Dan and I were on the Beyond the Perimeter Podcast Featuring Amrit Williams and will be for a couple more episodes. It’s hard work to not sound like my usual dorky self. =)
Posted in Public Policy, Speaking | 
1 Comment »
Tags: Cyberwar • government • infosec • speaking
Eh? What’s that mean? Developer Days is a weeklong conference where they get down into the weeds about the various SCAP schemas and how they fit into the overall program of security automation.
Highlights and new ideas:
Remedial Markup Language: Fledgeling schema to describe how to remediate a vulnerability. A fully automated security system would scan and then use the RML content to automagically fix the finding… say, changing a configuration setting or installing a patch. this would be much awesome if combined with the CVE/CWE so you have a vulnerability scanner that scans and fixes the problem. Also needs to be kept in a bottle because the operations guys will have a heartattack if we are doing this without any human intervention.
Computer Network Defense: There is a pretty good scenario slide deck on using SCAP to automate hardening, auditing, monitoring, and defense. The key from this deck is how the information flows using automation.
Common Control Identifier: This schema is basically a catalog of controls (800-53, 8500.2, PCI, SoX, etc) in XML. The awesomeness with this is that one control can contain a reference implementation for each technology and the checklist to validate it in XCCDF. At this point, I get all misty…
Open Checklist Interactive Language: This schema is to capture questionaires. Think managerial controls, operational controls, policy, and procedure captured in electronic format and fed into the regular mitigation and workflow tools that you use so that you can view “security of the enterprise at a glance” across technical and non-technical security.
Network Event Content Automation Protocol: This is just a concept floating around right now on using XML to describe and automate responses to attacks. If you’re familiar with ArcSight’s Common Event Format, this would be something similar but on steroids with workflow and a pony!
Attendance at developer days is limited, but thanks to all the “Powar of teh Intarwebs, you can go here and read the slides!
Posted in NIST, Technical | 3 Comments »
Tags: 800-53A • 8500.2 • catalogofcontrols • compatibility • compliance • fdcc • genius • government • infosec • infosharing • management • NIST • pci-dss • scalability • scap • security • seminar • tools
Letter from GAO on how Congress can fix FISMA. And oh yeah, the press coverage on it.
Now supposedly this was in response to an inquiry from Congress about “Please comment on the need for improved cyber security relating to S.773, the proposed Cybersecurity Act of 2009.” This is S.773.
GAO is mixing issues and has missed the mark on what Congress asked for. S.773 is all about protecting critical infrastructure. It only rarely mentions government internal IT issues. S.773 has nothing at all to do with FISMA reform. However, GAO doesn’t have much expertise in cybersecurity outside of the Federal Agencies (they have some, but I would never call it extensive), so they reported on what they know.
The GAO report used the often-cited metric of an increase in cybersecurity attacks against Government IT systems growing from “5,503 incidents reported in fiscal year 2006 to 16,843 incidents in fiscal year 2008” as proof that the agencies are not doing anything to fix the problem. I’ve questioned these figures before, it’s associated with the measurement problem and increased reporting requirements more than an increase in attacks. Truth be told, nobody knows if the attacks are increasing and, if so, at what rate. I would guess they’re increasing, but we don’t know, so quit citing some “whacked” metric as proof.
Reform photo by shevy.
GAO’s recommendations for FISMA Reform:
Clarify requirements for testing and evaluating security controls. In other words, the auditing shall continue until the scores improve. Hate to tell you this, but really all you can test at the national level is if the FISMA framework is in place, the execution of the framework (and by extension, if an agency is secure or not) is largely untestable using any kind of a framework.
Require agency heads to provide an assurance statement on the overall adequacy and effectiveness of the agency’s information security program. This is harkening back to the accounting roots of GAO. Basically what we’re talking here is for the agency head to attest that his agency has made the best effort that it can to protect their IT. I like part of this because part of what’s missing is “executive support” for IT security. To be honest, though, most agency heads aren’t IT security dweebs, they would be signing an assurance statement based upon what their CIO/CISO put in the executive summary.
Enhance independent annual evaluations. This has significant cost implications. Besides, we’re getting more and more evaluations as time goes on with an increase in audit burden. IE, in the Government IT security space, how much of your time is spent providing proof to auditors versus building security? For some people, it’s their full-time job.
Strengthen annual reporting mechanisms. More reporting. I don’t think it needs to get strengthened, I think it needs to get “fixed”. And by “fixed” I mean real metrics. I’ve touched on this at least a hundred times, go check out some of it….
