Author Archives: Brent Huston

About Brent Huston

I am the CEO of MicroSolved, Inc. and a security evangelist. I have spent the last 20+ years working to make the Internet safer for everyone on a global scale. I believe the Internet has the capability to contribute to the next great leap for mankind, and I want to help make that happen!

MSI Launches New Threat Modeling Offering & Process

Posted on by
Reply

Yesterday, we were proud to announce a new service offering and process from MSI. This is a new approach to threat modeling that allows organizations to proactively model their threat exposures and the changes in their risk posture, before an infrastructure change is made, a new business operation is launched, a new application is deployed or other IT risk impacts occur.

Using our HoneyPoint technology, organizations can effectively model new business processes, applications or infrastructure changes and then deploy the emulated services in their real world risk environments. Now, for the first time ever, organizations can establish real-world threat models and risk conditions BEFORE they invest in application development, new products or make changes to their firewalls and other security tools.

Even more impressive is that the process generates real-world risk metrics that include frequency of interaction with services, frequency of interaction with various controls, frequency of interaction with emulated vulnerabilities, human attackers versus automated tools, insight into attacker capabilities, focus and intent! No longer will organizations be forced to guess at their threat models, now they can establish them with defendable, real world values!

Much of the data created by this process can be plugged directly into existing risk management systems, risk assessment tools and methodologies. Real-world values can be established for many of the variables and other metrics, that in the past have been decided by “estimation”.

Truly, if RISK = THREAT X VULNERABILITY, then this new process can establish that THREAT variable for you, even before typical security tools like scanners, code reviews and penetration testing have a rough implementation to work against to measure VULNERABILITY. Our new process can be used to model threats, even before a single line of real code has been written – while the project is still in the decision or concept phases!

We presented this material at the local ISSA chapter meeting yesterday. The slides are available here:

Threat Modeling Slides

Give us a call and schedule a time to discuss this new capability with an engineer. If your organization is ready to add some maturity and true insight into its risk management and risk assessment processes, then this just might be what you have been waiting for.

Spam from a Security Vendor

Posted on by
Reply

I really wanted to call this post How NOT to Sell Your Scanning Tool to Other Security Companies, but it seemed a little long.

Great….. That’s really just what you want to see…Looks like it went out to all PCI ASV companies. Fantastic, now I get spam based upon the PCI vendor list… I guess there is irony in the security business after all…

So, today, I was lucky enough to get spam from another security vendor with an offer to tell me all about how their company and tool can really help us be a better PCI ASV. I thought I would include it here, with some relevant commentary…

My name is Bob XXX and I am responsible for XXX PCI Compliance Partner Program.

Hi Bob. Just in case you are new to the security world, spam is not really cool and uninvited emails, especially those without an opt-out mechanism (like this one…) are really not much different than the guys selling V1agr4 and other junk via email. It basically uses other peoples’ time and resources without their consent…

A number of PCI ASVs use XXX products and services as a basis for their PCI Scanning offerings for the following reasons:

Wow! This is a great point. So, I can use your tool, just like other ASV providers and have even LESS to set me apart from my competition on the race to FREE scanning for PCI compliance. Ummm, thanks…

XXX PCI Scanning Solution

Wait for it… Here it comes…. The long list of “benefits” to me as a security provider…. Right….

… Is a leveraged investment providing unlimited scans and not a pay for every scan expense.

Well, at least I only have to pay for it like regular software and not that pay as you go model. Ummm… How is this a benefit for ASV companies? How is this different from Nessus and the plethora of other scanners that don’t follow the “Comodo model” (wait… aren’t they FREE for PCI scans now???)?

… Can accurately identify over 17,000 conditions which can decrease analyst review time; reducing time and cost.

I always love these numbers… Our toolset checks for more than 20,000 security issues… I hate adding these in, but a lot of clients always ask for them….Also, a definition of “accurately” would be appreciated. If you are suggesting that your tool has 17,000 checks that don’t create any false positives then I would say you are delusional. Be truthful, you say it reduces analyst time, but if an analyst still has to check them then we are again back to the definition of “accurate”…

… Is based on XXX XXX, a commercially available product, with ongoing investment in research and development to insure it is the most robust and accurate solution available.

So, “commercially available” translates to “better”? I would love to see you argue this with several security folks I can think of. How does commercial availability translate to quality? Are you implying that open source or propietary solutions are lesser because of their availability and lack of commercial cost? Is Linux less “robust and accurate” than Windows because it is open source or does the fact that Redhat sells a version of it make it more “robust and accurate” since it is commercial???

