Human Behavior = Biggest Security Risk

Two quick examples (both considered 'spear phishing' or targeted phishing attacks) from today's headlines:

1. The perpetrators of the RSA data breach which may have compromised the security of RSA's premium two-factor authentication solution, as it turns out, got help from RSA employees when they opened an email attachment. An Excel spreadsheet containing an Adobe Flash exploit opened the doors to RSA's network.

2. Conde Nast recently paid $8 Million to a fake company in response to a single believeable email that asked them politely to update their payee information on one of their vendors.

Both of these examples make the clear, simple point that it doesn't really matter how much technology you put between an attacker and your business assets. If an employee opens the door, they can walk right in. We're either going to get extreme in terms of limiting behavioral options (disallow all email attachments?) or we need to do much better in employee training.

Since employees are ultimately only motivated by what is easier, I don't think training will be the silver-bullet answer.

The RSA Breach

[Updated 5:36 pm ET 23 Mar 2011]

Sorry - two points of clarification:

1. Where I say "serial #" throughout my post below, we should keep in mind that the token has a hidden 'seed record' which is actually used in the algorithm, so that's another level of security. The serial # is not enough - you also need the seed # and the ability to match it to a given user's token.

2. I should've mentioned that there's also a feature which prevents brute-force attacks by disabling an account after x number of failed attempts, so if you have a very good educated guess on the PIN, along with the other data, you have a good shot. If you think you'll brute-force it, that isn't going to fly.

[end update]


I don't have any inside info, but it certainly sounds like the algorithm for generating the One-Time-Passwords (OTP) may have been accessed. This makes an attack much easier because to some degree it eliminates the "second factor" in the Two-Factor authentication. But not 100%.

If I know the algorithm, to spoof the token functionality, I still need the serial # of the token, matched to the user name, and the PIN. These things aren't impossible, though. You could stop by a person's desk, for example, and scribble down their serial # while they're getting coffee. If they're a co-worker, you probably know their user name and can make some guesses about the PIN.

Most people I know that use RSA tokens use a pretty simple PIN - a date, 4 digits of a phone number, something like that. So, if you use social engineering to get the serial # and user name, your down to having to guess the PIN, which is really a shorter, less secure password. And you're back to one-factor authentication. PINs may also be written down on the desk, scribbled on the back of the token (I've seen it), left in email or browser auto-fill, etc.

For an outsider to use this attack, it's a little more challenging than an insider. You'd need access to the serial numbers used by the company and the ability to match them with user names. Based on the info provided by RSA in their letter to customers, some or all of this may be in the RSA server logs. So, protecting those logs has just become critical.

If the token is installed on a smart phone or PC (software token), the token only works from that installed device. So, if the algorithm is public, the software tokens may have just become slightly more secure than the hardware tokens since it would be difficult to spoof the hardware configuration (or even to know the exact hardware) associated to that software token. ...at least, that's how I think it works.

So, a few shifts have been made if my assumptions are true:
- Software tokens may be more secure if the algorithm is known.
- Protecting the RSA server and logs, and access to those logs has become critical.
- Overall, the system is still somewhat secure, but people don't buy RSA tokens for 'somewhat secure'.
- RSA tokens have become pretty insecure against insider attacks.

If anyone knows something different, please correct me.

The End of Internet Security

Remember all that stuff I said about how we already have an end-to-end security solution that ensures that users are connected to the right web site and that there's no eavesdropping going on? Well, you can scratch all that.

I knew there was a User Experience problem with SSL in that most people ignore that it's happening and therefore don't notice when it's not happening. I also knew that there are known potential attacks on SSL, but it seems there's a newly discussed renegotiation problem that makes the whole system seem suspect. This posting from RSA does a good job at providing an explanation.

This is a big deal. SSL really IS web security. So many other security solutions rely upon it -- assuming that communication is safe and secure because it's done over SSL. Even if all the major vendors get a fix out tomorrow, we'll probably see this problem around for years to come.

