Information Centric Security

Software or Appliance?

When choosing a security solution, what you need to consider.

                            

If you want to have custom software developed, who would you contact? If you needed a database security product, who would you call?  The database vendor?  A big security vendor?  A small security startup? Would Cisco or Juniper make your list?   

 

It’s an interesting question to which I am always looking for input or perspective.  I certainly have some ideas on the subject, but as every company environment is different there is no ‘right’ answer for the market in general.  You can however weed out a few things you should NOT do.  What got me in a recent snit was discovering that a couple companies who have purchased network and/or appliance based database security solutions are less than happy.  OK, no surprise, but when I learned that these same companies had contacted their vendors to write custom software to overcome the issues I just about blew a gasket.  Why on earth would you work with an appliance vendor to make software, especially Network Appliance people working on Database Software.  That is absolutely nuts!

 

Some background: When IPLocks introduced the Database Monitoring Suite, the competition was mostly network based Intrusion Detection Systems (IDS) and agent based System Event Management (SEM) vendors.  Over time, the IDS evolved into more database aware network solutions, and Database Activity Monitoring (DAM) was born.  Later, as these network based DAM appliances missed too may events, the Appliance/Agent DAM combo arrived on the scene.  It still falls short, so now we are seeing the migration from network appliance to full blown software solution. 

 

Why?

 

#1 Cost – The biggest reason.  Those $100k appliances are an expensive way to cover databases, and in a geographically disperse environment, simply untenable.

#2 Unfit for purpose.  The market has changed, and no matter how many appliances you throw at the problem, they are not going to address PCI compliance.

#3 Virtualization can obviate network scanners. If you are not thinking along these lines, you need to be. Depending upon your virtualization model, you may render your IDS and DAM appliances completely irrelevant. 

#4 Context.  Peer based software solutions do not miss transactions that are invisible to network sniffer’s, and can be invisible to external protocol based agents as well.  Peerage to the database not only addresses this deficiency as well as provides referential medium for dynamic adjustments to remediation. 

#5 Flexibility of software.  The network is a simple ‘lowest common denominator’ to build a quick and cheap scanner, but appliances do not adapt as quickly as software, which be adjusted in far less time and money as  IT Environments change.

Software development should not be taken lightly

I have been preaching this for a long time that for certain types of issues, looking at the network is an efficient way to provide security, but wholly unfit for other type of security.  Typically packet inspection is inappropriate for Database Security and Compliance.  The lack of visibility to all activity and the lack of contextual understanding requires a solution that is above the network layer, or at least a combination of network and peer based scrutiny. But this is not just about market appropriateness!  

While the software architect in me has been very amused, smug even, as I watch other vendors alter their architecture every 12 to 18 months, there is a different dimension to this.  IPLocks experimented with appliances prior to our first product delivery, but dismissed the idea in 2002. We went with a software only solution and decided on our architecture at that time. However, that meant a complete systemic overhaul of engineering staff, tools and process!  Any software development manager will tell you that appropriate engineering team skill sets, QA, appropriate development processes and depth of domain experience are critical. Any single deficiency can completely break a project.  Throw architectural deficiencies on top and the migration from appliance to software, from network to database, is a very risky proposition to invest in.  

 

Don’t get me wrong, in some cases appliances are the right solution. In other cases software may be right for you.  It really depends upon your security and compliance goals, as well as the quality of the offering. But if you want database security software, asking a network monitoring vendor is really asking for trouble. 

Data Centric Security Model

Security attributes of data and data should be inseparable

                            

I was having lunch last week with a good friend, Kurt Stammberger, discussing various security technologies and the state of the industry in general . If you’re not familiar with the name, think RSA Security Conference, as Kurt successfully guided that event from its origins as a small conference room gathering to one of the largest security events around. During lunch Kurt brought up the Transactor project, a Digital Rights Management platform that proposed a method of creating unique objects that the two of us had worked on together.  That dredged up a lot of old memories and war stories. Reminiscing over the amazing people who worked on that project, how advanced the security was in both design and execution brought to mind many of the same old problems we are trying to solve today. But as with many tech startups, there was some incredible work never saw the light of day. The crux of the conversation was this is a great idea, but one who’s time had not yet come.

