Which do you want first? The good news or the bad news?

IBM’s X-Force researchers have released their 2011 year end Trend and Risk Report and there’s good news and bad news for those of us trying to defend the castle, so to speak. First the good …

• spam is down compared to last year (although you wouldn’t know if from my inbox),
• software vendors are doing a better job of patching their products in a more timely manner,
• and one of the long-standing threats to web server security, cross site scripting vulnerabilities are down (but not out, I might add).

But don’t pop the corks just yet …

• attacks focused on mobile devices (i.e. smart phones, tablets, etc.) are on the up tick,
• and so are automated password guessing and phishing attacks.

Also, bear in mind that some of these statistics are cyclical in nature with a down year typically proceeding an increase in the following year.

All in all, though, some great info to have at your disposal and to factor into the way your organization views IT risk.

For more info including access to the free report and an overview video go to http://www-03.ibm.com/security/xforce/.

Advertisement

WITX Security Panel

I’ll be serving as a panelist at the Wilmington Information Technology eXchange and Conference hosted by the University of North Carolina Wilmington on April 18, 2012. I’ll be joined by Jonathan Campbell, CSO for New Hanover Regional Medical Center, with the subject of our discussion being “Security and Privacy Concerns including Mobile Device Management.” I plan to give a brief overview of the latest attack trends with a focus on one of our most challenging areas for security — how to handle the proliferation of mobile phones, tablets and other devices that are cropping up in greater numbers in corporate environments. For more information on the event click on the image below …

Pass the word, choose a better password

In keeping with the theme of the previous post, I was recently asked by Tyler Dukes of The News & Observer, who writes the biweekly “Stump the Geeks” column, to comment on issues with choosing good passwords. Here’s a link to the article  below:

http://www.newsobserver.com/2012/03/19/1935703/passwords-are-still-securitys.html#storylink=misearch

Due to space considerations, a lot of what I wrote didn’t make it past the editor’s knife so I’m posting here my larger response so you can see what didn’t make the paper and, hopefully, get a better sense of my thinking in this area…

Ideally you would want each password to be chosen randomly and comprised of a mixture of upper and lower case characters along with a few numbers and special characters like *!%$ thrown in for good measure. Also it is best not to also use same password on any other system so that if it does become compromised, the damage is limited. Finally, it should be changed at regular intervals such as every 90, 180 or 365 days, depending upon the risk involved with the information being protected.

All this is to make the password hard to guess. The problem is that things that are hard to guess often tend to be hard to remember, which is people naturally bristle at such guidance.

I think the best compromise is to use password storage or single sign-on software. These tools can generate strong, random passwords that are unique for each system they will be used to log into and only require the user to remember a single password to unlock the password storage “vault.” I have literally hundreds of passwords — all unique and none that I actually know, but with tools like these I only need to keep up with the one password that unlocks the tool and it keeps up with the rest.

IBM sells a product called Tivoli Access Manager for Enterprise Single Sign-On that I work with that is designed to do this for an entire organization’s user population. There are consumer products as well that are both free and fee-based. One nice freebie that I have used is Password Safe, which is an open source tool available from SourceForge.net. Still other tools offer to save your passwords on a shared system (i.e. in the cloud), which is convenient if you need them to be available across multiple systems. Just bear in mind that when you store your passwords on someone else’s system then you are totally at the mercy of how good a job they do with their security and, in most cases, there is no way for you to verify if their claims of using strong encryption and the like are valid or not.

As with all such decisions, there’s a trade-off between security and convenience and the answer will be different for different people depending upon their tolerance for risk and their understanding (or lack thereof) of that risk.

iTunes U interview on User Authentication

One of the hardest problems we face in the IT security space is that of user authentication. In other words, are you really who you claim to be? One the one hand, it’s something we do every day when we run into people we know (or don’t know), yet there have continue to be cases of impersonation, which means our systems for verifying authenticity aren’t perfect. Complicating matters is when this identity verification happens at opposite ends of a wire in cyberspace where many of the mechanisms we rely on in the physical world elude us.

Here’s a link to an iTunes U podcast interview I did with Dr. Steven Furnell, who heads up the School of Computing and Mathematics at the Plymouth University (UK). Apologies in advance for my weak sounding voice and seeming lack of energy as I had to go in for vocal cord surgery two days later.

InfoSec World 2012

I’ll be presenting at InfoSec World 2012 in Orlando, which runs April 2-4. My talk will be on the first day at 1:30 on the subject of “Creating an End-to-End Identity Management Architecture” and will cover the following:

• A holistic view of the various components that comprise an enterprise-wide identity and access management infrastructure
• The appropriate role of directories, metadirectories and virtual directories – what they reasonably can and cannot do
• The elements of an automated account provisioning/de-provisioning system
• How role management can help you get a better handle on identities
• Lessons learned and best practices of identity management

I’ve been attended and presented at this conference numerous times over the past decade and found it always to be one of the best of its kind. If you can make it down to Orlando, please stop by and say “hi.”

Ron was wrong, Whit is right — So now what?

It seems that every 18 months or so we are treated to another scary story about how SSL is broken and all your encrypted secrets are at risk. Of course, there’s always at least a kernel of truth to the report or wouldn’t get much traction and the latest case is no different.