Cloud-Based Strong Authentication

Yesterday, RSA and Verisign announced a partnership on cloud-based secure authentication for the consumer market. Pretty interesting stuff. The management of these organizations should be commended for looking past their competitive rivalry to identify a new business opportunity.

The solution isn't new. Verisign has been offering its VeriSign Identity Protection (VIP) authentication services for quite some time. I've had a token that I use with my PayPal account (and my OpenID) for the past couple of years (made in China by ActiveIdentity). But adoption of the offering has been less than overwhelming.

We could probably all count on one hand the number of people we know with a non-work-based authentication token. And most of those are likely tokens handed out by banks and other financial companies that are tied to a single account. The VIP solution gives you a token to use across multiple sites. And there are a few other perks as well.

I don't know what they charge to add this strong authentication to your site. But, I expect that it's more competitive than implementing your own solution. And the end-users benefit from a single token that can be used across systems.

RSA hasn't been wildly successful in getting tokens into the hands of consumers. So, partnering with Verisign seems like a good move - leverage an existing solution to sell more product. And Verisign customers benefit from more choice. RSA has a lot of token options and some are impressive. Their manufacturing is done at their headquarters in MA and the quality assurance process is top rate (I've been through the tour).

In addition to overall quality, some provide additional convenience as well such as a token with an integrated smart chip (for access to encrypted laptops and digital signing) or the software tokens for BlackBerry, iPhone, Win Mobile, etc. that don't require an additional piece of hardware. I should note that the release only mentions hardware tokens, but in the consumer market, it would be a bad move to restrict usage to hardware only.

Crows Using Vending Machines and the Security Implications

As reported in the NY Times, researcher Josh Klein actually taught crows to buy their own food from vending machines. If you have 10 minutes, the TED presentation is definitely worth watching. Crows are way more intelligent than you would think.

And we think we can stop them with an inanimate pile of clothes stuffed with hay!


Of course, there's a lesson to be learned for information security practicioners. Your company's employees and system adminstrators will learn and adapt. They can see the scarecrow that you've put in place to ensure security. And they figure out how work around it.

Security company RSA in their Oct. 2008 survey reported that:

53% [of employees] have felt the need to work around IT security policies in order to get their work done.

Those are well-meaning employees just trying to do their best for the company.

A recent NetworkWorld article titled Inside a data leak audit provides a real-world example. It describes an organization that was seemingly doing everything right with regard to information security. But, a thorough audit revealed 11,000 potential leaks in two weeks. All the scarecrows you could imagine were hanging on posts all across the organization. They weren't enough.

Preventative security doesn't always get the job done. Many organizations would benefit from real-time audit and monitoring solutions. In addition to after-the-fact forensic and audit trail benefits, active monitoring can be a powerful deterrent and even enable real-time remediation.

Verisign's File Vault

Today, I configured my File Vault at Verisign's Personal Identity Portal.

Secure

If you read this blog, you probably know that nothing is 100% safe. And you probably distrust this type of offering. But, Verisign knows encryption as well as anyone. Verisign spun off from RSA (then RSA Data Security) in 1995 with some of RSA's public- and private-key cryptography technologies. They're really good at authentication and encryption which are exactly the two specialties I expect from an online storage vendor.

Convenient

They're giving you 2GB of storage space free - it requires Two-Factor authentication to get in and encrypts data on the back end. And it's an easy-to-use UI with no software install. It's probably a better option than backing up my docs on a USB key (subject to damage and loss) or using some other non-security-focused vendor.

Smart Business

I also like the business model. We all wonder how OpenID providers will make a profit. Verisign seems to be ahead of the pack in providing value-add to users. You get more than just an OpenID credential. You get strong authentication, secure storage, and a personal identity page (probably the least interesting, but still somewhat fun and on the right track).

So, they can sell 100 million tokens to customers who get real value above and beyond reducing the number of credentials they need to remember. And of course, Verisign can license this technology to banks, governments, or anyone else who wants to resell online safety deposit boxes along with secure two-factor authentication solutions under their own brand. Paypal already re-brands the token to protect their customer accounts.