Strengthen OMB oversight of agency information security programs. This one gives me brain-hurt. OMB has exactly the amount of oversight that they need to do their job. Just like more auditing, if you increase the oversight and the people doing the execution have the same amount of people and the same amount of funding and the same types of skills, do you really expect them to perform differently?
Rybolov’s synopsis:
When the only tool you have is a hammer, every problem looks like a nail, and I think that’s what GAO is doing here. Since performance in IT security is obviously down, they suggest that more auditing and oversight will help. But then again, at what point does the audit burden tip to the point where nobody is really doing any work at all except for answering to audit requests?
Going back to what Congress really asked for, We run up against a problem. There isn’t a huge set of information about how the rest of the nation is doing with cybersecurity. There’s the Verizon DBIR, the Data Loss DB, some surveys, and that’s about it.
So really, when you ask GAO to find out what the national cybersecurity situation is, all you’re going to get is a bunch of information about how government IT systems line up and maybe some anecdotes about critical infrastructure.
Coming to a blog near you (hopefully soon): Rybolov’s 5 steps to “fix” FISMA.
Posted in FISMA | 2 Comments »
Tags: accounting • accreditation • auditor • catalogofcontrols • certification • compliance • fisma • FUD • gao • government • infosec • itsatrap • management • metrics • omb • S773 • security
Face it, your security requirements suck. I’ll tell you why. You write down controls verbatim from your catalog of controls (800-53, SoX, PCI, 27001, etc), put it into a contract, and wonder how come when it comes time for security testing, we just aren’t talking the same language. Even worse, you put in the cr*ptastic “Contractor shall be compliant with FISMA and all applicable NIST standards”. Yes, this happens more often than I could ever care to count, and I’ve seen it from both sides.
The problem with quoting back the “requirements” from a catalog of controls is that they’re not really requirements, they’re control objectives–abstract representations of what you need in order to protect your data, IT system, or business. It’s a bit like brain surgery using a hammer and chisel–yes, it might work out for you, but I don’t really feel comfortable doing it or being on the receiving end.
And this is my beef with the way we manage security controls nowadays. They’re not requirements, functionally they’re a high-level needs statement or even a security concept of operations. Security controls need to be tailored into real requirements that are buildable, testable, measurable, and achievable.
Requirements photo by yummiec00kies. There’s a social commentary in there about “Single, slim, and pleasant looking” but even I’m afraid to touch that one. =)
Did you say “Wrecks and Female Pigs’? In the contracting world, we have 2 vehicles that we use primarily for security controls: Statements of Work (SOW) and Engineering Requirements.
Let’s have a quick exercise, shall we?
What 800-53 says: The information system produces audit records that contain sufficient information to, at a minimum, establish what type of event occurred, when (date and time) the event occurred, where the event occurred, the source of the event, the outcome (success or failure) of the event, and the identity of any user/subject associated with the event.
How It gets translated into a contract: Since it’s more along the lines of a security functional requirement (ie, it’s a specific functionality not a task we want people to do), we brake it out into multiple requirements:
The $BarApplication shall produce audit records with the following content:
For a COTS product (ie, Windows 2003 server, Cisco IOS), when it comes to logging, I get what I get, and this means I don’t have a requirement for logging unless I’m designing the engineering requirements for Windows.
What 800-53 says: The The organization configures the information system to provide only essential capabilities and specifically prohibits and/or restricts the use of the following functions, ports, protocols, and/or services: [Assignment: organization-defined list of prohibited and/or restricted functions, ports, protocols, and/or services].
How It gets translated into a contract: Since it’s more along the lines of a security functional requirement, we brake it out into multiple requirements:
The $Barsystem shall have the software firewall turned on and only the following traffic shall be allowed:
If we drop the system into a pre-existing infrastructure, we don’t need firewall rules per-se as part of the requirements, what we do need is a SOW along the following lines:
The system shall use our approved process for firewall change control, see a copy here…
So what’s missing, and how do we fix the sorry state of requirements?
This is the interesting part, and right now I’m not sure if we can, given the state of the industry and the infosec labor shortage: we need security engineers who understand engineering requirements and project management in addition to vulnerability management.
Don’t abandon hope yet, let’s look at some things that can help….
Security requirements are a “best effort” proposition. By this, I mean that we have our requirements and they don’t fit in all cases, so what we do is we throw them out there and if you can’t meet the requirement, we waiver it (live with it, hope for the best) or apply a compensating control (shield it from bad things happening). This is unnerving because what we end up doing is arguing all the time over whether the requirements that were written need to be done or not. This drives the engineers nuts.
It’s a significant amount of work to translate control objectives into requirements. The easiest, fastest way to fix the “controls view” of a project is to scope out things that are provided by infrastructure or by policies and procedures at the enterprise level. Hmmm, sounds like explicitly stating what our shared/common controls are.
