Michael Mongold's Technology Security

The Case for Hybrid Identity-as-a-Service

The Case for Hybrid Identity-as-a-Service (IDaaS) Part I

Hybrid Identity-as-a-Service (IDaaS) provides a clear path to reducing the dangers associated with cloud-adoption.

The world of the information security professional continues to become further complex as more of the services that were traditionally within the control of the information security team, are outsourced to external entities. Just a few years ago, a CISO (Chief Information Security Officer) was able to confidently assure his CIO/CFO/Legal Counsel that their organization was providing adequate levels of protection for the confidentiality, integrity, and availability of the sensitive data that they were tasked with securing, by simply inspecting the organization’s internal hardware and software solutions.

But as organizations are being pushed to adopt more flexible working environments that includes the consumerization of the users’ laptops and mobile devices (BYOD: Bring Your Own Device), those organizations are also faced with no longer having direct control over the security of the locations that the data is served from and the infrastructure used to deliver those services.

Information Security team’s are now tasked with vetting an external service provider to ensure they are up to the task of providing the same level of confidentiality, integrity, and availability that they once provided internally. Now, the Information Security Manager has a new layer of abstraction between their role and the role’s responsibilities while maintaining the same level of liability if something goes wrong. If the CISO had difficulty sleeping before, they are certain to be bleary-eyed now.

So if there are inherent risks in rushing these services into the cloud, why is the business pushing for them? There are many truly exceptional benefits of leveraging cloud providers for reducing CapEx costs, realizing fast ROIs, and amazing, almost unlimited, scalability. Unfortunately, the speed of business can, and often does, exceed the speed of security.

One area where the vacuum has been most largely felt is in the expanse of secure access and identity management.

The Problem. When a panel was asked at a recent security conference “How many web or cloud services their organization is using and how do they manage identities and authentication into them?” One panelist, the CIO of one of the largest cities in America, initially responded, “How do you define the cloud?” Upon further reflection, he stated that there were more than six services with no centralized identity management or authentication mechanism in their organization. The CISO for a state government agency responded similarly but with over 20 (potentially 50) services that are utilized with no centralized access or identity management.

This will probably not surprise most. Just ask any business about the cloud services they use and how they manage the identities and authentication into those environments. Over the past couple of years, adoption of cloud offerings have accelerated to provide businesses’ solutions that deliver needed services without direct payroll costs or management in an incredibly scalable manner. The justification for cloud adoption is becoming clearer to the business-side of the house as there is little or no spin-up time for the organization between the purchase of a solution and using it. So business have jumped ahead at the savings-potential the cloud market provides.

But the information security team is not the only ones trying to catch up. Even now organizations such as the PCI Standards Council are struggling to redefine what is considered “in scope” as the boundaries of past networks are dissolved in order to allow access to valuable data anytime/anywhere.

With the gap widening between the services that a cloud offering can provide and the solutions that can secure the access and identity management to those services, it is clear that organizations must educate themselves of the dangers that this vacuum presents even as compliance organizations work to provide standardized controls.

Stay tuned for Part II next week or drop on by www.passwordbank.com for an advance copy. :)

Researchers hack your vehicle (again)

A few months ago, researchers with the University of Washington and UC San Diego released a paper detailing their "Experimental Security Analysis of a Modern Automobile". It presented a dark story where the electronic components of a vehicle, given the right access and know-how by a motivated individual, could   program events to occur from the benign (windshield wipers come on when you reach 20 MPH) to the homicidal (disable brakes and ignition over 80 MPH). It even proposed that with newer vehicles self-parking capabilities, it might be possible for steering to be arrested from the driver. If there was a silver lining it was felt that the individual hacking the device needed physical connectivity in order for the exploit to be realized. There was some indication that with weak Bluetooth security it might be possible to use that as an access vector but nothing was firmly tested.