I could easily imagine brick and mortar banks handing out tokens with every new on-line bill pay account and/or offering a virtual safety deposit box to every physical box customer. It's value for the customer and a business model that makes sense. I'd even pay for a new token every few years just to maintain a secure place to archive my important files.

I knew there was a reason I never setup that Amazon S3/JungleDisk account.

More Insider Threat Data

RSA recently released their latest data on Insider security.

Some interesting results:

53% of respondents feel they NEED to work around security policies to get their jobs done.

37% of respondents have stumbled into areas of the network to which they SHOULDN'T have access.

50% of U.S. respondents switched roles and still had access to UNNECESSARY accounts/resources.

And that's with most respondents understanding security policies and having been given training about the importance of following security practices.

The last time I wrote about an RSA survey pointing out that employees feel they NEED to work around security controls to get their jobs done, the number was at 35%. So, it's either gotten worse or it varies from crowd to crowd (likely the latter).

Get the full survey report here

The SecurID Killer

I'm a fan of RSA's SecurID product. It's got a highly secure approach, nearly indestructible hardware form factor, lots of form factor options, tons of partners and coverage for apps, servers and devices, and a flawless track record. But the competition has been creeping up.

Some try a similar approach to RSA with key fobs displaying numbers or other hardware tokens:

ActivIdentity
Aladdin Knowledge Systems
EnTrust
CryptoCard
MyPW
SecureComputing
Vasco

Others have a software only approach:

AdmitOne (formerly BioPassword) - uses keystroke dynamics
Arcot - uses PKI
PassFaces - uses user's ability to remember human faces
PhoneFactor - uses mobile phone as the device

Some are biometric:

DigitalPersona
L-1

And they all have redeeming qualities. But many are susceptible to keystroke logger attacks (which are getting more and more sophisticated). Others are cheaply made hardware. Some just lack partnerships and market penetration.

But there's a new kid on the block. And it seems to be a very cool solution that may quickly become a force to be reckoned with. It's a very small form factor, seemingly very secure, extremely easy to use, requires no client software, inexpensive, and works on any platform.

Welcome YubiKey to the arena.

I'll let you figure out the details for yourself.

It won't allow you to converge a single credential for physical and logical access and it won't work across multiple systems (unless it's used with OpenID or something like that) and it won't serve as a single form factor for multiple uses (like signed email and remote VPN). But, it's a pretty cool new entrant to this arena. And that's a feat in itself.

Let me know if I missed your company and you'd like to be added to the list.

Overheard at the RSA Conference

A few more of my favorite paraphrased quotes from RSA and then I'll try to stop blogging about what I did last week...

In the Cryptographer's panel, Whitfield Diffie, Vice President and Fellow Chief Security Officer, Sun Microsystems, said that within 10 years he believes that technology will create the genetic offspring of two women thereby rendering men a clumsy and inefficient means of reproduction. I think he then said that due to genetic engineering, it won't be humans having this discussion in another 10 years. I look forward to reviewing the video to see if I heard all of that correct. He got some good laughs, but I think he was serious.

The BT/CNBC Risk Resilience webcast was one of the more entertaining sessions for me. Michelle Dennedy, Chief Privacy Officer for Sun Microsystems, said that Sun employees' avatars in the game Second Life must adhere to a Sun-approved dress code. I believe she said that Sun wasn't trying to interfere with how employees play games on off-hours while at home, but I can't imagine Sun has a policy that encourages playing games at work? As a CPO, she has a tough job, but I thought Dennedy did a good job at being a likable bad cop to Schneir's good cop.

In the same session, Bruce Schneir said that we're currently experiencing the biggest generation gap since Rock n Roll. He reminded me of a quote that I heard attributed to Doc Searls – email is how old people communicate. Schneir explained that young people are growing up with their lives exposed on YouTube, MySpace and Facebook. They're in constant communication via SMS and Twitter. They won't be wounded by privacy breaches the way "old people" are afraid. He reminded us what the old people said about Rock n Roll. It will lead to drugs, sex, wildness and the end of marriage. And yeah, they pretty much got it right. But we survived and went on. He believes that our privacy issues will not be privacy issues for the next generation. He summed it up by saying that in every generation gap, the younger generation wins because the older generation dies. Entertaining and poignant. Thanks Bruce.

