Security: The Window of Exposure 44
Bruce Schneier has written an interesting analysis of dealing with security on the Internet as a business issue -and what that means in how we deal with it, in a company setting. It's a well written piece, and quite useful for those of us out there in the corporate world.
Change Over Time (Score:2)
It's interesting to read some of the things Schneier wrote some years ago and what he's writing now. In Applied Cryptography, he seemed to argue that widespread and careful adoption of good crypto would lead to better security.
Now the point seems to be that system security is simply too complicated--too many issues, too many variables. And that system is secure.
Despite this sentiment, however, OpenBSD seems to be doing quite well....
And just a reminder--Less than a week before the RSA patent expires.
--
Lagos
Awareness vs. Protection (Score:3)
So, it becomes more important to know when you have been cracked (you will anyway, eventually) than to prevent it.
It looks like the future for products like Tripwire (detects system file changes and the like), Portsentry (portscan detection)and other 'security break awareness' products is bright.
Then, if you really want to be aware, directly send the important syslog-messages (like, people becoming root, portscanning detected etc.) to an old unused matrix-printer. Works great, since it is possible to erase your log-files (once you're root), but it's *real* hard to mess up logs that are on paper (without physical access to the site, that is)!
Process vs. Product (Score:2)
Business Security (Score:3)
I worked for a company for almost a year which was in the business of website hosting/design. As I was fairly close to the servers, I knew that we were getting regularly port-scanned, our NetBios was wide open and had had a number of attempts to break in [obviously script-kiddies, since it wouldn't have been particularly hard, yet to my knowledge they never got anywhere!]
The boss was fully aware of these problems - and yet consistently refused to accept that at a very minimum we needed a firewall - even when we finally got it into his head that this was a necessity he allowed so little time for our linux guru to work on it that it was still not operational when I finally resigned.
This is the sort of attitude that seems to be prevalent in industry - the people in charge just do not seem to understand that basic security is a must. Had anyone penetrated the system, they could easily have put this company out of business - and I'm sure this is also the case for many others!
Unless businesses wake up, they will find themselves digging their own graves - and all for want of devoting a little time to something which, with all the media hype, is staring them in the face.
which came first? (Score:2)
In connection with his new book (which I haven't read yet, because I'm still trying to find a good consultant to find me a morally upstanding bookseller), I wonder how much of his attitude is a necessary contingency of running a security business, or if that's why he started counterpane in the first place. I don't find fault with his presentation of facts, more with the sense of hopelessness he has conveyed in recent writing (I'm going mostly by articles, excerpts, and his crypto-gram newsletter).
Re:Change Over Time (Score:1)
Plus, the RSA algorithm has been public domain since September 6. How did you miss that story being the crypto expert you are?
While I agree OpenBSD is "doing well" in terms of security, there is a LOT more to security than running a "secure" operating system. He's not the typical Linux user who's only worries are stopping a couple losers from breaking into his krad linux box. He works for LARGE corporations who's security needs far outweigh anything the average person here could comprehend. Even you.
Punk
Re:which came first? (Score:1)
Fluff and puff (Score:3)
Interesting MARKETING Document (Score:3)
Re:Change Over Time (Score:1)
Mea Culpa of a Kikes? (Score:1)
Re:which came first? (Score:1)
Well, if you don't mind a little freeform juxtaposition, then yes! The real question is whether or not it's excessively hopeless, and I think the answer is yes there too. Security isn't easy, but it's possible to restrict risk to acceptable levels. I agree that backups and insurance are also important. But anyone who doesn't have these already knows they're incompetent.
And the insurance really shouldn't be so expensive for anyone who is conscientious about risk. To put this a little differently, I wonder how an insurance policy would sell if it had two tiers of coverage, the lower of which kicked in if it were found that at the time of the incident a relevant patch more than five days old was available. Well-run organizations would be happy to buy it, poorly run ones would have to stick with the expensive stuff.
Seen this sort of thing before (Score:1)
And, I'm not sure that quoting Lloyd's of London is necessarily the best thing. Lloyd's has had some significant hits from bad insurance policies recently.
