Came across news this fine day about the RIAA settling with a woman on one of their music-pirating crusade cases because she didn’t even own a computer at the time. But what really struck me was the facepalm of this paragraph:

[Mavis] Roy, of Hudson, New Hampshire, had been charged by four record labels with downloading and distributing hundreds of songs from the Internet. A letter from the record companies’ attorneys in July 2007 directed her to a web site where she could pay by credit card to settle the case. Since she did not have a computer in her house at the time she was alleged to have downloaded the music, she ignored the requests. “For many months she thought it was just a scam…”

Why do we even bother these days? Remind me to never wonder when people say, “Well, how are we supposed to know what is a scam or what isn’t? Good question, and unless the English is broken and stupid, we really don’t know anymore. Be paranoid.

My Friday thought is this: Much like drinking while on stage at a Defcon presentation, do you swear on your blog? If you don’t swear on your blog, I submit that your blog is fucking boring. 🙂

You buy our appliance and plug it into your data center. With care, cool temperatures, and constant feeding with power and network packets (they do not have to be destined to the box, but just spanned over), the appliance will start to produce nanomites within 6 months.

These mechanical mites will first gestate inside the appliance, but will soon skitter across your network cables and fix everything wrong. They will also steal unused bits and bytes of storage and bring them back to the hiv…appliance.

After 6 more months of scavenging unused cycles and bits, the appliance will begin to produce nanomites v2: physical security. They will be constructed inside the appliance and when ready, slip out of the vents and secure your data center. Do not be alarmed if you see network cables moving as if blown by a breeze, or small shadows around the corners of the racks when no one is around. Those are just the nanomites!

They are small enough to slip unnoticed anywhere, including all of your office PCs and telephones. They are constructed to adopt such devices as their new homes and they will protect them and their security for 47 years, per their average life expectancy. If your users or the systems they use exhibit insecure tendencies or practices, they will take physical action to shock…err…correct the situation.

Hmm…so not wanting to be at work today. Need sleepy. The above inspired after seeing Rybolov’s picture of a cat appliance!

Via McKeay, I read a list of 10 things your auditor isn’t telling you, compiled by David Shackleford. Utter, terrible truths! So much so, that I had to yoink them and add comments.

If you read nothing else in this post, read my comments on #6. In fact, I’ll quote myself here: “This is where pen-tests can trump audits. A pen-test can say WRONG, but an audit is trying to say CORRECT, and it often can’t.”

1. I am actually just following a checklist.
A subjective checklist. An incomplete checklist. A checklist I can’t intelligently talk about because I don’t get it, nor can I really give you anything beyond obsurd vagueness if you ask me how to meet those checklist bullets! Oh, Dave covers some of those coming up! 🙂

2. I do not understand the technology I am auditing.
Also, too many varied ways of using varied technologies in various environments. Either you follow the checklist in #1, or you have to have a very large swath of knowledge. We’re just not close to being at the latter, yet. Kudos to any teams of auditors who have a nice cross-selection of skills that the lead can use to fill such gaps!

3. The well-dressed, experienced greyhairs came in and sold this deal, but I graduated from college 8 months ago and went through ( E&Y || IBM || Deloitte ) auditing bootcamp.
Possibly good if the guy is smurt, but honestly experience in a working environment does go a long way to “getting it,” both with technology and the how’s and why’s of business.

4. Most firms are really incentivized to help you pass.
In addition to Dave’s comments, I would say no one wants to lose business because your client only wanted a passing score. They *will* shop around to pass a weak audit rather than actually work up to passing any audit. Sad, but security will continue to be an economic function.

5. Show me a viable set of compensating controls, and I’m liable to pass you.
Just say no! Then again, combine #4 with #1 and you get #5. Don’t lose the business, but cover your ass so you’re not passing obviously wrong things. The one thing I dislike about this situation is if the controls are there, but just not really used except when the auditor is around, i.e. that AV/IPS management console full of alerts that no one ever looks at.

6. Auditing standards suck.
I’m not sure how this can get better, mostly because of what I said in #2 about varied technologies used in varied ways. *CAN* you have an easily understood Ubuntu Server build checklist? Doubtful, especially when you have no context as to what that Ubuntu Server should be doing. This is where pen-tests can trump audits. A pen-test can say WRONG, but an audit is trying to say CORRECT, and it often can’t. Yes, we can get better, but this is a Big Deal. And we all know the reaction when they see NIST docs for the first time. “Oh, just follows the recommends at NIST [and keep some Tums on hand.]”

