GEEKONOMICS

U.S. Cyber Consequences Unit Names David Rice Consulting Director for Policy Reform

For Immediate Release

Monterey, CA - April 2009 - The U.S. Cyber Consequences Unit (US-CCU) named David Rice Consulting Director for Policy Reform. Mr. Rice, an  internationally-recognized cyber security expert, brings to the  position a decade of experience as an advisor to commercial sector leaders and securing critical government and military networks. Mr.  Rice is one of the key figures shaping current discussions of public  policies involving cyber security and is fluent in the technical and policy issues facing U.S. and American interests. His 2008 critically acclaimed book "Geekonomics: The Real Cost of Insecure Software" is highly influential and informs decision makers worldwide.

Scott Borg, Director and Chief Economist of US-CCU, says, "David Rice’s ability to combine a deep understanding of security technology with a wide-ranging grasp of the economic and policy dimensions makes him a terrific addition to the US-CCU team.  What’s more, David is willing to argue the other side in debates with US-CCU heavy weights, like Warren Axelrod and John Bumgarner.  This takes an enormous amount of self-assurance as well as a nimble mind.  David will be immensely valuable in helping the US-CCU to explore all aspects of the emerging cyber-security issues.”
 
The US-CCU, a non-profit research institute, provides reports and briefings about the strategic and economic consequences of possible cyber-attacks and cyber-assisted physical attacks directly to the U.S. government, all critical infrastructure industries, and, limited only by security considerations, the public. Mr. Rice's research and participation in national level policy discussions regarding the risk and implications of cyber security will contribute to the U.S. Cyber Consequences Unit's efforts and further development of U.S. national cyber policy.

For more information please visit http://www.usccu.us/.

Cyber Security: The Battle Joined

Cyber security has come of age when U.S. agencies fight over budget and control.

Much attention has been paid to the Obama administration's 60-day review of the nation's cyber security led by Meslissa Hathaway. Matters have come to a boil now that U.S. agencies are fighting (although somewhat obscurely) over budget and control. This is a good sign.

Battle is joined (The Economist)

To quote:

In the past few weeks there have been alarming reports that America’s systems have already been infiltrated. On April 8th the Wall Street Journal quoted “current and former national-security officials” who warned that “cyberspies” from China, Russia and elsewhere had broken into the systems that control America’s electrical grid and had installed software that could be used to disrupt it. And on April 21st the newspaper said foreign hackers had penetrated computers containing data about the F-35 Joint Strike Fighter. Does this mean America is suddenly under attack, and that war has broken out in cyberspace?

...the most likely explanation for the sudden spate of scare stories is rather more mundane: a turf war between American government agencies over who should oversee the nation’s cyber-security...At stake are tens of billions of dollars in funding promised for a multi-year cyber-security initiative.

In February Barack Obama launched a review of America’s cyber-security efforts. The findings are expected to influence how funds are allocated and the relative balance of power between the various agencies. Frantic jockeying for position may explain the recent scare stories, and their curious lack of detail.

Let us hope the leaders of US agencies fight as hard for real and lasting improvements in cyber security as they do for budget and control.

Geekonomics on Traders Nation

An interview with David Rice on Traders Nation.

Trust, Misplaced

Microsoft says the Internet needs more trust to grow. It should start with its software.

In a video posted to Microsoft's Web site, Scott Charney, Microsoft's Corporate Vice President of Trustworthy Computing, described Microsoft’s new End-to-End Trust initiative, an endeavor to reduce the anonymity of cyber criminals on the Internet.

Microsoft: The Internet needs more trust to grow

To quote:

The Internet needs to be more trustworthy if it wants to grow, according to Microsoft's senior security executive, Scott Charney… "We need to push back on anonymity and lack of traceability," he said. "Because the Internet can be anonymous and untraceable, criminals flock to the Internet," Charney explained. "Today too many people do not know what software is running on their machine and often they have malware…”

Not only do people not know what software is running on their machines, but no one can say with any confidence how trustworthy that software might actually be…particularly the operating system, browser, and desktop applications.  It is woefully ironic that only a few days after releasing what some called an "insane" number of security patches for the reporting period (23 fixes in all), Microsoft would confidently voice the need for trust  on the Internet when its own software significantly retards the ability to attain it.

