The Ashimmy Blog

Just Another Risk Podcast – NOT

Continuing my series of podcasts on all things Risk, I have another great one in this episode.  I am joined by an all star panel of HD Moore, CSO of Rapid7 and founder of Metasploit, Ron Gula, CEO and CTO of Tenable Network Security and Jody Brazil, founder and President of Firemon. With that kind of talent, this is not just another Risk Podcast!

The four of us discuss some common mistakes people make in risk management.  How vulnerability and pen testing figure into the Risk equation. We even manage to discuss scenario based risk management as exemplified in the Firemon Risk Analyzer. 

Having smart people on the show makes my job easy and fun. This was a very easy and fun podcast. I hope you enjoy!

Related articles

• Have We Got Risk All Wrong? (ashimmy.com)
• Risk, Risk, Risk (ashimmy.com)
• Tenable Network Security Podcast Episode 108 (tenablesecurity.com)
• The inter-relationships of risk, objectives, strategy and performance (normanmarks.wordpress.com)
• Metasploit Updated: Forensics, SCADA, SSH Public Keys, and More (community.rapid7.com)

Have We Got Risk All Wrong?

Most of us in the information security industry long ago recognized that we could not eliminate every risk and threat to our data and networks. Instead we have tried to manage that risk to acceptable levels, with acceptable being in the eye of the beholder. An entire information security risk management industry has sprung up over this time. But, have we missed the boat on risk? Has the risk management space been hijacked by the vulnerability management crowd?

We have settled on a formula for risk being:

Risk (R)= Threat (T) x Vulnerability (V)

But is that the correct formula to use? Are there other factors that need to be considered?

I am joined on this podcast by Jody Brazil, President of Firemon and Gary Fish, CEO of Firemon to discuss these questions in light of Firemon's new Risk Analyzer product.

Risk Analyzer offers a new way to look at risk using risk based scenarios. Introducing concepts such as reachability, exposure and asset value into the equation, it gives us a better measure of risk. Risk Analyzer also gives us another way of prioritizing different risks to make us more efficient.

As many of you know, I have been working with Firemon for a few months and have watched Risk Analyzer develop. The folks at Firemon have taken a great engine that was developed at the MIT Lincoln Labs and developed some great front end features to make this a complete product. I am very excited by what it offers and I think you will be too.

Have a listen as I discuss this with Jody and Gary.

Also be advised that there was a clicking in the recording (which we obviously didn't know about when we recorded this). I have done my best using my not very considerable sound engineering skills to remove it. It is still there, but it is the best I can do and I thought the quality of the conversation was much more important than the quality of the sound.

Enjoy!

Related articles

• Security Exe Podcast With Ward Holloway of Firemon (ashimmy.com)
• Debate: Are Risk Assessments an Outdated Approach to Security? (btsecurethinking.com)

Good News From Alert Logic

Image via CrunchBase

My friends at Alert Logic posted two press releases today containing good news for the company.  In the first release they announced that they had raised a Series E round of funding totaling 12.6 million dollars.

Besides existing investors, Updata Partners, Covera Ventures, DFJ Mercury, and Access Venture Partners, several members of the company’s management team invested as well.  It is always a good sign to see the management team putting skin in the game. The money will be used to expand all phases of the business.

In the second release, Alert Logic announced that they had broken through the 20 million dollar revenue run rate barrier. In the past I have taken private companies to task for releasing “another great record quarter” press releases. The reason I have is because they usually don’t include the actual numbers. But in this release Alert Logic announced 2.3 million in new ARR for the quarter, bringing the companies ARR to 20 million.

It would seem that Alert Logic’s SaaS delivery model and strategy of selling through cloud and hosting providers is working and paying dividends. The company has doubled revenue since 2009 when they began to pursue the service provider channel.

Very impressive news from Houston. Congratulations to Gray Hall, Misha Govshteyn, Urvish Vashi (an old Interliant friend) and the rest of the team there.

NASA - It’s a science thing

I was reading my friend Bill Brenner’s Salted Hash blog today on the disclosures of vulnerabilities in the NASA systems that could have endangered the space shuttle missions.

Bill remembers having discussions with a NASA official years ago that set off red flags with him regarding policies and processes (or rather the lack of them) on the NASA network.

I also had a chance to speak with folks from NASA a few years back. Actually I was not interviewing them for a press opp, but instead was looking at potential security business for StillSecure.  Also back then I spent a lot of time speaking to folks at the DOE Labs like Los Alamos and some of the people from DOI and US Geological Survey.

All of these folks had somewhat of a common view towards information security and data security. They viewed themselves and what they do as scientists doing science.  In their mind science is best done by sharing.  Therefore the idea of “locking up” the data and making it hard for people to access was anathema to them.

If they think the whole idea of restricting access to the data is wrong, you can imagine how they feel about security. Why do they need it? They want people to be able to share and help advance the science.

