Every week in our daily threat and intelligence briefings I read about government and business computer systems that are hacked. And many, many times the stated reason is that a user name and password was revealed, hacked or stolen and the cyber criminals were able to use it to log into the system. But I don’t think this is the real reason at all; the real reason is that we are not properly establishing the identity of whoever is trying to access the system.
I know how inconvenient computer security can be for everyone. I not only see it every day in my profession, I also suffer from it myself as an individual. And the last thing most of us want is to make the task even more inconvenient and frustrating. But the fact is that identifying one’s self to a computer system by simply inputting a user name and password is just not good enough. We must increase the reliability of identity verification systems if we are to have any real hope of preventing illicit access.
To establish the identity of any person there are only three factors that can be employed. You can identify a person by something that they know, by something that they have or by something that they are. Obviously, a user name and password is something that a person knows, and we waste all kinds of time and effort in the futile hope that we can keep this special knowledge secret. I say futile because, as we all know, secrets have a frustrating habit of not lasting very long.
Something we have can be a physical object such as an RSA token or smart card, or it can be a “soft token” such as a digital certificate. An example of using something you have and something you know in tandem is a debit card and PIN. Something we are can be a number of things: fingerprints, retinal patterns, DNA, body features, etc.
Every time you add another “factor” to your user identification scheme, you more than double the amount of real security you are adding to the access control system. That is why, despite the inconvenience, I am a big proponent of using all three types of identification factors at once, especially for privileged or high-risk access. As far as I’m concerned, it’s time to bite the bullet, live with the inconvenience and just get the job done!

Over the last seven years, the amount of fraud from stolen credit card data has doubled in the U.S. This has been the primary driver pushing American credit card companies and retailers into adopting the use of credit cards with computer chips in them. The problem with the old magnetic stripe credit cards we are so familiar with is that the data on the magnetic stripe is static – it never changes. Because of this, fraudsters have been able to simply copy the magnetic stripe data from your card to a blank one, and then use the new card to make purchases. The computer chips in Europay, MasterCard and Visa (EMV) cards, on the other hand, set up a one-time transaction code that is useless to intercept or copy. If a thief attempts to make another transaction using this information, the transaction will simply be denied.
These kinds of credit and debit cards have been used in Europe for decades, and have greatly reduced the amount of credit card fraud there. But the American versions of these cards are going to be different for some years to come. For one thing, EMV cards issued to Americans are still going to have the magnetic stripe on them until at least 2017. This is to give retailers a chance to install the necessary (and expensive) equipment needed to process EMV cards. Also, even though most retailers are supposed to have EMV card reader hardware in place as of October this year, gasoline retailers are not required to change their pump card readers until 2017.
Another difference is the use of a PIN with the cards. In Europe, they have found that requiring a 4 to 6 digit PIN number when cards are used greatly adds to the security of the transaction (just like inputting a PIN when you use your debit card here does). But most companies in America are just going to require a signature, and are not going to allow the use of PINs with these cards for a while. This is not only to spread out the cost of re-equipping for the merchant, but is also to allow American consumers to get used to the new cards. Eventually, America will probably be using the same setup they currently use in Europe, but until then, remember that your cards will still suffer from some of the same old vulnerabilities as always.

As a risk management guy, I’m often asked why I think information security programs fail or are less effective than they should be. There are certainly a number of answers to that question, but I think one of the main causes is lack of management participation in the program.
First, it should be recognized that these programs are driven from the top down. Upper management must demonstrate real interest in the infosec program to make it work. Right or wrong, people take all their main cues from upper management, and an apathetic CIO or CEO is a death knell for an infosec program.
Once you have achieved high level buy-in, it is very important to ensure that mid and operational level management are also properly involved in the program. Managers on these levels need to demonstrate their interest in the infosec program just as upper management does. However, beyond that, these individuals should also be involved in the program in a much more direct way.
It isn’t enough that information security policies and procedures have been established and communicated to all appropriate personnel. There also needs to be regular documented processes in place for management oversight of the information security program. Managers sometimes tend to become complacent about the information security program; they don’t really demonstrate interest in it and don’t seem to check up much. And if managers become complacent about infosec, you are safe to bet that the personnel in their purview will as well.