For those of you that aren’t crypto geeks (which, I hope for the sake of humankind is most of you), Ron, in this blog post heading and in the research paper than uncovered the vulnerability, is Ron Rivest (the “R” in the “RSA” cryptographic algorithm that is widely used across the Internet) and Whit is Whitfield Diffie of Diffie-Hellman key exchange protocol fame. Both Ron and Whit are giants in the crypto arena due to their many contributions.

You can read more about the vulnerability, it’s likelihood of impact and some countermeasures you can take in the following article from Dark Reading:

http://www.darkreading.com/taxonomy/index/printarticle/id/232602467

The net of it is that this is a bona fide risk but it isn’t likely to affect most web sites. So, the sky is not falling but I would recommend taking an umbrella…

LinkedIn – a hacker’s dream?

My previous posting dealt with a technical attack involving malware being distributed through social media. Here’s a story on how social media sites can be used for social engineering to entice users into being attacked.

http://money.cnn.com/2012/03/12/technology/linkedin-hackers/index.htm

The article points to how information gleaned from LinkedIn profiles can be used to target users with more plausible attack scenarios — a.k.a. spear phishing. It describes how one person was able to get added as a connection to more than 60 people at a company where he posed online as a worker and then proceeded to get himself added to a private LinkedIn discussion forum.

• “Now I had an audience of 1,000 company employees,” O’Horo said. “I posted a link to the group wall that purported to be a beta test sign-up page for a new project. In two days, I got 87 hits — 40% from inside the corporate network.”

Of course, the risk here is that the fake page could have been infected and used to distribute malware as previously described. But is this really a problem with LinkedIn? Should we avoid social networking sites as a result?

I would say “no” and “no.” The real issue here was that people were trusting things they shouldn’t trust. If someone had bothered to find out who this guy was before adding him to the private discussion forum, it wouldn’t have been an issue. Also, if users had been more discerning as to which links they clicked on, it wouldn’t have been an issue.

The point really is what and whom should you trust? LinkedIn, like any social networking site, is only as good as the information in it and only as trustworthy as the people posting to it. It seems that every time we develop a new communications forum, whether it be snail mail, telephone, email, SMS, or social networking sites, we have to re-educate ourselves as users as to what is and is not reasonable and responsible behavior within this new context.

Hackers know this and it’s how they are able to exploit these windows of opportunity with each new turn of the technological crank. The onus is on the good guys to maintain a healthy skepticism when moving into new forums or risk being the next victim.

Impeachable Timing

So just as I start up my new security blog on WordPress with a video where I talk about some of the risks (including malware) of social media, guess what shows up?

You got it! A story about 30,000 WordPress blogs being infected to distribute none other than malware. Here’s a link to the story:

http://www.pcworld.com/article/251374/30000_wordpress_blogs_infected_to_distribute_rogue_antivirus_software.html#tk.nl_dnx_t_crawl

This is really nothing new, of course. Drive-by download attacks have been around in various forms for years. I wrote about the risk in my book a dozen years ago when most users assumed that the mere act of browsing a web site was safe.

Unfortunately, as long as we have browsers with bugs, some of those bugs will result in security vulnerabilities and some of those vulnerabilities will be exploited.

No defense is 100% foolproof but one of the better ones in this area is the NoScript add-on for the Firefox browser. NoScript prevents mobile code such as JavaScript, Java and Flash (inherently avoids the exposure of ActiveX that exists in Internet Explorer) from being downloaded and executed by your browser for untrusted sites.

It does result in some pages not being rendered correctly but you can either temporarily override the block or add the site to your trusted list to get around this issue. It’s more trouble, but well worth the effort in my opinion.

IBM Pulse Conference

I attended IBM’s Pulse Conference in Las Vegas this week (March 4-7, 2012) and what a show it was! IBM Fellow Grady Booch’s interview with Apple co-founder, Steve Wozniak (Woz starts about 56 mins in), was a real highlight as was the Maroon 5 concert the night before. They even let me join in on the fun with a video interview of “all things security” which ranged from discussing the significance of launching of the new IBM Security Systems division to the changing nature in both motivation and sophistication in the current hacker threat.

Social Media INsecurity

Welcome to Inside Internet Security — the blog. I qualify it that way since it is named after a book I wrote about a dozen years ago which, in a sense, served as the launch pad for what has been an amazing personal journey through the intricacies of IT security in the age of the Internet.

It seems somehow appropriate to commence this new (for me) means of outreach through social media with an exploration of some of the security risks inherent in this format. So in that spirit, I offer up a link to a keynote talk I did in September of 2011 at the New York Institute of Technology’s Cyber Security Conference for your consideration in hopes that it will provoke some thinking on the topic.

In this talk I discuss some of the vulnerabilities in the social networking format as well as cite examples of real world attacks and compromises that have occurred on Facebook and LinkedIn along with some discussion of the weaknesses that exist in current authentication technologies such as passwords and biometrics. (There were some technical difficulties with the audio at the start but it smooths out soon.)

Enjoy …

NYIT Cyber Security Conference: How Secure Are We? Identify Management and Social Networking Threats