Metrics Show the Relevance of Information Security
Everyone wants information security to be easy. Wouldn’t it be nice if it were simple enough to fit snugly inside a fortune cookie? Well, although I don’t try to promote such foolish nonsense, I do on occasion pass on readily digestible nuggets to reinforce security principles and get people thinking how security applies to their environment. The key to fortune cookie advice is ‘common sense’ in the context of security. It must be simple, succinct, and make sense to everyone, while conveying important security aspects.
Fortune Cookie advice for February, 2010:
Metrics Show the Relevance of Information Security
Although not easy, metrics show the relevance of information security programs or the lack thereof. Internal security does not generate revenue, it is a cost center. The value of such initiatives is derived by the amount of loss they prevent. Metrics can show this relationship and represent the value. Sounds simple, but in fact it has been one of the long-standing challenges in the security industry.
Security metrics are immature. No pervasive standards exist and organizations continuously struggle to independently show value. Advances are being made, but we are not at a stable point of comfort and confidence. More research is needed. A recent Department of Homeland Security report ranks metrics as #2 of top security research areas.
Some metrics do exist, but organizations are currently faced with an awful decision: meaningful or accurate; pick one. Vague metrics are possible but lack tangible results which can be compared or quantified. A flashing red light does not speak to dollars saved, how systems can be improved, or the future outlook. Nor do simple metrics accurately reflect true causality correlations. More accurate metrics are very difficult or in many cases impossible to deliver. The industry has not settled on provable and reliable methodologies which scale with any confidence. What can be produced with high accuracy typically provides little substance and not much assistance when making complex decisions. Although specific metrics can provide dollar savings for small environments, they are likely to lack accuracy and can easily be challenged. Such false predictions may be cause for overall loss of confidence in a security organization. A risk many groups don’t want to take. Security metrics still have a long road to travel, though their role is undeniable in showing the relevance of security.
Google is the latest major player to establish a financial reward bounty for reporting software bugs in their products. Opinions differ on paying outsiders for vulnerabilities in such a manner, but for the record, I fully support the idea!
I think these programs support security objectives on a number of fronts. It brings to bear more resources to find the vulnerabilities, leverages positive aspects of greed to accelerate the process, and targets the motivations of potential attackers to undermine their destructive activities.
Bounty programs tap extended resources to identify bugs in a constructive and competitive manner. Even though Google likely has a very proficient security design team, they still will miss vulnerabilities that external researchers may find. A financial incentive can direct more volunteers to the effort.
Reward initiatives leverage the ‘greed’ of potentially competing attackers and researchers. Greed can be good. In this case it creates competition among researchers and against attackers. Researchers will strive to be the first to report a bug. It accelerates the process of finding and closing vulnerabilities before an attacker can take advantage. In doing so, pressure is put against attackers who are looking to exploit a new bug.
Bounties directly target the motivations and objectives of attackers. For threat agents who are motivated by financial gain but are not set on doing harm, this provides an opportunity to leverage their hacking skills without crossing moral boundaries or be at risk of criminal prosecution. These programs will also appeal to those seeking personal fame. Positive recognition and validation by the software vendor is something which builds reputation and looks very good on a resume.
Lastly, I suspect such enticements may also lead to conflicts within the internal dynamics of attacker groups. Weak members, who may feel slighted or undercompensated, may choose to go behind their cohorts to directly benefit from newly discovered exploits by reporting it themselves. There is no honor among thieves. The potential of driving a wedge between members will give pause to organized groups of attackers and force them to limit who they involve and manage their own internal security. In a small way it turns the tables against those very people who seek to undermine information security. The irony is sweet.
Overall, I think a well managed bug bounty program, is a very good idea. Only time will tell if the benefits can be measured and understood. I fully applaud Google, Mozilla, and the likes for taking this approach and hope to see others follow!
There has been a lot of chatter about Advanced Persistent Threats (APT). APT is a sexy acronym to be sure, but let’s not get too excited or distracted with this latest catch phrase. This is nothing new, rather just a trendy description to an existing threat.
APT’s are threat agents, not vulnerabilities or specific attacks. They are people who plan and conduct the attacks. They are people who are focused, talented, and possess significant resources. APT’s conduct directed attacks, with malicious intent, to achieve specific objectives. That combination represents a powerful and serious threat to any organization. They sit at the top of the threat-agent pyramid, the elite, being few in number but very dangerous to the victims they target.
Before paranoia sets in, keep in mind we deal with all kinds of threat agents. From masterful economic espionage spies planning long term orchestrated attacks to steal the crown IP jewels, to the Homer Simpsons who walk out with the same IP on a USB drive in their pocket, only to lose it at the bar while going to the bathroom. They are all part of our ecosystem, and must be accounted for in our continual balancing act of managing security. APT’s are a dangerous threat agent to be sure, but they have and will likely always exist.