Now, another method of wirelessly accessing your vehicle has been exposed by researchers at Rutgers University. In a paper being presented this week at the USENIX Security Symposium, tire pressure monitoring systems (TPMS) are gaining quite a bit of attention. Most people are likely unaware that all new cars in the US have been required to have a wireless tire pressure monitoring systems since 2008. The paper explains that with relatively inexpensive equipment, researchers from up to 120 feet away could obtain wireless data from the sensors, spoof it, and then send it back to the car with inaccurate data while traveling 65 MPH. While the data that was spoofed was merely enough to make the tire pressure light on the car's dashboard display incorrectly, it signals a potential foothold for wireless attacks by nefarious individuals. At, once again, it shows a serious lack of foresight by product manufacturers to account for ways that their systems could be gamed.

Each and of themselves, the threats have limited play. However, when they become combined (and what would make anyone think otherwise?), the results could be extremely dangerous. Automakers need to review how they approach the security architecture of our vehicle's internal devices now, before a flashing light on your dashboard turns into a stuck accelerator or worse…

Send me my password...

Let me know if this sounds familiar: You are visiting a website that requires you to create a profile in order to gain access to the site. So you put in your name, perhaps an address, an e-mail address, a username, and a password. Everything is great, you gain access to the website, you buy the sock monkey slippers you were dying for, whatever. Then you check your e-mail and BAM! There is an e-mail from the website you just signed up on, letting you know your username AND password that you just entered on their website. Holy credentials, Batman! This is such a poor policy and one that makes me cringe to think who is running security at these organizations. I know that they mean well and just want to make sure you have your password so you don’t forget it, but it’s really not doing you a favor.

A password that is sent in a non-encrypted e-mail should be only one thing, temporary. If anyone thinks that what is in their e-mail is secure, that person needs only to Google for "email password". Additionally, it does not matter that you have encrypted e-mail on your end if they have not encrypted e-mail on their end because they are sending YOU the password.

If a password is sent to a user, it should be a password that was generated by the website and forces the user to reset the password the next time they login. Too many people use only one password for everything, thus if you entered your usual password on the website, your domain password and bank website password are now sitting in your e-mail. Bad policies and bad habits can combine to create an very bad situation.

So, next time, if you receive your self-configured password in an e-mail, let the organization know that you do not appreciate the lack of concern for your privacy. It is simple for the website to correct and when resolved, will show they are doing what is right for their customers.

Michael Mongold

NAC Defense

With any new product technology that is introduced into an industry, there will be evangelists and naysayers, highs and lows. Network Access Control is no different. I think what I find most interesting is the amount of buzz that has been generated over the last couple of years for the technology. I have read some articles that equate NAC to a product in search of a problem. Apparently, they are not speaking to the customers I have come in contact with.

I typically interact with customers that are pursuing data encryption but when I segue over to Network Access Control, they inevitably become very interested in the technology. And why wouldn't they be? If a product can help insure that devices that are connecting to your network are compliant with the security policies you have set in place, that seems like a good thing. Not to oversimplify things here, but companies are being hammered to show due diligence when it comes to their efforts towards technology security. This product helps them to that end. As PART OF a comprehensive security solution, NAC is an essential element.

While there are some organizations that may have had some misses with their deployments; that seems par for the course of technology. There are misses and there are hits, those that miss go away and those that hit the home run become the market leaders. There is going to be a shake up in the market soon. In the beginning of every release of a product technology, there are a multitude of players that are trying to stand on each other to be noticed. Then natural selection kicks in and the weak and unlucky are weeded out.

Critics should stand back and look at the bigger picture and take a peek at the longer time line and place NAC in its appropriate stage of development and growth. There is no reason to believe any hype that purports NAC to be the cure of all ills, nor should industry types overlook the importance of including Network Access Control into any security solution they provide to their organizations and/or customers.

I have complete confidence that NAC will become centrally integrated within all major organizations within the next 2-5 years. The need is there, the demand will soon follow.

 

Michael Mongold

What a tangled web we weave…

What a tangled web we weave…

I imagine that most technology security readers are aware that Oracle has sued SAP for acts of industrial espionage that represent "theft on a grand scale."  By using the credentials of Oracle's customers and generating SAP's own credentials on Oracle's website, SAP was allegedly involved in some blatantly subversive activity.

Now I do not want to sentence SAP before they have responded, that is not proper. But I do want to point out that it is not a stretch to think that a large legitimate company would involve itself in an illegal activity to further its success.