7. Compliance regulations suck.

8. You can’t have it “your” way.
Combine this with #1, #2, and #3, and your auditor may WORSEN your security. But it is true, the audit’s real effectiveness is going to be rooted in the auditor and somewhat in the client technical staff (who may be able to pass off an auditor as being inexperienced). <--Of course, those staff that can do that probably need to be recruited into security/auditing!! 9. I know more than you.
Dave’s comments remind me why I think the trend on-going is to have in-house auditing/security. The biggest things stopping that will be a solid workforce and the Blame Game when a breach does occur. You can’t have someone blitz in for a week or two and be effective with anything but a checklist. You can’t expect a firm’s auditor to give you MSSP-like/consultant-like hours without either being gouged or limiting how many other paying clients he can handle. And you can’t always expect a client sticks to what they say, especially if they have no real security analysts whose job is to maintain such secure practices.

10. Covering my ass is my major goal.
Dave mentions the audit firm pestering to get answers/details to make sound decisions. Given #1, #2, #3, #4, and the ego-part of Dave’s comments in #9, this leads down the road of eliciting a response you want and then client wants, even if it is false. “Yes, fine, we have a log management product and sure we …watch…it…” can be written down as “Check!” even if it’s not true. “Honey! You let Billy track mud all over the living room!” “But dear, I asked if he had taken off his shoes and he said yes!” “Right, but did you actually CHECK that he was doing it?” “Wait, blame Billy, he lied about it!”

bonus: I know you probably don’t like me.
Really, we techs should like auditors. Tech/Sec managers should like their auditors. If you’re doing a good job, they legitimize it. If you’re doing a bad job because you can’t get budget, they’ll justify it. But if you’re being subpar and you know it (or don’t know it), yes, you dislike your auditors because they look at things you suck at and are asking for details that you don’t have. In that case, you need to look at them as being helpful to improve what you’re doing, not trying to expose you for a hack in front of your boss. If I’m driving stick horribly and someone gives me a tip, it’s just that…helpful!

This sounds cynical of me, but it’s likely because I’m too close to all of this to really appreciate it sometimes. Even my most cynical days are liked by some people because there is a deep thirst for security knowledge beyond sec geek circles. They just don’t like all the work we remind them needs done. No magic buttons… 🙂

I find this news particularly interesting. China’s Green Dam software is riddled with bugs? Nice!

Not only is the government lowering overall security (and illustrating that even on a national security level functionality trumps security), but homogenous systems like that scare me. A business with a standard security suite is one thing, but a country of a billion people is a whole new game. If a government ever mandated a piece of software for its citizens and businesses, I can pretty much guarantee you it will be the most tested, fuzzed, and attacked piece of software since Windows, because just one remote exploit can turn into a virtual nuke for a government whose hackers find it…

If you click the link in the link I posted (or go to this article), you get this juicy quote from the CEO of the Green Dam maker:

“We are specialists in producing Internet filtering software rather than security,” Zhang said, according told the China Daily.

Figures I would miss it this year, once they changed from winter to summer dates. The 2009 Microsoft Scripting Games are currently underway. It’s too late to truly sign up, but their challenges are as good as any excuse to start learning a scripting language. Such learning endeavors are usually killed by lack of ideas on what to use as a goal for early scripts. Events like this provide the answer!

There are only two script languages in use this year, PowerShell and VBscript. No Perl like last year.

Passing along an article discussing the recent Merrick Bank vs Savvis case, where an auditor is being sued by someone who relied on their assessment results. The title says it all, “Why suing auditors won’t solve the data breach epidemic.”

I’ve added a section of links on the page (right menu for those who only see me through RSS) for security-related LiveCDs. I know, I’m missing some old ones like PHLACK, Whax, and even Knoppix-STD, but I’d like to link only actively supported and recent editions. So far I’m only listing backtrack (duh), NST, nubuntu, owasp, pentoo, and samurai.

I may adjust this section and include virtual images as well, since there are some pen-test target and tool images out there, like the recently announced Securix Network Security Monitoring virtual image (the sheriff badge logo has got to go, lol!). Really, these days there is not too much difference between a livecd and a virtual image in your pocket, assuming you control the target system.

Matthew Hackling over at Infamous Agenda has posted a list of things to know for working in infosec. I really like this list, kinda like previous lists* I’ve pointed to or referenced. I can see a few items on here I certainly could work on!