So what should an organization do? Even if you are a likely target of APT’s, don’t give up. They have to play in the same field. It’s just they may be a more challenging adversary than what you may be accustomed to. Every threat agent can be undermined, deterred, or minimized. Knowing attacker characteristics, such as objectives, motivation, capabilities, limitations, etc. is important in making good security decisions for each organization. Think critically and focus on the attacker. Know the most likely methods they will employ and determine the right balance of defense-in-depth controls to attain the optimal level of security.
We should never limit our focus to just the elite attackers. I think we must all be flexible in understanding the broad threat agent landscape for our specific environments. Stratagems effective against one agent may be useless against another. Do APT’s exist? Yes. So do Homers and a whole span in between. All the relevant threat agents must be addressed.
In this game we play, most of us reading this blog benefit from home field advantage, playing defense. We own and manage the field. However, let us not be consumed nor ultimately comforted by that fact as “…knowing your adversary is far more important than knowing the condition of the field”. If this is somehow a foreign concept to you, it is time to look up and see who you are playing against, as the opponents may include an APT 800 pound gorilla. And look closely, as he may be wearing one of your employee badges.
Intel IT has developed a threat agent risk assessment (TARA) methodology that distills the immense number of possible information security attacks into a digest of only those exposures most likely to occur. This methodology identifies threat agents that are pursuing objectives which are reasonably attainable and could cause unsatisfactory losses to Intel.
It would be prohibitively expensive and impractical to defend every possible vulnerability. By using a predictive methodology to prioritize specific areas of concern, we can both proactively target the most critical exposures and efficiently apply our resources for maximum results. The TARA methodology identifies which threat agents pose the greatest risk, what they want to accomplish, and the likely methods they will employ. These methods are cross-referenced with existing vulnerabilities and controls to pinpoint the areas that are most exposed. Our security strategy then focuses on these areas to minimize efforts while maximizing effect.
Download the whitepaper and share your thoughts, criticisms, and ideas.
The Christmas 2009 incident, when a bomber attempted to detonate explosives sewn into his undergarments while in the passenger cabin of a commercial airliner, could have resulted in a horrific catastrophe. Although near tragic, it is another example of how security savvy minded people were quick to respond and interrupt the attack. The media has focused on how the device malfunctioned, but paid little tribute to those passengers who rose up, acted quickly, and subdued the assailant. Given the fact his primary plan failed, he likely would not have stopped in his mission to do great harm. The passengers essentially stopped his ‘Plan B’ and deserve credit.
Americans will never again be subdued like what happened on aircraft during the infamous 9/11 attacks. We have learned a very important lesson. Being aggressive to assure security, in the face of an incident, is imperative. Security knowledgeable people will remain aware and act quickly when situations arise that require intervention to restore security.
These lessons translate well to the information security realm: 1. Security savvy users are incredibly valuable component in a Defense in Depth strategy (Defense in Depth strategy) 2. Rapid and aggressive response is important to reduce loss and restore the environment to an acceptable level of risk 3. We as administrators and users must continually learn, adapt, and evolve to security risks. The attackers continuously adapt, we must too.
I am a strong advocate of programs which establish and support security savvy end-users. Security ‘common sense’ is neither common nor intuitive, yet plays a significant role in the protection of entire computing environments. It is an important and frugal way of improving the overall security posture of an organization. Although ongoing investment in behavioral security programs is valuable, it can be difficult to measure and justify.
The purpose of security awareness campaigns is to change or reinforce behaviors of the community in a manner which improves the overall state of cyber-defense. Users can be the best asset or the worst enemy of an organization. Some would say the value is limited to social engineering attacks, but consider that well informed users will purposely stay aware of ever changing security issues and are more apt to apply patches/updates, take precautions with new technologies, and use common security sense when dealing with less trustworthy aspects of computer use as compared to uninformed or careless users. In this manner, such behaviors extend well beyond the obvious social engineering attacks.
How should the value be measured? The obvious approach may not be the best. Take for example, an employee training program instituted to improve general awareness, identify dangerous situations, recommend good practices, and communicate how to get assistance. Typical metrics for training programs are focused on saturation and recollection. They measure how many people or what percentage has completed the course. More ambitious metrics may actually test absorption, administering a test at the end of the class and scoring users’ knowledge. These metrics track the progress of the project and have their place, but neither actually measures the security value.
Avoid investing in the wrong measures. To estimate the value, as a factor of reducing security risk, the impact of what is being taught must be measured. Did the number of successful attacks or the average loss per incident decrease?
If a behavioral security program succeeds, it changes the actions of users to be more secure. The end result will manifest in a number of measurable ways:
A reduction in the number of successful attacks. Attack attempts may not decrease, but due to better decisions on behalf of the users, fewer will succeed.