 

Ironic that when I got back from lunch I ran across Gunnar Peterson’s article on SOA security. I think the Gunnar is dead on target! The introductory examples that it is about the car, and not about the garage is precisely the point. How do you protect data in a distributed environment, not just when parked but also when in motion? Who do you trust and what rules do you enforce? This must be part of the design if the system is to have a chance for success, and to extend that one step further, wrapped around or embedded with the data. The car is secured, not the garage.

 

It is based upon these concepts I have proposed that the ability to protect data without some form of wrapper or ‘meta data’ is difficult to impossible in an SOA environment, either at rest or in motion. And coincidentally, this is much of what the Transactor project was about, and quite specifically what the Limited Edition Digital Object was meant to provide a medium for this type of transfer. In a nutshell, a LEDO is a container with embedded use and ownership rules, private & public components, with each component maintained by its respective owner. I have even gone so far as to propose that perhaps we do away with the concept of unstructured data altogether in the corporate environment. If it is valuable, wrap it up, and let the data bring its own security and ownership along for the ride.

 

 

In the late 90s the Transactor team members at large viewed this type technology as fundamental to Internet commerce, as security and ownership are critical elements to conducting commerce, so the need was obvious to this tiny minority. There was considerable conviction that we were building ‘the right thing’. Many people outside the team thought we were a cursed group of morons, bringing our unneeded security to their projects, and told us as much. Especially members of other projects in house projects, who had our beta version DRM technology rammed down their throats under the guise of ‘eating ones own dog food ‘. While surprised at the hostility we generated at the time, it did prepare me in the coming decade as how those who are not worried about security perceive it as pure hindrance to their own activities, and willing to go to great lengths to avoid dealing with these additional challenges. I have come to expect that security is still not typically part of the development process because it is not part of the specification, process or mindset of the development teams.

 

I have talked with several members of the security community about this over the last few months and the concept of a data centric security model is starting to gain some momentum. I will delve into some of these concepts and variations more thoroughly in the future, as there are many potential variants. There is no hurry because the market is still 3-5 years away at best. We are a long way away from viewing data security as an enablement for conducting transaction in open – and subsequently more risky – environments. I hope that Gunnar’s article will get some attention by software architects in the meantime, as less time discussing the use of POJO’s, and more time discussing security in a distributed processing environment is needed.

Tech Security Conference

Feb 20th.

 

                           I was headed over to the Tech Security Conference on February 20th.   It's being held at the Santa Clara 'Network Meeting Center'. Never been there, but I wanted to check out one of the end point security presentations.   Shoot me an email if you are planning on going.

eWeek: DLP, DAM Share Common Data Security Objectives

Content-aware technologies.

Brian Prince of eWeek published an article on the similarities of Database Activity Monitoring and Data Loss Prevention shook me from my morning calm.

Brian is on target with his opening statement, that DAM & DLP are both trying to protect data and they work in/on a separate area of the IT infrastructure. And I could not agree more with the ending quote by Mark Nicolette of Gartner that "We expect a few acquisitions of DAM vendors by large vendors that have DLP technology …"  I agree because Data Security, from the customer perspective, is viewed as a single problem. They do not differentiate between data theft at the database, file server, network or application level. They want a unified solution to deal with insider and external threat and not worry about the vagaries of packet inspection on the network or agent based issues. What is more, it is far more appropriate to develop a single data security policy and deploy it to the software/appliances that actually perform the inspection. The industry needs to consolidate to provide a unified security strategy for customers who really don’t care about the widget that gets the work done, just that it gets done. 

 

So my quibble with this article … and you probably could guess this was coming … is the quotes are disjointed, somewhat contradictory and (from my perspective) misses the state of the industry. Here is what I mean, and while I have a lot of respect for Paul Proctor, I find this befuddling: "DAM [Database Activity Monitoring] and DLP tools will not likely become one product because they have different buying centers and purpose, but DAM tools will likely become content-aware."

 

I think DAM and DLP as tools will in fact coalesce for the reasons stated above. Business rules and policies, coupled with whatever dashboard to review reports and status is a likely customer interface, and the data collection & analysis tools that sit  below should be and will be invisible to the user. Think about who the audience for these tools are and I think you will agree that these products (or tools) do in fact coalesce. 

