, but who can successfully instrument-land a jet fighter.
Bruce, when you and I are old coots sitting on the porch, you'll be amazed to see the current generation of kids nimbly navigating their way through software and system configurations that completely blow our minds. Relax; it's just what progress looks like from our side of the hill. Will the future be more secure? It'll be just as insecure as it possibly can, while still continuing to function. Just like it is today.
Saturday, October 06, 2007
Non-separability and thoughts in the ether
I've been banging on about this for ages:
http://taosecurity.blogspot.com/2007/09/microsofts-anemone-project.html
"Reclaiming Network-wide Visibility Using Ubiquitous Endsystem Monitors."
http://taosecurity.blogspot.com/2007/09/microsofts-anemone-project.html
"Reclaiming Network-wide Visibility Using Ubiquitous Endsystem Monitors."
Monday, September 24, 2007
5 years from now!
Stuff to think about:
- PCI DSS(Payment Card Industry Data Security Standards) QSA (Qualified Security Assessor)
- NetFlow/IPFIX (Crannog/NetScout/Arbor) as networking/security is increasingly about context/relationships/visibility.
- Normalization/baselining tools a la PeakFlow, SourceFireRNA
- Visualisation and Modelling (Opnet)
- IDS/Rootkit detectors for virtualised environments.(Watch this space... BluePill/F-Secure )
- Security Metrics(emerging/huge future as currently un-quantifiable!) and audit via Skybox / Algosec
- Digital Signage, MCAST/P2P distribution JOOST style.
- Infrastructure/solutions to facilitate SoaS(Software-as-a-Service) e.g. Salesforce/Joomla/Atlassian(Confluence)/GoogleApps/Zimbra/Zoho, virtual offices whereby nodes act as client/cache/server and don't backup locally but more to Web Services akin to AWS(Amazon Web Services),S3,EC2. Managing a virtual customer's DNS and aggregating management of their services has potential?
- Mobile and mobility gateways, 3G(HSDPAv2) vs WiMAx back-haul for project offices/satellite sites and SME/SOHO
- Location based services and GIS(Geographic Information Systems)
- Identity Management via OpenID/Cardspace(InfoCard) hosted services.
- Thin clients (Neoware)
- Fixed Mobile Convergence(Still a while off!) Engin / MyNetPhone / SIP/IAX/Asterisk
Web 2.0+ has as many solutions as problems, a new middleware-tier('internet-service-bus' if you will!). Businesses will increasingly want more audit/control and lower operational overheads and greater security via thin-client computing utilizing the browser as the platform of choice, also generating secure local host based flows for compliance and reporting. Thin clients and infinitely scalable distributed computing/storage is on the way. If you don't run the data-centre processing/storage nor have the power, you'll want to control the gateways/reporting/auditing/caching and own/re-sell/manage as much of the local infrastructure/bus and back-haul as possible!
Regulatory and compliance requirements will always have a perceivable effect, especially in the financial services sector.. but with breach disclosure laws on the way in Oz the security -> landscape/consulting/auditing/accountability/visibility aspects of networks/services are not going to allow organizations to keep their heads in the sand for much longer.
- PCI DSS(Payment Card Industry Data Security Standards) QSA (Qualified Security Assessor)
- NetFlow/IPFIX (Crannog/NetScout/Arbor) as networking/security is increasingly about context/relationships/visibility.
- Normalization/baselining tools a la PeakFlow, SourceFireRNA
- Visualisation and Modelling (Opnet)
- IDS/Rootkit detectors for virtualised environments.(Watch this space... BluePill/F-Secure )
- Security Metrics(emerging/huge future as currently un-quantifiable!) and audit via Skybox / Algosec
- Digital Signage, MCAST/P2P distribution JOOST style.
- Infrastructure/solutions to facilitate SoaS(Software-as-a-Service) e.g. Salesforce/Joomla/Atlassian(Confluence)/GoogleApps/Zimbra/Zoho, virtual offices whereby nodes act as client/cache/server and don't backup locally but more to Web Services akin to AWS(Amazon Web Services),S3,EC2. Managing a virtual customer's DNS and aggregating management of their services has potential?
- Mobile and mobility gateways, 3G(HSDPAv2) vs WiMAx back-haul for project offices/satellite sites and SME/SOHO
- Location based services and GIS(Geographic Information Systems)
- Identity Management via OpenID/Cardspace(InfoCard) hosted services.