… Is supported by XXX’s award winning customer support organization.

Good. I am glad to hear you have won awards for support. How much support does the product need? Oh, wait, I think I see your implication – it’s that open source thing again isn’t it? Exactly what products are you attempting to compete against? I mean Nessus, which I would assume to be your primary target, has support too if you purchase the product. My guess is that this is a stab at the customer emotions and fears of newsgroup and mailing list support. Is that still an issue? I mean, especially since ASV companies are supposed to be the experts with their scanning tools, how does this translate to something I should be concerned about? Don’t my technicians know their tools well enough to not need the usual technical support?

… Can provide a strategic foundation for other revenue generating services such as
Ø Web Application Scanning
Ø Vulnerability Risk Management Scanning
Ø Configuration Compliance solutions

Now this is interesting… At first, I took it to mean that the tool did all of this… But it just says that it provides a “strategic foundation” for generating revenue from other services… What exactly is “Vulnerability Risk Management Scanning”? How is that different from traditional vulnerability scanning? Does it measure, quantify or create metrics somehow that communicate real-world risk, or is this just the usual H/M/L stuff like always? As for the revenue, would that be revenue for the ASV or for XXX? Both? On the good news front, I am pretty glad to see that you mentioned scans for web application issues, that is a good thing and at least you got this right…

I would like the opportunity to discuss your current solution and answer any questions about XXX to determine if we are an attractive alternative.

If you are interested in learning more, please respond to me so we can coordinate a day/time for a phone conversation.

Ummm…. Thanks, but no thanks. First, my company is an ASV. To become an ASV we had to do some scanning and testing. Thus, we already have tools. We also already appear to have tools that are superior to yours, at least in our opinion.

But, the number one reason I would not buy from your company is that one of the first rules of e-commerce security is don’t purchase things from unsolicited emails; it only encourages more spam. In addition, it just doesn’t fit my ethical compass to support security vendors who would engage in “spammy practices”. Good luck, Bob, but I think you might want to think about your email marketing approach a little bit more…

Book Review: Security for Wireless Ad Hoc Networks

Posted on by
Reply

Authors: Anjum & Mouchtaris
Publisher: Wiley
Cost: $75.00
Rating: 3 out of 5

This book reads like a PHD thesis. It is long on technical and mathematic detail and a little short on real-world scenarios. The examples are well researched and deeply technical. While the reading is a little tedious, those seeking an in depth understanding of wireless security will benefit greatly from this book.

At just under 250 pages it’s likely to take longer than a weekend to complete the read, but especially if you’re a mathematical genius, this book should be right up your alley. One of the highlights of the book is the content that relates to intrusion detection systems. The section did an excellent job of explaining various techniques and architectures for wireless intrusion detection. This content will be especially interesting to engineers and vendors in the wireless security space.

New MSI Tool for Analyzing Your Security Program

Posted on by
Reply

MSI is proud to release a new tool to help security managers analyze the overall balance, maturity and capability of their security program. The new tool is a simple matrix based around quantifying the amount of controls, efforts and processes you are employing.

Using the tool as brainstorming aid is also possible. Security engineers have told us that the process works for them to analyze particular applications and other security undertakings. Simply build out the matrix on paper or in your chosen office product and it should help you clarify where your security initiative stands.

Effective, mature security programs should be well rounded in the matrix and should be well balanced between all of the cells. They also tend to balance out between strategic and tactical approaches.

Feel free to give us feedback on this project and let us know if we can answer any questions you may have.

You can obtain the relevant file here.

SecurityProgramAnalysis.pdf

It is licensed under Creative Commons. Check out the PDF for details.

The “TSA Week at a Glance” Content – Huh???

Posted on by
Reply

This just in from the “No, we swear this isn’t propaganda” department.

The TSA seems to have added a section to their web site where you can keep tabs on just what they have been up to this week. You can check it out here.