Oracle should be aware of this considering it was sued by J.D. Edwards in 2003 to the tune of $1.7 Billion for wrongful conduct and unfair business practices.

The fact that SAP has within its organization the Apollo Group, a self-professed “Attack Oracle” group designed to combat Oracle does not bode well for SAP’s defense.

In the past year we have seen HP executives bringing the word “pretexting” into the common vernacular. An incredibly dirty and illegal method of obtaining information under the “pretext” that you are the owner (or someone who should have access to) that data. Now it appears that KPMG is also involved in a pretexting matter.

Wal-Mart just a few days ago apologized to The New York Times for spying on TNYT by intercepting text messages and phone calls of Wal-Mart employees and journalists. A matter that I believe will get much worse by the time it is done.

HID threatened legal action by raising the specter of patent infringement when a security researcher attempted to show the vulnerabilities of their technology. This could have a stifling affect on the technology research that is performed daily to better the technology sector.

 

And then there is the Telecom Italia fiasco where a team of security personnel at Telecom Italia infected publishers with a Trojan and stole documentation from their laptops. Then one of the members of the group had the gall to show the publishers their documents that were stolen and offered to take over the publishers’ security so they would be better protected.

Outside of the world of technology, there are also plenty of issues: Chiquita, for example, gave $1.7 million between 1997 and 2004 as protection money to Columbia’s United Self-Defense Forces, defined as a terrorist organization by the US Government.

It’s a shady world, folks. And just because you are paid well and everyone can speak proficiently on technical matters does not mean they have the moral fiber to avoid such lascivious behavior. I am constantly amazed at how smart people can be so under-handed. If you haven’t seen “Enron: The Smartest Guys In The Room”, please rent it soon and observe.

Technology is truly a device of our own creation. We can either give it the ability to make our existence better or we can pollute it with that which is the worst in us.

Michael Mongold

This Is Harder Than I Thought...

Within the past couple of weeks, I have come across information that indicates that some organizations sold on the value of certain hard drive encryption technologies are more problematic than they are worth. I am not going to mention them by name but there are two data encryption software companies that are in the process of being booted or are already OUT of deals that were already signed, due to the difficulty in deploying them.

Now, it is important to note that encrypting a hard drive can be an invasive process that requires a number of resources and some time in order to deploy properly. And that is if it is performed correctly. Mistakes in the testing phase, misrepresentation by the sales monkeys, and over-expectations by the customer can make an installation even more complicated. Nothing too significantly different than any enterprise software deployment, right? Well, not exactly.

See, hard drive encryption is a rather stressful event for a drive to endure. It touches every sector on the hard drive (if it doesn't you bought the wrong software) and gives the ole platters and apertures a good work out. So, right off the bat, before you deploy one copy of an FDE product, make sure you perform a chkdsk such as the following:

chkdsk c: /R /F

This will take care of a couple things for you: 1) it will give your disk a good stress test to insure it can handle the rigors of being encrypted, 2) it fixes the errors on the disk, and 3) it locates the bad sectors and recovers readable information. This could, of course, cause your hard drive to fail if it is on its last legs or could result in lost data due to the fact that a sector that was marked bad is no longer accessible and that sector happened to contain an important piece of data.

So, you must step back a little bit further and make sure you have been practicing a prudent backup policy within your organization. If you have not, then you are just a few errors from unemployment as it is and should concentrate more on your resume. But I know YOU are making sure that no xls, doc, ppt, pdf, mdb, or, MOST of all, pst files are being stored locally, or if they are, they are being backed up regularly so there is no need to hit Dice just yet.

So once you have verified your backups are working well and that chkdsk with repairs has ran on all of your devices, you are ready to think about encrypting the hard drives. And we're not talking a gentle recommendation here. You will see a drop from failure rates as high as 25% to less than 1% if you just run a chkdsk. Granted the organizations that hit the 25% mark were using some old hard drives. So, do it. A hard drive that fails during encryption can be an unpleasant thing.