While it is a noble view and I understand how they feel, obviously it does not take into account how some people in the world operate.  The folks from NASA would never think that someone would actually want to blow up a shuttle.  The USGS wants everyone to see the data from the seismic monitors they have on the bottom of the ocean. The scientists at Los Alamos, well lets leave that alone for now.

So I am not surprised to hear about NASA’s vulnerabilities either. It is a cultural thing in an agency with a scientific culture.  It is up to the security folks there though to put the controls in place that will keep it all safe or science be damned.

Related articles

• Houston, We Have a Problem: Critical NASA Systems Vulnerable (pcworld.com)
• Security fails could put NASA missions at risk (zdnet.com)
• NASA spacecraft vulnerable to cyber-attack (blogs.nature.com)

Security.Exe Podcast Powered by The CISO Group – Marc Maiffret returns to eEye!

You may have heard that Marc Maiffret has returned to eEye as the CTO. I was able to get some time with Marc to discuss why he came back, what he thinks of the state of the security industry and what we might expect to see from him and eEye in the near future. 

The interview is only about 25 minutes long. Congrats to Marc, Kevin and the whole eEye team. I think Marc is back where he belongs. You can read more about it on the press release here.

 

Goatse, evil or not?

After last weeks article on Google doing evil, you can’t expect me to sit here and condone Goatse disclosing the iPad vulnerability (I guess it is an AT&T vulnerability actually) before AT&T was given proper time to fix it.

The question is were they given proper time. I have read what I can on this one, including Goatse’s Escher Auernheimer’s blog response.

From what I can tell Goatse only disclosed the vulnerability after the patch had been made. The issue is they didn’t wait long after the patch was done and did show the list of iPad customers to one journalist.

In my mind this is very different from publishing attack code to exploit a vulnerability after only giving a vendor 5 days to fix it.

I understand the need to “claim the scalp” by a researcher, but this is another case of what happens when responsible disclosure breaks down.

I don’t agree with AT&T blaming the hacker in this case for the vulnerability, but I wish there were clearer guidelines to be followed by all.

What do you think, was Goatse wrong to do what it did? Do I have the facts straight or am I missing something?

Related articles by Zemanta

• Hacker defends going public with AT&T's iPad data breach (Q&A) (news.cnet.com)
• iPad e-mail hackers defend attack as 'ethical' (macworld.com)
• A week in security: Feds investigate iPad breach (v3.co.uk)
• Up To 114,000 AT&T iPad Customers' Security Has Been Breached (cultofmac.com)
• Google Does Evil (ashimmy.com)
• FBI investigating AT&T iPad security breach (sfgate.com)

Google Does Evil

Google seems to have violated its own prime directive with the premature disclosure and publishing of attack code by one of its researchers. According to this story in ComputerWorld, a Swiss Google researcher Tavis Ormandy gave Microsoft just 5 days before publishing the zero day vulnerability with attack code. This is just outrageous.

You can tell me that Ormandy did this without Google’s knowledge and consent. If that is so, they should fire him tomorrow. If it is not true, shame, shame, shame on Google.  Allowing their Microsoft-phobic psyche  make them violate their own prime directive to “do no evil”.

When two security researchers that I have a tremendous amount of respect for, Andrew Storms and Robert “R-Snake” Hansen are quoted saying things like:

"This stinks of retribution," said Hansen. "If Google really goes by responsible disclosure, they should fire Ormandy today." Hansen noted that Ormandy credited other Google security researchers for their help and linked to a Google blog on browser security in his message on Full Disclosure. "You shouldn't do that if you want to disassociate yourself from your employer."

That's impossible, argued Andrew Storms, director of security operations at nCircle Security. "[As a security researcher] you can't really separate your work from your employer. So you have to wonder if [Ormandy[] isn't intentionally feeding the feud between Google and Microsoft."

Like Hansen, Storms questioned Ormandy's decision to reveal his findings just five days after he reported the vulnerability to Microsoft. "You can't say in this case that the vendor was sitting on their hands, not being responsive, which is why researchers usually go public, to force [a vendor's] hand.

"This is no better than not reporting it to Microsoft," concluded Storms.

You know that what was done here was very bad and evil. Another example is that Google gives lip service to responsible disclosure while their employee had this to say about it:

He also slammed the concept of "responsible disclosure," a term that Microsoft and other vendors apply to bug reports that are submitted privately, giving developers time to craft a patch before the information is publicly released.

"This is another example of the problems with bug secrecy (or in PR speak, 'responsible disclosure')," Ormandy said. "Those of us who work hard to keep networks safe are forced to work in isolation without the open collaboration with our peers."

I am telling you, if Google does not fire this dude then their words about “doing no evil” don’t amount to a hill of beans. If I remember correctly violating the prime directive carries a death penalty even in Star Trek.

Is this the smoking gun for Aurora?

