Headlines from the Computer Security Blogosphere

We’re joined today by Glenn Fleishman to talk about our own recent past and the recent cracks in the WPA armor.  Rich recently got to visit Russia to participate in a talk on Data Leak Prevention, while Martin got his own sit down with DHS Secretary Michael Chertoff.  Glenn had a little excitement of his own, with a detailed article on the recently revealed vulnerabilities in WPA using TKIP.  It’s a small vulnerabilty, but both Rich and Glenn suspect it’s just a precursor to bigger, badder things to come. And somewhere in there, a three year anniversary for the podcast slipped by.

Network Security Podcast, Episode 128, November 18, 2008

Show Notes:

• Battered but not broken:  understanding the WPA crack 
• Practical attacks against WEP and WPA 

No time for any music or fancy stuff like that. 

Paul & Larry discuss security, hash, rubber chickens, religion, politics, and American history (Yes, I'm convinced no one reads what I type here ;)

• Sponsored by Core Security, listen for the new customer discount code at the end of the show
• Sponsored by Astaro, download a free trial of the Astaro Security gateway today!
• Sponsored by Tenable Network Security, creators of Nessus and makers of the Tenable Security Center, software that extends the power of Nessus through sophisticated reporting, remediation workflow, IDS event correlation and much more.
• Want to register for any SANS conference? Please visit http://www.pauldotcom.com/sans/ for our referral program
• Be sure to check out "Maltego" from Paterva, try the community edition for free!
• Don't forget to sign up for our Mailing List, Forums, and log into our IRC Channel!
• Full Show Notes

Hosts: Larry "HaxorTheMatrix" Pesce, Paul "PaulDotCom" Asadoorian

• TaoSecurity: Security Event Correlation: Looking Back, Part 3
• CA to Acquire Eurekify - Yahoo! Finance

How effective is antivirus software if the computer doesn’t have the latest patch updates?

Secunia tested 12 Internet security suites (PDF report) and found them all wanting. Symantec came in first, but it only detected 64 out of 300 exploits.

This suggests that McAfee, Norton, Windows OneCare, ZoneAlarm, AVG, CA, F-Secure, TrendMicro, BitDefender, Panda, Kaspersky, and Norman may be ignoring a key strategy to improve their products; products that claim to do so much for the consumer.

If these products detected vulnerabilities and installed patches maybe they would protect customers better. Secunia recommends the features offered by Kaspersky Internet Security 2009 to identify programs that need patching. Interesting thing is Kaspersky did poorly in this test.

One security suite I would like to see tested against this list is eEye’s Blink. Unlike most other products, it was designed with vulnerability scanning and patching in mind.

Hope you all had a great weekend.  I had meant to point you earlier to a FAIR analysis that Chris Hayes did over at his Blog.  But I’ve been a little busy, and before I could mention it, Stuart King put up a kind of angry response on his ComputerWorld blog.  Snark aside, there are a couple of other really troubling aspects of Stuart’s reaction to Chris’ analysis that I thought we could talk about this morning.

The problem is that (Chris’ analysis is) completely impractical. I’ll take a recent, and fairly typical situation as an example. I was taking issue with the manner in which remote access was being provisioned for a third party vendor to connect to a system hosted by one of our European business units. To cut a long story short, it was not only a breach of policy but highly insecure. I wanted the access to be disconnected, the business unit director wanted my risk assessment. And he didn’t want to wait for it.

To quote Chris Hayes, spending time on working out the expected effectiveness of controls, over a given timeframe, as measured against a baseline level of force was not going to pacify an angry Italian fearful that my decision was going to cost him money. He wanted my explanation of the risk and more importantly, what I was going to offer as a solution to keep his business functioning

As Chris is someone who actually does this for a living in a large company, and this is typical of his actual day job, I really find Stuart’s “impractical” comment to be, um, misinformed.

Also, I think Stuart mistakes the purpose of a risk analysis.  The purpose of the risk analysis is not to force someone to be “secure”, but to provide knowledge for decision making.  Using it as a “hammer” to knock in the nail of your personal risk tolerance impairs efficiency and in the long run retards “security” as it creates political resentment.  Seriously, who cares if something might violate policy or not in a pre-implementation discussion?  Policies are not stone tablets handed down from on high, they are state-in-time codification of the data owners risk tolerance.  This risk tolerance changes sometimes, and that’s OK.

To that extent, I appreciate (and I’m sure Chris does, as well) that risk analysis does not create rationality in the data owner.  Someone who sees you as a speedbump on the route to progress they may not be ready to appreciate your point of view even if it is stated in the most rational manner possible.   But it’s worth noting (and Stuart’s example is indicative of this point) that risk analysis does not create rationality in the analyst, either.  If one is being so “security minded” as to ignore the risk tolerance of the business owner - we’re bound to get a reaction similar to that Stuart encountered.  In fact, a practical risk analysis like Chris performed on his blog, done in 30 minutes, should identify the critical point of disagreement between Stuart and the data owner (again, Stuart doesn’t own the data, the agitated Italian does).

But let’s stay rational and open to alternatives to what Chris offers.  Stuart states his approach to risk analysis as:

When I need to document a risk assessment I use a very simple form: list the threats, state the level of vulnerability, list the associated operational costs and potential revenue hits. High, medium, or low risk? Describe the controls and options. Write up who needs to do what, and how much of their time it’s going to take. Job done.

At first glance, I don’t think what Chris has done is any less efficient, and it provides greater insight (using Frequency and Capability instead of just ‘listing the threats’).  But what is key here is that Chris’ approach is consistent and defensible.  Less generous risk geeks and CSO’s I know would have no little difficulty with Stuart’s approach.  But to particularly answer Stuart’s main objection (impracticality) I would offer that with practice, Chris’ work is probably quicker and easier than Stuart’s described process as it eliminates much of the ambiguity an immature risk analysis creates - reducing the need for further discussion and arguments with data owners (regardless of disposition or nationality).

Finally the irony of Stuart’s post is that the reason he had this confrontation may in fact be because he was incapable of bringing a salient model for risk to the table, one that identified the factors that create risk and developed a defensible belief statement concerning risk.   We’ll never know if one would have helped him in this isolated instance, but I can tell you that in organizations like Chris’, good risk models and strong risk anlayses create operational efficiencies, reduce costs, and streamlines intra-departmental communications.

I spent the last day helping my friends Jason and April get hitched.  I think there’s some work to be done on it, but you can see some of the video on their site.