The Ashimmy Blog

Just Another Risk Podcast – NOT

Continuing my series of podcasts on all things Risk, I have another great one in this episode.  I am joined by an all star panel of HD Moore, CSO of Rapid7 and founder of Metasploit, Ron Gula, CEO and CTO of Tenable Network Security and Jody Brazil, founder and President of Firemon. With that kind of talent, this is not just another Risk Podcast!

The four of us discuss some common mistakes people make in risk management.  How vulnerability and pen testing figure into the Risk equation. We even manage to discuss scenario based risk management as exemplified in the Firemon Risk Analyzer. 

Having smart people on the show makes my job easy and fun. This was a very easy and fun podcast. I hope you enjoy!

Related articles

• Have We Got Risk All Wrong? (ashimmy.com)
• Risk, Risk, Risk (ashimmy.com)
• Tenable Network Security Podcast Episode 108 (tenablesecurity.com)
• The inter-relationships of risk, objectives, strategy and performance (normanmarks.wordpress.com)
• Metasploit Updated: Forensics, SCADA, SSH Public Keys, and More (community.rapid7.com)

Marketing Security

No this is not about a new VP of marketing at some security vendor. I was reading an article today about a presentation at RSA Europe by Lee Parrish, VP and CISO of construction firm Parsons Corporation. At a time when most of the departments and budgets in his company where shrinking, Parsons nearly doubled his security budget and was hiring more people. 

I know you think they must have had a really poor security department, suffered a breach and so finally security got the attention it deserved.  You would be wrong.  How did Parrish accomplish this feat?  Easily, he “marketed security” internally to the board and stakeholders at his company.

This is a topic I have written about over the years before.  Too many times we hear security folks lament the fact that they just can’t get management to take the threats seriously. They just don’t care enough to approve the budget and resources needed to do security right.

Usually these same people will turn their nose up at marketing types. The marketing and sales people are as reptilian as Queen Anna was in the V series to these folks.  Whether it be security vendors or not, often times security admins will want to take a long hot shower after spending time with marketing and sales types.  What a mistake!

The point Parrish makes is that you need to market security. In the case of security admins you have to market to your own buyers. The decision makers and purse holders at your own company.

Parrish gives a great example of seeing that apps were being downloaded that were not approved and presented a security issue.  But these rogue apps also were driving help desk call numbers through the roof.  So instead of talking about the security threat of these rogue apps he talked about buying technology that would thwart the downloading of rogue apps which would drive help desk calls down by X% saving Y$ per year.  That is the kind of message the business managers understood and they gladly approved the budget.

If you are going to sell (and as I have said before we are all sales people in one way or another) you have to understand your customer. What is it that keeps him up at night, what are his buttons.  So start thinking of your stakeholders internally as your customers and you have to sell them. Before the sale, you have to market to them.  Think like a marketing person and you just might get the security budget you need to make your job fun again.

Related articles

• RSA Europe, day one (roer.com)
• RSA Europe conference - a waste of time? (roer.com)
• Security on a Shoestring Budget (pcworld.com)

Glass House Syndrome and the Security Industry

Image via Wikipedia

By now you have probably read about the hacking of Barracuda Networks website. Barracuda has also posted their official response to the incident via a blog post by Michael Perone, CMO of Barracuda. Another report came out shortly thereafter indicating that the attack was the work of a Malaysian group called, HMSec.

It appears that the information made public while embarrassing for a security company to have disclosed, was not financially in and of itself valuable.  Of course any security breach at a security company could be damaging to their reputation and with that damage to reputation, could come financial loss. 

However, lets be clear here.  This kind of thing could happen to any of us. In my case it did. It was just three or four years ago that my blog and email accounts were hacked. But besides that, Barracuda joins some decent company. RSA, McAfee, Symantec, Comodo, Kaspersky and Google to name a few, have all suffered hacking attacks.

So this really is a case of it could happen to any company. Recently it appears that security companies themselves have been targeted by hackers. For that reason any company that would fault Barracuda for what happened here is really playing with fire.  They may find themselves the next one in the glass house while someone else throws stones.