- Thin clients (Neoware)
- Fixed Mobile Convergence(Still a while off!) Engin / MyNetPhone / SIP/IAX/Asterisk
Web 2.0+ has as many solutions as problems, a new middleware-tier('internet-service-bus' if you will!). Businesses will increasingly want more audit/control and lower operational overheads and greater security via thin-client computing utilizing the browser as the platform of choice, also generating secure local host based flows for compliance and reporting. Thin clients and infinitely scalable distributed computing/storage is on the way. If you don't run the data-centre processing/storage nor have the power, you'll want to control the gateways/reporting/auditing/caching and own/re-sell/manage as much of the local infrastructure/bus and back-haul as possible!
Regulatory and compliance requirements will always have a perceivable effect, especially in the financial services sector.. but with breach disclosure laws on the way in Oz the security -> landscape/consulting/auditing/accountability/visibility aspects of networks/services are not going to allow organizations to keep their heads in the sand for much longer.
Thursday, August 30, 2007
Wednesday, August 29, 2007
Monday, August 13, 2007
Sunday, August 12, 2007
Monitoring and visibility, old'y but a...
From :http://www.schneier.com/crypto-gram-0107.html#5
From the ensuing comments:
Nice segway to this post by Bejtlich re: Schneier and Cyberwar;
http://taosecurity.blogspot.com/2007/04/taking-fight-to-enemy-revisited.html
"Without monitoring, you're vulnerable until your security is perfect. If you monitor first, you're immediately more secure."
"Monitoring should be the first step in any network security plan. It's something that a network administrator can do today to provide immediate value. Policy analysis and vulnerability assessments take time, and don't actually improve a network's security until they're acted upon."
"It's specious logic for a CIO to decide to wait until his network is stable, he understands his security, and all his patches are up to date. It'll never happen. Monitoring's best value is when a network is in flux -- as all large networks always are -- due to internal and external factors."
From the ensuing comments:
"However if you insist on war as the metaphor, here are two thoughts along those lines. First, the war, if that is what it is, is surely a guerrilla war. The entities being attacked are large, visible, slow-moving and part of the power structure. They have much greater resources than the attackers, but no effective way to apply them. The attackers and few, dispersed, hidden and have few resources. But what they have is the free choice of when and where to attack.
To fight guerrillas it is necessary to a) identify them; i.e., distinguish them from civilians and b) control some resource that is essential to their survival. Given the Internet as it exists today, I don't see much hope of doing either of these. If the authorities decide to employ broadly targeted, draconian measures, they will find like the British in America and the Americans in Vietnam, that the collateral effects on innocent civilians are simply unacceptable.
My second thought about hacking as war is that the situation can be compared to that in many wars, but most especially the American Civil War. While some people were busy fighting and dying, war profiteers made fortunes selling rotten food, unserviceable uniforms and non-working weapons. With a market full of snake oil security, bug-ridden applications and vendors who are more interested in suing or prosecuting people who reveal security problems than fixing them, this seems like the kind of war we are in."
Nice segway to this post by Bejtlich re: Schneier and Cyberwar;
http://taosecurity.blogspot.com/2007/04/taking-fight-to-enemy-revisited.html
Thursday, August 09, 2007
ROI or NPV?
If you understand the acronyms above, maybe have a trek over here : http://financialcryptography.com/mt/archives/000939.html
otherwise you may want to move quickly on :)
otherwise you may want to move quickly on :)
Thursday, August 02, 2007
Time to think the unthinkable
So the problem as quoted many times before is, "how to demonstrate that
security practices are both working and effective?".
As in most production network and system footprints, the goal posts,
risks and processes are ever moving and changing. How do we measure
security and track a risk management program effectively without making
comparison to some baseline or standard configuration?
The answer is we don't. There isn't any and there never will be for
*your* IT footprint.
So, you ask, what can we measure when trying to prove the unprovable?
The answer lies in making a comparison to something, but to what? Other
organisations perhaps? Too tough it seems, as they don't have nor share
relevant data or reports for obvious reasons. Each IT footprint and
business is built on similar building blocks but is fundamentally
different as the "superorganism" morphs, grows and responds to different
traffic and needs constantly.
What is required is a clone. A sometimes inferior and sometimes superior
clone of the organism. A test subject if you will.
I am not talking about development systems or sub-models of the organism,
but a live fully functional version of the entire entity, which can
assume many states at a whim.
With todays focus on virtualisation and seemingly never ending
processing and storage, surely we could construct a clone of our
business residing all in memory on a single or distributed platform.
This is what we would perform change management upon and measure
against. Think of it, not as a "honey-net", but a "honey-org".
Yeah, yeah, needs X memory and won't be perfect, but better than nothing
and the "honey-org" could be constantly updated from the live management
systems.
With a form of total information awareness we could build a clone of our
systems, nodes and processes - exclusively in software, running on
lower spec hardware perhaps. Here, only time becomes the key factor.
