My kids' Dad

Getting Published

Network Magazine just published my piece about the Death of a Firewall. It is fairly condensed and the editor, David Greenfield, did a fine job with my more verbose draft. I encourage you to send your feedback to the magazine and copy me as well (or copy to this post as a comment). This was a great experience in summarizing a topic that needs a lot more space to cover in technical detail - perhaps one day I can publish a more detailed article. I hadn't expected my family to be so excited about this accomplishment, it certainly makes me feel good.

The rest of my family is now out of state visiting relatives which leaves me an abundance of time to... study for my GSEC recertification. Oh - the life of a geek... truly glamorous. I studied for about a month for my original tests but this time I'll give myself three nights since I have a deadline of June 29 so my blogging may be light for a few days. Or then again...

Update:
Getting some recognition on SlashDot

Go Tom, go!

Thomas Barnett takes on The Atlantic Monthly and Newsweek in one fell* blog:

What Newsweek recently did in its story on interrogations was the journalistic equivalent of yelling "fire" in a crowed theater. People died as a result, and they should answer for this professionally.

What Kaplan does in the Atlantic Monthly piece is, in my opinion, basically the same thing--only in slow motion, so to speak. Fear-mongering and war-mongering is reprehensible and morally wrong. If you believe a legitimate case for war exists, like enforcing the global community's emerging rule sets against certain forms of very bad behavior (e.g., Saddam, Kim, Mugabe, etc.), that's one thing. But there's no such argument with China along these lines, and Kaplan does not even seek to make such arguments. Instead, he's just pushing the inevitability argument and trying to plant that seed in the minds of Americans: Get used to thinking about war with China!

I like seeing some of this righteous indignation!

From one who knows

When talking about security we often segue into concerns about privacy but often the aspects of the two are confused. Security primarily involves trust (or lack thereof) - of those around us, those we interact with and in a greater power to mete out justice, whereas privacy ideally involves our control over what is revealed about us. Often however we see security focusing on control as a strategy... internal controls are something we may need, but offering hope is another thing altogether.

Fouad Ajami had a great opinion piece in today's Wall Street Journal - some key excerpts that got my attention:

"George W. Bush has unleashed a tsunami on this region," a shrewd Kuwaiti merchant who knows the way of his world said to me. The man had no patience with the standard refrain that Arab reform had to come from within, that a foreign power cannot alter the age-old ways of the Arabs."

[Regarding Lebanon] They were under no illusions about the change that had come their way. They knew that this new history was the gift of an American president who had put the Syrian rulers on notice.

Unmistakably, there is in the air of the Arab world a new contest about the possibility and the meaning of freedom.

Mr. Bush may not be given to excessive philosophical sophistication, but his break with "the soft bigotry of low expectations" in the Arab-Islamic world has found eager converts among Muslims and Arabs keen to repair their world, to wean it from a culture of scapegoating and self-pity. Pick up the Arabic papers today: They are curiously, and suddenly, readable. They describe the objective world; they give voice to recognition that the world has bypassed the Arabs. The doors have been thrown wide open, and the truth of that world laid bare. Grant Mr. Bush his due: The revolutionary message he brought forth was the simple belief that there was no Arab and Muslim "exceptionalism" to the appeal of liberty. For a people mired in historical pessimism, the message of this outsider was a powerful antidote to the culture of tyranny.

For those who dwell on the pain of birth - the heavy cost of freedom - consider the hope being offered to hundreds of millions who had been abandoned to tyranny. Those who actively work to destroy the trust we have earned (based on their opinions) are the real warmongers.

Observations from ISD 05

Just back from drinking from the firehose of thinking at the Information Security Decisions 2005 conference. The speakers are a wide diversity of some of the most interesting thinkers and practitioners in the field. My biggest criticism of the conference is that there is too much good information and not enough time. [Note to Larry Walsh and Andrew Briney: There should be fewer speakers, a lot more time to interact with them directly after the presentations and a lot more time between speakers to think through the rich content they usually present.]

Richard Thieme was the highlight of the conference for me. His topic was "Five Strategies for Creative Security Leadership" and the points that reverberate are:

The three priorities in security (or why it is so bad):

1. Please the boss (survival at the expense of excellence)
2. Satisfying compliance (avoiding the government beast at the expense of security)
3. Working on good security (if time remains after #1 & #2) 

His observations are insightful and profound:

You are only going to get results in what you intend to accomplish - do you know what your intentions are? Look at where you want to go, not at the obstacles.

If you truly care about people and have a clear vision - you will lead people and they will follow you.