A reduction in losses for those attacks which do succeed. Security smart users play a key role in detection and rapid response to attacks which can reduce the overall losses experienced. Measuring the average loss per incident is a good tactic to recognize underlying value.
A change in the type of attacks targeted at the organization. When attackers find a winning method, they stick with it. When those methods become ineffective, attackers specifically targeting the organization must adapt. A security aware workforce can change the game dynamic by forcing threats to evolve their attack methods. These adaptations can be measured and more importantly, communicated to users in a continuous feedback cycle to keep them informed of emerging attack vectors, thereby sustaining the security value proposition.
A widespread behavioral security awareness campaign, to establish and maintain security experienced users, is both valuable and important. It is not a silver bullet, but it is one of the most powerful components to a defense-in-depth security strategy, as users can play a role in the prediction, prevention, detection, and response aspects. Security savvy users are the core of behavioral security. Measure the true success and value by understanding their impact.
After posting the video and opinion paper It is Time for a Data Security Revolution! a reader posed a simple yet deep question. GroogFish, in the YouTube video comments asked ...who is supposed to start this "revolution"? As my response is a bit lengthy for the comments section of YouTube, I am posting here.
I believe everyone has a role to play and a responsibility to support steps for securing data. It is, after all, OUR information. To succeed, a data security revolution must be a community effort resulting in the development of an entire ecosystem, with standards, communication, and an open architecture.
Consumer demands bring attention to the problem and ultimately will drive features. Regulatory bodies, dare I submit, can enact requirements which mandate changes to technology capabilities. Hardware and firmware vendors are important in order to support new architectures. Data management and processing organizations must be on-board to insure interfaces and storage formats of data are compatible. Operating system and application writers are key players to utilize and enforce such controls at the host system and repository levels. They develop the products which engage the user.
The information security communities are the expert advocates. They must analyze the situation, stimulate conversations, guide changes, and engage in value assessment discussions to become the sharpened spearhead which leads the charge forward. Traditional and social news media should also contribute to overall education and public awareness. They must go beyond just reporting the breaches, failures, and losses. We are at risk of becoming numb at all the stories, without a meaningful reference point or perspectives of significance which show how the situation can change. The public must be better informed to the root problem, the industry opportunities, and the dark truth of where apathy will lead.
I would like to see a consortium formed with major players and international standards bodies to establish a framework for development. Government, privacy, commercial, academia, technology, and security representatives should be represented at the very least. Critical mass with the aforementioned groups must be established before enough traction motivates a commitment on behalf of lead players to allocate initial resources. Alternatively, assertive academic bodies could work together and take a first step by developing recommended standards, architectures, and proof-of-concept systems.
Although some pieces to the puzzle are out there, we don’t even know what the picture is supposed to look like and no guarantees the available parts will or should be brought together. Boldly, I believe we must enforce a tabula rasa to nurture a fresh start, otherwise risk poisoning from our natural presumptions of what we believe we know. It may not be the most popular sentiment, but adopting refined solutions and attempting to bolt them together is a mistake. Instead, we take the learned and proven principles of those solutions and integrate them at a strategic level to eventually lead us to workable end solutions.
Threat agents maintain the initiative and we respond to restore balance. The bad guys innovate, find exposures, and use technology which they can leverage to achieve their objectives. They take the first step, set the tempo, and lead this wicked dance. The security industry normally operates in a responsive manner, closing the door behind successful attacks to prevent further loss and scrambling to prepare for the next issue. But every once in a while, the security community comes up with a predictive and proactive idea which has sweeping effects against attackers and their future likely methods, and we show true leadership in innovation.
These golden nuggets can change the initiative and give an advantage to the defenders. Sadly, it is rare. In most instances it is difficult to justify expenditures for capabilities which may or may not interdict future potential attacks. Our industry cannot confidently measure and substantiate such innovation to determine which will leapfrog us ahead of the bad guys and those which fail miserably. Without clear value, those holding the purse strings are not very motivated to blindly invest. It reverts back to the age old security problem of measuring attacks which are avoided.
How will we ever change our industry to support security taking back the initiative? First we must devise a good way of measuring innovation. We have much better metrics for how good the bad guys succeed, and are blind on how to measure the value of security ideas. This must change in order to facilitate the financial support necessary for investment. The value is there, we must adjust our focus to see the opportunity. Otherwise, the enemy will maintain the advantage as we continue to follow behind the attackers, cleaning up messes, and forever responding to their ingenuity.
Russell C Thomas delivers a great post on How to Value Digital Assets. It covers many basics and more importantly gives a good direction to take while spotlighting common pitfalls in the valuation journey.
