Buildings don't fall down, why should network security

<div dir="ltr" style="text-align: left;" trbidi="on"> <div style="text-align: justify;"> Over the centuries the building trades have learned from their mistakes and set up complex systems of checks and balances that not only works but could serve as a model for network security, attendees at the Security Bsides Boston 2014 conference were told.</div> <div style="text-align: justify;"> <br /></div> <div style="text-align: justify;"> Use of failure-mode effects analysis by the construction industry instills safety in the building process, something that could work to thwart network attackers by building in network protections in areas attackers have been known to exploit, said Michael Davis, CTO of Counter Tack during a Bsides keynote.</div> <div class="separator" style="clear: both; text-align: center;"> <a href="http://elmekon.files.wordpress.com/2010/12/enterprise-building-network.gif" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="376" src="http://elmekon.files.wordpress.com/2010/12/enterprise-building-network.gif" width="400" /></a></div> <div style="text-align: center;"> <br /></div> <div style="text-align: justify;"> Network security pros should look at how security fails and what the consequences were, then build protections into future network designs, Davis said.</div> <div style="text-align: justify;"> <br /></div> <div style="text-align: justify;"> Failure Mode Effects Analysis was first used in the 1960s by NASA, he said, and has been employed in auto design. Cars have crumple zones – less essential parts of the car that are designed to collapse during collisions in order to absorb the impact and protect passengers and more essential parts of the car.</div> <div style="text-align: justify;"> <br /></div> <div style="text-align: justify;"> That’s a lesson network designers should emulate but don’t, he said. “Nobody designs a network segment that can be turned over to the attacker entirely in order to save the rest of the network,” he said.</div> <div style="text-align: justify;"> <br /></div> <div style="text-align: justify;"> Architects should study breaches, find the conditions that lead to failures and correct for them. This can be accomplished through analysis during design and implementing measures for mitigating the risks. Designers should ask, for example, what would it take to hit a particular server and what defenses would have to fail in order for an attacker to get through?</div> <div style="text-align: justify;"> <br /></div> <div style="text-align: justify;"> This methodology saved the Mars rover Spirit, whose flash became corrupted during its mission. Engineers had foreseen the possibility and instilled a secondary system in it that enabled controllers on the ground to re-flash and reboot the system, bringing the rover back to life, Davis said. The lesson? “Be prepared for the low-probability event with huge consequences,” he said.</div> <div style="text-align: justify;"> <br /></div> <div style="text-align: justify;"> In network security the problems are extremely complex, he said. For instance, the Verizon Data Breach Investigation report says fixing nine security weaknesses can stop 95% of SQL injection attacks. But each of those nine problems connects to another nine that can ultimately lead to a successful breach. “You need to look at the chain of events, not just weaknesses in isolation,” he says.</div> <div style="text-align: justify;"> <br /></div> <div style="text-align: justify;"> The complexity makes it extremely difficult to block all the problems, he said, so businesses need to calculate the business risk for each potential failure and address each in order of priority.</div> <div style="text-align: justify;"> <br /></div> <div style="text-align: justify;"> He proposes a formula for determining risk: Severity X Frequency X Detection = Risk Priority Number. Severity means the importance of the negative effect the attack can have on the environment (1 – Not Severe, 10 – Very Severe). Occurrence refers to the frequency with which a given cause occurs and results in failures and is based on historical data if possible (1 – Not Likely, 10 Very Likely). Detection means the ability of the control scheme to detect and prevent a cause (1 – Easy to Detect, 10 - Hard to Detect).</div> <div style="text-align: justify;"> <br /></div> <div style="text-align: justify;"> This type of analysis can improve the decisions businesses make about security, Davis said, and that’s important because attackers hammering away at a network need to find only one way in and don’t quit after the first try.</div> <div style="text-align: justify;"> <br /></div> <div style="text-align: justify;"> “We need to make better decisions,” he said. “Attackers can make stupid decisions and fail and try again on another machine.”</div> </div>

Buildings don't fall down, why should network security

Over the centuries the building trades have learned from their mistakes and set up complex systems of checks and balances that not only wo...