...phil
This isn't anything new (Score:1)
Re:Business Security (Score:3)
Changing terminology is important (Score:2)
Talking and thinking in these terms has importance far beyond securing your own system. It affects how users think about their participation and actions. It affects how law enforcement thinks about their reactions. It affects how legislators think. Right now they act like there is some sort of magic fairy dust that you sprinkle on your technology and poof --- an impenetrable secure system. The result is devastating losses when (often inadequate) security processes fail.
Crypto-gram (Score:3)
Actually, this month's episode, which came in the mail this morning, talks about the same windows of exposure.
I can hartly recommend this newsletter to everyone!
Ivo
Interesting but -far- to theoretical (Score:2)
Sounds nice if you stay within the range of companies this article is focused on. But it sure will not do for every organisation out there. Allthough he stated this himself (For example, it makes no sense to purchase a $10,000 safe to secure $1000 diamond...) I'm surprised to see this in his final conclusion. For a small business the costs to maintain a M.S.M. system is far more expensive and has much more overhead then a solution based on prevention. Lets take this into 'normal proportions' and try some real life examples...
M.S.M. would take a system to track the entire stuff, a network operator (or more offcourse) to monitor the readings and take action once something is happening. Perhaps he can do this besides his normal work but that would reduce the whole effectiveness I guess. Is this effective? Sure, but don't look at the costs of this solution. To put it blunt; if I wanted something like this I'd go broke very soon.
When I compare this to setting up a masquing proxy & firewall with some "low-end" solution like ipchains (prevention), making regular backups (even more prevention) and finally having some very good insurances it becomes quite clear which is the best solution for SOHO's and up. When an attack is made it sure took 'm some time to breach my firewall. If that happens and I loose data I got backups and when they fail (unlikely) I'm still way off from going broke since my immediate costs to reduce the damage are covered as well.
Therefor I think that globally concluding that M.S.M. is the most cost-effective way, by standard, is not true.
Network Security System Administration (Score:1)
Re:Changing terminology is important (Score:1)
If people are fooled by names like that then they have no business within the security sector and should not bother with it IMVHO. After all; rule one is knowing what you are talking about, and this isn't just the case for security issues.
Secure Systems are possible (Score:2)
Whether or not it is financially possible to create a 100% secure machine should not be cause to abandon the idea and leap towards compromise. A beautiful example, is of course, OpenBSD -- the pursuit of an absolutely secure system *DOES* result in a more secure system. I'd take OpenBSD out of the box over any commercial UNIX with all the vendors' "window-limiting" products any day!
If your goal is a secure system -- then it is possible (even if unlikely) to create a secure system! If you goal is something else (profit, chrome, popularity, enlightenment, whatever..) then it probably isn't. SO, if YOU are trying to create a secure system don't let someone with another goal get in your way! (accounting firms, authors, vendors, users, managers, whom/whatever)
There is nothing abstract about system security -- and intentionally abstracting it to liability management or limiting window time is a lie -- even though it may be a white one.
This is analysis? (Score:1)
The idea of moving from blocking threats to risk management is an old one and quite recently there was an article on Slashdot about Bruce coming to this conclusion. Not to mention that he published a whole book where he talks in detail about it.
I like Counterpane, but is it really necessary to put every press release of theirs on Slashdot?
Kaa
Re:Business Security (Score:2)
Nobody succeded in their attempts to break in, so any money spent on more security would have been wasted.
Rather than being stupid one could argue that your boss took a gamble (the current state of security will suffice) and won.
(OTOH buying a firewall without spending enough time to get it to work properly... THAT is stupid. He just wasted the money spent on equipment without getting any better security in return)
The article was right. The goal of most businesses is not to have maximum security, but to spend *just enough* time and money on it.
Re:Crypto-gram (Score:1)
hardly or heartily? I'm guessing the second.
</nit>
--
Re:Change Over Time (Score:2)
I understood that the patent actually does expire in around a week so the poster you responded to was correct. The RSA algorithm was indeed released and made public domain early. Perhaps because the patent holders thought there was some PR value in doing so. Who knows...
Cheers...
--
Re:Secure Systems are possible (Score:2)
Define secure. Secure against guys from a TLA coming round and beating the information out of the sysadmin?
What you can actually do is assess what threats you wish to defend against, what compromises in usability and other functionality you are prepared to accept, and design a system that provides defenses against the expected threats.