“This tutorial article presents one method aimed at helping line-of-business managers (”business owners” of digital assets) make economically rational decisions. It’s somewhat simplistic, but it does take some time and effort. Yet it should be feasable for most organizations if you really care about getting good answers. Warning: No simple spreadsheet formulas will do the job. Resist the temptation to put together magic valuation formulas based on traffic, unique visits, etc.”
Definitely a good read for anyone wondering where to start the valuation process. I especially like the Three Principles section. He makes a logical separation between assets which provide direct revenue (Class 1) and those which are in a support function (Class 2).
As follow-on, I believe some other aspects may be covered under the Class 2 section including liability avoidance, direct efficiency gain, life safety, and regulatory compliance. In certain cases we must apply a different method to determine the value, outside what has been explained. As management may be willing to replace or upgrade, but typically such investments must have a positive ROI, therefore they provide much more value than the replacement/repair costs.
Years ago I had a stimulating conversation with the late (and some would say infamous) Dr. Bill Hancock. Bill had trudged through the information security swamps for decades and had a unique insight to valuations of vulnerable systems, particularly single-points-of-critical-failure. He recanted his experience evaluating an airline’s security and discovery of a minor system which was largely ignored, a weights and balances server. Apparently when planes take off, the distribution of weight must be calculated to insure they don’t become giant ‘lawn darts’ (Bill’s colorful description) at the end of the airfield. A data integrity compromise of this system could cause catastrophic consequences, leading to the end of the business. Who would fly on an airline which had several take-off crashes in a single day? It would be the critical factor to likely cause the airline to no longer exist as a viable business. Although this was a support system, the integral value was far beyond the cost of the equipment, software, and support.
Secondly, the blog is written with the assumption the assets are already in place. Thus, in a perfect world, a proper ROI/justification has already been made to assist the decision to acquire and land these assets. But what if a decision to purchase or not, is the objective? The Class 2 method then becomes circular. The value is the expenditure management is willing to invest? How do they know?
Overall it is a great blog. I think it would be helpful if the author could give an example for a medium sized enterprise, with particular focus on Class 2 areas (specifically security or safety assets). Hopefully he is willing to post such details.
Passwords of reasonable strength (8 characters or more consisting of upper/lower case and special keys) coupled with timely expiration, are secure. Passphrases with comparable measures are equally secure. The systems and users are currently the weakest links in the security chain.
The interfaces and tools which we input the passwords may be vulnerable. This includes but is not limited to key-loggers, sniffers, input redirections, etc. But it is the user, where the most significant weakness exists. They can be duped into divulging their passwords (phone, web, chat, email, etc.) and in many cases make them available in other ways (sticky note under the keyboard).
A recent Newsweek article covered the topic of building a better password:
"...a short but hard-to-remember string like "J4fS<2" can be broken by what is called a brute-force attack (in which a computer attempts "a," then "ab," then "abc," and so on) in 219 years, while a long but easy-to-remember phrase like "du-bi-du-bi-dub" will stand for 531,855,448,467 years. (Two hundred nineteen years is actually very good, but the lesson remains: simpler can be stronger.) The idea of passphrases isn't new. But no one has ever told you about it, because over the years, complexity-mandating a mix of letters, numbers, and punctuation that AT&T researcher William Cheswick derides as "eye-of-newt, witches'-brew password fascism"-somehow became the sole determinant of password strength."
The difference between passwords which can be cracked in two-hundred versus a billion years is immaterial if users are forced to change passwords every few months. The bad guys just don’t have the time to crack the password before it is changed or the data is sufficiently aged to not be of value.
To undermine cracking attempts, we force users to use 'strong' passwords so that dictionary attacks are fruitless and threat agents must resort to a laborious brute force attack, trying massive numbers of combinations in order to be successful. All passwords can be cracked via brute force, but it takes time. It becomes an exercise in how many attempts can be made over a given period. The faster the process the more combinations can be tried and therefore the shorter the time to discover the one which works. The length and possible characters determines the number of combinations.
Undermining the strength of a password is not the biggest concern. It is far more likely for a password to be sniffed on the network, captured on a system, or duped from a user, rather than be cracked.
The most significant vulnerability is with the user and systems where passwords are entered and stored. There is no practical benefit to further abuse users with new diabolical password schemes. We should pay less attention to stronger and better password formats and instead invest in better behavioral controls, user education, and the strengthening of system and interfaces.
With a painful taste of irony, it was recently reported that the Ministry of Defense's (MoD) manual explaining how to prevent leaks, was itself leaked.
"The Defense Manual of Security is intended to help MoD, armed forces and intelligence personnel maintain information security in the face of hackers, journalists, foreign spies and others. But the 2,400-page restricted document has found its way on to Wikileaks, a website that publishes anonymous leaks of sensitive information from organizations including governments, corporations and religions."