In Thomas Kurian's keynote, he talked about protecting data across the network even from the DBA. He joked that DBAs should be the highest paid people in the world since they have direct access to change salary information in the database. Technologies exist to prevent that access while allowing the DBAs to continue doing their job. He described the need for transparent encryption so that applications won't need to be re-written. He then talked about the absolute need for strong identity management solutions and emphasized the fact that a comprehensive identity solution must include an audit of identity transactions. (ding ding) I almost stood up and said "yes" but luckily I stayed quietly in my seat. That hit home for me because it's what we do at NetVision and as I walked the expo floor and spoke with Identity solution vendors, nobody could audit transactions outside of what their own system does. I was glad to hear it emphasized on the big stage.

Last one - in the track on Consolidating Logical and Physical Access Control, John Thielens and Michael Hejtmanek explained that part of the friction holding back convergence has been that the physical security vendors haven't been traditionally trained in enterprise IT architecture. More often, they resemble cable installers who may not know how to join a workstation to a domain. The big take-away for me from that session is that there is hope. PAC and LAC are coming together. Training is happening and vendors on both sides recognize the urgency. So, what I saw a year or two ago (which was discouraging) sounds like it's getting closer to reality for widespread adoption. I don't know how companies are dealing with the fact that they're in shared or leased buildings, but at least progress is being made.

OK, I think that gets all the highlights out of my head.


UPDATE: Apparently, that quote wasn't from Doc Searls. Sorry Yogi. um, Doc. Unfortunately, I'm fairly confident it was someone on stage that passed the quote as yours - can't recall who though.

IT Security Risk = Lost Business Opps

In Art Coviello's key note last week, he reported that 80% of executives surveyed have avoided real opportunities for business advancement because of IT security risk.

It was probably the most powerful statement I heard all week. It means that enterprise IT security is falling short in a critical way.

When I present on the business drivers of a security solution, I always include three areas: risk reduction, enhanced ability to respond to audits, and creation of business opportunities. The first two generally resonate pretty well but the last one usually gets blank stares and I call myself an optimist and move on. So, I'm glad Mr. Coviello brought this into the spotlight. And honestly, I didn't know if I was right. But RSA has now collected the hard data to confirm that businesses are actually losing opportunities because they don't have a handle on IT risk. Art went on to say that security not only needs to be a business enabler, but should be transparent to the business, and should act as an accelerator of innovation. It was probably my favorite key note of the week (that honor might have gone to Malcom Gladwell, but having read the book I already knew the punchline to his stories).

I got into an elevator with Art two days later and took the opportunity to tell him that I liked his address. He seemed to have other things on his mind so it wasn't much of a conversation. I might have also told Art that I liked John Thompson's key note as well. And it would've been relevant because in my opinion, Thompson just reiterated the same message that Coviello's RSA has been articulating since I worked there more than a year ago. I agreed with most of what Thompson said and considered it a testament to the leadership of RSA. (and no - I don't own stock and I'm not waiting on any final pay checks - just giving credit where due)

Securing borderless networks

Here's a nice blog entry on 10 ways to secure borderless networks. It could have been written by EMC/RSA as it covers many of the capabilities they've been talking about for the past year (and for which they have pretty nice solutions).

The reason I mention this article is to re-raise the point that security needs to be handled from numerous directions and in numerous ways. There's no single security solution that will prevent against every type of attack or breach. People are mobile and our information is mobile. A good security strategy needs to cover many fronts - from remote user authentication to data encryption.

One note to the author: MIIS/ILM is not a federation solution. And while I'm on that subject, I wouldn't have even included Federation as a solution to make systems more secure. Although the argument can be made that it provides greater control over user accounts by the identity provider, it's primarily a solution that enables ease-of-use in a secure way rather than a solution for increased security.

And since there's an empty spot on the list, we could replace it with real-time user behavior monitoring as another good way to enhance security in a borderless environment.