This point was brought home to me by the tweets I saw after this incident was originally reported.  Josh Corman of 451 Group said he wasn’t interested in hearing from companies who would say this sort of thing would never happen to them.  Mike Rothman and Bill Brenner agreed +1 and +1000.  Martin Mckeay wondered why he didn’t already see marketing around this story.

Is that really the sad state of our industry? Are there people arrogant and stupid enough to stand up and throw stones at any of these companies that have suffered breaches, as if it couldn’t happen to them?  I would hope not, but maybe I am wrong.

In the post from Barracuda they say that their WAF was inadvertently placed in passive mode and then shut down for a maintenance window. The inference being that had the WAF been up, this would not have happened. Of course there are some who in their best SNLChurch Lady voice say “how convenient”.

But really does it matter? If the WAF was up, but there was some spear phishing that gave the attackers a vector in, would you feel differently?  There is no guarantee that you cannot be hacked. I don’t want to use the APT word, but no one, no one is 100% immune.

So if we really have members of our industry who would say this could never happen to them, shame on them. Pride is the deadliest of the deadly sins.

The only real lesson to be learned here is that it could happen to you or I or any of us. That is why we have to  be ever vigilant and work as an industry to safeguard not only our own but the property of others as well.

Related articles

• Hack attack spills web security firm's confidential data (go.theregister.com)
• You: Barracuda Networks to Take the Stage at RSA and BSides Security Conferences (menafn.com)
• McAfee's Website Full of Security Holes (it.slashdot.org)
• Behind Comodo hack, an insecure Web (roundup) (news.cnet.com)
• McAfee's website full of security holes, researcher says (infoworld.com)
• The breach felt 'round the Web (week in review) (news.cnet.com)

Life without Firewalls - Possible,Yes Practical, No

Image via Wikipedia

SC Magazine UK edition had an article the other day by Dan Raywood. He tells us of Kevin Dowd, CEO of CNS Networks and Security who has been running an experiment for years now running a network without perimeter firewalls. 

The premise is that we rely too much on our firewalls, they are not a magic bullet and you can have a secure network without them.  You can read the article for all of the tricks and tweaks done to try and secure the network.  They try to keep the network as simple as possible and actually seem to substitute a lot of host based firewalls in place perimeter firewalls.

As we used to say as little kids, “anything is possible”. But just because something is possible, doesn’t mean it is practical or even advisable. Why you would want to tie one hand behind your back and get into a street fight is beyond me.  Just doesn’t make a lot of sense.

My friend Jody Brazil, CEO of FIremon had some thoughts on this as well. He actually went through the exercise of pointing out some of the pitfalls and reasons you wouldn’t want to do this. You can read his thoughts at the link above.

But really, I would think we have all learned that there are no magic bullets in security. Why one would want to take a tool like a firewall out of the hands of security and network admins just doesn’t make a lot of sense to me.

Do our security products do what they say they do? A false sense of security is worse than no security at all

A foundation of much of our security strategy today is to deploy security solutions to protect us. As an industry we have put policy and process in the back seat to technology. But is our blind trust on security technology justified? I have seen some evidence lately that says no. In fact I am not sure that all of these appliances and software that we use work at all.

What makes me say this? Let me give you some evidence:

1. Kelly Jackson-Higgins has a good post up on Dark Reading about the research done by Larry Suto on web application scanners. According to the report which you can download the pdf of free at Dark Reading, most of the scanners missed almost 50% (one half) of all web app vulnerabilities! Think about it, scanning your web apps, you might be missing one out of every two vulnerabilities!

I was shown this report a few days ago by my friend Matt Cohen of NTOSpider. To give Matt and his team credit, they did lead the pack with 94% accuracy. But overall the numbers were pretty bad.

Qualys in particular was pretty low with only about 28% accuracy. It should be noted that they only have a “point ‘n click” test though. But still you have to ask yourself, if 2/3rds of the vulnerabilities are getting by, why bother?

Is it any wonder that being PCI compliant is meaningless from a security point of view? You can use a web app scan, check the box on your PCI audit and still have a security posture that is like swiss cheese on your web app!