Re:Change Over Time (Score:1)
You must also make sure that whenever a break-in happen that the inpact is as low as possible. By making the exposre as shorts as possible you can minimize the risk of complex systems. A computer system is so complex that it is practically impossible to ensure that it is 100% safe. The goal must be to have strong crypt AND ways to make sure that a single fault do not leave the system wide open. So that the security risc is as low as possible.
Security Management in the real world (Score:1)
Security in the real world is seldom measured in absolute terms. Locks, Cryptography, anything a person can put together, by DEFINITION can be taken apart by another person.
We used to say, "Don't put a $100 lock on a $20 door." Most security was not broken by breaking our locks, but by bypassing them. A strong lock on a strong door, next to a window. A back door with flimsy panels. And, when the price was good enough, an axe to completely destroy the door of a liquor warehouse.
Most people had nothing this valuable to steal.
Security only makes things HARDER to circumvent. For "little" secrets, a "little bit" of security is enough. For bigger ones, more security.
Look at history once in a while. Some of the greatest "Security Devices" in the world were the great pyramids in Egypt... hacked.
Security through obscurity? The only tombs from ancient Egypt that were never ransacked were the ones that were never found. Obscurity can be your friend.
Remember that the strongest ciphers and the best locks in the workd buy ONLY one thing. Time and difficulty from the people that you are protecting against. Its reasonable to use weak cryptography for things that are weak secrets. My credit card information is simply not worth several mips years of cracking. It would be good for ONE moderate purchase, then cancelled.
Strong locks, strong crypto, are both expensive. It is important to fit the worth of the secret to the strength of the lock, then manage when (not if) some breach occurs.
wobbly@angel[nospam]fire.com
go bruce go (Score:1)
---------///----------
All generalizations are false.
Re:Secure Systems are possible (Score:1)
>
Expand your expectations. Get *LOTS* of people together listen as they expand their expectations.
Bruce didn't address responsibility (Score:2)
Unfortunately, I've never heard of a business actually using this policy. All of them, including banks, brokerages, and the rest, are so greedy that they continue operations even with major vulnerabilites. Worse, they do not tell their customers that the vulnerabilities exist. In fact, they typically have shiny marketingware which extolls the security of their systems. Hackers and crackers are the only people aware of the vulnerabilities in the meantime.
In a system that I am building at work, I am including a "scram" function which provides central control for shutting down all network operations. Hopefully the scram combined with they type of intrusion detection system that Bruce outlines, will help me uphold my responsibility to my cusotmers.
Re:which came first? (Score:1)
Perhaps the direction their headed will be to offer a one-stop-shop: "send my $$$ per month, we'll provide and manage and monitor your network."
I basically agree with his latest conclusions and you have to admire his mea culpa regarding "Applied Cryptography"...
Commercial firewall vendors. (Score:2)
To save a long anecdotal rant, the team, particularly the head of the team, were completly incompetant. Things didn't work, projects ran over budget, and serious holes (open relays) were left in place. Some projects would take weeks to complete, and he would not let them know their own firewall passwords.
The silliest aspect was that he believed that by adding a second NIC to a server, 2 processes could then listen on the same port on that machine, one on each NIC.
He also installed our firewall (previously we relied on a router with really severe port filtering rules in place). FTP from a browser was broken for 6 months, despite promises to fix it, until someone on my team got hold of the firewall password and fixed it himself.
They moved to exploiting another market, leaving a handful of broken installations with no effective support. They now sell web servers, and believe that the best web server product is Lotus Notes! Says it all, really! And they IPOd earlier this year. Not on f*ckedcompany.com yet.
The moral - even so-called security experts can be utterly hopeless.
Arguments for REACTIVE management (Score:2)
One this I didn't see in the article is a rational discussion of costs. There are the obvious costs of security (administration) and insecurity (theft and fraud). But there are also much less obvious costs from lost business. These can be several times greater.
Lost business costs can come from both excessive (preventative) security, and from insufficient security. Excessive security is a hassle, and deters customers. Perceived low security might also deter customers if they fear they will lose something valuable (credit card numbers? data).
I think in any business security discussion, ALL these costs must be considered, not just the easy, hard $.
Re:Awareness vs. Protection (Score:1)
Re:Interesting MARKETING Document (Score:1)
Hmmm, and where can I get this wonderful managed security? Why look, Bruce himself sells it! What a happy surprise ...