Simply put, the Internet is an expression of software. Without software the Internet is just a bunch of cables and devices much like a human cell, stripped of its DNA, is just a bunch of proteins and amino acids. For the internet to be trustworthy, software must be trustworthy. Acknowledging the fact that a majority of the software on the Internet happens to be Microsoft’s, it is more than reasonable to demand the company produce software worthy of trust.

Microsoft has indeed improved the security of its software through its Trustworthy Computing Initiative; an effort for which the company, and Mr. Charney, should rightly be commended. But users are still left with only a vague assertion by Microsoft that the company’s software is in fact trustworthy. To date, users have no objective measure to judge or compare the security of software; a disappointing shortfall given that a majority of worm and viruses regularly leverage design and implementation flaws in Microsoft software. Conficker is but one of many examples. Microsoft, and some within the cyber security community insist that lack of user patching is to blame for worm outbreaks. This is true to a degree. The fact remains however, that but for software vulnerabilites worm authors would not have nearly as much advantage or impact.

The holy grail of ubiquitous identity authentication then, which Microsoft appears enamored with in its End-End Trust campaign, is a dangerous distraction for cyber security and is not likely to address the key issues Microsoft so confidently says it will. It is also wrongly re-directs the core notion of what trust ought to be for any type of infrastructure.

Imposing strong user authentication would entail enormous technology-switching costs on users, something Microsoft is more than happy to force, but users less likely to welcome. To the extent that stronger authentication measures would be bolted onto legacy software to as well as embedded in new software the company releases, the endeavor would tend to increase the complexity of information systems and likely introduce new and original defects, compounding the ones already uncomfortably prevalent. While anonymity certainly attracts criminals, it also attracts larger numbers of non-criminals, whom, without anonymity, would not enjoy the vast benefits (some virtuous, some not) the Internet has to offer.

Most importantly however, attackers are rarely traced to a particular point of origin, so one could argue that it matters little whether these origination points are firmly associated with an identity. Even when attackers are traced to a particular computer, there is no guarantee that the owner of the computer is responsible (or culpable) because the same types of flaws that enable attackers to hijack systems also enable attackers to exploit particular computers and impersonate others. In other words, if software manufacturers are under-motivated to produce software that is secure right now, it is unlikely that software manufactures will choose in future to produce software for identity systems that is also secure.

The Internet indeed needs more trust - preferrably the objective kind. The foundation and fabric of the Internet – software – is a perfect place to start.

A Curmudgeon Bludgeoned by the Fudgin'

After glossing over the Verizon Business Data Breach Investigations Report (DBIR) I was a tad confused with some of the findings and recommendations. I comforted myself with the fact that I had only glossed over the report and that, in my haste, I was not able to connect the dots which should obviously connect to show me the bigger picture.

I was wrong.

An excellent post by Brooke Paul over at the The New School of Information Security blog pretty much sums up the confusion I've heard from others.

A Curmudgeon is a Little Confused by the 2009 DBIR

To quote:

There is little new here in the way of recommendations - I guess nobody is listening or the controls are ineffective (or a bit of both).

1.) While only 17% of attacks were considered ‘highly difficult’, they account for 95% of the records breached.  Would the recommendations have fixed this issue?  I can’t imagine, since the recommendations seem more focused on what I would consider fixes for simple attacks.  It does appear that fixing SQL injection issues is the obvious first step.  How long have we as a profession been talking about that one?  Someone has failed and it is us.

2)  What is meant by ‘breach’?  The report talks about ‘breaches’ and then mentions that records are also breached.  What is a ‘breach’?  A few definitions would be helpful for simple-minded folk like myself...

3) “The majority of breaches still occur because basic controls were not in place or because those that were present were not consistently implemented across the organization. If obvious weaknesses are left exposed, chances are the attacker will exploit them. It is much less likely that they will expend the time and effort if none are readily apparent.” - This important statement isn’t supported by the data. See my point #1 above...

