Information Centric Security

Blog Monitoring and Analytics.

Ran into a firm called "Collective Intellect" during RSA week over at the Ziff-Davis briefing. Their product, mediaintellect, was different enough of an offering that I thought I would make a comment on this concept. While not security oriented, they are Blog oriented. They advertise "Real-time actionable insight from social media monitoring and analysis"€.  Basically they monitor blog traffic and content for market research and feedback. Good product? Bad Product? I have no idea.   The people I met from the company were nice enough, but there is something about 'predictive marketing intelligence' for social media that makes me uneasy.

A Rothman-esque 'So What?' is in order here. What are they going to do for you? Are they going to tell you if your corporate blog sucks? Or they can tell you your marketing campaign sucked because some bloggers they read said so? Is there really a way to do this based upon traffic and key words? Can you really quantify brand influencer's? And you want this service why? I got to wonder if this an angle for PR & Analysts to re-insert themselves into the process now that their opinions are not interesting enough to generate their own readership. Blogs Analysts: can they provide value or are they simply parasitic?

Clearly Blogs have upset the PR apple-cart.  And I can see how mediaintellect would to fill a need for PR and Marketing departments to make some sense of Blogs and use them to their benefit.  But I read Blogs that are decidedly non-corporate for the reason that I don't want to wade through the endless controlled-sanitized-non-informative-corporate-attorney-approved marketing spin that most companies pump out. It is marketing influence I am trying to get away from, and this tool/service provides those organizations a way to monitor and affect the very medium I use to avoid their influence.  ~Shiver~  Maybe I am overly sensitive and this is simply a natural evolutionary step based upon the fundamental change in media and broadening of audience, such as Black Hat changing to look more and more like the RSA conference with each passing year.

Thompson's RSA keynote.

I finally got around to watching John Thompson’s RSA keynote address this morning. I was hopeful that there would be something interesting here. There was. He was speaking on the topic of Information Centric Security. This is surprising to me. Partially because this is a concept that a lot of people in security have trouble getting their head around. So if the leaders in security still have trouble conceptually, mass acceptance is probably a long way off. Even more so, Information Centricity would require a metamorphic change to the products Symantec produces today. A decidedly non-perimeter, non-network, non-packet model that requires bi-directional establishment of trust does not fit with what they offer today. I am unaware of any company CEO that really follows through with changes that would adversely affect the usefulness of their core revenue generating products.  Still, his advocacy is encouraging.

There is a link for the presentation here if you did not see it during RSA.

The quote “The battleground for security no longer revolves around the infrastructure, it revolves around data” gives me a warm fuzzy feeling, being a non-network security guy.  Sure, a statement taken unto itself is rather generic. Just because you perceive a need to move away from a perimeter or network based model for security does not necessarily mean you endorse an information centric model.  But when put in context to the remainder of the presentation and the other quotes about the need for an information centric approach to security, digital rights management, security as a business enabler, white listing, linking security with data management, it appeared to me that he really ‘gets’ it. I am not trying to be condescending, rather my point is this does not appear to be marketing speak, but genuine understanding. Cool. I will be interested to see what the strategic product roadmap looks like to get there.

 

p.s. Does anyone know where the statistics came from about reaching the ‘inflection point’ that the lines of malicious code has grown equal to the lines of ‘legitimate’ code produced on a daily basis?

Oracle Critical Patch Update for April 2008

Comments on database security notice.

 

I just received my notification for the April 2008 security update from Oracle. Some information can be found here, and scroll down to the ‘Oracle Database Risk Matrix’. Unlike some of my peers in the industry, I have usually been pretty happy with the patches that come from Oracle for security. What is more, they tend to release security patches on a very regular schedule, so the DBA in me appreciates this consistency both because Oracle has trained me to look for it, and subsequently can plan the deployment of the patch into my normal workflow.