I’m totally yoinking this list because his site doesn’t look built around getting hits (no ads, good man!), and I’d love to keep this list even if the site someday dies. To every entry he says to configure or install an app, I would also suggest living with it for more than a few days or weeks. Consider that extra credit!

1. TCP/IP basics like OSI model, routing, protocols, ports, NAT
2. Construct a checkpoint firewall rule base
3. Construct a PIX firewall rule set
4. Configure a cisco router to CIS benchmark
5. Configure VLANs and port mirroring on a cisco switch
6. Deploy Microsoft security templates to a group policy object
7. Configure a WSUS server and run MBSA to check it is working
8. Use Solaris Security Toolkit
9. Administer a linux box, enable/disable services, use package managers etc.
10. Install oracle and mysql
11. Be able to construct an SQL query or two
12. Configure a web server or two (say apache and IIS)
13. Configure an application server or three (say tomcat, websphere application server, maybe BEA weblogic)
14. Be able to use a web proxy (burp, webscarab) and a fuzzer
15. Know how the following security controls of authentication, session management, input validation and authorisation are implemented securely for a number of application development frameworks
16. Configure an IDS or three (Snort, IBM solution set)
17. Know the ten domains in ISO27002 and their content
18. Be able to identify control gaps from ISO27002 in your operations
19. Be able to build a security plan to address control gaps (planned end state, costs and benefits, dates, actions and responsibilities)

* sadly, while I can visualize the page I have in mind, I have no idea where my link to it is.

I either need two more of me, or a permanent 3- or 4-day weekend to catch up on all the little notes I send myself about tools or things to check out.

It’s not the reading of RSS feeds and news that gets me bogged down. It’s all the crazy awesome stuff out there that takes some hands-on time with to really know it.

(Ok, so I have a backlog of books to read too…)

By now everyone has seen the quote from Michael Lynton, CEO of Sony Pictures Entertainment: “I’m a guy who doesn’t see anything good having come from the Internet, period.” What I didn’t know was this guy was a former CEO of AOL. A media company CEO making a statement like this pretty much tells me that this guy isn’t necessarily anti-internet, he just has absolutely no strategy for properly using it. None. He hasn’t just lost the battle; he didn’t even know one was happening until it was too late.

This was the general topic of one of the best blog posts I’ve read this year. The post is by Jason Frisvold over at the Technological Musings blog and hits every point square.

I’m pretty passionate and open about much of my opinions on media and piracy (although maybe a tiny bit less open since earning my cissp). And this article pretty much echoes, eloquently, my position on these matters.

Kinda like malware fears on a Mac, most people use what they want to use and turn an ignorant eye to any issues that may be present. Me? I’m paranoid. I’m wary about things like LogMeIn, and this post from SecureThoughts.com illustrates why this is a healthy disposition.

As one of the commentors states, LogMeIn is used by more than just home users, but also by technical support teams and maybe even by users in your office to get home or vice versa! Remote management in a controlled manner is one thing, remote management using a browser and the web just because it’s easy is entirely another.

Good bye Web 2.0. Welcome back Mainframe 2.0, I mean, Cloud Computing!

The move to virtualize centralize has been brewing for years now. That includes the desktops (say thanks to mismatched Microsoft licensing and software upgrade durations and users who want to violate bastardize lose/bloat their systems). Terminal/Server is back in sexy! Centralized, to decentralized, to centralized, to decentralized…get used to the ride!

So, why is “cloud” so confusing? I’ll take a stab that doesn’t include the reason that everyone is using “cloud” to describe anything and everything (my toilet is Cloud-driven because it has a soft seat and flushes away my products to a central hub…)

Web-driven
The “cloud” is web-driven because firewalls tend to only be allowing 80/443 through with impunity. Make firewall requests of network admins? Security evals from the security teams? Move faster! Skirt any and all barriers security or business-related! It sure is easier to just pump everything through what’s open, right? In my opinion, that’s one of the only reasons. Much like a river carves a course of least resistence.

Outsourcing 2.0:
IT is painful internally. And costly. And often not line-of-business/revenue-generating. Homegrown apps just aren’t all that agile, and it takes a ton of experience and knowledge to create them properly. Internal IT is not all that glamorous anymore, but “cloud” certainly seems like it for now. Just wait until we collectively realize it is less agile/customized! Oh, and any advantages you thought you had in your technology are now a moot point; get over it. That or just realize you got marketing-fed into re-consuming the same old web you were using yesterday. Yeah, sure, those are new donuts because I say so (they’re taste stale because they’re healthy!).