You can manage controls by exclusion or inclusion:
We need a reference implementation per technology. Let’s face it, how many times have I taken the 800-53 controls and broken them down into controls relevant for a desktop OS? At least 5 in the last 3 years. The way you really need to do this is that you have a hardening guide and that is the authoritative set of requirements for that technology. It makes life simple. Not that I’m saying deviate from doctrine and don’t do 800-53 controls and 800-53A test procedures, but that’s the point of having a hardening guide–it’s really just a set of tailored controls specific to a certain technology type. The work has been done for you, quit trying to re-engineer the wheel.
Use a Joint Responsibilities Matrix. Basically this breaks down the catalog of controls into the following columns:
Posted in BSOFH, Outsourcing, Technical | 3 Comments »
Tags: 800-53A • C&A • catalogofcontrols • certification • compatibility • compliance • fips-200 • government • infosec • management • pwnage • risk • scalability • security • tailoring
As usual, I greatly enjoyed your blog from 17 June, A Short History of Cyberwar Look-alikes, Rybolov. Moreover I really appreciated your historical examples. It warms my heart whenever an American uses the Russo-Japanese War of 1904/5 as a historic example of anything. Most Americans have never even heard of it. Yet, it is important event today if for no other reason than it established the tradition of having the US President intercede as a peace negotiator and win the Nobel Prize for Peace for his efforts. Because of this, some historians mark it as the historic point at which the US entered the world stage as a great power. By the way the President involved was Teddy Roosevelt.
Concerning the state and nature of Cyberwar today, I’ve seen Rybolov’s models and I think they make sense. Cyberwar as an extension of electronic warfare makes some sense. The analogy does break down at some point because of the peculiarity of the medium. For example, when considering exploitation of SCADA systems as we have seen in the Baltic States and in a less focused manner here in North America, it is hard to see a clear analogy in electronic warfare. The consequences look more like old-fashion kinetic warfare. Likewise, there are aspects of Cyberwarfare that look like good old-fashion human intelligence and espionage. Of course I also have reservations with the electronic warfare model based on government politics. Our friends at NSA have been suggesting that Cyberwarfare is an extension of signals intelligence for years, with the accompanying claim that they (NSA) should have the technical, legal, and of course budgetary resources that go along with it.
I’ve also have seen other writers propose other models of Cyberwarfare and they tend to be a mixed bag at best. At worst, many of the models proposed appear to be the laughable writings of individuals with no more insight to or knowledge of intelligence operations beyond the latest James Bond movie. My own opinion is that two models or driving forces behind international Cyberwarfare activity. The first is pure opportunism. Governments and criminal organizations alike, even authoritarian governments have seen the Hollywood myths and the media hysteria about hacker exploits. Over time, criminal gangs have created and expanded on their cyber capabilities driven by a calculation of profits and risks much like conventional businesses. Combine an international banking environment that allows funds to be transferred across borders with little effort and less time and an international legal environment that is largely out of touch with the Internet and international telecommunications, and we have a breeding ground for Cyber criminals in which the risks of cross-border criminal activity is often much less risky than domestic criminal activity.
As successful Cyber criminal gangs have emerged in totalitarian regimes, it shouldn’t be a surprise that eventually the governments involved would eventually take an interest in both their activities and techniques. There are several reasons that totalitarian government might want to do this. Perhaps the simplest motivation is that the corrupt officials would be drawn to share in the profits in exchange for protection. In addition, the intelligence arms of these nations could also leverage their services and techniques at a fraction of the cost of developing similar capabilities themselves. Additionally, using these capabilities would also provide the intelligence agencies and even the host government with an element of deniability if operations assigned to the criminal gangs were detected.
Monument to the International Brigade photo by Secret Pilgrim. For more information, read the history of the International Brigade.
Perhaps the most interesting model of development and Cyberwarfare activity today would be based on the pre-WW II example of the Spanish Civil War. After World War I, a period of mental and societal exhaustion followed on the part of all participating nations. This was quickly follow by a period of self-assessment and rebuilding. In the case of the defeated Germany the reconstruction period protracted due to difficult economic conditions, in part created by the harsh conditions of surrender imposed by the winning European governments.
It was also important to remember that these same victorious European governments undermined many of social and moral underpinnings of German society by systematically all the basis of traditional German government and governmental legitimacy without regard for what should replace it. The assessments of most historians is that these factors combined to sow the seed of hatred against the victorious powers and created a social climate in which a return to open warfare at some time in the future was seen as unavoidable and perhaps desirable. The result was that Germany actively prepared and planned for what was seen as the commonly inevitable war in the future. New systems and technologies were considered, tested. However, treaty limitations also hampered some of these efforts.