Own the Burden

Chris Parkerson of RSA raises an excellent point about the expectations that organizations put on employees regarding data protection. He asks "Is it really possible to expect employees to be educated enough about such policies to always do the right thing?" And he goes on to make the point that "well intentioned employees in many cases are under pressure to complete projects in record time and with minimum resources. The consequence of this dynamic is employees will prioritize getting a critical project completed above adhering to company security policies."

I think he's right. It's not an issue of having bad-guy employees. It's that productive employees have too much going on to be constantly thinking about security policies. Some employees may even think that policies are important for audits, but don't really need to be followed day-to-day. Ask your co-workers and friends and I'd bet you'll find a few people who think along those lines. If you've ever worked on a software integration project, I bet at some point you encountered a permissions error and elected to just give the user admin rights to get things working. Of course you eventually went back and revoked those rights, right?

So what can an organization do to protect themselves short of mass employee hypnosis? Own the burden. Put the right security controls in place and continue to balance employee education with effective IT controls. And, of course, run regular audits and real-time monitoring on those controls. Create a culture of compliance. Automate the process of security and most employees won't fight it. They'll probably like it better if they don't have the option to subvert security because there will be no pressure to do so by coworkers or deadlines.

The End of IdM

I've been telling people over the last 2-3 years that in 5-6 years (circa 2010), there will no longer be stand-alone identity management companies. IdM will be rolled into the platforms. We've seen this Nostradamus-like prediction coming true as Oracle has moved in that direction for a few years now - Peoplesoft, Oblix, Thor, OctetString. And Sun too, of course. Microsoft has integrated many security features (anti-malware, firewall, encryption, etc.) into Windows. And now, I'm hearing more people saying the same. Especially at EMC. Art Coviello made this point clearly at the RSA conference. It's one of the reasons I joined RSA as they were becoming part of EMC. The future is wildly uncertain for smaller independent security providers. EMC really gets it. The focus is on information-centric security. The systems that control your information need built-in security -- not bolt-on security. Bill Gates' RSA address had much of the same focus.

Gates urged companies to think beyond traditional "glass-house" and perimeter-centric security strategies focused largely on keeping intruders and malicious activity out of corporate networks. What is needed, he said, is a "far more powerful paradigm" that uses security as a way to secure information access, not as an impediment to access.

"People want more access" to information, and they want that access at any time, from wherever they happen to be, and via whatever device they happen to have, Gates said. "Traditional network perimeters are fading away," mandating new approaches to security, he added.

This year and 2008 may be the last years for the independents. So, it's time to nail down the technology and get it into your favorite platform - the end is near and the paradigm is shifting.

Phishing Special Report

Another interesting paper from RSA’S Anti-Fraud Command Center (AFCC)...
Phishing Special Report: What we can expect for 2007

Phishing attacks are more numerous, more varied and more creative than ever. And this on the heals of a NY Times report about a study by a few MIT and Harvard researchers that suggests that site-to-user authentication (generally believed to be a good anti-phishing solution) is ineffective for many users. The full report is available here.

I enjoyed Don Park's comment on the subject:

While I have little doubts about their integrity, I do wonder if the study is not flawed. For example, doesn't using people who willingly let others observe them signing into their bank account for such a study skew the result? It's probably not as bad as counting virgins among prostitutes but I would like to hear more about how they accounted for such problems.

The report does note that participants may have had reason to behave less securely than they would in the real world. But I'm not completely surprised at the report's findings -- the report isn't really saying anything about technology -- it's talking about people.

An interesting premise was made by the researchers:

In real life, security is rarely a user’s primary goal.

Based on the context of that statement, I believe what they're really saying here (in an understated way) is that security is often the furthest thing on a typical user's mind -- the site-to-user authentication (and other security technologies) failed because the user's weren't even trying to look for them. So, even if the technology is effective, it's vitally important to educate end users about how the technology works and what's at stake.

Things are clearly going to get worse before they get better. Since there's no silver bullet that can put an end to all phishing attacks, we can only attempt to provide the right tools and educate people as much as possible.