Read more »

Facebook experiment helps battle man-in-the-middle attacks

<div dir="ltr" style="text-align: left;" trbidi="on"> <div style="text-align: justify;"> Researchers at Facebook and Carnegie Mellon University have developed a detection tool for man-in-the middle attacks that security pros might find helpful in protecting corporate data.</div> <div style="text-align: justify;"> <br /></div> <div style="text-align: justify;"> While the technique has been around for years, the researchers were able to adapt it for use on Facebook, proving that the method would work on a large-scale network.</div> <div class="separator" style="clear: both; text-align: center;"> <a href="https://encrypted-tbn1.gstatic.com/images?q=tbn:ANd9GcQoqwYUBmcUs_vvS5dBeTGbfGzgVuoHzx9GA-UuPRLxj5Fv2p3CeQoavo_2" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://encrypted-tbn1.gstatic.com/images?q=tbn:ANd9GcQoqwYUBmcUs_vvS5dBeTGbfGzgVuoHzx9GA-UuPRLxj5Fv2p3CeQoavo_2" /></a></div> <div style="text-align: center;"> <br /></div> <div style="text-align: justify;"> The researchers analyzed more than 3 million SSL connections to the website and found 0.2 percent, or 6,845, contained tampered or forged certificates.</div> <div style="text-align: justify;"> <br /></div> <div style="text-align: justify;"> Most of the changes were related to anti-virus software and corporate content filters, with only 121 forged by malware and 330 by adware, the researchers said Tuesday.</div> <div style="text-align: justify;"> <br /></div> <div style="text-align: justify;"> "The takeaway for IT professionals is that SSL man-in-the-middle is at the same time more common than expected, but also mostly perpetrated by the good guys," Wolfgang Kandek, chief technology officer for risk management company Qualys, said.</div> <div style="text-align: justify;"> <br /></div> <div style="text-align: justify;"> A man-in-the-middle attack is a form of eavesdropping on communications between a browser and a web server. If the traffic is encrypted through the widely used SSL protocol, then the attackers will somehow tinker with the certificates to decrypt the communications.</div> <div style="text-align: justify;"> <br /></div> <div style="text-align: justify;"> To detect certificate shenanigans, the researchers embedded a Flash applet in web pages served to Facebook users chosen at random. The code bypassed the network protocol stack of the browser and sent information on the certificates to a server run by the researchers.</div> <div style="text-align: justify;"> <br /></div> <div style="text-align: justify;"> In proving the technique works on a large scale, the experiment, conducted under Facebook's data use policy, showed that the method would be useful to corporate security pros who wanted to watch for man-in-the-middle attacks on users of company websites, Collin Jackson, co-author of the study and an assistant research professor at Carnegie Mellon, said.</div> <div style="text-align: justify;"> <br /></div> <div style="text-align: justify;"> "We were looking at Internet users as a whole, but CSOs are probably a lot more interested in protecting the people inside their organization," Jackson said. "This would be one way to identify if any employee's traffic is being tampered with, at least when they're communicating internally,"</div> <div style="text-align: justify;"> <br /></div> <div style="text-align: justify;"> The research also highlighted the potential security risks introduced by anti-virus products and content filtering technology that act as proxies through which all Internet traffic flows. These products can be on a person's computer or in the cloud.</div> <div style="text-align: justify;"> <br /></div> <div style="text-align: justify;"> Either way, the software uses its certificates in place of the browser's, which could weaken the latter's ability to validate certificates, making communications with web servers less secure, Jackson said.</div> <div style="text-align: justify;"> <br /></div> <div style="text-align: justify;"> Bottom line, companies using such proxies have to trust their ability to manage certificates in an environment that's more complex than if the vendors somehow leveraged the browsers' certificates, Jackson said.</div> </div>

Facebook experiment helps battle man-in-the-middle attacks

Researchers at Facebook and Carnegie Mellon University have developed a detection tool for man-in-the middle attacks that security pros mi...

Read more »