2. The NSS tests. I have written before about the great work Rick Moy and the folks over at NSS have done. But go read this article in GCN by William Jackson interviewing Rick.

It is downright scary that after 5 years in the prime time, IPS still does not catch such a large percentage of attacks. We all knew that signature based detection alone was not going to see all attacks. But we have deluded ourselves about anomaly and behavior based detection, somehow making our signature based technology actually work.

Yes, IPS may catch rudimentary types of attacks, but how can we sleep at night with some of these well known IPS devices on the job?

3. Anti-virus – another false sense of security! For all of the millions of dollars spent by the AV vendors (a small fraction of the billions they rake in) on better detection what have we got. A day late and dollar short technology I am afraid. Our AV is great against last years attacks, but is pretty weak on this years threats.

That is of course assuming that your AV is actually up to date. In most organizations what percentage of mundane AV updates are failing? From my NAC experience I was surprised that even on some of the most sensitive networks in the world, the number of AV update failures across the network is pretty high. It only takes one bad apple.

4. Patching is a lot like AV. How many failed patches are not pushed out to every machine that needs it? Too many is the answer.

We could go on and on. Don’t even get me started on NAC and DLP. In general our reliance on technology that does not work as well as we hope, think and pray it does is more dangerous than if we had nothing at all. At least then we would be serious about the policies and process that we need to put in place.

In the meantime we need to rethink if we are as protected as we think we are. If not, we need to take measures in response.

No magic bullet for database and server security? I’m shocked!

From the classic movie Casablanca:

Rick: How can you close me up? On what grounds?
Captain Renault: I'm shocked, shocked to find that gambling is going on in here!
[a croupier hands Renault a pile of money]
Croupier: Your winnings, sir.
Captain Renault: [sotto voce] Oh, thank you very much.
[aloud]
Captain Renault: Everybody out at once!

This week’s winner of the Captain Renault is none other then the folks over at Forrest-er Gump Research. Kelly Jackson Higgins has a report up on her Dark Reading column about the latest report from the Forrester guys.  Can you really charge someone to tell them that? I am in the wrong business.

When are people going to learn there are no magic bullets, magic wands, security Santa Claus or Easter Bunny for that matter.  Nothing takes the place of best practices, layered security defenses. It doesn’t matter if you are virtualized, cloud-ized, local, remote, wired or wireless, there are no short cuts.

Louie, this could be the start of a great friendship!

An old/new kind of cybercrime/cybercriminal

I was reading Ellen Messmer's report today about the security incident over at Lending Tree. Yeah, I know another information breach by insiders case, BFD.  But I think there is something different about this one.  From what I am reading this is more a case of corporate espionage than the usual hackers for fraud and financial gain type of deal.  For a long time now we have been hearing from people like Bruce Schneier in this article talk about the front in security moving from dealing with script kiddies working for kicks to organized cybercriminal gangs that are in it for financial gain. Mostly the gain is about identity theft and gaining access to funds fraudulently.

In the Lending Tree case though there was not evidently a motive to use the ill begotten information for identity theft or fraud.  Rather they represented Glengary, Glen Ross leads.  That is the names, contacts and qualifications of people looking for mortgages.  A mortgage company would consider these leads more valuable than gold, more valuable even that gasoline!  So to my mind this is more a case of corporate espionage where a company that is competitive to Lending Tree infiltrated their networks through people, rather than technology to gain access to their corporate crown jewels. 

This sort of stealing your competitors information has been going on for decades, well before computers and cybercrime were around.  However, this is a great example of some things not going out of style.  Obtaining your competitors information is a great motive, computers are just the container where the information is kept.  Sort of like cracking a safe.  It is always easier getting into a safe if you are given the combination, than if you have to crack it yourself. 

Yet another front in the cybercrime war that security folks need to be on guard for!

A new, pragmatic approach to security - is it the future of security?

