Archive

Posts Tagged ‘Rant’

Innovate, innovate, innovate – making time for ideas

March 17th, 2014 Comments off

Warning: this is a half thought – I saw this YouTube clip recently by Steven Johnson , titled – Where good ideas come from.

http://youtu.be/NugRZGDbPFU

The short of it is:

  • Ideas need time to incubate
  • The best ideas and breakthroughs come from a collision of multiple ideas or hunches
  • You need to provide a way to allow contemplative thinking and mingling of people to allow the discussion to happen.

Every day customers, managers, investors are telling us to innovate more. The biggest issues I see is that in the corporate world we don’t make time to think about things. If we do it is generally in some form of work-shop environment where no one has had 5 minutes to spare before getting there to think about it.

Whilst the internet has made it a lot easier to collaborate, borrow, use or bounce-off other’s ideas, having time to get out there and participate in discussions as well as making time to reflect and absorb is becoming increasingly harder.

 

Are passwords the new security theatre?

September 10th, 2012 1 comment
Offline Password

Offline password by binaryCoco available at “http://www.flickr.com/photos/binarycoco/2704267877/”

As you may have noticed there have been a lot of website and business breaches in the last 3-4 months where usernames, passwords and occasionally some personal information has been taken. You can see a consolidated, and up to date list here at liquidmatrix.org. Given that passwords are so easily “lost” these days, are they doing much more than security theatre?

This has been an ongoing topic of discussion for several years inside the info-sec community and I thought I’d get my current thoughts out on the subject as it seems to be coming to a head again.

It is becoming generally accepted that users cannot be trusted/expected to look after their credentials and more and more businesses are looking at offering additional ways in which to secure user accounts beyond the humble password.

Background

A bit of Background, the issue is really comprised of 2 parts, the businesses supplying their services and the people that use these services.

Part of the problems is that the businesses breached don’t always take the appropriate care when managing credentials, these are stored in plain text (readable by anyone) or in a poorly encrypted form (that allows the passwords to be cracked or reversed).

This is not always something that is malicious and there can be any number of reasons why this happens. For example, the people building these websites are web developers and not security people, they don’t necessarily know that the standard library or function that they call when building a web application is 10 years old, calls a deprecated function/hashing algorithm and doesn’t do what is required in this day and age.

A more pessimistic take is that you can see, historically, businesses that have been caught out by these breaches in the past don’t always take a hit financially (unless it leads to privacy violations and they are fined or sued) and weigh up the cost of doing things right vs. the likelihood of something going wrong and having to pay compensation. This attitude is definitely changing, as be described. More and more businesses are beginning to offer alternatives.

The other factor in this is that users tend to reuse their passwords across multiple sites. Users tend to do this for any number of reasons, mostly because it is convenient to only have to remember a small set of credentials to get around work and social media sites.

This too is understandable as most people don’t realise that once there is a breach, and your credentials are leaked, people (hackers or script kiddies) will automatically try them against other popular sites or even your place of work (as apparently one Dropbox employee found out).

What’s the hoopla anyway?

Those that say, yeah great for clear text passwords, but mine is/was encrypted, how does that cause an issue? For a great overview of the problem with password breaches and cracking, head over to Ars Technia. The summary of the article, however, is that with the cracking tools available today, each breach feeds the beast and makes it easier to crack each time there is another breach.

The other issue today is that Microsoft (live), Facebook, Google, and Yahoo!, to name a few, offer the ability to provide federated authentication services through OpenID, SAML, OAuth or similar services.

This means that you can use your credentials, username and password, for one of these systems to authenticate (verify you are who you say you are) to another completely separate system that then authorises (provides permissions to do things based on who you authenticated as) you. So if your Facebook account is compromised and you use it to login to any other account with your credentials that you have linked to Facebook.

People also tend to cascade the linking of their accounts so that when you’ve forgotten your password you have Facebook , Twitter or Apple  email your Gmail account with the password reset token, allowing the compromise of one account open up the possibility of access to a lot more.

Whilst you can point the finger and blame the companies that were breached, your username and password, and the management of them, are ultimately your responsibility.

What can you do?

Given that this looks like the sky is falling and that every password leaked means that it becomes easier and easier to get into systems, what can you do? You can invest in a password generation and management tool or look at 2 factor authentication methods offered by vendors.