Is this a fluke or is the world suffering from abhorrent information security practices, culture, and capabilities?
YES, the world is terrible at securing data! Yes, you and I are part of the problem! Yes it can be fixed, but it is unlikely unless dramatic steps are taken!
Information technology has lagged behind society’s skyrocketing need to manage and secure data.Information is growing exponentially and our demands for control and oversight continue to develop rapidly.Efforts to create or improve current paradigms are fractured and have failed to reach the tipping point of the maturity cycle necessary to catch up.We have failed. It is time we shed our entrenched archaic ways and leap forward to revolutionize how data is protected and managed.The confluence of changes in our culture’s expectations of data, demand we succeed.A revolution in data security is coming; we can either lead or be trampled by it.
The problem
The world is demanding more control, security, oversight, and awareness of where our data is and how it is being used.This includes information generated and processed at work, as well as our own personal information including financial, health, and privacy data.As a society, we are just starting down the road to explore data loss prevention issues, privacy expectations, digital rights management, and electronic discovery requirements.Additionally, we are just beginning to understand the vast, hidden, and expanding world of data breaches, identity theft, user profiling, and online victimization.Intellectual property controls are more important than ever to businesses in the information age and the social networking phenomenon is opening our eyes to the need for better security and management of individual’s data and the systems which control it.
Yet the current behaviors, tools, and infrastructure is vastly insufficient for what we need today and the gap is increasing, leading to a critical failure point in every way for what will be needed a decade from now.As fast as technology evolves, it simply cannot keep pace given the confines of current structures.We will be left with a snarl of vague and unrealistic regulations, unsatisfied community demands, incompatible point solutions, tools which can’t scale, and an entire generation of information victims.A radical change is needed!
The storm is brewing
A confluence of conditions is manifesting to create a perfect storm for radical change.Consider the following social and technical changes which will change people’s opinion:
·Data exposures are becoming public, showing the terrible depth of the problem
·The number of data victims, for identity theft and online crimes, is increasing as are the losses
·Data, system, and privacy regulations are emerging across the world with complex variations, creating severe challenges for global compliance, interpretation, and compatibility
·Social media users are realizing the honeymoon is ending, their data is exposed, and being used in ways they never intended
·Malware is reaching epic proportions.The trend is shifting to target capturing victim’s data
·Individual opportunists, organized criminals, and nation states are actively working to control systems, data, and networks
·Surveillance, profiling, and filtering controls are becoming mainstream to target or seek control of user data
·The sheer number of people and businesses on the internet is reaching a critical mass to determine how the world communicates, and the engine driving an exponential growth in the amount of data being generated
This problem may be complex in the details, but it is simple in principle.Basically, we manage data poorly.If I create a document today and email it to a co-worker, I essentially surrender almost all control.In a week’s time, I will have virtually no idea who has seen it, how many copies exist, how long it will stay buried on storage devices, or what modifications have been made to it.I have no control to update the copies, control access, or revoke the files.Chances are good that after a year I will likely lose it myself or forget the content of the document.It is terribly inefficient and represents poor overall management of data.
This situation presents as both a technical and behavioral problem.The personal computer revolution has bestowed the tools to easily create and store data.The pervasiveness of the internet established the unprecedented ability to share and disseminate information.The natural limitations of the pencil and paper generation supported modest but adequate physical management solutions.The creation, distribution, and control were tangible and restricted to local resources.Our newfound ability to generate and distribute information has not been coupled with equitable management solutions.Caught in the euphoria of new freedoms, we ignored the capabilities to control and secure.The shortcomings of technology have been tolerated due to an apathetic and disjointed demand from society.We have failed as consumers to recognize the importance of our data and the deficiencies in the realization of how it should easily be managed.
It’s the 21st century; do you know where your data is?
Today, data is easily created, lost, transferred, edited, stolen, abused and destroyed with very few mechanisms to prevent, detect, or respond.
Consider the following:
·We don’t track who creates files and who owns them
·Rarely do we consider if files should be secured or how
·We don’t take steps to determine who should access, view, or edit files and where they can be stored
·Destroying data after it is no longer useful, is a foreign concept, as is who should be responsible and when
·We don’t understand who, at any given time, has possession of our data and how to effectively recall it
·We have little insight to data content.We rely on short and sometimes cryptic filenames to give clues, but we don’t comprehend contents in a meaningful way
·Sharing data is mostly ad-hoc for specific files or locations, with little thought of content or other security factors which should be considered
In summary, we are poor custodians of data.In fact, people keep better track of the clothes in their closet than the information assets they create every day.I would wager you know where your clothes are, which are clean and which are soiled, and you have designated places for both.You regularly maintain your wardrobe by cleaning, pressing, matching, folding and storing clothes in an organized manner.Items are added, minor repairs made, and eventually clothes are purged when they no longer fit, are outdated, or simply not needed.You plan and may budget when new clothes are required.Depending on your age and habits, you may even have your name on them for ownership identification.You organize your closet for easy searching and you know which articles have been loaned out and to whom.For important items you would likely detect if they went missing and probably have a good idea of likely suspects, as you know and control who has access.So why do we do such a good job at managing our clothes, yet such a miserable job at managing our data?