Of course. He
Ok, so he could have chosen to do step 2 and 3 in reverse order. (Actually, maybe he did and we just didn't notice?) But that doesn't invalidate the analysis. Nor the product.
/A
Wait a sec... (Score:1)
Got it right here (Re:Secure Systems are possible) (Score:1)
Re:which came first? (Score:2)
It sure does. The article says that "outsourced Managed Security Monitoring" is the answer. Now click Our Solution [counterpane.com] at the bottom of the page to read about Counterpane's "outsourced Managed Security Monitoring".
This sort of thing protects against script kiddies, not serious attackers who are trying to steal something of value.
Too Expensive! (Score:1)
I talked with Counterpane about 6 months ago about monitoring service for the company I worked for then. While I will admit that I wasn't very interested at first (we talked with them because the brother of one of our sales reps worked for Counterpane) I was intrigued with the idea of out-sourcing some of the security burden. As anyone who has had the pleasure (pain?) of managing an Internet start up company's network will tell you there is never enough time to do most things 'right', least of all securing the network against intrusion and attack. So the idea of external monitoring was interesting, at least until we actually sat down with the sales reps from Counterpane and asked about pricing...
As I recall, and please remember that it has been awhile so my numbers may no longer apply, Counterpane's minimum service offering was $25,000 monthly for one detector box and 24/7 monitoring. I wanted to laugh when I heard that figure. And they were never able to satisfy my requirements for dealing with DoS attacks (the monitoring boxes did not have any type of fail-over access though they did promise "It's comming in just a few months...").
Until the prices come down I can't see their service being useful for any but the largest and most heavily trafficed Internet e-commerce sites. And even then only as a backup to in-house monitoring efforts.
Re:Business Security (Score:1)
I agree, fully. I recently left an insurance company that believed installing a firewall without designating a qualified, diligent administrator solved all its network security problems. Oh, BTW, their Shiva LANRover drills a hole right through the FW-1 box. At least one sysadmin there reads /., so I hope you guys can get JW to take his head out of the sand.
I now work for a bank where my responsibilities include network security review and evaluating intrusion detection products. (Currently playing with Axent's NetProwler.)
Schneier is right about the importance of efforts before and after the fact. Intrusion detection and response are as important as any preventive efforts.
-----
Re:Change Over Time (Score:1)
Re:Change Over Time (Score:1)
Despite this sentiment, however, OpenBSD seems to be doing quite well....
i I think OpenBSD doesn't cracked much because no-one actually runs it. it's "that really secure OS", but we need mainstream software to run on our OS, so we're going to use FreeBSD or Linux.
MacOS is also revered to be to secure the DOD, It's security through obscurity.
-Jon
Re:Business Security (Score:1)
Wow, I think you really missed one of the points of that article. The generation of commisions is also a generation of sales for the company. To say that security out ranks sales for the company is short sighted. Now, to be sure, sales shouldn't blindly outrank security either. But one of the critical points in the paper is that when thinking about security for businesses, you're providing a benefit to your company if you only look at removing risks. You need to look at risk management. Which means all 3 of the following:
- accepting risk - risks are acceptable when the cost to transfer or avoid is higher than the cost of incurring the risk (e.g. I will drive on the highway, despite the risk of accidents. This is necessary because I have to work to feed my family.)
- reducing risk - risks are reduced/avoided when the cost to reduce them low in comparison to the cost of incurring the risk (e.g. I will drive at reasonable speeds and drive with a constant vigilance towards other unsafe driving practices. I will wear my seatbelt. I will invest a little bit more in a safer vehicle).
- transfering risk - risks are transferred when you pay someone else to take them if they occur (e.g. I will buy car/health/life insurance).
Simply banning the installation of a mail server because it hasn't been passed "as secure", might just be the best solution. But it may be the worst solution. If not having that mail server available costs the company their business, then not installing it is actually a bigger security threat than installing it insecurely. In short, there's got to be more to it than the overly simplistic example that you gave.And that's one of the points of the article. That security isn't a thing. It's an activity. You have two choices:
- Delude yourself into not thinking there's any risk.
- Realize that risk is a constantly changing and morphing thing, and appropriate response must also be constant and morphing.
Failure to do the latter on a constant basis is the same as doing the former. But the only reasonable way to do the latter is to accept some risks, avoid some risks, and transfer some risks.