So it seems some researchers from Zscaler have found the Aurora malware resident on a Chinese government website.  Anyone going to the site would be infected by the same thing that Google, Adobe and others a few weeks ago. Up until now though it was suspected the attacks were Chinese based, whether or not the Chinese government was involved or tacitly approved of the hackers actions was a very touchy subject.

Byron Acohido over at USA Today broke this story. You would need root access to put this on the server according to Achohido.  So how did it get on the Chinese governments server? Good question.  I will be doing a full blown follow up to this whole matter tonight, so stay tuned. But for now, is this the smoking gun?

Related articles by Zemanta

• Evidence Weakens That China Did the Recent Cyberattacks (tech.slashdot.org)
• Alleged Employee Role in Google Attack Highlights the Importance of Computer Security Education (mwd.com)
• Security researcher IDs China link in Google hack (sfgate.com)
• VeriSign says Chinese government was behind cyberattack on Google (downloadsquad.com)

Rebuilding the house at eEye

eEye today announced the appointment of a new CEO, Kevin Hickey.  I recently had a chance to sit down with Kevin and some of the new team members. Hickey is a long time veteran of the IT industry, most recently heading up NetPro. NetPro had a successful exit via a sale to Quest.  Hickey is coming on board eEye with a mandate to rebuild the Retina franchise and return eEye to a place of prominence in the vulnerability management space.  As is often the case, Hickey is bringing along some of the folks he has worked with in the past. Joining him as VP of Strategy is Brad Hibbert, also from NetPro and CFO Tyler Hanson, who worked with Hickey at NetPro and another company.

In addition to the NetPro folks, Hickey has also hired some new sales executives. eEye did not raise any additional funds with bringin Kevin and team on board. Hickey says that his predecessor, Kamal Arefeh left the company with a strong balance sheet and profitable business. 

Good for Kevin and his team. Unfortunately I think the profitability and strength in balance sheet was due to sacrificing growth and some of the vulnerability research that eEye was known for in the past, rather than a big increase in revenue.But at least they have something to build on.

Hickey and Hibbert promise a return to eEye’s roots. They are going to refresh Retina and finally move beyond vulnerability assessment to vulnerability management. This has been tried before at eEye, but REM was never as successful as Retina was in the pure scanner market. They want to focus on the mid and SMB market for vulnerability management.

The new management team also wants to rebuild the research team that was the strength of the company in prior years. Hickey also talks about building out a strong professional services team. 

The new eEye will sell both from an inside and channel model, as well as through the enterprise and the government. A very ambitious sales plan for a smaller company.But reaching the mid-market and SMB market means a strong channel program. Selling to large enterprises needs a direct sales force. Hence the need for both.

Hickey says eEye is doing everything they can to see to it that the DISA DoD wide Retina contract is renewed and is profitable for eEye.  The government sector will still be a big focus of eEye, as will compliance, including PCI.  To that end they will be working on increasing their ability around application and database scanning.

They were a little less clear on the future of Blink. My impression is that Blink will be moving out of the crowded and hyper-competitive endpoint market and become a tool to help in vulnerability management. We will have to see what the future holds in regard to Blink.

A few years ago when Marc Maifrett left eEye I wrote a blog post asking if the last rat had left the ship at eEye. Now with Hickey and team coming on board it looks like they are ready to rebuild the house. I wish them luck and we will be watching their progress!

Exactly how much do TippingPoint and Qualys know about our networks?

Some great info about how the threat landscape has shifted from OS based attack vectors to application based vectors in the new report from SANS, TippingPoint and Qualys. It was good to see Microsoft getting some credit finally for the work they have done around shoring up Windows and that the OS is no longer the primary focus of hackers.

Of course the report would not have been possible without the voluminous data provided by TippingPoint and Qualys. TippingPoint provided attack data from over 6,000 organizations they protect. Qualys provided vulnerability data from over 9 million customers computers.  Staggering numbers for sure.

Here is my question: How much does Qualys and TippingPoint really know about your network?  Does Qualys know which computers on your network have which vulnerabilities? How did they find out? I thought your vulnerability data, stored on their systems is encrypted and not even there own employees have access to it. Can you imagine if that data got into the wrong hands? Someone who had a list of which devices had which vulnerabilities on your network would certainly make it a bit easier to wreak havoc on your system, no?  I would hope that the data was collected with the permission and knowledge of their customers. But the fact that they know the vulnerability status of 9 million computers is a bit disconcerting. It is just too tempting. 

The lesson is make sure that not even your security vendor has this type of information which could give someone the keys to kingdom unless you are comfortable with that.

Related articles by Zemanta

• SANS Report Says Organizations Focusing On the Wrong Security Threats (tech.slashdot.org)
• Organizations fail to address top cyber vulnerabilities, report says (seattlepi.com)
• Companies patch OS holes, but biggest priority should be apps (infoworld.com)
• Blog - Firms Patch Some Companies' Bugs Quicker than Others (technologyreview.com)