 

But the issue that really gets to me … actually annoyed me enough to write this Blog post is as follows: IPLocks released a Content Monitor product in 2002 to … now watch for it … Monitor Content! And, before you ask, it really is content aware. We were so happy with the concept we patented it (reference).  So I can say with a high degree of certainty it is more than ‘likely’ to happen, it happened a long time ago.  And I believe there might be another vendor out there today who offers it as well. We thought that a Meta Data monitor, to watch some of the quasi-data and structural changes was a nice complement as well. No disagreement that there is value in content monitoring, just seems appropriate to be talking about the vendors who offer it today as opposed to speculating as to it’s value in DAM solutions.

 

And I want to offer what I consider to be a slight clarification on a comment from Ted Julian "We think its critical customers can discover sensitive data automatically, even on databases they don't know they have," Julian continued. "Network appliance-based solutions just aren't practical in this regard, simply way too cumbersome and expensive."

 

Data discovery is different than content sensitive DAM.  More to the point, there are several forms of data discovery, but typically it is either an active interrogation of the database to discover sensitive content or a passive monitoring of the network for content. A network based appliance can work well in this later regard, in fact I think most of the DAM vendors say they provide this, but I have no argument that it is a little more unwieldy for the former methodology. 

Virtualization & Power Consumption

Can energy consumption drive application improvements?

The first keynote session at the InfoWorld Virtualization Executive Forum was by David Reilly of Credit Suisse. Fascinating discussion with dozens of interesting points raised, but the topic I was most interested in was Mr. Reilly’s response to an audience question “Do you monitor power consumption and at what level? His response was that they do; at the box, cabinet and room level. He said he can even judge applications on how much power they use, and compare them head to head.

 

I think it is great that Green Technology and power savings is driving some IT decision making, and Virtualization helps with our ability to measure consumption. Not just provisioning memory and processor, but power as well. Various changes make this worth spending time to consider: Power has gotten significantly more expensive. Global Warming is no longer considered a kooky left wing hoax, but a real environmental issue. Heat in the data center continues to climb. There are signs that the nearly linear progression of

Moore

’s law may be coming to an end. All things told, we need to continue to look for efficiency and cost savings where we can, and I think it is great the companies like Credit Suisse is monitoring power usage, especially if they make some of their application purchase decisions based upon this metric!

 

I started my career in Operating System development. At that time memory and processing power were rare resources that we had to use efficiently. We had to make clever uses of things like ‘Overlay’ files to optimize the use of memory, and we spent considerable time reviewing the merits of sort algorithms, queuing theory, hash functions, caching, call backs and every other operation to improve resource usage. Today we see Applications and Operating Systems that are developed seemingly without regard for efficiency and offer shockingly poor performance even with wanton consumption of resources. Installing services into memory when they are not needed, applications grabbing huge chunks of memory that will never be used, OS’es that are not judged by how fast and efficiently they provide resources, but how many features have been packed into them. Sure, it’s worse in consumer software than commercial, but still, I could swear it’s like the vendors are looking for ways to waste processor cycles and memory.

 

If we can measure resource consumption at this level – memory, processor and power – and alter corporate buying decisions based upon this, we provided a real emphasis for software vendors to look at efficiency of resource usage. Virtualization not only allows for inspection and comparisons, it really demands attention to general resource consumption metrics. If an application not only has to meet certain feature requirements, but resource usage requirements as well, IT organizations have yet another metric to judge software quality and cost. And a way to push back on some of these horrid programming practices by a huge number of software & tool vendors. The direct and indirect benefits could be considerable savings.

 

Now if we had security metrics that were this straight forward.

Re: Virtualization & Power Consumption  

 

            Comment from Christine on February 9, 2008 12:23:18 PM PST  

 

   

Great idea. But the market isn't ready for this.  Don't get me wrong - Green is good. But Green is also a theme and a very hip one at that. Just take a look at the money being poured into all manners of Green (and not so green but masked as green) investments.  Reminscent of 1999 / 1999.

Application vendors need to make better quality and efficient code. Vista and Office 2007 is a classic example. Was it really necessary to redo the whole Office UI so that it takes 5 minutes to find the 'align objects' function??  Where app vendors struggle is on understanding what the business problem is they are trying to solve.  The 'every function but the kitchen sink' comes from trying to be all things to all people in the quest to expand market share. Most users will tell you that enterprise apps do, at best, 60% of what they need. The other 40% is inhouse code, 3rd party software with overlap capabilites or good ole' human intervention. 