Real computer information security is highly dependent on the awareness and concern of individual computer device users. But people don’t view the security of their computers, pads and smart phones the same way they view the security of their cars, or houses or kids. On the whole, we are apathetic about the subject.
I have often tried to figure out why this is true, and I’ve heard several reasons such as: “Computers and technology are just too complicated and technical. I feel inadequate to the task.” Or “I have too many things to worry about already. I don’t need anything else to take a bite out of my quality time.” Or “So what if I get hacked!? The worst that can happen is that I’ll be embarrassed a bit or lose some of my money – I’ll still have my health, my family and my life!” Of all these mistaken ideas I think the last one is the most dangerous; not believing that anything really bad will happen to me and mine because of a hack.
For years my compatriots and I have discussed the idea that what will truly shock society awake is a hacking incident so severe that nobody can just ignore the subject anymore; a kind of cyber-Pearl Harbor. But none of us actually want to see “the big one” occur. We are hoping that smaller but still significant incidents will get the ball rolling.
The Ashley Madison hack is a small step in this direction that I hope people will embrace and learn from, because the consequences of this hack are a cut above what has been experienced by the everyday user in the past. Think of the marital unrest this has caused – think of the divorces, the tears, the kids that no longer feel safe and secure. Then there are the legal entanglements and lost jobs (both present and future) to consider. Awful!
But the biggest consequence of all is the loss of human life that has (and will in my opinion) come about because of this exposure. There have been a number of suicides already that are directly attributable to the Ashley Madison debacle, and I would be amazed if there weren’t some murders to accompany them as well. Is it worth human lives to be apathetic and unaware!? Let’s hope that folks decide it isn’t and take steps to protect themselves.

The number of people in the United States has been increasing heavily over time and we are currently the third most populace country on the planet. In the last century, the population has more than tripled here, and it is estimated that we will add more than 100,000,000 to the current total by 2050. One of the things that help us cope with such huge numbers is taking advantage of economies of scale.
For example, we build truly giant ships to carry our oil and cargo because the bigger the ship is the more hydrodynamic advantage there is and the less cost there is per ton for transportation. Similarly, we build enormous power plants and network them into grids because it is more efficient and cheaper per kilowatt hour to do so. There are many more examples of this trend all across American commerce. While this practice indeed does work and enables us in many ways, it comes with a variety of costs; one of which is increased risk.
We stand to lose a lot of oil and cause major environmental catastrophes if someone starts sinking major super tankers, for example. And if an enemy starts destroying our large power plants (or critical nodes in the infrastructure connecting them), the impact could be very much worse than that.
I mention all of this, because now we are seeing the trend toward economies of scale coming into the information processing world, mainly in the form of cloud computing. This trend is inevitable because it truly is more efficient, cheaper and improves peoples’ lives in many ways. But it must be realized that this centralization of data processing and storage brings with it the same increase in impact if a major compromise occurs – and the greater the impact, the greater the risk.
What this means in the information security world is that we need to have more security assurance built into these large cloud systems. It should be stated like a natural law: the bigger the system, the more effective the security controls need to be. So before you put all of your valuables into the cloud, keep the risks inherent in economies of scale in mind and vet your cloud provider’s security measures. Make sure that they have all the technical, operational, physical and management controls in place. Ensure that their information security program is transparent and reactive to realistic criticism. And ensure that your own organization realizes the risks inherent in the cloud and plans accordingly as well. Remember, it is your own organization that is ultimately responsible for the security of their data no matter where it is stored or processed.

A distributed denial of service attack is a malicious attempt to make machines, applications or other network services unavailable to legitimate users. There are many types of DDoS attacks including SYN and UDP floods, reflected attacks, application attacks and multi-vector attacks that employ several types of attacks in combination. In the past, it was typical for businesses to accept the risk of DDoS attacks since they were relatively rare and small scale. But that has all changed in recent years; both the number and scale of DDoS attacks have increased dramatically. Because of this trend many savvy businesses have changed their philosophies and taken steps to mitigate DDoS attacks. Unfortunately, this trend is far from universal. Many businesses remain complacent and have done little or nothing to prepare for DDoS attacks. Is your business one of these and if so, what should you do about it?