In the Soviet Union a similar set of conclusions developed during this period of history within the ruling elite, specifically that renewed war with Germany was inevitable in the near term. Like Germany, the Soviet Union also actively prepared for this war. Likewise they considered and studied new technologies and approaches to war. Somewhat surprisingly, they also secretly conspired with the Germans to provide them with secret proving grounds and test facilities to study some to the new technologies and approaches to war that would otherwise have been banned under provisions of the peace treaties of World War I.
So, when Civil War broke out in Spain in the summer of 1936, both Germany and the Soviet Union were positively delirious at the prospects of testing their new military equipment and theories out under battlefield conditions but, without the risks of participating in a real shooting war as an active belligerent. So, both governments sent every military technology possible to their proxies in Spain under the auspices of “aid”. In some cases they even sent “advisors” who were nothing less than active soldiers and pilots in the conflict. At first, this activity took place under a shroud of secrecy. But, when you send military equipment and people to fight in foreign lands it usually takes no time at all for someone to notice that, “those guys aren’t from here”.
Bomber During the Spanish Civil War photo by -Merce-. Military aviation, bombing in particular, was one of the new technologies that was tested during the Spanish Civil War.
Since the fall of the Soviet Union, I think the world has looked at the United States as the world’s sole superpower. Many, view this situation with fear and suspicion. Even some of our former Cold War allies have taken this view. Certainly our primary Cold War adversaries have adopted this stance. If you look at contemporary Chinese and Russian military writing it is clear that they have adopted a position similar to the pre- World War II notion that war between the US and Russia or war between the US and China is inevitable. To make matters worse, during much of the Cold War the US never seemed to pull it together militarily long enough to actually win a war. Toward the end of the Cold War we started smacking smaller allies of the Soviet Union like Grenada and succeeded.
We then moved on to give Iraq a real drubbing after the Cold War. The so-call “Hyperwar” in Iraq terrified the Russians and Chinese alike. The more they studied what we did in Iraq the more terrified they became. On of the many counters they have written about is posing asymmetric threats to the US, that is to say threatening the US in a way in which it is uniquely, or unusually vulnerable. One of these areas of vulnerability is Cyberspace. All sorts of press reporting indicate that the Russians and Chinese have made significant investments in this area. The Russians and Chinese deny these reports as quickly as they emerge. So, it is difficult to determine what the truth is. The fact that the Russians and Chinese are so sensitive to these claims may be a clear indication that they have active programs – the guilty men in these cases have a clear record of protesting to much when they are most guilty.
Assuming that all of this post-Cold War activity is true, I believe this puts us in much the same situation that existed in the pre-World War II Spanish Civil War era. I think the Russian and Chinese governments are just itching to test and refine their Cyberwarfare capabilities. But, at the same time I think they want to operate in a manner similar to how the Germans and the Soviet Union operated in that conflict. I think they want and are testing their capabilities but in a limited way that provides them with some deniability and diplomatic cover. This is important to them because the last thing they want now is to create a Cyber-incident that will precipitate a general conflict or even a major shift in diplomatic or trade relationships.
One of the major differences between the Spanish Civil War example and our current situation of course is that there is no need for a physical battlefield to exist to provide as a live testing environment for Cyber weapons and techniques. However, at least in the case of Russia with respect to Georgia, they are exploiting open military conflicts to use Cyberwar techniques when those conflicts do arise. We have seen similar, but much smaller efforts on the part of Iran, and the Palestinian Authority as embrace what is seen as a cheap and low risk weapon. However, their efforts seem to be more reactionary and rudimentary. The point is, the longer this game goes on without serious consequence the more it will escalate both vertically (in sophistication) and horizontally (be embraced by more countries). Where all of this will lead is anyone guess. But, I think the safe money is betting that the concept of Cyberwar is here to stay and eventually the tools and techniques and full potential of Cyberwar will eventually be used as part of as part of a strategy including more traditional weapons and techniques.
Posted in Public Policy, Rants, The Guerilla CISO | No Comments »
Tags: cybercommand • Cyberwar • FUD • georgia • government • incidentresponse • infosec • publicpolicy • pwnage • risk • security • subversion
Well, we have half a bazillion people saying that we need a Cybersecurity person of some sort at the White House, but nobody’s stepped up to take the job and to be honest, I don’t anybody wants it all that badly. It might be time to call out for real heroes.
Posted in IKANHAZFIZMA | No Comments »
Tags: government • lolcats • security
« Previous Entries Next Entries »
Posts RSS
Subscribe via Email