As of this moment, here is what they have been doing so far this week:

* 15 passengers were arrested due to suspicious behavior or fraudulent travel documents

* 18 firearms found at checkpoints

* 12 incidents that involved a checkpoint closure, terminal evacuation or sterile area breach

* 16 disruptive passengers on flights

So, basically, according to those figures – they apparently have worked 61 “incidents” this week alone. Unfortunately, what they don’t seem to show is a graphic that shows where this lies as a historical piece of data. Wouldn’t it be whiz bang cool if they had a graph that showed historic trending? Maybe they could also do some sort of predictive “threat radar” that could turn various colors and make beeping sounds when they think more disruptive passengers are expected- like say the next time airlines go out of business, strand travelers, treat them without dignity – oh wait, that seems to be usual air travel today. No wonder they don’t have any sort of historic metrics…
I also particularly liked the large window at the top of the page that currently says something to the effect of “Chilling details have emerged about a trans-atlantic terror plot.” I am pretty sure that’s what I want to read from the TSA – horror stories. Is it just me or does this stuff seem like maybe it belongs someplace else? I really don’t want to view that material from the government group that’s supposed to protect me. Sure, you have the details. Sure, you might even have caught them, but I also think it induces more fear than it calms and reassures.
Hey TSA, how about a lot less marketing and a lot more focus on the presenting the details that we NEED TO KNOW. Please, refrain from using FUD to justify your presence in our lives and your budget dollars. Thanks!!!

The Dangers of “We Find Vulns or It’s Free” Security Offers…

Posted on by
Reply

I was astounded at this posting this morning in Credit Union Times.

These types of offers always make me cringe when I see them. At first blush, they may seem like a good idea. Why not, after all, we all want to believe that our application is secure and we all want something for free. This certainly seems like the best of both worlds. How could this be bad?

Well, first off, security testing choices should not be based on price. They should be based on risk. The goal is to reduce the risk that any given operation (application, network, system, process, etc.) presents to the organization to a level that is manageable. Trust me, I have been in the security business for 20 years and all vendor processes are NOT created equal. Many variations exist in depth, skill level, scope, reporting capability, experience, etc. As such, selecting security testing vendors based upon price is a really really really bad idea. Matching vendors specific experience, reporting styles and technical capabilities to your environment and needs is a far better solution for too many reasons to expound upon here.

Second, the “find vulnerabilities or it’s free” mentality can really back fire for everyone involved. It’s hard enough for developers and technical teams to take their lumps from a security test when holes emerge, but to now also tie that to price makes it doubly difficult for them to take. “Great, I pay now because Tommy made some silly mistake!” is just one possibility. How do you think management may handle that? What about Tommy? Believe me, there can be long term side effects for Tommy’s career, especially if he is also blamed for breaking the team’s budget in addition to causing them to fail an audit.

Thirdly, it actually encourages the security assessment team to make mountains out of mole hills. Since they are rewarded only when they find vulnerabilities and the customer expectations of value are automatically built on severity (it’s human nature), then it certainly (even if only unconsciously) behooves the security team to note even small issues as serious security holes. In our experience, this can drastically impact the perceived risk of identified security issues in both technicians and management and has even been known to cause knee-jerk reactions and unneeded panic when reports arrive that show things like simple information leakage as “critical vulnerabilities”. Clearly, if the vendor is not extremely careful and mindful of ethical behavior among their teams, you can get serious skewed views between perceived risk and real-world risk, again primarily motivated by the need to find issues to make the engagement profitable.

Lastly, I am the first to admit that such marketing approaches simply “bother me”. They lend a certain air of “used car dealer” salesmanship to the security industry. This is hardly something that, in my opinion, our industry needs. We are already working hard to overcome the idea that many vendors have glommed onto for decades – that fear sells products. This enough challenge for us for now, so the last thing we need is for our industry to be viewed as is another marketplace full of “gimmicks”.

In my opinion, let’s stick to plain old value. My organization helps you find and manage your risk. We help you focus on the specific technical vulnerabilities in networks, systems, applications and operations that attackers could exploit to cause you damage. To do this, my company employs security engineers. These deeply skilled experts earn a wage and thus cost money. Our services are based around the idea that the work we do has value. The damages that we prevent from occurring save your company money. Some of that money pays us for our services and thus, we pay our experts. Value. End of story.

No gimmicks, sales hype or catchy marketing will ever replace value or the truth. Between you and me, I think that’s a very good thing!

Bot-nets Continue to Grow in Scope and Danger

Posted on by
Reply

There is quite a bit of talk online right now about a new bot-net that is supposedly quite a bit larger than Storm. This new bot-net, called Kraken, was discovered and initially revealed by another security team. Various folks are pointing at it as another evolutionary step in the growth of the bot-net threat and as a major new development in the area of cyber-crime.

Bot-nets, it seems, are today’s Internet worms. Their power, capability to produce FUD and impact make them on par with the Slammer, Code Red and Nimda worms of the past as significant threat evolutions. However, just like the worms of yesterday, there are some pretty common – albeit sometimes tough – things you can do to help minimize your risk of exposure.

