Category: Concepts

The elements of cybersecurity

Concepts, Security Assessments, Threat Modeling

Threat Modeling – What’s the worst that can happen?

Posted on by Ron Woerner

A threat is defined as “a person or thing likely to cause damage or danger.”  Threats are all around us, but we shouldn’t treat all threats as equal.  Too often we fail to identify threats because they aren’t readily apparent or we consider them to be too small.

Threats and vulnerabilities are both part of the overall risk equation.  While organizations are getting better at identifying and fixing weaknesses, many still don’t understand the potential threat landscape.  We’ve all heard, “Oh no one would ever want to attack us. We’re so small and our systems have no value.”  I can hear Target saying that about their HVAC systems. Malicious hackers can use anything connected to a production network in order to gain access.  It shouldn’t be assumed that a small target means it can’t be hit.

All organizations should conduct assessments to understand the multitude of threats they face both in and out of their cybersystems. Threat modeling is still a new arena in security, but it’s gaining in prevalence.  In CSOOnline (http://www.csoonline.com/), George V. Hulme has an article, “Can threat modeling keep security a step ahead of the risks?” where he makes a case for more effective threat modeling. He references how a CISO uses threat modeling to understand the organization’s risks, prioritize security spending, and focus security efforts.

Adam Shostack is also calling for increased threat awareness.  In his book coming out on Feb 17 called, “Threat Modeling: Designing for Security”  he explores various threat modeling approaches, explains how to test system designs against threats, and learn effective ways to address threats that have been validated at many top companies.

What does this mean for you?  As security professionals, we conduct threat modeling throughout our career.  That’s why we take the time to study threat modeling and apply it.

Careers, Concepts, Security Education, Security Management

Breaking into Security

Posted on by Ron Woerner

One of the common questions I am asked is, “How do I get a job in information security?”  Infosec continues to be a hot career field with many job opportunities.  Therefore, we continue seeing people who are interested, but don’t know the steps it takes to gain employment in information security.  This blog post answers the question, “How do I break into (the) security (career field)?”

A few years ago, I was asked a similar question of how I got started in security.  It all started as a computer science major at Michigan State University. I was also in Air Force ROTC.  This combination allowed me to start developing my security mindset.  As a military intelligence officer, I learned about data classification and safeguarding sensitive information. I left the Air Force for a job as a UNIX systems administrator where I learned how to apply technical controls to protect the systems and its data. As a junior security analyst, I learned the importance of policies and awareness. The combination of technical and managerial experience led me to security management roles. (You can read more about my experiences here: Me and my Job: Ron Woerner, Bellevue University, SC Magazine, April 2011)

To become a security professional, you need a mix of experience, knowledge, and abilities. It’s not generally an entry level career field, because you need time to develop yourself as a security professional who understands the many aspects of cybersecurity. The security community has a vast number of articles on breaking into the security career field.

This reminds me that everything old is new again. Many of the articles I mention above were written a few years ago. Things really haven’t changed over the years.  The career path still requires education, training, experience, and persistence.

As an extra, added bonus, here’s a 3 ½ minute Ted talk from Richard St. John: 8 secrets of success – http://www.ted.com/talks/richard_st_john_s_8_secrets_of_success.html (Watch for his explanation of CRAP).  It’s great, general information on how to succeed in any career.

2
Concepts, Security Management

Is it time of Security Rating of Software and Systems?

Posted on by Ron Woerner

One of the fundamental papers in the Information Security industry is “The Protection of Information in Computer Systems” written by Jerome Saltzer and Michael Schoeder in the mid-1970s.  This paper defines eight design principles to ensure the safety, security, and functionality of computer systems and applications.  It’s timeless as those principles still apply today. If you haven’t seen it yet, Adam Shostack of Emergent Chaos does a great job in his blog of explaining the Saltzer and Schroeder Design Principles and equating them to something almost everyone can understand: Security in Star Wars.

One of the ideas that come out of it is the concept of “work factor” and the fire/safety ratings on safes.  Safes are classified by Underwriters Laboratory for their ability to protect their contents from both fire and burglars.  It’s the degree of protection that safe will protect its contents. There are both construction and performance requirements.  The former defines the minimum specifications for the container. The latter defines how long the safe must withstand a burglary attempt.  You can read more about it here: http://www.maximumsecurity.com/safes/pc/Burglary-Fire-Rating-Guide-d92.htm.

