Spire Security Viewpoint

Mr. Spock's approach to separation: Logical

I am reading through Amazon's new Virtual Private Cloud annoucement. Definitely interesting stuff. It is a useful exercise to recognize the number of times you see the word "logical" modifying the segmentation / separation requirements for VPC.

This is not the end of the world by any stretch, but it is important to understand the difference between "logical" separation and physical separation. Seems sort of obvious when plainly stated, but it applies in many circumstances - virtualization is another technology that employs logical separation. Switches logically separate nodes.

When you logically separate elements or nodes or whatever, that means there is software providing the separation. Software that could be compromised. This is why standard recommendations for DMZs was not to hang different zones off the same switch.

Keep in mind that the risk is higher when comparing logical to physical separation. How much higher? Well, that depends on the attack surface of the software doing the separating.

"Read the whole thing"

Pete says:

What do you think the motivation is for bloggers when they mention or quote some other piece of work and then say "read the whole thing" in their post? For some strange reason, I find myself reacting as if I am being ordered to do something (the old Marine in me?)... which I suppose I am.

But is this order a power play on the part of the blogger or is it simply a strong endorsement of the "whole thing"? Is there a guilt thing going on (the blogger doesn't want to co-opt readers from the original)? Maybe some sort of MLM for bloggers? Or perhaps an instructor's directive so that the context is more fully provided?

Can't we decide for ourselves whether to "read the whole thing" or should we further subjugate ourselves to the power of the blogger in question and actually go out and and "read the whole thing" with no discrimination on our part? Can I trust that the blogger in question "read the whole thing" and will therefore accurately represent the "whole thing" so I don't have to "read the whole thing"? Or is this simply a tacit way of suggesting that we never "read the whole thing" and really should? 

Read the whole thing.

[Btw, just felt like riffing a bit here - supposed to be a bit of existential fun for us bloggers ;-)]

Apple, Google, and Microsoft

I was talking with a colleague (not a security guy) who made the point that in the marketplace it seemed like Apple and Google can do no wrong and Microsoft can do no right. That struck me as interesting because I think the tide is shifted in security, where Microsoft can do no wrong and Apple/Google can do no right.

I don't think either situation is healthy, and generalizations are prone to extremes anyway, but it made me wonder - which situation would you rather be in if you were selling non-security related software (and hardware, I suppose)?

If I were a Czar*

Via New School we have a challenge from Michael Tanji:

You are the nation's new cyber czar/shogun/guru. You know you can't _force _anyone to do jack, therefore you spend your time/energy trying to accomplish what three things via influence, persuasion, shame and force of will?

I think pretty much every security professional should take this one point to heart - you can't force anyone to do jack - click your heels together, look in the mirror, deny it for as long as you want... but it is so true. But don't cry about it. Figure a way around it.

Getting back to the question, here are my three things I would do as Cybersecurity Czar:

1. Promote and engender industry support for Software Safety Data Sheets and/or Software Facts Labels, the former providing a mechanism for inline protection by host intrusion prevention and the latter providing software details to assist humans in recognizing and assessing risk factors of the software they are evaluating.
2. Create a lab, or promote existing labs for use in validating the strength and weaknesses of various software applications and platforms. The lab would consist of enough systems (VMs, likely) to allow for single variable manipulation for controlled experiments. This lab could test the veracity of each individual configuration setting or patched vs. unpatched systems, etc.
3. Create secret backdoors in software and a secret universal monitoring program for the federal government. (Ooops, guess I blew the "secret" part, and some may also suggest I am too late, anyway). 
4. Since number 3 is really a joke (you did get that, right?), I have another option - find a stronger way for universal identification and authentication other than using social security numbers. Push the industry towards a better solution by publishing all SSNs.

(*sung to Beyonce's "If I were a boy" - here's hoping Hoff or Shrdlu strut their stuff and flesh this one out! Maybe that's what it takes to find a cybersecurity czar who will stick around -> Beyonce singing about it... Btw, I really don't get the song, but maybe that is the point... ;-))

Should I be recommending credit card usage?