What bugs me is the lack of information pertaining to the threat, or what the real issue is, when looking at the contents of the security patches. Why the lack of details? I am not too sure if this is because they have the mindset that they do not want to reveal too much information to would-be hackers, which is a laughable assumption, or if this is some legal mumbo-jumbo to reduce liability. Regardless, it’s annoying. I want to understand the threat so I can take appropriate action; for example I may not agree with Oracle’s threat assessment and desire an interim workaround prior to deploying a patch. Or I might alter my normal deployment schedule if I deem the risk too great to delay. But you cannot assess the urgency of the patch, or take appropriate action if you have no clue as to the nature of the threat, so in fact the customer has little information that is helpful.   ‘Critical Patch’ is only marginally more informative than ‘Threat Level: Orange’.

More important to this discussion: Oracle does not assign risk for your business. You do. Even if Oracle could produce a satisfactory definition for “Base Scores”, (here is a blog post that does a better job than the official Oracle documents) it is irrelevant to understanding the threat to your business. A database is not a standalone entity; rather it can have multiple audiences, applications, processes and users. If you’re going to provide a ‘Risk Matrix’, you need to include some information that is pertinent to the risk, not a list of code areas affected. Two completely different concepts that they have merged together as if they were equivalent. 

I don't think you need to jump out and install this ASAP, despite what some of the sensationalistic journalism based this patch release. The Oracle advisory states “1 of these database vulnerabilities may be remotely exploitable without authentication, i.e. may be exploited over a network without the need for a username and password.” But the ‘Risk Matrix’ lists Oracle 11.1.6 as the version affected. Even if the Oracle Base Score was considered a ‘10’, a complete system compromise, does this have an impact to you? As 11 is the only release affected, making the comments about databases being a ‘Sitting Duck’  are a little overblown IMO. I am unaware of any corporate client of ours who has gotten Oracle 11 out of the lab and into production, so the scope of this threat is minimal.

What does concern me is when areas of the code like DBMS_CDC_UTILITY and SYS.DBMS_AQ which are complex and have had vulnerabilities over time. Hackers tend to learn the nuances about specific modules and then attack them over and over again, thus why we see a chain of vulnerabilities against specific modules over time. But those modules tend to be the ones that were not designed with security in mind and why they were targeted to begin with.

I will post more once I get a chance to review the patches more thoroughly, so while I recommend you apply it when you get a chance, I do not see anything that is a huge hair on fire threat.

The Four Horsemen

The Network Is the Compu...oh, crap.  Never mind, it's broken. (Death)

Nearly made me snort coffee from my nose when I read this line. That is brilliant.  It is a long post, but worth the time to read.  It will take imagery like this for people to understand the fundamental changes offered by Virtualization ... or as I have heard many people  refer to it, the Virtualization ‘feature’ ... and subsequently why approaches to security need to be re-considered.  We may be marginalizing and commoditizing IT resources like processing, but we are breaking a lot of existing assumptions along the way.  It is going to be harder to determine where your data is, who has access, and how it is being used.  If you want an example set of why an Information Centric data security model is a good idea, this is it.

The week in review

Spent last week in San Francisco at various shows and events, so I thought I would share some of the high (and low) points.

 

IDC Virtualization Conference : I was at the Virtualization show on Tuesday just to get some variety during the week of RSA all the time. Really not much going on here at all other than product pitch after product pitch ad-nauseam. You would have thought they were selling condo time-shares. And here is a hint, if you are going to inundate us with a sales pitch, at least have coffee to keep us awake. 

The only presentation that actually had a customer success story, Pano Logic, happened to be the highlight. This is a very cool little box for client side virtualization. From a security standpoint, data is not floating around, as there is no disk or local memory to steal from. And the session follows the user to any location they choose to use. While not suitable for every user the benefits in both security and IT costs are considerable. Check it out!

 

Ziff-Davis: A very nice security briefing put on by Ziff Davis Enterprise in the evening, and followed it up with excellent food & drink at the reception. I have seen Lawrence Walsh presentations a couple of times now and I always enjoy them, and this particular “Risk Perceptions and Reality” was no exception. His research on where security dollars are being spent, and presentation points on applying those dollars in a more risk management oriented way is similar to some of the presentation I give, only his research data is better than mine. The major theme was ‘security will not improve until security becomes part of the business process’.  Not sure the audience was getting the point, but it was not for lack of trying. 