The real work is done through social networks - your relationships determine your effectiveness.

As you grow more powerful the real danger lies in disconnectedness.

[From Robert Galvin - Motorola] "Big ideas start out as a minority opinion of one..." & "Ideas held in common by a group are typically wrong" (consensus)
I found a scribbled note after the speech where someone had written 'why Bush as elected' - but I believe this is a misapplication of this principle, Bush was elected based on "The Wisdom of Crowds" reflecting a diverse spectrum of reasoning even within those who voted for him. Consensus is built on compromise and mediocrity, emerging victorious from a race among diverse and numerous less than coherent groups indicates superior decision making.

You can subscribe to Thieme's mailing list or check out his book.

Ken Tyminski, CISO of Prudential Financial, detailed his success in getting his company to embrace security. Ken is living proof that security done well costs less and is more effective than security done haphazardly. He keenly noted during the Q&A that your only hope for success is the attitude at the top of the organization - if they want and appreciate security.

Bruce Schneier is brilliant and well regarded and talked with us for nearly an hour. Bruce's real contribution lies in his ability to provoke thought and stimulate conversation. Once he leaves his technical area of expertise - his advice becomes of less consistent quality:

• He tells us how bad a variety of legislation is (such as the new national ID (REAL ID act) then insists that our current troubles must be solved by regulation!
• He offers an example of how an Miami businessman lost $90,000 due to a fraudulent wire transfer involving his spyware infected computer. Some challenged him on his reasoning - and then he dissembled. He said that he could toss his credit card out into the audience and not be liable for any theft. I highly doubt that - as cardholders we are obligated to report the loss of our cards and are liable for losses if we don't.
• He also made quite an issue out of the dangers of living in a police state.

On this last point I had a minor epiphany... the desire of some people to solve too many of our problems through government regulation is in effect the harbinger of the creation of a police state. In chatting with a 'liberal' friend, I was assured that this was not the case since it would be the 'justice system' that hold the keys to power. I simply can't buy that since the courts then are subject to corruption by elevating their powers above our freedom. Centralized power and control has proven itself failed by the test of history - but people are scared of the uncertainties of change and decentralized power and control as best exhibited by free market capitalism and democracy. As Thieme says, '(when rafting) look at the direction you want to go, not at the rocks'.

Chicago Fun

In Chicago for a few days at the always smart Security Decisions conference. This semi annual conference targets decision makers rather than the DefCon crowd. The weather is perfect and I love taking the opportunity to run the lakeshore.

The Financial Times had a very nice Worldwide Security section yesterday. In the front page article they highlight:

Direct threats from computer hackers, political activists or fraudsters are more likely causes of disruption than a terrorist attack.

We also have to add another 'ph' word to our vocabulary... first phishing, then pharming and now 'pherreting' in an article about cyberspace.

[AT&T's Eslambolchi] argues that firewalls and intrusion detection software at the network edge are inaccurate and expensive. Companies spend 80% of their security budget on protection against external hacking while 80% of the attacks come from within.

Sounds like perimeter security just isn't adequate anymore.

[Trend Micro's David Perry] accepts that cybercrime will never be totally eliminated but he believes that it can be controlled.

Once again we are reminded that security isn't about eliminating risks but about managing them.

Long day

Got up very early this morning and drove my weary/almost recuperating remains across our state to an IT security conference. The initial impression I received was that this would be a painful day. Despite the lack of any food that was even close to being suitable for Passover (you know - the 'no leaven thing') it turned out to be a worthwhile day. (Oh - and I didn't have an appetite anyway.)

First session was a by a lawyer specializing in IT related defense discussing her actual cases (which her very large firm has more than enough of).
Discovery cases are huge and mostly unreported (wait until the boss hears that!)
Zubulake V cited along with Kessler. IT staff handles like Laurel and Hardy.
Big news - lawyer having done this for years continues to see corporate IT staffs as incompetent and untrustworthy - giving us plenty of examples.
Unfortunately, everything she describes is all too familiar.
And of course executive management is blissfully unaware of this until a lawyer gets called in and she has to cope with a system out of control.
I don't blame IT - it reminds me of the old "I Love Lucy" show where Lucy gets stuck on a malfunctioning chocolate production line. IT is compelled to crank out work without regard for maintainability and control. Executives don't want to hear about the problem or costs. Then Sarbanes Oxley hits and controls are forced into place with most companies complaining loudly about new costs. We are talking about basic controls that should have been required from day one!