Until app vendors get their solutions 'on the mark' code bloat and it's associated power hogging will not abate. Beside what would all those hardware and virtualization vendor sell?

 

The Future of Virtualization & Security

Hoff Rocks

Christopher Hoff gave an excellent presentation yesterday in

San Francisco

at the InfoWorld Virtualization ‘Executive Forum’. I am glad he badgered InfoWorld, and in turn them giving him a presentation slot because he provided one the of highlights of the show. Even if you are not interested in security, I would pick up the slide deck when it becomes available. This is the clearest vision of the future of Virtualization I have seen, weaving together the different ways the large and mid sized vendors are positioning their products to gain market share, he makes a very compelling case as to what we can expect in the coming 2-5 years.

 

A couple points I found most interesting was the uncertainty of the attack vectors and appropriateness of today’s solution set.  He has covered this on his Blog to one degree or another, but the concepts coalesce nicely in the presentation, and I wanted to mention here for those who are considering Virtualization in and around their databases.  And I am paraphrasing …

 

Most of the attacks on Virtualized environments are hypothesis or lab work, with few to none being ‘in the wild’.  This makes it hard for companies to digest why exactly they need to worry about security in and around hyper-visors over and above what they have today.  There is no tangible understanding why existing security tools are insufficient to meet the challenges as they have not fully examined security from this new perspective.  Hoff’s presentation really hammers home how Virtualization in all likelihood does not lessen the number of threats, but provided new many new ones to worry about. 

 

The other point is the difficulty believing security vendors with their Virutalization security products because they are probably providing exactly what they provided before … just in the virtual environment.  If this is a failure to account for the variations in the environment, or a marketing frenzy to get into a nascent market, changes will need to be made in order to be effective.  Examples?   If we Virtualize the network layer, does your IDS and NAC continue to function?  How do we discover services, applications and machines to assess and patch in this environment? We can spawn identical Virtual copies of an application nearly at will, so how do we maintain trust in SOA or distributed database environment? How do you detect a rogue clone? How do you keep your database from being v-Motioned to a non-trusted platform?  Depending upon the platform we use, and what gets virtualized, the security tools we use today may or may not work.

Our assumptions on trust and security will need to be re-examined.    How we deploy monitoring, auditing and assessment  solutions will need to change as data collection, policy deployment, enforcement and remediation become more complex.  A very interesting set of challenges in the future. 

 

Anyway, the slide deck it is worthwhile reading. And if it’s not too risqué, I hear InfoWorld may even post his “Interpretive Security Dance" video from the post forum cocktail party. Who knew ‘Safety Dance’ had so much hidden meaning?   

Virtualization and Security

InfoWorld Executive Forum

I spent Monday up at the InfoWorld Virtualization ‘Executive Forum’ up in

San Francisco

. It ended up being a really educational event on a number of different fronts. Database Security & Compliance is not usually considered part of this revolution, but as Virtualization breaks many IT infrastructure models we have been using and creates dozens of new trust relationships, it requires rethinking data collection, policy management, enforcement and many other areas of data security as well. I will be making a couple of posts on this in the next few days, covering some of the high points and interesting revelations about these changes.

 

Virtualization is here.  And if your in IT, you probably already know this.  The degree that companies are rushing headlong into Virtualization I found startling. It’s like the IT administrators said “Hey, this is cool, and it could save us money”, and then people in  middle management said “Wow, that is cool”. Then they rushed off to see how fast they could virtualize their infrastructure, like high school kids rushing off with spastic euphoria on the first day of summer vacation. And in a very short time we have arrived at a point where a majority of US firms already implementing Virtualization, or they are in process.

 

Then someone in accounting asks “Why did you pick Virtualization platform A over platform B or C. Couldn’t we negotiate a better price is we play the vendors off each other?” Then the CIO asks “What is our Virtualization Strategy? How will we manage this infrastructure and what other tools do we need?” And the Risk Management group asks “What metrics are you using and how are we incorporating this into our Capability Maturity Model?” And then the CISO (Played by Chris Hoff in this movie) asks “Have you given any though what-so-ever to security?”  This is approximately where we are today, killing IT's "Buzz" by asking a lot of ugly questions.