This idea isn’t new. A DARPA research report from 2001 presents it from a scientific standpoint: “Adversary Work Factor as a Metric for Information Assurance.” In this paper, Schudel and Wood present the hypothesis, “that adversary work factor is a quantifiable metric that yields valuable insights into the relative strengths and weaknesses of modern complex information systems.” The authors go on to develop an approach for observing and reporting adversary work factors for information systems.

It’s time we used the same approach in Cybersecurity. The UL rating system is a standard that’s long been in use in the physical world. Why not begin to follow it in the cyber world?  The IT industry should consider creating construction and performance standards for all computer systems and applications. An unbiased, standardized security work factor rating would allow consumers to understand the safety of an application or system to determine if it fits into their risk appetite.

Why reinvent the wheel?

Concepts, Research

The Turning of a Year

Posted on by Ron Woerner

HAPPY 2012 to All!

The end of one year and the start of another is a good time to both reflect and plan.  We should look back a little at what happened in the past year and use that to look ahead into the new one.  To paraphrase the famous quote by George Santayana, “Those who don’t learn from the past are doomed to repeat it.” 

In many ways, 2011 was a booming year for the Cybersecurity industry.  Many organizations realized the need for better security practices and tools.  Unfortunately, this was due to the multiple breaches.   According to the Privacy Rights Clearinghouse (PRC), there were 535 breaches during 2011, involving 30.4 million records containing sensitive information.   (See the full story here: https://www.privacyrights.org/top-data-breach-list-2011.)  Jim Lewis, a co-blogger on this site, posted a short list of major events from 2011 with his post Major cyber security events of 2011.  

My list is similar, but takes a different perspective:

  • Sony PlayStation Network (SPN) – Sony disclosed in April an external intrusion where the thieves stole millions of online IDs and passwords and gained access to account holders credit cards.  A concise history of the Sony hacks can be found here.
  • Epsilon, an email service provider for other companies reported the largest security breach ever with at least 60 million names and email addresses compromised.
  • The group Anonymous seemed to have their way on any system.  While they didn’t cause massive breaches, they did show how most organizations (like the BART subway system) are vulnerable to attack.  It forces the question, is anyone safe?
  • Sutter Physicians Services, HealthNet, & TriCare/SAIC.  I’ve combined these breaches of medical systems, although they each have their own story and lessons to be learned. These show how having lax policies for many years are now leading to breaches of sensitive medical information.  Despite the HIPAA security rules, our personal medical information continues to be vulnerable. For some it’s cheaper to risk paying fines than it is to secure the data.

As we move into 2012, we need to reflect on these breaches and their root causes. Here are some of my thoughts on their lessons learned:

  • Approximately 30% of users reuse passwords across Internet sites.  If a thief discovers one password (like at SPN), then it can be used at many others. We need to educate our users to have different passwords, especially for sites containing their sensitive information.  Better yet, we need to encourage the use of tokens or other forms of multi-factor authentication.
  • It may seem innocuous when our names and email addresses are disclosed, but that can open us up to spear phishing attacks. This is when a criminal directly focuses fraudulent email at us to try to deceive us into disclosing more personal information.  The end result is identity theft.  There are two things to remember: (1) protect your name and email and (2) be on the look-out for any type of phishing attack.  If you’re unsure about a text, tweet, or email, contact the sender offline (telephone if possible) to confirm the message.
  • Policies and laws are in place, but are not consistently followed.  There are often no repercussions for failure to follow the policies and procedures to protect our personal information.  Compliance and governance would solve this issue for many organizations and could help prevent future breaches.

In 2012, we’ll continue to see the move to anytime, anyplace computing as more people move to smartphones and tablets for their basic business. Data will continue to be pervasive as more people trust cloud services.  It provides great convenience, but at what cost?  Diligence will continue to be the key for both individuals and organizations. If you can develop and keep a security mindset, it may save you many headaches in both 2012 and years to come.

What do you think will happen in 2012?     

Have a happy, safe, and secure 2012.