Next you have deployment. This is where companies shoot themselves in the foot. Hard drive encryption companies come in and show what a great backend they have. They have glossy presentations that show a sexy user interface and tons of reporting that can be done at the drop of a hat. But, they don't get into how difficult this is going to actually be to deploy. So, now you're going to need a new dedicated server with someone who knows it inside and out and how the management works with all of the keys that must be backed up. Ah, the keys. What a pain in the ass. Trust me when I say that almost none of the companies out there want to get into key management when they are trying to sell the product to you. They may have to talk about it because you are asking, but they know it's not pretty.

You really have to think about hard drive encryption a little differently. It is not something that needs to be touched after it is deployed. Think of it like scotch guard for a couch that never wears off. If you had scotch guard that you sprayed on your couch that never wore off, why would you ever mess with it again? And really, hard drive encryption should be that simple. You encrypt the drive and never touch the encryption software again. It does its job quietly in the background and that is it. Thus, the whole backend management really complicates what should be a transparent process to the IT staff and the users. To deploy the product, you simply should be able to push it out via SMS, Altiris, etc. and never have your end user be the wiser.

Ultimately, transparency is the key. Don't interfere with your end user's ability to do their work. Do not change the experience that the end user is accustomed to. This will make the help desk and IT department in general, a much happier place to be.

Also, a note on Pre-Boot Authentication:

I personally do not recommend for most customers that they use Pre-Boot Authentication. Most users will require significant training to deal with a PBA screen popping up to them when they turn on their computer.

Now you and I may not be phased by this but if you are like some of our customers - someone who is forced by their boss to use one of these new fangled computer thingies then the first thing you're going to do when you see that alien screen pop up immediately after you turn your computer on is... call IT. Then the help desk call board lights up like a Christmas tree that was placed too close to the menorah and suddenly you are much less popular for just trying to protect everyone's data.

So, skip the PBA, the hard drive is still encrypted, bad guys can't use l0phtcrack, or slave it, or boot to a live cd and read the hard drive. It's all good. There are some POTENTIAL vulnerabilities but nothing within the realm of the probable or realistic. And if you want to know more about those vulnerabilities, I'll run over them in another post.

If you go for the simplest yet securest solution, you will find it the easiest to deploy and manage.

Data Incontinence Syndrome

I have to start with saying, I am not a huge fan of the term "Data Leakage Prevention" Sorry, McAfee - I know that you can get some easy name recognition with a number of TV manufacturers promoting DLP (how they are promoting data leakage I'll never know). (wait for it) Ok, I kid I kid. Plus, we know that humans can only remember three letters at a time and if we were to go beyond that mental boundary we would immediately spin off into the abyss never to return again.

So we have DLP but some manufacturers out there like Information Leakage Detection and Information Leakage Protection.

Noooooooo

Not another IDS/IPS mish-mash! ILD/ILP makes DLP look like a linguistic paradise.

However, the real crux of the issue for me is the middle word in all of this - leakage. I am sorry but when I see that word I have an association in my brain with Depends udergarments and incontinence issues. This is not really what I want to envision when I'm plying away at work. Perhaps the industry should just jump both feet in and call it data incontinence prevention to help us with our data incontinence syndrome. Wouldn't our customers be able to better understand what we're selling if we related our products to biological functions? I suppose there are some similarities that are already out there. When your desktop blue screens and states it is taking a dump, there is certainly some correlation between the mechanical and the biological at that point.

Now there are some that are promoting the term Data Loss Protection.

Hmmmm

OK, well it certainly has a familiar ring to it without conjuring up images of people dribbling in their diapers. Which for me, is a good thing. And I have to say I like the idea of being protected more than prevented since prevention seems only before the fact and just not as warm and fuzzy as being protected. So, I think that henceforth I will call products that protect the loss of data - Data Loss Protection. Unless everyone likes the incontinence stuff.

Michael Mongold

Chikushou!!! Eight Million Pieces of Data Part II

So the real hit here is the fact that the data was allowed to be copied onto removable media. I have discussed this problem with customers in the health care industry that are scared that this is going to happen to their patient/customer records. Organizations are unwittingly ordering desktops and laptops that have RW functionality. Yikes! You can fit A LOT of patient records within the confines of a 650 MB disc. Even a 1.44 MB disc can hold a huge amount of information in text, database, or spreadsheet format.