I was interviewed by NPR's Marketplace today regarding identity theft. When they asked for recommendations, one of the things I said was to use credit cards instead of debit cards due to the benefits in liability structure.

That felt really weird given the problems that contributed to our current recession. I guess I should have suggested that people pay off their balance every month, too, but not sure anyone would have stuck around to hear that part.

Picking PCI's Locks

Two stories this week grabbed my attention. First was Schneier's rather traditional take on the notion that no control is 100% secure. In this case, he is talking about locks and how they "aren't very good." To be honest, I was pretty frustrated at the black and white approach to something that is obviously mired in shades of gray. The goal for any control isn't 100% security, it is a reduction in risk. That is, a lock should reduce the potential of an incident (or its consequences), preferably by more than it costs. That is not a high bar to meet as the cost of locks in many cases is built into the price of doors (or cars, lockers, etc..). I also find it difficult to believe that people would stop locking their doors, especially in high-traffic areas - I believe there are many more opportunist criminals looking for an open door than there are professionals who know how to pick/break a lock.

The second story was the Heartland PCI story that took off with Bill Brenner's interview of CEO Robert Carr. My initial take there was that this was another instance where PCI was broken and we should pursue alternative methods of compliance like Andrew Conry-Murray's. In other words, I was making a black and white assumption based on my predisposition to dislike compliance audits.

Then I realized that I was doing the exact same thing I was frustrated at Schneier about - oversimplifying the nature of controls to a binary outcome  of work/don't work.

There is a much bigger problem here than I was exhibiting cofirmation bias and being hypocritical in some respects. That is, we still don't know WHAT WORKS. We don't have a good definition of success nor do we have any evidence or results that demonstrate that controls WORK. This doesn't mean they don't work; it simply means we haven't done a good job proving it. (I had a similar discourse regarding Microsoft's SDL a while back).

My assertion is that locks "work" if (as I described earlier) the risk-adjusted amount of damages (or expected value of losses) is reduced by more than the cost (total cost) of the lock itself. Similarly, PCI "works" if the risk-adjusted amount of damages is reduced by more than the cost of the audit. (Note: In a previous take on whether PCI is working, I focused solely on a risk reduction without accounting for the cost of the control.)

Clearly, my bar is set much lower than complete security, but much more practically when it comes to determining appropriate controls for an enterprise program.

Update: After re-reading my post, I realized I was short on explanation about why the Robert Carr interview showed PCI was broken. I agree with everyone that said PCI isn't about catching that single compromise - that's not the point, the point is "compliance." But when you peel that onion, the real value all of a sudden disappears... compliance really *IS* supposed to reduce risk and perhaps it doesn't... subject to the criteria I laid out in the rest of the post.

Implied Probability and Loss Calculations

So, you have decided to spend $250,000 on security measures. You have done the analysis and you believe the spending is well worth it. You already have the money and some happy salesperson is working on a proposal right now. You don't need risk management because you're close enough to the finish line that all that annoying stuff has been evaded successfully. Only it hasn't...

Assuming you are a conscientious security professional, you actually went through the process of risk assessment and completed it when you decided it was "worth it" to make the purchase. Informal, ad hoc, seat of the pants are all tried and true methods of success in this field.

In fact, you, as conscientious security professional, conducted an informal calculation of the consequences and the probability associated with some negative event that this $250k countermeasure is supposed to eliminate or reduce.

Now, I can't tell you exactly what consequence and probability values you implicitly decided on, but I can tell you that their product must be greater than $250,000. It could have been a 5% chance of losing $5 million or a 50% chance of losing $500,000. Perhaps it was a 1% chance of losing $25 million.

In order to get your money's worth (e.g. ROSI or return on security investment) that $250,000 must be LESS than the amount of reduced risk. If you assert otherwise, then it wasn't a good decision. Let me say that another way - if you tell me I am wrong, then you are making a poor decision for your organization.

Is Prevention Worth It?