 

The technology is very cool and the conference opened my eyes to a couple ways the technology can be used that I had not considered before. The different ways you can slice and dice the IT services is truly amazing. But it feels a little ‘Wild Wild West’, with lawfullessness and civilization left behind for the exciting new frontier.  This is certainly accelerating the adoption of the technology, and the appropriate timescale to measure the changes will be months, not years. Formal processes & controls will eventually catch up, and I imagine much of the double-digit cost savings will boil away to more modest levels given the needs for documentation, planning, training, workflow, source control, backup and disaster recover. Oh, yeah, and Security.  Once again, security and compliance will be forced to play catch up, and be patched onto existing infrastructure.

Say what you will, it will not be dull in Security for the next couple of years.

My Beef with PCI

Shortcomings with the PCI specification

I am frustrated with the Payment Card Industry Specification. Perhaps it’s 9 straight days of rain that has me crabby, but as I was referencing the PCI specification v1.1 today, I found myself annoyed enough with a few things to Blog about it.

 

Metrics: PCI metrics?  Where do they talk about measurement of compliance? How do you judge? Is it a secret? For Sarbanes-Oxley you have to list the controls you have, demonstrate that they are operational, and periodically show that they are appropriate. I see no mention of controls, and no corresponding measurements in the PCI specification. Security is not a black and white issue, and there should be metrics in place to help get a handle on how you stack up, and see if you are making improvements. Security is not a destination ...

 

What data to keep? There is a list of Credit Card related items that you can store, and what you may not keep. There is no explanation of what is optional to keep, how long the information can be kept, or should be kept for that matter. To me, the best way to reduce the possibility of data theft is don’t keep it around. Why is this not discussed? Why is does the PCI standards board not place an addendum in the specification on way to reduce CC data?

 

Network focused! Is it just me or is this document written by a group of security experts from the network realm? Perhaps I am being overly sensitive, or perhaps because the word ‘network’ comes up 58 times, and the word ‘application’ 27, but the entire PCI specification seems to be looking at the problem of credit card security from the transport layer up. If I am worried about the privacy and security of Credit Card numbers and related information, I am most worried about where the data is stored, and second where CC# is used. I am far less about how they are moved. Why? Because network encryption available, it’s very effective, and is far easier to implement (and implement well) that other types of encryption. It can be retrofitted into the unsecured environment without affecting business operations, and does not require the inspection of the data that is being transported. Applications, both those that use the information and store the information, are at a distinct disadvantage in terms of complexity and threats. The focus of the standard seems backwards to me.

 

Security 101.  There is nothing extraordinary about PCI. There is nothing in here that is novel or cutting edge about the recommendations. It’s good basic security. Organizations should be doing this … already. PCI is a minimum set of best practices in my opinion, and it still falls short. And we have companies with data breaches trying to hide behind a PCI compliant moniker?  Grrrr! 

 

Data Encryption and Compensating controls. My beliefs in this area are not widely shared. Encrypt all your backups! It’s no longer an optional practice! Encrypt Credit Card information in the database if you can, but as it may not be possible without a serious issue, compensating controls can be equally effective.

 

At various ISSA and ISACA meetings I have attended, I am always shocked that a majority of IT administrators do not want to implement encryption on backup tapes. At one meeting in

San Jose

the crowd was unanimously against (well, except for me) it! The fear they voiced was not being able to locate the key and algorithm and decrypt at a future date, and not being able to recover. Yep, key management is tough, but it is part of the process.  So I am not surprised this is not happening because the people responsible for it are fearful for their jobs, but this needs to happen.

 

The last time I implemented a credit card payment application, I did not encrypt the credit card data I kept in the database. I chose to use a separate database, with separate user account, with processing constrained to a small set of stored procedures, surrounded by a small set of checks and triggers to verify security and thus allowing no person to see or use the data. In a company full of cryptographers, long before their was a PCI standard, I made that conscious choice because I could show equal security and two orders of magnitude faster processing. As far as compensating controls, if they are intelligently designed, they can be a very effective alternative to encryption.

 

I would like to see PCI offer examples and scenarios about the proper uses of encryption, key management best practices and compensating controls. If you provide guidance, some of the mystery goes away, and adoption rates climb.

 

Enough ranting. I think there is sunshine outside. Time to get some fresh air.