Confuser Catalyst for all this:
The over-bloated web browsers, of course! They’re out of control and starting to get such a big head to want to be OS in themselves! Or at least try to pave the way for market share as they futiley attempt to flank the OS giants. You use the web and you like the web, so cloud / browser-OS must be good!

Leverage the power of Amazon’s computing cloud power all over port 80/443! Your competitor already does it, so we’ll give you a start-up discount and you can just use the exact same translations and maps and apps that we already built for them!

In regards to my previous post on what should be called Merrick Bank v Savvis, here is another blog post from Dave Navetta that goes into glorious detail about this case and why we should be watching it. An excellent article.

Please note that a potential analogue for security assessors are lawsuits by investors against accountants. Both engage in attestation services that are known to some degree to be relied upon by third parties. There are numerous cases going both ways (some finding liability/some not) with respect to accountant liability to investors who relied on inaccurate financial statements.

The subtitle for this post should be, Compliance is not secure! Compliance is not secure! Compliance is not secure! And because no one wants to spend money, we’re all going to suffer for it.

Wired has an article posted on a lawsuit CardSystems has filed against its auditor, Savvis.

In theory, CardSystems should have been safe. The industry’s primary security standard, known then as CISP, was touted as a sure way to protect data. And CardSystems’ auditor, Savvis Inc, had just given them a clean bill of health three months before.

and

More than four years later, Savvis is being pulled into court in a novel suit that legal experts say could force increased scrutiny on largely self-regulated credit card security practices.

They say the case represents an evolution in data breach litigation and raises increasingly important questions about not only the liability of companies that handle card data but also the liability of third parties that audit and certify the trustworthiness of those companies.

The number of ways this is all so fucked up makes my head spin and makes me want to vomit out all the reasons in a babble of words and rants. So much so that it is hard to begin to even plan to be concise!

This lawsuit may result in finally punching the elephant in the room: Compliance is a one-time deal and it fails without continuous internal rigor (i.e. staff/money).

So many experts understand this concept, but so many middle-men and legalists choose to ignore it, probably because their management squeezes on the budgets from top-down. Secure vs profits.

The use of the analogy between digital security and physical law enforcement is over-used, but can still be used in parts. For instance, if you are robbed, can you sue the police department? Is the aim of law enforcement (i.e. security) such that it prevents all crime, or that it simply responds to, detects, and maybe contains the crime?

To take another tact, one can draw parallels between digital security and accounting practices. Why do accounting departments go through audits and make changes? Often you’ll hear, “because we have to.” Someday, if we can’t do this shit ourselves, we’ll “have to” go through transparent digital security audits just like financial audits. And we won’t be able to say no.

And it will both not be pretty nor all that much more effective than what we have now for digital security.

Conflict of Interest
There’s another elephant in this room. Yeah, really, there is. And that is the elephant of conflict of interest. (Maybe the biggest elephant is simply greed and cost-avoidance!).

It could be easy to point a finger at auditors and say they have a conflict of interest in certifying their clients, even if their security sucks. But the real blame may lie with the client who, when handed a failure audit, may immediately go elsewhere. In this way, they’re not buying a real audit so much as they’re demonstrating that they just want to buy a rubber stamp of compliance. This subtle attitude in turn punishes the quality auditors and rewards that crappy ones!

Another possible end result: internal solutions
Prepare while I ramble just a little bit.

Card industry smacks Payment processors.
Payment processor takes shortcuts whenever possible.
Payment processor pays for an audit pass.
Payment processor gets hacked.
Payment processor sues auditor (i.e. passes the blame).
Auditors protect themselves by demanding unfettered 24/7 access otherwise no guarantees.
Payment processor may as well staff internally (so they can pass the blame).
No 24/7 operation can prevent internal employees acting in unexpected ways.
This leads to vicious circle of management (secure it!) vs employees/staff (not possible!).
Eventually we pass the blame to employees.

And all this because no one can guarantee security.
And too much of our legal and business foundation cannot handle lack of blame/guarantee.

The Silver Lining: Natural Selection
One common complaint these days, especially amongst the truly skilled pen testers and auditors, is the number of crappy firms and people doing audits. If we get no other benefit from CardSystems vs Savvis, at least it should scare off the firms that know their products and services are incompetent.
And finally some subtext: smaller is better?
So, can one say that we should be able to trust smaller audit firms more? If you hire a small team of auditors, will they have less conflict of interest and possibly higher standards than a large firm trying to churn through clients for profit? This might just be a personal slant…