Password Management

The first thing you can do is start using a password generation tool like LastPass or 1Password. Most of the tools out there have the ability to generate passwords given a number of different parameters like whether it is pronounceable, includes numbers, capitalisations, hyphens, etc (see the example below of 1Password browser plugin for password generation).

Couple this with a tool that remembers your passwords and you now have the ability to generate new and unique passwords for each and every application and website you can think of.

Most of these applications have browser plugins too that automate the entire process so there isn’t even the need to do more than follow the prompts.

Passwords – becoming too hard

Given that all of this is very complicated and relies heavily on you to do the work, more and more businesses are realising that trusting their user base to create unique passwords is not necessarily the best thing and offer a number of additional mechanisms to assist in the protection of themselves and the authentication of their users.

This second factor authentication mechanism is something that you should always take advantage of.

 

2-Factor authentication

What is 2-Factor authentication? Two factor authentication takes the something you know (your password) and then adds in either something you have (like a security token) or something you are (biometrics).

The “something you have” can be any number of things:

  • Digital certificate;
  • Smart card (generally stores a digital certificate);
  • Physical Token (generates a one time password or pin on a screen of a device);
  • Soft token (generates a one time password or pin via an application); or
  • SMS (short message service) one time password or pin.

The something you are is exactly that, something that is uniquely you:

  • Fingerprint;
  • Retina scan;
  • Palm print;
  •  etc.

This second factor when coupled with your password makes it a lot harder for your account and personal information to be compromised should one or the other components be lost.

Most financial organisations offer a number of options for 2 factor authentication. The most common of these are SMS based one time passwords for transactions. Others opt to provide their customers with physical tokens that generate one time passwords.

Other organisations have started offering 2-factor authentication methods for their users –

Google offers both SMS and soft tokens for unauthenticated devices or services across their services like Reader, Gmail, etc.- http://googleblog.blogspot.com.au/2011/02/advanced-sign-in-security-for-your.htm

Dropbox have just added soft tokens for previously unauthenticated devices – https://blog.dropbox.com/index.php/another-layer-of-security-for-your-dropbox-account/

WordPress are now offering Vasco tokens – http://www.scmagazine.com.au/News/313736,wordpress-adds-vasco-one-time-password-technology.aspx and support for the Google Authenticator application –  http://wordpress.org/extend/plugins/google-authenticator

Facebook  now supporting SMS based tokens for unauthenticated devices- http://www.facebook.com/note.php?note_id=10150172618258920

The above list is certainly not exhaustive, but shows that there is now a move away from the old Username and Password as the way in which to authenticate a person.

 

What should I do?

The short answer to this is as follows:

  • Never reuse passwords. Ever;
  • Be aware of the risks in linking accounts to each other;
  • Use a password manager; and
  • Take advantage of 2-factor authentication.

Following these 4 simple things won’t guarantee that you and your accounts will not be compromised, but it will guarantee that the damage will be mitigated.

All about the path

October 20th, 2011 Comments off

Recently on the twittersphere there was a short exchange  as to why would  a security professional care about VXLAN when they don’t care about ASICs in a switch.

In stead of putting the conversation up (I’m lazy and can’t be bothered screen capturing it) I thought I’d share my $0.10 worth here.

In short, you always need to be concerned about the path of data. Just like Network Architects want to know packet paths for engineering purposes a Security Professional also is concerned with what systems or processes does it cross and where are the enforcement (choke) points. But most importantly, you need to know the data path so you can secure it.

I’ll start by briefly explaining what VXLAN is, its deficiencies and then a quick look as to why a Security professional needs to be concerned with the data paths, irrespective of whether or not they are virtual or physical.

What is VXLAN?

VXLAN (IETF REF: http://tools.ietf.org/html/draft-mahalingam-dutt-dcops-vxlan-00) is “A Framework for Overlaying Virtualised Layer 2 Networks over Layer 3 Networks“. This is a VMware and Cisco (amongst others) initiative. That’s the fluffy way of saying it is a tunneling protocol, more precisely a L4 tunneling protocol.

Why have VXLAN?

Personally I wouldn’t. It is a VMware kludge to a very specific problem. However, if you are a VMware proponent then you have your uses. For any one dealing with large virtualised environments, especially multi-tennant ones, you will find that you run into the limitations of your L2 network (even a well designed one) really quickly; 4000 VLANs doesn’t go far in multi-tennant environments .

  • How do you migrate VMs across L3 boundaries?
  • How do you move devices about without changing IP addresses?
  • Do all application support the readdressing of VMs?