Using something akin to enterprise management systems the information
and images could be gathered to build a clone of our organisation or
enterprise in as much detail as possible which would facilitate a form
of testing that would see us able to demonstrate what would, and does
happen, if certain policies or changes are not enforced.
Three, is the magic number. A production network, a clone network, and
whatever other development or model systems are required.
This would not address physical security in tandem with virtual
security, nor would it be able to fully simulate all users or business
processes, but it is what we are approaching with products like Cisco's new provisioning platforms, Opnet's modeler and risk management via Skybox. The ability to then generate traffic and incidents is also required. SmartBits, IMix, VA and fuzzing till your heart's content including session replay all in one go? Easy huh?
The main problem today is we don't know enough about our environments.
We need to know more. We need to build a fully virtual infrastructure to fully understand our real infrastructure. We may be still quite some
distance away, but in extrapolating the possible futures, this seems to
me to be the only way of demonstrating the "what if" scenarios!
Open up the virtual infrastructure to the net. Offer up your virtual
systems to the bad guys. Transparency is the key both for the bad guys
and the good guys if we really want to make progress. Perhaps.
In theory this is what we pretend to do with "Change Management" today, though the results are more often than not guessed at, divined from experience and faith and are totally subjective.
Yes it is time to slow down the rate of change, make a copy, offer it up
or strip bits away from our clone to see where and how the security
dollars are really being spent. Gimme' a clone, drop it in the lions
den, and I'll give you, at least in part your ROSI(Return on Security
Investment).
security practices are both working and effective?".
As in most production network and system footprints, the goal posts,
risks and processes are ever moving and changing. How do we measure
security and track a risk management program effectively without making
comparison to some baseline or standard configuration?
The answer is we don't. There isn't any and there never will be for
*your* IT footprint.
So, you ask, what can we measure when trying to prove the unprovable?
The answer lies in making a comparison to something, but to what? Other
organisations perhaps? Too tough it seems, as they don't have nor share
relevant data or reports for obvious reasons. Each IT footprint and
business is built on similar building blocks but is fundamentally
different as the "superorganism" morphs, grows and responds to different
traffic and needs constantly.
What is required is a clone. A sometimes inferior and sometimes superior
clone of the organism. A test subject if you will.
I am not talking about development systems or sub-models of the organism,
but a live fully functional version of the entire entity, which can
assume many states at a whim.
With todays focus on virtualisation and seemingly never ending
processing and storage, surely we could construct a clone of our
business residing all in memory on a single or distributed platform.
This is what we would perform change management upon and measure
against. Think of it, not as a "honey-net", but a "honey-org".
Yeah, yeah, needs X memory and won't be perfect, but better than nothing
and the "honey-org" could be constantly updated from the live management
systems.
With a form of total information awareness we could build a clone of our
systems, nodes and processes - exclusively in software, running on
lower spec hardware perhaps. Here, only time becomes the key factor.
Using something akin to enterprise management systems the information
and images could be gathered to build a clone of our organisation or
enterprise in as much detail as possible which would facilitate a form
of testing that would see us able to demonstrate what would, and does
happen, if certain policies or changes are not enforced.
Three, is the magic number. A production network, a clone network, and
whatever other development or model systems are required.
This would not address physical security in tandem with virtual
security, nor would it be able to fully simulate all users or business
processes, but it is what we are approaching with products like Cisco's new provisioning platforms, Opnet's modeler and risk management via Skybox. The ability to then generate traffic and incidents is also required. SmartBits, IMix, VA and fuzzing till your heart's content including session replay all in one go? Easy huh?
The main problem today is we don't know enough about our environments.
We need to know more. We need to build a fully virtual infrastructure to fully understand our real infrastructure. We may be still quite some
distance away, but in extrapolating the possible futures, this seems to
me to be the only way of demonstrating the "what if" scenarios!
Open up the virtual infrastructure to the net. Offer up your virtual
systems to the bad guys. Transparency is the key both for the bad guys
and the good guys if we really want to make progress. Perhaps.
In theory this is what we pretend to do with "Change Management" today, though the results are more often than not guessed at, divined from experience and faith and are totally subjective.
Yes it is time to slow down the rate of change, make a copy, offer it up
or strip bits away from our clone to see where and how the security
dollars are really being spent. Gimme' a clone, drop it in the lions
den, and I'll give you, at least in part your ROSI(Return on Security
Investment).
Thursday, July 12, 2007
Zen and back again...
What follows are some "modern" haiku (interspersed with images *to come*) which are based partially on my notes over the past few months, and also, to a degree upon, some of my experiences in this wonderfully calm and quaint Rinzai Zen Temple outside of Kyoto.