First, segregate your network. Create enclaves that separate and manage access to servers that hold critical or sensitive data. Basically, segregate any and all user systems into untrusted areas and manage them as if they were untrusted systems (they are!!!)

Next, deploy egress controls as tightly as possible for all user -> Internet activity. Apply egress controls as tightly as possible to all enclaves.

Now, ensure that you have proper preventative and monitoring controls on all of the enclaves. Check for unneeded services, missing patches (OS and applications), bad configurations and known security issues. Mitigate or repair as many as possible. Monitor everything at the egress point for forensics and help with finding infected hosts. Deploy HoneyPoint sensors in user community and all enclaves.

Harden the user systems to the largest extent possible. AV, personal firewalls, patches, consider hardening or changing browsers. No matter what, consider user systems as untrusted hosts!

Educate your users about threats, their responsibilities and security mechanisms for their systems when outside the corporate network.

Monitor, manage and handle incidents quickly and with public consequences. If you find an infected machine and can trace it back to porn downloads on a company machine, fire the person and make a public example of the fact that actions against security policy (you have one of those, right?) have consequences…

Doing these basics will increase your overall security and greatly reduce your risk from bot-nets (and other threats). Is it easy? No. Is it expensive? It can be, depending on your size, complexity and technology level. Is it worth doing? Yes. It reduces risk and is much more interesting than ignoring the problem and/or continually working reactively to various incidents and compromises.

The Application Layer is Where the Action Is…

Posted on by
Reply

I thought this particular “hacker” article was pretty interesting. Thanks to Dr. Anton Chuvakin’s “Security Warrior” blog for pointing it out.

Once you look beyond the manifesto hype, you can really get a feel for what it represents. It represents a call to action to remind security professionals that the game has changed. The network and systems that it is composed of remain but a part of the security equation. The real target of the attackers that represent the REAL THREAT is the data that the network and systems hold.

Attackers have definitely moved up the stack. They do not care that most organizations are still focused on the network layer and more than a few are still trying to get the basics of that right. In fact, it simply empowers them more.

Today, attackers are focused on the application. That is true whether you look at holes like SQL injection and XSS or at the browser vulnerabilities that are at the root of a majority of malware and bot-net activity today. Today’s attackers have excellent tools for exploit development that have seriously changed the security landscape. More attackers understand the deeper nuances of computer science than ever before. Man security teams and professionals are lagging behind in knowledge, resources and capability.

One of the big reinforcers of this ideal to me was a presentation I gave a few weeks ago about application security. During the research for it, I found that according to several sources, a HUGE amount – roughly a third – of all reported security incidents last year involved SQL injection and XSS. Almost 2/3s of all reported incidents were web-application focused. Clearly, there is no denying that the attackers have moved up the security stack – the question is – have the defenders…

What are you, your security team and your security partners doing today to ensure that your data is protected tomorrow?

Patent Wierdness and the Security Market

Posted on by
Reply

CrowdedMarket.jpeg

So I was doing some patent research today and I have to say that some of the patents out there for information security are pretty weird.

I found patent applications for wireless access points that turn on radio jammers in response to attacks (thus blocking even legitimate users), ethernet cables that can be colored with special markers depending on the security of the system they are attached to, a physical key-based device that controls an ethernet air-gap and even a patent application that was denied for patenting the word “security”.

I had no idea that so many things had been patented, or attempted to be patented. Maybe I am not a “patent insider” – but a lot this sounds like junk, bad infomercials and “seen on TV” security products.

I think I should find a VC and maybe patent the special “security gnomes” that some software vendors believe protect their software from well-known exploits. Or the “magic security dust” that some managers believe allows them keep their data protected without investing in any real security staff or initiatives. If those don’t work, maybe I will patent some sort of “cyber-ninja” that seeks out and destroys cross-site scripting vulnerabilities and SQL injections. Why not? It might be as effective a control as colored ethernet cables…

For a couple of years now, Allan and I have been talking about just how noisy the information security market has become. Even after a large consolidation phase, there are still a bunch of vendors, some selling solutions and some selling snake oil. The average IT manager is probably getting 10+ calls a day from vendors selling them everything from firewalls to NAC and from AV software to USB blockers. No wonder average security consumers are having so much trouble knowing the real from the hype!

I didn’t start this blog post to be a rant or anything, but the oddity of the patent searches really left me in awe. The security space is crowded, noisy and a lot like a downtown Delhi market. There are exotic spices, rarities and a number of arcane items everywhere you look. Hopefully, there are also some honest to goodness, back to basics solutions mixed in too. Your mission, should you accept it, is to sort them out…