Let’s take a fairly simple example of vMotion; this is not the ideal example but sufficient to get the concept across. vMotion is the movement of one Virtual Machine (VM) from a physical server to another physical server. Figure 1, below, shows a fairly simple setup with servers connected to the same switch, which we will assume are in the same Layer 2 Domain.

Figure 1 – Servers with VMs in a single L2 Domain

I won’t go into the gratuitous detail on how vMotion works, you can look that up for yourself, but for the VM to move from one physical machine to another there needs to be Layer 2 (L2) adjacency. Figure 2 below shows how the machine is replicated. The path between the virtual Machine on the left (highlighted in Green); through the Hypervisor (in this instance I’ve used VMware) out the physical NIC into the switch; out the switch; into the first NIC of the second server; up through it’s Hypervisor and finally coming to rest.

Stay with me there is a point to all of this.. I hope.

Figure 2 – VMotion path through switch.

Now, throw a router in the middle (see figure 3) and the whole process breaks. Because there isn’t the ability for L2 adjacency, it crosses the L3 boundary, the machine cannot move, let alone retain its IP address, etc.

Figure 3 – VM Servers in two L2 domains, separated by router.

 

As mentioned previously VXLAN is essentially a tunneling protocol. It is taking a Layer 2 frames and wrapping it in a Layer 4 Datagram, Figure 4 depicts 2 VXLAN networks, green and pink. This, with some other wizardry gets over some of the aforementioned limitations, the virtual machines are tied to a VXLAN ID by the Hypervisor (they need to be the same) which is then passed to the VTEP (VXLAN Tunnel End Point) which then wraps everything in a UDP packet (OK that is slightly simplified).

Figure 4 – VXLAN allows pseudo L2 connectivity across L3.

Now there is an L2 adjacency between the two servers, they can now replicate VMs between each other whilst maintaining the same L2 and L3 addresses. See Figure 5.

Figure 5 – vMotion across L3 boundaries is now possible with VXLAN.

Security Issues:

This is where I hope the rant has some value – If you didn’t care how the protocol works (even in a rudimentary sense) or how the data flowed in the scenarios above you wouldn’t understand what the limitations, and therefore potential security flaws, are or understand what issues it solves. That said VXLAN doesn’t solve any of the existing security issues we find in Ethernet today. It still requires processes to lock down deficiencies in the technology.

  1. Just like Ethernet you can spoofing ARPs;
  2. Broadcast storms still possible (turned into multicast within VXLAN domain);
  3. No security mechanisms built into VXLAN;
  4. If you have access to the network you can spoof anything? If you are on the same network as a VXLAN segment; and
  5. Through the very nature of the VXLAN function you are also now removed from the ability to provide hardware handoff for L2-L7 security measures (think ACLs, VACLs, Firewalls, NAT, Load-balancing, etc). You need to have this gated between VXLAN domains via a VM that spans both.

Even ignoring all these new issues (yes they are new issues, is this a new way of accessing an environment, of course it is!) what about policies, enforcement points, network taps, etc, that may be already in place, in-line/path with the new VXLAN tunnel that you are proposing?

These are all why a security engineer/architect/designer needs to care about the path.

Now to the comment “security guys don’t care about the path through a switch’s ASIC…”, generally speaking, most won’t care, but they should. Just because it is a switch doesn’t mean that nothing happens to a packet once it goes in and then goes out the other side. ASICs are customised, programmable chips that allow the device to perform a number of different functions; if you’ve ever looked into this you will know that no two platforms are the same (even from the same vendor).

In the diagram below (which is a fictitious switch construct) you can see that there are some capabilities built into the different components of the switch, specifically the ASICs.

Getting traffic from one port to another port isn’t necessarily a simple thing. Can I get straight from Eth1 to Eth2 directly, or do I have to go up through the switching fabric to the L2 switching engine? What happens when I have to route (below shows a path of a packet when going via the routing engine)? Does, or can, the packet be modified/duplicated inside the switch and if so what happens? At what point in the packet’s path through the switch is policy enforced, and in what order?

The list goes on and on.

Most enterprise switches, even basic ones, will allow you to mirror ports, I’m pretty sure that Security folk would care about what ports are set up as mirrors and more importantly, what’s at the other end of that port.

Conclusion:

The scenario’s above are fairly simple, more advanced switches allow far more sophisticated things to happen. You can rewrite packets, pass off packets to other processors (Routing, Load balancing, Packet inspection, policy enforcement, etc). Again you need to know the path through the switch and what touches a packet to understand the risk and potential impact to that application.