Agreed. Either people are not listening (which means the cyber security message isn't resonating) or what they are doing isn't working (which means our guidance is hollow). The muddled signals from the Verizon report does not help matters any nor does the report's fudging on the definition of a "breach" - a aspect central to the report. Regardless, it is a dangerous mixture that shows just how far we have to go towards effecting meaningful change in cyber security.

Insanity Indeed

It's Not The Number of Patches, But the Effect

Microsoft released updates today that patch 23 vulnerabilities in Windows, Internet Explorer, Excel and a host of other software the company makes.

Microsoft patches 'insane' number of bugs

To quote:

More dangerous than the sheer number of patches, however, is the fact that nearly half fix flaws that are already being exploited or are publicly known in enough detail to craft working exploits. In some cases, sample attack code is available...

"What really caught our eye is the large number of exploits that are already available," said Wolfgang Kandek, chief technology officer at security company Qualys Inc. "Out of the 23, there are 10 exploits or [flaws] that have proof-of-concept. This is a huge deal and shows just how much the patch window is shrinking." ...

That's exactly why this month's patches are so important, [Andrew ]Storms said -- not because the quantity is a "giant leap" from the past three months, but because of the in-the-wild exploits and the proof-of-concept code samples publicly available. "Once Microsoft releases the patch, what's in there is what they've fixed, and [attackers] can more easily see where their exploit code is working and not working. It lets them create code that's more exploitable more often," he explained.

Insanity? Indeed. First, patching offers a perverse incentive for software manufacturers: it allows software makers the opportunity to "re-negotiate" contract terms buyers could not negotiate in the first place (recall Windows Media Player, XPSP3, and everytime iTunes patches a vulnerability). Second, patching allows cyber attackers to optimize their techniques, promoting exactly the behavior patching is intended to discourage (patching is meant to take away an attacker's capability, not refine it). In either case, the effect is less that satisfactory.

The problem here is that neither software manufacturers nor cyber attackers can self-correct without an external stimulus; that is, neither will consciously make themselves worse off by altering current behavior unless they are pressured to do so. Software manufacturers will not forego a powerful tool that allows them to optimize their market and legal protections (no matter the argument that fixing bugs in production is 100 times more expensive than in development); cyber attackers will not forego the benefits of exploiting software vulnerabilities in tens of millions of computer systems.

We have a choice. We can attempt to change the incentives for an unknown number of globally-distributed, un-indentified cyber attackers through increased law enforcement and frenetic patching, or we change the incentives of a few thousand well-known software executives and encourage them to stop supplying attackers with new vulnerabilities on a continuing basis.

One choice might be less insane than the other, and the effect, far more desirable.

2008: The Year of Crash Test Dummies

2006 was dubbed the "Year of Cyber Crime".

2007 was dubbed the "Year of Cyber Espionage" by the Wall Street Journal.

And what of 2008?

Forgive the imposition, but I am deeming 2008 "The Year of Crash Test Dummies."

I know it doesn't quite roll of the tongue as other titles, but it is more than suitable.

2008 was the year when, despite all our efforts in cyber security, our pigeons came home to roost.

The 2008 ScanSafe 2008 Annual Global Threat Report has all the gory details. But one observation sticks out:

“Indeed, as a result of the continuing mass compromise of legitimate Web sites observed throughout 2008, the standard 'safe surfing' advice of avoiding unknown or non-trusted Web sites no longer applies. Today, it is the known trusted site that should be viewed as posing the greatest risk to Web surfers.”

This observation is backed by Alex Stamos, a partner at ISEC Partners who stated at the Web 2.0 conference:

The Internet cannot be safely used by normal people," [Alex] said. "Most people are not prepared to make the technical decisions necessary to safely use the Internet." ...

After decades of computer security work...things are worse than they were. Finding bugs and publicizing them is not making people safer. At the same time, security researchers who try to help the community by developing a free static code analyzer for open source code are not rewarded. And every solution gets turned into an overpriced, marketing-driven $500,000 product.