Traditional or formal haiku should not only have a 5-7-5 syllable count, but should be composed during a pure moment of Zen which reflects and invokes an empathic experience in the reader. Also present should be a characteristic of, or reflection on, a season by virtue of an appropriate subject or action. Due to the pace and disconnectedness from nature of today's society I have dispensed with some of the more traditional aspects, in the hope of evoking in the reader a similar experience to mine. There are perhaps more messages than moments in the below, and of course some information technology!
Traditional or formal haiku should not only have a 5-7-5 syllable count, but should be composed during a pure moment of Zen which reflects and invokes an empathic experience in the reader. Also present should be a characteristic of, or reflection on, a season by virtue of an appropriate subject or action. Due to the pace and disconnectedness from nature of today's society I have dispensed with some of the more traditional aspects, in the hope of evoking in the reader a similar experience to mine. There are perhaps more messages than moments in the below, and of course some information technology!
Many distractions,
information overload.
Where is the wisdom?
Internal battles.
Elephant for dinner.
Morsel at a time.
Physical struggle,
gateway to inside, not out,
receiver go deep.
Faith in science,
No moral compass found here.
Perhaps in Zen?
Arrogant mind.
Our attachments and desires.
Wake up time.
So many "sheeple",
asleep at the wheel.
How to de-program?
Input and output,
constantly processing them.
Who does the work?
Watching the watcher.
One of us is a tool.
Wield with respect.
Bits in, bits out.
Quality information,
computer mind?
Symbiotic "we".
Both need constant attention,
unplug the machine.
All is nature,
what can we not control?
Begin with yourself.
Symmetry desired.
Where is the fun in that?
Let's remain human.
Dirty fingernails.
Ground is moist and warm.
Food from the womb.
Dappled sunlight,
much potential energy,
free-wheeling downhill.
Sooner or later,
worry grips the mind, draining.
How much is enough?
Half full, half empty.
Begin again. A new cup.
Paradigm shifting.
Summer decisions.
Experience of last year.
Life's moving goal posts.
Mind management,
herding cats, bees and mice,
welcome to the zoo.
Energy in thought,
our most prized possesions,
content and intent?
True nobility,
Improve upon former self,
ad-infinitum.
Criticise, gossip,
matter not when others speak,
self-judgement.
No unhappiness,
curious, energetic,
spirited, joyful.
All basic questions,
unanswered, never stupid.
Reluctant probing.
Form expectations,
plain as the nose on your face,
perceptions altered.
Too young, too old.
Deceive oneself, just do it.
Too rich, too poor.
Control your thoughts,
failure, no courage to try.
Nothing more, nothing less.
Future shock, peak oil,
adaptational breakdown.
Disease of change.
Ogburn culture lag.
Rate of human response,
obsolete people?
Premature future,
incompetent neurosis.
Avalanching change.
Death and permanence,
Suffocating complexity.
Impermanent rise.
Bleeding edge I.T.
Security, assurance,
nowhere to be found.
Always hurry forward,
Moulded mass education,
de-school society.
Early adopter,
enumerate the pitfalls.
Risk or reward?
Guaranteed future.
Where is the fun in that?
Step to the unknown.
Neural feedback loops,
"Thin slicing" situations,
partial involvement.
Avoid human ties,
flow through of people slowing down.
Nomadic children.
Sunday, June 24, 2007
Kyoto and the art of human maintenance
Heading for some 'Rest and Realization' on Tuesday. Back soon.
Thursday, June 21, 2007
Dear Sirs..
Another bold question if I may. The topic is trust. The subjects are sheeple and computer systems. The framework is IT Security. The context is always changing. The goals are the same. Intent is irrelevant. Miscreants abound.
Excuse me arguing by analogy, but this online age verification system to access movie trailers, sums up many of the major issues and ignorances in IT Security.
http://blogs.csoonline.com/dirty_trailers_cheap_tricks
As the depth, pace and breadth of technology increases, no one can be expected to be an expert in all systems and subsystems they either use, interface with or build upon. Knowing what's going on 'under the hood' is becoming increasingly abstract and esoteric, especially to the standard consumer of computing resources. The issue is compounded by depth of code, system complexity, legacy systems, and third party drivers and modules, which are either knowingly or unknowingly part of a solution. Users require protection from both themselves and others while interfacing with systems or when having their information stored or utilised.
Unfortunately global systems span geo-political boundaries. Global systems which can be highjacked and used to attack more innocents.(Unfortunately systems will continue to be or will become vulnerable over time!) And I am talking about any node here; routers, switches, firewalls and traditional endpoints.