UPDATE:

Chris Neal sums up my rant nicely below:

Security

January 17th, 2011 1 comment

Image Source: Rogers' Security Blog

Have you ever noticed that if you stick 3 security professionals in a room you’ll get 3 different opinions?

That’s the first thing that popped into my head when I was asked to explain what security is to some colleagues.

What is Security

  • Security is to protect against malice, error and mischief.
  • It is ultimately a trade-off. To get some “security” you need to give up either money, time or convenience (personal freedoms); in order to feel or become secure.
  • It is a function of “duty of care” that a business must provide.

OK the longer version – What is it?

Security is ultimately identifying and managing risks, most of which are based on fear (and to a lesser extent Uncertainty and Doubt – FUD) and is something every one of you think about and deal with everyday. From where you sit on a train to where you park your car to what street you walk down at night, you think about what could happen.

Enterprise Security attempts to put a formal framework around identifying these fears, remove the emotional baggage associated with FUD and arm those that have to make the decisions.

“But that’s not my experience.”

You might say “but that’s not my experience”. Technology Security, specifically in the Enterprise, has generally been approached in a piece-meal, or point solution, fashion for a very long time. The market has played with our emotional baggage and driven the FUD factor causing businesses to buy that one product that will bandaid/cover that potential flaw in that critical system whilst failing to address the root cause.

We know we need to have building, infrastructure, information and policy security as well as risk assessment with a bit of compliance thrown in the mix, but for a very long time they have been delivered by completely different areas from within the business; Facilities, IT, HR and Finance, cobbled together in a fashion where Security is almost an afterthought and where it will been seen by everyone as business prevention.

Today, as organisations have matured, Like IT services in general, Security is becoming considered an integral part of the business’ development.

A Relative term.

Remember when I asked “Have you ever noticed that if you stick 3 security professionals in a room you’ll get 3 different opinions?

You need to remember that, for the most part, security is a relative term. Each person has a certain view on each topic e.g. I don’t like catching the train at night due to bad experiences, whereas my wife prefers to catch the train (over getting in a cab for instance – though the Australian Bureau of Statistics isn’t all that helpful when wanting to do that sort comparison).

Work related example:
- How do you feel about sharing your passwords?
- What about password sharing in manufacturing, warehousing or retail environment?
- how would the managers of these staff view sharing of account details?
- Now what about management when something like PCI comes into play?

Each component in a Business environment, or eco system, has different values to different people within an organisation, let alone between organisations.

Security within an Enterprise tries to take these disparate view points and consolidate into a formalised view addressing the various needs of the business, as well as key individuals, ideally removing as much FUD as humanly possible.

Where to take security today?

The idea is to take Security and turn it from a HAZMAT suit approach to an immune response. By that I mean to stop trying to wrap the business in a preventative/protective shield for the “just in case” or “worse case” and move to a more dynamic stance where you are able to cope with changes by applying business logic to any given situation.

But How?

There are a number of formal Security Architecture, Risk Management and Governance frameworks and methodologies (and to a lesser extend ontologies) out there to help like ISM, PSPF, SABSA, Zachman, COBIT, ISO/IEC 31000, ISO/IEC 27002, and TOGAF (OK the first two are Australian Government standards, but hey they fit the bill).

These play a role, of varying degrees, in overseeing the design and build of Business Systems which are;

  • Free from fear;
  • in safe hands;
  • not likely to fail;
  • safe from attack.

These all provide the formal framework for identifying the requirements and risks (fears) and work to remove the emotional baggage and apply some sense to how they are addressed, arming those that have to make the decisions.

There are a lot of great resources out there, both generic and specific to issues, they are but a Google search away.

Are we taking fear too far?

November 17th, 2010 Comments off

Has the fear mania that seems to engulf every day of our lives gone too far? Do we really need the security theatre that is crammed down our throats, or poked up are nethers, or do we need to man up to society and accept that there are bad (and stupid) people out there who want to do bad (or stupid) things and we can be less paranoid about it and make intelligent, considered decisions? –

Is it the security theatre and the hype it generates the cause of an increased “incidents”, are people using this media induced heightened awareness as an excuse to check their brain out and abdicate commonsense and decisions on what and what isn’t safe to others, or are we just getting more and more stupid?

Food for thought.

UPDATE: I love it when someone tests the stupidity of some of these things.