I think back to some of the contracts that I have worked on and the data that I have had access to AND the lack of security that could have allowed me to just walk out of an organization with some incredibly painful data. I would say that it is amazing the amount of trust that organizations put in their employees, consultants, contractors, and vendors but the truth is that it is not trust, it is naivety.

There is software that is available today that could help prevent this vulnerability. An organization that is serious about limiting (notice I did not say completely stop because I think at some point you can bankrupt yourself with diminishing returns) the vectors of data leakage can implement policies, training, and software that stem losses such as this. Organizations that want more protection should block the RW functionality of their CD and DVD drives, limit USB connectivity to only approved devices (mice and keyboards, for example), and impose some form of data loss protection.

If these organizations are not taking their responsibility to protecting their customer's data seriously enough, who do they have to blame but themselves?

Michael Mongold

Chikushou!!! Eight Million Pieces of Data

Today, Dai Nippon Printing reported over eight million pieces of data (8,637,405 to be exact) were stolen by a former subcontractor last July. Ouch. I did get a really good chuckle though considering this article that was released a few weeks ago showing how "Dai Nippon Printing Develops Security Software Against Illegal Access". I don't think that's going to be enough to spin the bad out of this bungle. So allegedly this rascal copied data to optical and magnetic media then sold parts of the data to a third party. Kind of a worst-case scenario. Now the question is, whose heads are going to roll?

Once actual monetary compensation is discussed, this is going to be very unpleasant for a number of people. I imagine it would be a good time to be selling data security software in Japan.

As for their current CSO, how do you say "Do you want fries with that?" in Japanese?

Peril by USB

There is an interesting article by James Rogers that is posted on Dark Reading today that briefly explores the perils brought into organizations by portable media devices such as USB drives and MP3 players. Of course, many desktops and laptops have write capabilities on their CD and DVD drives which open a potential vector for data leakage as well.

Nearly everyday I am confronted with a customer in the health care industry or financial vertical that brings me their concerns of these devices gaining access to one of their endpoints and sucking up some potentially sensitive data on these extremely portable, extremely losable, extremely stealable formats. Because of their relatively low physical value, they are likely not as well monitored by the end user and the threat they represent to malicious use is not viewed seriously enough by those responsible for data security in most organizations. But security officers are starting to sweat a little bit. It is starting to become more apparent that an organization does not have to lose a whole laptop to incur the wrath of its customer base or share holders. In fact, it is now becoming more of an issue for security officers to spread the news to the pocketbooks at organizations of the true dangers these unsecured devices represent.

One way the modern workforce has become more mobile without lugging around the big ole laptop is by copying spreadsheets and word documents onto a little USB jump drive or burning a CD or DVD with the data and bringing it home so that they can work on it over the weekend from their home computer. It is convenient and means that they can now leave the big laptop back at the office for their commute home. Our organizations certainly want to encourage us to work from home to maximize their investment in us. But the obvious problem is now the data that we have spent so much money on protecting in our computer networks is going to be shoved in a purse or a jacket pocket where it might be far more easily lost or snatched.

So, do you frisk every employee as they leave the building to make sure they do not have any CDs or DVDs on them? Do we make sure that there are no USB drives or MP3 players allowed in or out of our organzations? How about when vendors or contractors come to visit? When they leave, do we know what they have?

There are some good software solutions that address the problem. Software by Utimaco and Pointsec allow organizations to lock out the write functionality of the CD and DVD drives. They can also make sure that any data written to portable media devices is encrypted and require a password or pin to unlock them when they are used elsewhere. And it is not with some lightweight encryption that these products secure our devices, but instead the default is typically the AES-128 and AES-256 encryption algorithms. Additionally, these software products can lock out all removable media devices except very specific company-approved units. Thus, no more 30 GB iPods or 4 GB iRiver Clix on the laptop, but perhaps a Kingston 2 GB Data Traveler with AES-128 bit encryption or even a Stealth MXP Biometric  2 GB USB device with AES-256 bit encryption. If companies really want to provide their employees the freedom to work from home and encourage us the flexibility to do their bidding on our personal time, then they must be willing to cough up the money to do so in a responsible manner.

Anything less might just result in some unwelcome attention in the local and national media.

Yea, we're not quite so secure anymore. Welcome to the mobile workforce.

Michael Mongold