People have not yet put the mental pieces together, but they will.When they do, they will demand technology deliver a solution.Revolt will be at hand.
Current efforts
A number of current initiatives have been struggling to gain modest traction but will always lack the ability to deliver a complete solution.Digital Rights Management(DRM) is well known in the online music circles, focusing on file based locks.Data Loss Prevention(DLP) is a collection of practices and tools which can scan, classify, and block inappropriate transmission of data.
Structures like Role Based Access Controls(RBAC), Mandatory Access Controls(MAC), Discretionary Access Controls(DAC), and Lattice Based Access Controls(LBAC) have attempted for years to establish controls within homogeneous and small environments, but rarely work as intended in large mixed environments like modern networks.A variety of secure data repositories have emerged, which do a stellar job protecting a few critical items akin to a vault, but are largely inaccessible, inconvenient, and not scalable.
A quick summary of current solutions highlights why they are not scalable, will fail to provide a complete solution, and likely never be widely adopted.Each of these does have its place and function but overall they will not deliver what is needed; a comprehensive capability to manage data security.
1.Vault solutions:Secure some files in a locked system or repository and provide access via custom interface applications.Not scalable for vast amounts of data, poor accessibility, high level of permissions management needed, inconvenient to use, and the trend to use proprietary software will keep the price tag high
2.Scan and classify DLP systems:Can apply controls both on clients and networks but relies on rules which are complex and a nightmare to maintain.Ultimately this is why they eventually just get ignored.Sustaining accuracy is not practical in environments which change and grow rapidly
3.Scan and alert/intervene DLP systems:Similar to Scan and Classify DLP systems, with an added benefit of intervention. Blocking suspect traffic and communications is a double edged sword, which requires high overhead to insure it does not interfere with legitimate business.These suffer from the same drawbacks as their cousins.
4.Employee policies:Policies which rely on manual intervention are hit or miss.For simple straightforward decisions they can be quite effective.For complex data decisions, changing environments, and potentially vague situations they fail miserably.People simply don’t act consistently when faced with complex decisions
5.System policy (MAC, DAC, and LBAC) solutions:System based solutions which can work well while data stays on the system but fails when collaboration across systems and users is required.They simply lack the applicability, scalability, and compatibility across a network with various uses and complex situations of collaboration and security.
6.Group/role access policies (RBAC): The natural evolution of the MAC, DAC, and LBAC concepts, can work great for small groups and data in an environment which does not change often.As the numbers and data size grows, the administration increases and ultimately does not scale efficiently.
7.File lockdown systems (DRM): Locking down files with digital rights (DRM) can work in situations needing a simple access control.Allowing a file to be opened or not, for example.But it does not work well when a multitude of access options are needed and other controls are required.Compatibility also poses a problem when sharing such files across systems.
8.Secure critical files and data solutions:File encryption is the major player in this field.Target only the most critical data and files, and focus on protecting those.Not scalable with the increasing amount of data organizations are processing and the shift of data across a much broader user and system landscape.Works great for handfuls of people with a small number of files needing protection.Those days are gone.
9.System data protection solutions:As file encryption has too much overhead necessary to scale, just encrypt the entire system and network.Works great for lost laptops but does little when the user has logged in and everything is now easily accessible.Network encryption only protects against sniffing.A good evolution but not nirvana.It is a one trick horse for confidentiality.
10.Do little to nothing and hope for the best.Don’t laugh.You might be surprised with how many financial, health, educational, and governmental systems followed this model for most of the past decade.
The list goes on.This is not comprehensive, but does give a taste of some stovepipe solutions which are struggling to evolve even slightly and will never leap forward on their own to meet what will be demanded.
Overview of solution
How do we succeed?We combine some of these technologies, integrate into the base computing infrastructure, and ease in the necessary user behaviors into the fabric of how people create, use, share, and destroy data.It must combine an object oriented definition structure and network based management controls.
Four core aspects for identification, security, and management of files
Data objects must carry specific characteristics to enable the computing environment to effectively and efficiently manage security.Although discrete parameters may differ based upon data type and parent organization, these aspects represent the necessary structures which work together to enable automation and to define security practices.Additionally the characteristics themselves must be secured and compartmentalized.