The first step I recommend taking is to perform a basic risk and impact study on the subject: how likely is it that my business will be attacked, and if it is, how badly will it hurt us? If the answer to either of these questions is unacceptable, then you should certainly move on to step two and start the process of incorporating DDoS into the incident response plan. In a nutshell – develop the policy language, include likely DDoS attack indicators and attack scenarios in the plan, develop specific strategies to counter these attacks, assign responsibilities to specific individuals and practice the plan. Sounds easy, but how do we go about doing that you may ask. Here are some basic tips:

• Contact your ISP. Get their advice, find out about their experience and capabilities with DDoS attacks, find out about any anti-DDoS tools they might have available and their cost, etc. If you don’t do anything else, at least take this step. You probably won’t be able to do much at all to counter a DDoS attack without your ISP’s help.

• Ensure that your team is fully aware of all the capabilities your present equipment and infrastructure has for handling DDoS attacks.

• Ensure that your IR and IT teams are aware that DDoS attacks are sometimes persistent and can last for days, weeks or more. Make plans for keeping your reactions strong and timely.

• Employ centralized logging and ensure that proper monitoring procedures are in place and reviewed.

• Make sure you maintain a whitelist of source IPs and protocols, major customers, critical service providers and partners that must be allowed access during attacks.

• If you are at high risk and impact levels for DDoS attacks, consider improving your infrastructure and/or employing specialized DDoS services or products. Cloud based servers, for example, have great capabilities for fighting DDoS.

• Ensure that applications, networks and operating systems that may be targeted in DDoS attacks are fully hardened.

Here’s hoping that no one out there targets your business with a major DDoS campaign. But if you think the possibility is high, better take a tip from the Boy Scouts and be prepared!

The news just came out that the OPM data breach was even more serious than was first announced. The toll has risen from 4.2 million to the present total of 22.1 million people – nearly seven percent of the US population. They are now saying that nearly 2 million of these aren’t even people who have applied for security clearances themselves, but are spouses and other people close to applicants. What a wealth of information for cyber-criminals!

One of the things that make this such a bad hack is the kinds of information that may have been revealed. Background checks, depending on the level of clearance that is being applied for, can delve into an individual’s past quite extensively. Information such as all your past addresses, who you associated with, who your teachers were, the periodicals you read, your medical history, your arrest records, the organizations you associate with, etc., etc. Just the sort of juicy information that Spear Phishers dream of! But worse than that, this is the sort of information that can be used to blackmail people.

Blackmailing is probably the most dastardly type of social engineering there is. Here you are; nice family, good job, couple of kids, respected in the community – life is sweet! Then all of a sudden, someone contacts you and threatens to release some scurrilous information to the public if you don’t do as they say. Maybe you were arrested for something embarrassing such as being caught as a Peeping Tom. Maybe it lists a past relationship that you were not candid about with your spouse. Maybe it’s an embarrassing medical condition such a venereal disease. Or maybe it’s some really bad dirt concerning your spouse or another family member. Whatever it may be, suddenly you are faced with the choice of cooperating with criminals and breaking the law or abject ignominy – what would you do?

It’s amazing how many people will actually cooperate with their blackmailers and do their bidding. Even if it means jail time! Either alternative seems so bad to the blackmailed that they just can’t face either. So they go along in the desperate hope that nobody will find out and the whole mess will just go away. Good luck!

The way to deal with this problem, in my opinion, is to give them a third choice. Agencies and organizations should set up programs that offer forgiveness and help for these individuals if they come forward. Make sure that your personnel are aware of the possibility of blackmail, explain the forgiveness program to them, and make them understand that no matter what, they are better off reporting the incident than submitting to intimidation.