Next session was principle from one of the Big 4 accounting firms.
Reaffirmed above - they see a lot of the Fortune 500 and see the same lack of basic controls. IT makes the classic mistake of applying technology as the solution when in fact the solution usually requires a change in business process which can be supported by technology. Big point is to 'operationalize' security.

RSA guy talked about smart cards and digital certificates - man is this timely. He basically reaffirms my little model - but to do it justice I should make a slide. The basic issue is that in all of the models today there is a weak link between the person and the authenticator. A key issue he raised about biometrics is what happens when you lose your biometric device - how do you reset that 'password'?

Keynote was about Cyber Security from the Washington DC perspective. He had some good points, but afterward I talked to him about Barnett and the need for a U.S. position on global cyber security strategy and policy. He was receptive, I'll need to follow up soon. Their [ITAA] biggest beef is lack of a U.S. cyber czar ('Assistant Secretary') to elevate national priority.

Finally heard CISO from University of Michigan. Schools like to believe they are so much different from businesses (lack of central hierarchy) but that just isn't so when looking at large global companies which are more like autonomous businesses. He discussed their strategies and CISO competencies which I found insightful. He mentioned that they didn't have firewalls and was surprised when I said that we are striving toward that.
Best line: Put protection closest to what needs to be protected. (anti perimeter security)

And I made it back home without getting a ticket or falling asleep at the wheel!

Help Wanted

It looks like we may have a position opening for a senior level security analyst. This is not a job offer but if anyone has an interest send me an e-mail. Even if you don't have an interest these guidelines should be of value to anyone considering a career in corporate Information Technology.

A qualified candidate excels in each of these four areas:

1. Technical skill/competency (see below for specifics)
2. Positive attitude (don't need any young or old curmudgeons)
3. Works as part of a team (lone wolf superstars not needed)
4. Communication skills (know how to interact with wide variety of people and write and speak well)

You should have expertise in two or more of the following skills: PKI design, implementation and management; global policy and standards creation; SAP security; regulatory compliance (SOX, HIPAA, SB1386, EU Safe Harbor); Incident Response Handling; Disaster Recovery planning; Project Management; Security Awareness program management; and security benchmarking and metrics. (If this was an official job posting it would undoubtedly include additional required skills like J2EE, C#, CPU design, super-cooled superconductor research, quantum physics, MCSE certification, PDP-11 programming and 10Base5 troubleshooting.... only kidding!!!!)

Our definition of security engineer or analyst does not include software developers or hardware engineers (Saar - you are first on my list if it were).

The other thing people always have to consider is the location of the job. I happen to love the area - locals enjoy a high quality of life, a city which is not too big or too small and ideal for families, great outdoor recreation, all four seasons (plenty of snow in the winters; green rainy springs; hot summers; and amazingly colorful autumns), affordable living, friendly people, growing diversity of culture, plenty of educational institutions and not too distant large cities (2 hours by car). Makes me sound like the chamber of commerce, hmm? I have lived in plenty of cities and even some places way off the beaten path so I appreciate what I found here. Tolkien fans will appreciate that this area is peaceful as 'the Shire' - not as magical as Rivendell, not as pedestrian as Gondor, not as rural as Rohan and not as nuts as Mordor. OK, maybe Maui would be nicer - but that is so far from everything.

Movers and shakers

Mark at ZenPundit posts a great piece on horizontal thinking.

We often hear about the need to think and act strategically especially if we want to keep our jobs. We typically think about strategy in a future state sense, how do we get someplace? But an important component is assessing where we are today and what our environment looks like. Often we have blinders on and we fail to see the context of where we are.

Horizontal thinking helps us to look at our position from a different perspective. We look at a successful analogue in another field and we attempt to apply it in ours - perhaps yielding a breakthrough. John H. Holland did it with genetic algorithms in the field of computing and Thomas P.M. Barnett did it with economic theory in global security.

Horizontal thinking requires that we understand our field and another field sufficiently enough to apply those principles often by means of engaging experts in the other field. This also implies a dissatisfaction with solutions in our own field as well as the ability to work with others. Definitely not for those who prefer the status quo.

Ending Identity Theft

In today's Wall Street Journal the CEO of Equifax presents the four steps to end identity theft:

1. Secure our data systems (information security)
2. Verify identity of applicants (business process)
3. Buy a credit monitoring service (self serving sales pitch!)
4. Punish identity thieves (negative motivation)

I think he's pretty close (if you skip step #3 which attempts to put the burden back on the customer). The biggest hole in this solution is that we have no universal means to verify identity. There is a lot of fraud being committed because of this and once some smart organizations decide to work on this problem we stand little chance of making any real progress.