Our approach to cyber security has failed because it is fundamentally based on a mistaken etiology:

Software was assumed to be inherently safe. As such, software buyers and computer system owners - "the nuts behind the keyboard" - were considered to be the source of many of cyber security's tribulations. Software buyers then, were compelled to buy firewalls, anti-virus, patch and configure their systems, and dammit, stop habitually clicking on hyperlinks! In fact, software is not inherently safe, and no amount of user education or corrective action can counteract its effect.

When "normal people" cannot use something safely, they are not the problem. Consumers do not make things safe. Manufacturers do. Epidemiologists know this. Cyber security apparently does not.

We have focused on "the nut behind the keyboard" but failed to supply consumers with software products that can withstand foreseeable malicious activities without a ridiculous amount of add-on defenses. We have blamed and castigated consumers for increasing insecurity, when the only products they can buy are insecure. At base, software companies have failed to design, and failed to implement, crashworthy software.

As a consequence, consumers are simply crash test dummies...and 2008 is their year.

Hold Them to a Higher Standard

David Kleidermacher posted an excellent article on SDTimes.

 IT security: apathy or ignorance?

To quote:

The world has a serious problem when it comes to IT security. In two words: It sucks. Critical IT systems, including national infrastructure, are built on software that is known to be hopelessly filled with vulnerabilities. We spend countless billions trying to patch and filter our way to security, but the hackers are always a step ahead. There are so many holes, it is downright child’s play to find a way in.

The daily reports of hacked credit cards are almost comical. However, a concerted attack by determined, well-funded, technologically sophisticated adversaries to take down our power grid or air-traffic control system wouldn’t be funny at all. As President Obama recently stated, “It's no secret that terrorists could use our computer networks to deal us a crippling blow.”

Why aren’t people more upset about (the lack of) cyber security? Sure, the economy is in shambles, but it has become clear from TARP and the stimulus bill that the best we can do is trial and error and patiently wait for the illness to run its course.

However, when it comes to computer security, there is a known cure for our cancer. Companies can create secure software by following a process that prevents vulnerabilities. It is done all the time in aircraft and in certain military and intelligence systems. But the enterprise software world chooses not to do it this way. There simply hasn’t been a strong enough incentive to do the right thing.

David is singing my tune. This is just his intro however....the opening salvo of a magnificent fusillade. David goes on to state:

The dilemma is exacerbated by the common practice, from otherwise reputable companies, of making misleading statements about the security of their products. A naïve public puts its crown jewels under the control of software and systems that can’t even keep a smart teenager out, let alone a nation state that puts its best Ph.D.s on the problem...

In 2008, VMware announced its hypervisor’s certification to Common Criteria EAL 4+. The announcement included the claim of suitability for “sensitive, government computing environments that demand the strictest security.” Three days later, severe vulnerabilities in these products were posted to the U.S. Computer Emergency Readiness Team’s National Vulnerability Database. Among other pitfalls, the vulnerabilities “allow guest operating system users to execute arbitrary code.”

When a gaping security hole was recently discovered in Google’s Android software, the only person to cry foul was an engineer. Ed Burnette, writing a column titled “Worst. Bug. Ever.” on ZDNet, reports that Google was almost flippant: “The reason why we consider it a large security issue is because root access on the device breaks our application sandbox."

Another example is General Dynamics’ Trusted Virtual Environment (TVE), a platform that uses SELinux as its “trusted computing base,” and makes claims of “high robustness” and a “quantum leap in the way military and government security levels are accessed.” Yet TVE has not achieved a high robustness certification. Numerous vulnerabilities in SELinux have been found (check the National Vulnerability Database). According to the NSA, the SELinux effort has included “no work focused upon increasing the assurance of Linux itself,” and SELinux is “very unlikely by itself to meet any interesting definition of secure system.”

In the end, David suggests we must hold software manufacturers to a higher standard. I wholeheartedly agree...I just hope this article wasn't an April's fools.