New times call for new ideas.  In security we have seen a revolution over the past few years in the depth and breadth of security solutions that are available to the security administrator and CSO.  However, all of this new technology and the methods of securing our businesses and data have not left us any safer or more secure.  The reasons for this are many.  Some are, the increased sophistication of the bad guys tools, the monetary reward to the hacker, the lack of secure software development, mono-cultural computing environments, etc.  So throwing more technology and dollars at the problem is not the solution.  What is the professional security person to do?  The answer comes from our friend Mike Rothman.  Mike has had a vision of writing a book and developing a community that offers the over-stressed security professional a new way of dealing with the problems.  A blueprint for success in security.  A realistic and holistic model to succeed in these tough new times.  In short a pragmatic methodology to becoming a successful security manager and a happier person.  He calls the book and the soon to be launched community the Pragmatic CSO. Don't let the CSO part fool you.  If you are in any way, shape or form responsible for security as part of your job or want to learn what to do to get a handle on a near impossible task, this book and the content to follow on the web site is for you.  At $97 dollars for the PDF version it is a steal and I would not waste any time before buying it.

I was lucky enough to be given an advance copy of the book by Mike last month.  Truthfully, I was going to take a look at it as a courtesy to Mike, but did not relish the thought of reading yet another boring business book. I was hooked in the first chapter.  The fictional Mike attends his first 12 step "security anonymous" program.  His story is one that is all too familiar to many of us in the security field.  Despite the hard work, the never ending flow of money out the door and the best of intentions, it is just not working.  The security is not there, the boss doesn't appreciate the problems or the amount of effort that goes into solving them and his life is running from one fire to another.  Into this desperate situation comes salvation in the form of the P-CSO 12 step program. The 12 steps are divided into 4 broad categories.  They  are as copied from the site:

Section 1 – Plan to be Pragmatic
	Step 1: Assess the Value of Your Business Systems You can’t protect what you don’t know about, so the first step is to figure out what you have. Likewise, you don’t want to spend $50,000 protecting a $2,000 business system, so in Step 1 you talk to senior management and discern how important each system is to the operations of the business. Then you can figure out how much to invest in protecting it.
	Step 2: Baseline Your Environment If you don’t know where you are, it’s pretty unlikely you’ll know that you’ve made progress. In Step 2, you gather data to understand your current state, where your most significant exposures are, and how much work you need to do.
	Step 3: Manage Expectations Managing executive expectations are the most critical responsibilities of the CSO. You must be very clear about what you are going to accomplish and how you are going to do it. In Step 3 you see the power of speaking security in the language of business, and how you can get everyone on the same page regarding what the security program does.
Section 2 – Build a Pragmatic Security Environment
	Step 4: Build Your Security Business Plan Every business needs a plan, and yours is no exception. In Step 4, you prepare a high-level business plan, laying out the reasons your business exists and presents a high level architecture, committed service levels, and the milestones that you plan to achieve.
	Step 5: Sell the Story You need money to secure anything, in Step 5 you package your business plan, associated service levels and milestones and sell the program to senior executives getting the funding you need to protect your corporate assets.
	Step 6: Procure the Solution A structured procurement process is critical to getting the right products, at the right time, for the right price. In Step 6, you learn about Security Incite’s Buying Security Products methodology and how that should be applied to how you buy the products and services you need for the Pragmatic CSO process.
Section 3 – Run Your Security Organization Pragmatically
	Step 7: Operate/Monitor Now that parts of the solution are implemented, you need to make sure they’re doing what they’re supposed to. In Step 7, you learn how to fortify your perimeter defenses, what you should be monitoring, and how to navigate the change control process.
	Step 8: Contain the Problem Inevitably you will have a compromise or breach situation. Dealing with that will make the difference between a CSO with a job and one collecting unemployment. In Step 8, you learn how to recover as gracefully as possible and use a structured incident response process to make sure you live to fight another day.
	Step 9: Train the Users Users are the weakest link in the security chain, so all the technology in the world will not help if a user gives up a password to the bad guys. In Step 9, you learn why a structured user awareness training process is critical to educate users to think and act securely and avoid many of the easy attacks used every day.
	Step 10: Assure Your Defenses It doesn’t matter if you say something is secure, you need third-party validation. In Step 10, you’ll engage third parties to try to penetrate your defenses, both to see where you are really exposed and also to make the case for more funding.
Section 4 – Communicate your Value
	Step 11: Benchmark Your Progress Quantitative measurements prove your worth and ensure your program is moving in the right direction. In Step 11, you’ll benchmarking your program by tracking the right metrics and comparing what you are doing relative to your peer group and other businesses your size.
	Step 12: Comply without Going Nuts Compliance with a variety of both internal policies and legislative regulations is a critical aspect of every CSO’s job. In Step 12, you see how compliance is a benefit of implementing the Pragmatic CSO program and how by generating a set of hard-hitting reports, the auditors will be gone in a fraction of the time it used to take.