The Congressional Budget Office released a letter discussing the impact of preventive services on health care costs. This section in a blog post about the letter is illustrative:

...Although different types of preventive care have different effects on spending, the evidence suggests that for most preventive services, expanded utilization leads to higher, not lower, medical spending overall.

That result may seem counterintuitive. For example, many observers point to cases in which a simple medical test, if given early enough, can reveal a condition that is treatable at a fraction of the cost of treating that same illness after it has progressed. But when analyzing the effects of preventive care on total spending for health care, it is important to recognize that doctors do not know beforehand which patients are going to develop costly illnesses. To avert one case of acute illness, it is usually necessary to provide preventive care to many patients, most of whom would not have suffered that illness anyway. Judging the overall effect on medical spending requires analysts to calculate not just the savings from the relatively few individuals who would avoid more expensive treatment later, but also the costs of the many who would make greater use of preventive care.

This is a very straightforward use of an expected value equation - take the number of patients likely to have an illness and multiply it by the difference between treatment costs for progressed illness and treatment costs for early identification. This total number is then compared with the costs for testing for the illness across a large population where only a fraction have the illness.

A good example of the application is hard drive encryption. I remember a few years ago hearing folks say that it only costs $100 per laptop (or something like this - I don't recall the real number offhand) to save breach costs that amount into the tens or hundreds of thousands of dollars.

The proper way to evaluate this is to compare the total costs for encryption to the number of laptops expected to be compromised times the expected losses. I still believe this is a win for encryption, but the analysis needs to be appropriate to ensure there aren't cases where you are spending too much money for 'preventive care.'

Cloud (and virtualization) Security: Hyperdynamic Processing and Maneuver Warfare

Ben at IronFog points to this article by Kevin Jackson about maneuver warfare in IT security. An excerpt:

"By leveraging virtualization, high speed wide area networks and broad industry standardization, new and enhanced security strategies can now be implemented. Defensive options can now include the virtual repositioning of entire datacenters. Through “cloudbursting”, additional compute and storage resources can also be brought to bear in a defensive, forensic or counter-offensive manner. The IT team can now actively “fight through an attack” and not just observe an intrusion, merely hoping that the in-place defenses are deep enough. The military analogy continues in that maneuver concepts must be combined with “defense in depth” techniques into holistic IT security strategies."

and

"After picking up a grossly abnormal spike in inbound traffic, targeted applications could be immediately transferred to virtual machines hosted in another datacenter. Router automation would immediately re-route operational network links to the new location (IT defense by maneuver). Forensic and counter-cyber attack applications, normally dormant and hosted by a commercial infrastructure-as-a-service (IaaS) provider (a cloudburst), are immediately launched, collecting information on the attack and sequentially blocking zombie machines. The rapid counter would allow for the immediate, and automated, detection and elimination of the attack source."

This is the type of thing that I was thinking of when I wrote about hyperdynamic processing in the ISSA Journal and on my blog:

Hyperdynamic processing – Darn straight I am making this name up. What do you get when you combine vmWare’s Vmotion with address space layout randomization (ASLR)? Well, hyperdynamic processing, of course! Think about stable, transaction-oriented sessions (can I say that?) running in random locations across the Internet providing protection against lower-layer targeted attacks while maintaining a stable application environment.

There are some obvious challenges here, like how you can maintain necessary contact with the user without tipping off an attacker, but the ability to spin up VMs quickly and migrate data, even sessions over has an interesting opportunity for future security interests.

If Security Performance can't be Measured / Monitored...

I was struck by this excerpt from a letter from George Mason economist Don Boudreaux of Cafe Hayek to the Chairman of Fairfax County School Systems:

"Alternatively, if the problem with merit pay is that measuring teacher performance is simply too difficult, then we can conclude that Fairfax teachers now are as likely to be doing a truly lousy job at educating children as they are to be doing an excellent job at this task.  (Indeed, if performance can’t be monitored, then chances are the teachers are doing a lousy job.  After all, why put forth effort if worthwhile results of your effort – or lack thereof – are undetectable?)"

It made me wonder about our ability to measure security professionals performance in a similar vein.