My solution is to use existing and cheap technology to build an identity system that is controlled by the individual and accepted by businesses, governments and other individuals.

High level overview:

• Digital certificates issued by any number of independent CAs
• Highest level of authenticity based on simple DNA typing done at health clinics for a modest fee (which is a field on the digital certificate)
• Certificates may be installed on credit (smart) cards, passports, PCs
• You lose your card(s) you simply have CA revoke the certificate and request a new one
• Someone claims to be you? Easy, no one else is made of your DNA - let's meet at the health clinic...

In essence you are identified by your DNA not your: name, social security number,  mother's maiden, driver's license, etc. But you don't give people your DNA 'number' (not that it is secret - it isn't) - you give them a trusted token of your choosing [credit card | ID card | digital signature] that they can easily authenticate. I can even have multiple certificates so that if one card is stolen, the others are not affected.

There still exists the small window between when a card is stolen and when it is discovered and revoked. Issuers may still want to use PINs or mutual authentication mechanisms to reduce their liabilities - this is where the law serves a good purpose - the trusting party (let's say bank) must be able to prove that the individual approved the transaction to avoid the loss.

As the CEO rightly points out, restricting data warehouses and adding more legislation will only serve to harm our economy and not fix the problem.

Perimeter Security

With all of the recent focus on locking down our national borders and the Minutemen, I am given pause to consider the parallels with perimeter security on corporate (and other organizations') data networks.

Amidst all of the partisan accusations of racism and protecting our national security lies the truth somewhere in the middle. We need to restrict criminals' access to our territory and we need the vital flow of immigrants and others into our nation. We also need to protect cornerstone ideals of our nation such as freedom and privacy rights.

We realize that our border checkpoints are unable to identify every criminal that attempts to enter or exit this country, but once we identify someone who is intent on criminal behavior we should expect that they be ejected and then identified and prevented in future attempts to enter this country or to avail themselves of our resources. Since we expect some criminal behavior (domestic or foreign) within our borders we need suitable defenses within (this is called 'defense-in-depth). For high profile 'targets', such as airports, we would do better to have a secure and trustworthy identification system that allows known users to suffer minimal disruption whereas unknown or new users to endure a more rigorous screening process until their trust has been established over time. For lower profile sites, such as retail stores, the silent alarm is adequate for bringing adequate force to bear on bad behavior. However financial systems which are increasingly hampered by fraud will see new mechanisms brought to bear, the aforementioned strong identification system would be helpful in this regard.

So too, in the electronic realm of network firewalls we see the dispute over perimeter security continue. Just as in the physical world, locking down the rules of network firewalls gives a false illusion of security. Bad guys find a variety of ways to circumvent firewalls, usually by simply going around them by finding a weak spot in the rest of the perimeter. Internal systems (PCs and servers) are loosely protected due to reliance on the protective illusion the firewall provides. At the same time tightly locked firewalls hamper legitimate business operations which are increasingly done in electronic form. The solution here is to add more layers of internal defense around critical servers that hold sensitive data (harden the OS, keep patched, anti-virus, use strong identity management systems/PKI with encryption, application level firewalls and logging and monitoring). PCs need to be capable of operating in hostile environments and capable of providing users with friendly and strong identity credential handling. The perimeter security model is often compared to an egg (or candy) which is 'hard and crunchy on the outside, but soft and chewy on the inside'. We know from experience the danger this model presents, once a 'bad element' has gained entry into the internal network the damage potential is extremely high. At one time networks were closed, but the reality is that organizations are opening their networks to outsiders; suppliers, consultants, outsourced service providers, partners, contractors, customers and visitors - at the same time employees are often traveling and expected to use their company laptops and handhelds on the Internet and remote networks as part of their work.

So too, our national border as well as our electronic borders must be protect us within reason and yet not hamper legitimate and desirable flows of people, commerce and ideas.

Let's agree that we welcome law abiding travelers, visitors, immigrants, students, workers and guests. Let's agree that we have a duty to prevent criminals from entering our nation. Our border checkpoints need to be smart in stopping known threats and our borders need to stop unidentified entry.

We can take this a step further using Barnett's model where we extend our perimeter to the borders of our allies. Each territory between us and the perimeter of the 'core' becomes a security buffer zone. I tried to articulate this in my presentation to the ISSA.

The Jericho Forum calls this deperimeterization although Mr. Pescatore dislikes the term.