Following the level headed, plain talking advice will give the reader and pragmatic practitioner a new sense of power over his security domain and a path to success.  It does not promise a magic bullet, just a realistic method and approach of dealing with the every day tasks and goals that all security folks live with. The writing style of the book is light and refreshing.  It is from Mike the recovering and now pragmatic CSO's point of view.  It will feel more like you are reading a short story than another how to business book.  I think the Pragmatic CSO will go down as a milestone in the security management arena.  I can already envision the follow ons as the pragmatic methodology is more fully fleshed out.  I am already thinking of how StillSecure can better align our products to help all of the new pragmatists that will be managing security out there.  Congratulations to Mike on a job well done!  I am looking forward to what is to come and seeing how the security pragmatists change the security world.

So who would you rather wake up next too?

So Mike Rothman (or should I call him Robin Gibb) has an issue with the  10 most important reasons security products don't work according to Dark Reading and the fact that I thought it helpful.  OK Mike, everyone is entitled to their opinions.  Mike says the problem is you go to bed thinking you are with Heidi Klum and wake up with Medusa. But I do detect some bias here.  First of all , against Dark Reading, as it appears Mike had some pre-conceived notions here.  Secondly and more troubling is the blame the vendor mentality.  I get that we are couching this in mismatched expectations, but when Mike digs in, it is always the job of the vendor to set expectations and we slimy vendors lie, cheat and steal our way into your hard won security dollars.  I don't know Mike, maybe you have been hanging out with the wrong crowd of security vendors and then I can see why you ran back to analysis.  Maybe, you are pandering to your constituency, the end user. What I can tell you, is don't paint us all with the same broad brush.  We try very hard here at StillSecure and I know other vendors do, to solve the customers problems.  To quote Chris Hoff, this "ain't my first ride on the tuna boat fella" and I know that I may fool a customer initially but sooner or later he is going to see through whether my product does the job for him or not. You can fool all of the people some of the time, but you only get to fool them once then.  Sell them a product yeah, we have end of quarter pressure and quotas to meet like everyone else.  Companies who stick around though build their business being honest with the customer and not pumping and dumping. 

Most of the problems I have seen in easily fall into one of the 10 categories the Dark Reading folks have highlighted.  Sometimes they are the vendors fault, sometimes they are the end user's fault.  We could all do a better job and that includes mismatched expectations.  But there are plenty of honest vendors out there who want to do more business with the customers in the future and know that they build those kind of relationships one sale at a time.

Pay it forward security tip #4

Not sure if Michael and Michael are still putting out the pay it forward tip of the day, but I already had one lined up for today, so wanted to put it out.  This one is a little different than my earlier ones, in that it is not aimed at an individual, but at the networked enterprise.  Today's tip is to regularly schedule vulnerability scans and put a comprehensive vulnerability management solution in place.  If your vulnerability policy is using Microsoft update after every patch Tuesday, you have  trouble.  If your only full vulnerability scan is a once a year audit, again you have trouble

Vulnerabilities are to fast and frequent to scan once or twice a year.  You should be scanning for them regularly.  Also,  there are many vulnerabilities that are not Microsoft or even Windows  specific.  You need to scan printers, faxes, switches, firewalls, routers, hubs, etc.  Anything with an IP needs to be scanned. Also, only about 20 to 25% of vulnerabilities need to be patched. Many need other types of remediation.  So a patch manager alone is not a comprehensive vulnerability  management solution.  When looking at a good VAM system, also remember how important reporting is as well.  Hope this helps.  If you want  an example of a good  vulnerability management system, check out our own VAM product.