If you want to be in direct command of a U.S. aircraft carrier you must be a pilot or navigator. There is a very good reason for this. Despite the fact that there are thousands of personnel on these ships, many with very responsible jobs indeed, what really counts are the aircraft and the pilots that man them – and the Navy knows it. They also know that if they want the mission to be carried out successfully they need an individual in charge with all the right knowledge and perspective to support these most valuable assets. Not a captain that made his rank by being a wiz at logistics!
Some of this same wisdom should be applied to leaders of government agencies and businesses that store and process private information. Do we really want people running our organizations who are not well versed in computers and information security? After all, these machines are not only vital components of our business practices; they hold the keys to the kingdom as well!
Take the recent Office of Personnel Management (OPM) debacle as an example. This agency had been warned repeatedly about the lack of security in their systems, but little or nothing was done about it. Result: four million personnel files compromised. That’s one out of every 80 people in the country! And the reason for this failure seems to be simple ignorance and inexperience on the part of staff.
One lesson that has become brutally apparent from my risk assessment experience is that if upper-level management isn’t behind the effort, the risk assessment is doomed to fail. I’m sure this is true of general information security programs as well; if upper-level management isn’t knowledgeable and interested then the information security program is doomed to fail – and the bigger and more entrenched the bureaucracy the more this is true.
Now, I’m not saying that I think all CEOs should be recruited from the ranks of IT security. What do most of us know about running a big organization? What I am saying is that I think a certain level of expertise in matters computer and security should be a requirement of any job that oversees the processing and storage of our private information. Especially since computer systems are going to become increasingly vital parts of our everyday lives as time goes on.

Have you ever heard of the list of most needed inventions?

These are the sorts of inventions that, if realized, would overcome technological hurdles that are preventing mankind from reaching our most cherished dreams. Room temperature super conductors, advanced nanotechnology and practical fusion power are just a few. There are a number of inventions like this that are needed to make information security a reliable, efficient and low cost process. And chief among them is the Holy Grail of information security: an un-spoofable identity authentication mechanism.

Just think of it! A way for people and machines to know with a certainty that it is you and only you that they are communicating with. No more worries that someone will steal your identity and empty your bank accounts. No problems with cyber criminals impersonating IT personnel and stealing information or crashing systems. Think of the money and time you could save on complex intrusion detection and prevention systems and complicated processes. It is fun to contemplate. But, unfortunately, it is all just wishful thinking. Despite years of concentrated thought and effort, nobody has a clue how to make it work!

There are just three ways known to authenticate identity:

• Using something you know
• Using something you have or
• Using something you are

When talking about authenticating yourself to a computer system, something you know is typically a user name, a password or an encryption key. I think all of us know that despite all efforts to keep these mechanisms secret and secure, it doesn’t prevent intruders from getting them. The problem is that people have to know them, they need to store them and they need to use them, and that makes them vulnerable. So something you know isn’t the answer.

Let’s go to the second mechanism: something you have. In the computer world this is usually a smart card, token or the like. Combined with a user name and password, this mechanism provides another layer of security that can be very effective. But it is far from perfect. Smart cards and tokens can be stolen or misplaced. Perhaps a certificate authority or token provider’s servers are compromised. Some mechanisms can be reverse engineered. So, the upshot is, you can add something you have, to something you know and get better, albeit far from perfect, identity authentication. But the cost you pay in dollars and personnel hours has just gone way up.

So let’s go to the final possible authentication mechanism: something you are. For computer systems this is presently typically finger prints or retinal scans, although other possible mechanisms include facial recognition, voice recognition, heuristics (behavior matching) and DNA matching. This mechanism, once again, provides added security to the identity authentication process, but still is not perfect. For one thing, this kind of authentication mechanism works best in person. If a fingerprint, for example, is transmitted it really travels as a series of electromagnetic signals and these can be spoofed. But even in person, this type of mechanism can possibly be spoofed. So adding something you are to something you have and something you know once again makes it much more difficult to spoof identity, but still doesn’t render it impossible. And imagine the added burden in money and inconvenience using all three mechanisms would mean to your organization! Seems like way too much just to protect some financial data or health information, huh?

So, please, let’s all of us spend some thought trying to find the perfect identity authentication mechanism. It may be like trying to come up with perpetual motion, but if you do manage it, I guarantee you the rewards will keep you and yours in clover for the rest of your lives!