Don't run with scissors... Look both ways... Wear a helmet... and always verify your financial institution prior to providing credentials. OK - I need help with the wording, but the point is that we need to get more mainstream about on-line security education.

Vantage from RSA

The latest edition of Vantage Magazine is available and there's a nice write-up on my old group at Unisys. It's nice to see them in print again - there are some wicked smart folks over there.

There's also some good information on EMC's vision for Information-Centric Security. After all the billions spent on security in recent years ($40B in 2006), less than 20% of companies believe that their information is secure. Firewalls are not enough. This issue provides some insight into how EMC will help solve the problem.

Also - look for the article on Vouching from RSA Labs. I haven't seen this idea anywhere else and it's a nice idea for helping people with lost or forgotten tokens -- without having to burden the Help Desk or use traditional User Self-Service.

Yikkes! Bad Security

Dave Birch (Hyperion) posted about an administrator at a large financial firm who encourages his user population to tether their RSA SecurID tokens to their laptops. All I could really say is Yiikes! ...and I don't think I've ever used that word before. Imagine the look on his or her face when the CIO (or other IT manager) who approved the 2-factor authentication project in order to achieve greater security got that email.

Apparently, some of the employees of this organization complained about having to carry a token with them. I can understand that, but there are certainly other options -- think Blackberry or Mobile Phone token, software token, browser toolbar token, just to name a few. And even the latest token design is less bulky on your key chain if you elect to stay with physical tokens.

So, if this message gets back to the SecurID administrator who posted that message, please reach out to us. We can make life easier AND more secure. It's not an either-or scenario. These users can install a soft token on their mobile device and then leave their hardware token at home where they use it most.

The proposed tethered-token solution really minimizes the organization's security investment. And I can only guess that this practice would have a negative affect on a security or compliance audit.

[Addendum: Dave was pointing to another article.]

First Week at RSA

I had an interesting and busy first week at RSA. It's no surprise that I met some extremely bright people. I spent my first few days in Phoenix working with an internal team and managed to speak with a few customers as the week progressed. Some of the very cool ideas I've already heard include:

• Providing Network Access Control using machine certificates. The idea here is that you can't plug in a machine without a proper cert and gain access to the network. RSA has certificate management software that makes this solution a reality. The cert can be based on a specific hardware profile so getting your hands on the cert won't help. It's simple and effective.
• Risk-Based access control or what RSA calls Adaptive Authentication. This is about adding an additional dimension to the authentication process. Not just what you have and what you know, but where are you right now? Or from which device are you attempting to gain access?
• The business value of implementing Federation as a way to reduce bandwidth on the LAN. It never even occurred to me until one of my new colleagues pointed it out. Why tie up your global WAN with unnecessary packets (and spend your budget on increasing infrastructure) when you can leverage the web to pass access rights to overseas applications using a simple Federation solution?
• RSA also has a nice key management utility for organizations that need to build encryption into software solutions but don't want to assume the burden of: 1) designing a secure encryption solution. 2) securing the encryption keys for use by the solution. Or worse yet 3) managing the on-going key life cycle. Keys can be shared amongst applications and re-generated on a schedule to reduce the risk of the keys being compromised.

Needless to say, I'm already getting very busy. I have a lot to do and I have to say I'm invigorated by the new challenges. ...until next time.

TBG's take on EMC + RSA

On The Burton Group's new identity blog, they recently weighed in on EMC's purchase of RSA. I think it's a little more insightful than the other coverage I've seen (albeit at a high level):

Why did EMC acquire RSA Security?

More Info:

• EMC sets up RSA security division, Sept. 26, 2006
• EMC Secures its future, Sept. 22 2006
• SMBs should outsource everything and vendors must adjust, Sept. 20, 2006
• In Depth: The Transformation Of EMC , Sept. 18, 2006
• RSA Security acquired by EMC for $2.1 billion, June 29, 2006
• EMC Announces Definitive Agreement to Acquire RSA Security, Further Advancing Information-Centric Security (Press Release), June 29, 2006