1.Confidentiality Designation – Level of sensitivity and confidentiality for the data.This has implications on required controls for data at rest, in use, and in transit.Also can define requirements for where and who can access and store the data.Examples might be Top Secret, Secret, Business Confidential , Personal, and Public.Classifications have implications to the Access and Handling aspects.
2.Access Rights and Permissions – Who has ability to access, edit, store, copy, transfer, etc. the data objects.DRM and RBAC technologies and DLP principles are a good start.The object must securely contain the concepts of ownership and those trusted to use the data in different ways, including to open, edit, destroy, move, copy , and transmit.
3.Content Synopsis, Tags, and Keywords – Identifying content supports indexing and understanding relationships between files.It facilitates scanning and auditing against policy as well as automation for determining access, classification, and secure handling requirements.
4.Secure Handling – Secure handling parameters determine retention, backup, destruction, storage, usage and transport requirements.These can be set by a default policy and updated based upon other aspects.Data Lifecycle Management (DLM) provide a good foundation for some practices.
These four aspects cooperate and influence each other.If for example, file content changes to include secret information, the classification may automatically bump to a secret designation, the secure handling settings will force persistent encryption, and change the access rights to allow access by a smaller community.
Cookbook of requirements:
This is the wakeup call for firmware, operating system, application and security solution providers.To change how people manage data, from creation to deletion, will require the major players to work together with standards and Application Programming Interfaces (API’s).We are not just altering one piece or bolting on additional security, we must change the fundamentals of the very infrastructure we use to manipulate data.
Some inroads have begun.DLP and DRM systems have established expertise in some preventative, detective and responsive functions.Social media is leading the way in many respects with tagging, sharing, collaboration and most importantly tracking and metrics.On the most modern sites, an author can post a video and track how often it is watched, by whom, and if they are using it in other mash-ups.A great deal of data can be gathered and if analyzed correctly, transformed into usable intelligence.Social media is the looking glass for what is to come.
These requirements are critical for success:
·Must apply system wide, embedded seamlessly in hardware, Operating Systems, and applications.It must include all data which is created, viewed, modified, transported, or deleted by users
·Must span across users, client systems, and into the backend infrastructure
·It must be holistic in nature and applyfrom creation to deletion (birth to death) for data and files
·Must possess default security for creation, storage, transit, and when in use
·Support at a minimum, basis functions of DLP, DRM, meta-data, content tagging, RBAC, client agents, data tracking, and control repositories
·Maintain a centralized structure for metrics, audits, maintenance, discovery, and reporting
·Distributed and centralized hybrid system supporting comprehensive scanning, indexing and auditing
·Enable data tracking, verification, auditing, and ownership administration
·End-user involvement and empowerment, to directly access and manage control systems and distributed data
·System interoperability across separately controlled domains and networks
·Establish end-user ease of use, manageability, and scalability at all integration points:
oStraightforward setup with additional modular extensibilities
oDefault settings based upon role for confidentiality and handling
oUser interface validation of parameters, and extra owner options, when saving, editing, moving or transmitting files
oDefault access rights based upon groups, tags/keywords, and storage location (for example, inherited rights based upon storage location or of like files)
oEscalation and resolution options when actions are prohibited by the system
Vision of Success
We have the intellect to succeed.We can create a new paradigm which meets the needs of legal, privacy, security and most importantly the maturing expectations of everyday people.
Keys to strategic success:
·Make the capability embedded, easy to use, and secure by default.Minimize impact and overhead to the users
·Champion behavioral changes of users and administrators, show the value
·Drive client Operating Systems and Applications to conform and support standards
·Leverage security tools to extend services and controls
·Establish back-end infrastructure support via standards
·Foster competition to drive affordability, scalability, support and continuous improvement
Key capabilities for value and functionality
·Automated intelligent determination of initial core file aspects, with validation by users during file management requests (save, transmit, copy, etc.)
·Automated security controls applied and enforced based upon file aspects and derived control requirements
·Automated data cleanup, archival, and destruction based upon file aspects and settings
·Data owners can easily search and organize their files both local and across the network
·Data owners can easily take control to manage access, confidentiality settings, change file handling parameters, and revoke files across the network
·Administration can conduct broad electronic discovery searches for files and data content, generate operational metrics, and gain an understanding of where sensitive data is located and how it is being used
·Automated security alerting and logging to assist with detection of unacceptable actions, resolution to events, and predictive information to facilitate the establishment of future preventative controls
Example Use cases
New document creation
Capturing the meta-attributes at the point of creation is a critical step.As a mock-up, this email was created and a default set of icons appear in the toolbar, showing the status of the 4 aspects.These default settings align to Confidentiality Designation, Access Permissions, Content Synopsis, and Secure Handling settings configurable by the organization or user.They establish base parameters but change dynamically as content is added.