I am leaning towards the belief that more services should be available to end-users in their local cloud. Not necessarily mandated, but available - depending upon the environment. This is a highly complex and potentially volatile area, and arguments abound, however the question should be 'what's effective?'. DAMN -> fast, reliable and cheap. Though I like reliable!
How can you trust unmanaged systems and users? (also known as an information processing nodes!). See previous post.
How can you trust managed systems and users?
How can you trust infrastructure nodes?
Expect them all to fail. Expect them to be compromised. Expect to lose trust in them.
Now where does that leave us?
Let's look at the enforcement points on a simple systems trust model again... See previous post. (I like to think of the diagram as the equivalent of a Feynman diagram for IT Security, tee hee!)
So some stuff to think about. Here's a new acronym/phrase for you akin to SOA(Service Orientated Architecture).
SOV(Service Orientated Vulnerability) can be a compound or blended vulnerability.
SS(Service Surface) interface, network, user, back-end etc
IS(Interface Surface) subset of the above and takes in to account multiple new input vectors as the future interface will have more than one API/endpoint/processor per endpoint utilising new input devices and virtualisation.
Fun, fun, fun.
Every node will be a client.
Every node will be a server.
Every node will be a cache.
So now, do you trust the node, or introduce another trusted node to watch the node.
This could go on ad infinitum. At some point you hope there are enough checks and balances to watch the watchers.
Can we checksum people, anyone?
Schneier gets credit for leading me to the age verification system... http://www.schneier.com/blog/archives/2007/06/age_verificatio.html
Excuse me arguing by analogy, but this online age verification system to access movie trailers, sums up many of the major issues and ignorances in IT Security.
This morning, the New York Times has a nice story on gateways to online movie trailers that contain adult content. Trailers online will be preceded by colored tags, just like the green one you see in theaters that indicates the preview is acceptable for anyone watching. A yellow tag indicates the trailer may include PG-13ish content and a red one indicates an R-rated trailer, as it does in theaters, though red tags are rarely used in theaters.
The trailers that appear on the studios' movie sites, the story said, also have time of day restrictions, ostensibly viewable only between 9 p.m and 4 a.m.
More here
As the depth, pace and breadth of technology increases, no one can be expected to be an expert in all systems and subsystems they either use, interface with or build upon. Knowing what's going on 'under the hood' is becoming increasingly abstract and esoteric, especially to the standard consumer of computing resources. The issue is compounded by depth of code, system complexity, legacy systems, and third party drivers and modules, which are either knowingly or unknowingly part of a solution. Users require protection from both themselves and others while interfacing with systems or when having their information stored or utilised.
Unfortunately global systems span geo-political boundaries. Global systems which can be highjacked and used to attack more innocents.(Unfortunately systems will continue to be or will become vulnerable over time!) And I am talking about any node here; routers, switches, firewalls and traditional endpoints.
I am leaning towards the belief that more services should be available to end-users in their local cloud. Not necessarily mandated, but available - depending upon the environment. This is a highly complex and potentially volatile area, and arguments abound, however the question should be 'what's effective?'. DAMN -> fast, reliable and cheap. Though I like reliable!
How can you trust unmanaged systems and users? (also known as an information processing nodes!). See previous post.
How can you trust managed systems and users?
How can you trust infrastructure nodes?
Expect them all to fail. Expect them to be compromised. Expect to lose trust in them.
Now where does that leave us?
Let's look at the enforcement points on a simple systems trust model again... See previous post. (I like to think of the diagram as the equivalent of a Feynman diagram for IT Security, tee hee!)
So some stuff to think about. Here's a new acronym/phrase for you akin to SOA(Service Orientated Architecture).
SOV(Service Orientated Vulnerability) can be a compound or blended vulnerability.
SS(Service Surface) interface, network, user, back-end etc
IS(Interface Surface) subset of the above and takes in to account multiple new input vectors as the future interface will have more than one API/endpoint/processor per endpoint utilising new input devices and virtualisation.
Fun, fun, fun.
Every node will be a client.
Every node will be a server.
Every node will be a cache.
So now, do you trust the node, or introduce another trusted node to watch the node.
This could go on ad infinitum. At some point you hope there are enough checks and balances to watch the watchers.
Can we checksum people, anyone?
Schneier gets credit for leading me to the age verification system... http://www.schneier.com/blog/archives/2007/06/age_verificatio.html
Sunday, June 17, 2007
Friday, June 15, 2007
What does IT Security and a HIV/STD test have in common?
Answers on a S.A.E. ( Self Addressed Email )
Thursday, June 14, 2007
Subscribe to:
Posts (Atom)