As text is added, the system determines the content to match criteria which changes the classification, associates to a current project, adds to the content tags, and modifies access permissions automatically.The icons change in appearance to show how the data will be treated.The user can intercede manually by clicking the icons, which will open the user interface showing more options and configurations.
Saving, moving, deleting or transmitting data
A modified window appears whenever users attempt to save, move, delete or transmit data.This confirms settings and if needed, solicits additional necessary data to complete the transaction.
End state vision
·From creation to destruction, data is automatically classified, secured, and under the control of the owner
·Additional capabilities extend to allow complex management, sharing, security, and tracking
·End users are empowered to easily organize and revoke their data, control access, and know where it resides
·Through leveraging technology, data files are treated like assets and security is efficiently managed across user domains
Conclusion:
Change is coming.The underlying community, regulatory, and behavioral factors are present and becoming more prevalent.The information technology and security industries must escape the façade and false hope of small improvements and truly revolutionize how data is secured and managed.This can only be accomplished with aligned industry partnership, a realization of necessity, commitment to user efficiency, common technical standards, and most importantly a shared strategy.It is possible.Now is the time to think, discuss, and plan.
Measures generate data and metrics organize data to generate information. The difference between ‘data’ and ‘information’, the former is something you know, the latter is something you use.
Everyone wants information security to be easy. Wouldn’t it be nice if it were simple enough to fit snugly inside a fortune cookie? Well, although I don’t try to promote such foolish nonsense, I do on occasion pass on readily digestible nuggets to reinforce security principles and get people thinking how security applies to their environment.
The key to fortune cookie advice is ‘common sense’ in the context of security. It must be simple, succinct, and make sense to everyone, while conveying important security aspects.
Fortune Cookie advice for September, 2009:
Measures generate data and metrics organize data to generate information.
The difference between ‘data’ and ‘information’, the former is something you know,
the latter is something you use.
In security, it is easy to confuse the terms ‘measures’ and ‘metrics’. They are two distinct but related concepts. Measurement theory incorporates the scale of nominal, ordinal, interval, ratio, and absolute. These scales are used to measure something, with the output being data. Metrics however are about analysis and intelligent decision making. Metrics translate data into meaningful information which will support decision making. Data is something you know. Information is something you use to make decisions.
Thinking creatively, a South African IT company decided to use a low technology solution to complete a data transfer when their ISP network could not handle the job. Typically, quick out-of-the-box IT solutions are rarely secure. Smart technologists are good at finding solutions to meet their objectives, but when time is short, security tends to be ignored. Does the combination of frustrated people, short timelines and the need to transfer a lot of data equate to insecurity? Not always.
Being different sometimes has its security advantages. In this case data was transferred in a manner which was unpredictable to intercept, highly reliable, impossible to sniff, faster than the traditional available wired network, and maintained high security for integrity and confidentiality.
After writing that blog, I began to think about the variety of levels by which information security is delivered.To truly manage risk and provide information security for a business, you need many levels of controls and defenses. In fact, I learned that Intel IT has a Defense in Depth strategy for information security
Within Intel IT, every strategic discussion I have witnessed from implementing cloud architectures, deploying server virtualization and client virtualization, evaluating Windows 7(more coming soon on our plans here), developing business intelligence and social media collaboration solutions, designing for security is a paramount factor.Every IT solution must take into account aspects of information security – the risks of not considering it are too great.There is a rich set on content dedicated to Intel IT’s approach to security solutions.
Of course the question for IT is how much is enough. Is meeting the minimum regulatory requirements sufficient – or should we strive for a higher level of protection – at what cost.There is no formula here.It is a delicate balance to match risk, investment costs and ROI to deliver sufficient information security protection.Over-invest in security and you could be constraining business growth or restricting process improvement … under-invest and you risk exposure to information loss could be too high; or (worst of all) don’t innovate business processes because of worries concerning security exposure
It was only after taking our required annual IT security training mandated for all Intel employees last week did it really hit me that PEOPLE are our primary defense against information theft.Within the Intel IT organization, I have found a huge focus on the value of our people – our subject matter experts.From the engineers, architects and IT strategists to the training of all employees on the principles, expectations and tools we all need to use to maximize the effectiveness of what IT has put in place.This was reinforced by a recent Gartner call I attended where the speaker proposed that people are our most agile and important asset.I agree.
The bottom line: IT’s job is simultaneously deliver business value through innovation aimed at enabling growth, boosting productivity, maximizing efficiency and maintaining continuity.This is what makes PEOPLE so critical because the balancing act is a question of IT governance – the formal means to evaluate, benchmark and decide how to balance these critical questions – in close collaboration with partner business units, HR, legal and senior management.
Technology can’t do it alone – we have to deploy technology with intelligence, purpose and controls.That is only possible by enabling people to be trained, educated and empowered with the ability, tools and support to be successful.