 

RSA:  How would I encapsulate the RSA show? In a word? “uhhhh”. I am too apathetic to yawn. It appears that they are still waiting for an answer to the question “What would Turing do?” Even the San Jose Mercury news only had a very tiny piece on Chertoff's presentation, so if they could not find much to write about you know it was bleak. 

It seemed to me that the industry has fallen back onto two of the ‘security pillars of truth’, access control and encryption. Essential ingredients to security cookbook, sure, but nothing that appeared innovative and new. Marketing these solutions to Governance, Risk and Compliance, which is new and possibly only 3 years too early, plus no one seems to agree on exactly what GRC means. Oh well, here’s to next year!

 

Security Bloggers Meet Up 2008:  The best after hours RSA party had to be the Security Blogger’s event organized by Jennifer Leggio at Fortinet. Great turnout, great people, great food and a whole lot of fun. I met up with people I have not seen in 8-10 years, and met a dozen so Bloggers who I have been reading for the last year or more.  Fun and educational. Great work Jennifer!

 

Miscellaneous fun #1: McAfee Hacks hackers. Did you know that? Their banner says so. I was intrigued, so I stopped by their booth and asked for a white paper on how exactly they do this?  What is it they offer? Can I pick the hacker to hack, or is it more random hacker hacking?  How do you reduce the false positives of hacking White Hat guys instead of Black Hat guys? What is my ROI? They took my business card and said they would get back to me. Maybe the product is still in Beta. 

Miscellaneous fun #2:  SFPD & Security. I took Cal Train into the city on Wednesday morning. It did not dawn on me that this may be a problem until I arrived and I heard that several of the bus lines were shut down because of the Olympic Torch. Then I started to worry when 10 kids with Chinese flags were walking along side of me right into the gauntlet of Sherriff’s officers.  Uh oh!

I have been to the out front of the west wing of the White House,  the executive building, the Senate and various other official places, but I have never seen a security show like this. Every hundred yards all the way up 4^th street were a pair of motorcycle cops flanking both sides of the street. Every nook, cranny and side-street had a Police, Sherriff, Marshall or undisclosed official vehicle standing by. Train schedules altered, bus routes changed or halted, streets barricaded, street lights run manually, profiling of participants, helicopters and more. Nothing going on as I guess they moved the torch route, but the Police were clearly on 100% alert. Amazing!

Miscellaneous fun #3:  A few years back, at the Oakland Coliseum, I had a disconcerting experience. I was walking out of the men’s room and was suddenly faced with half a dozen very large men in suits who were angrily walking towards me with hands reaching for me. At the last second the tall thin man next to me told them it was OK and they stopped in their tracks and just glared at me. I just so happened to exit the door and bump into Michael Jordan. His entourage was none too happy having me pop out of nowhere and be standing within inches of their charge. Cooler heads prevailed, but you never forget that split second feeling that things are not OK.

So I am walking around RSA exhibitor’s area on Tuesday, down a crowded aisle, and six guys in suits and short hair turned and are suddenly staring at me with that same glare of concern. At first I was thinking it was a secret service detail, and maybe Al Gore was in the area. Did I somehow look threatening in my casual sweater and dungarees? Then I looked up and saw I was standing in front of Guardium’s booth. Ah, now I get it! Move along!  Nice to know they care.

Miscellaneous fun #4: I was over at a partner’s Booth on Wednesday. I did not recognize anyone at the booth, nor did they recognize me. I decided to see what they were selling and what messages they were delivering at the show. Access Control. OK, what about the other security products you offer? I started to quiz them on database monitoring, auditing and the like. My questions were returned with blank stares. The first person did not believe they offered other security products … they do, trust me on this one … and the more senior representative said “Yes, we offer that product, but we have no one here who can talk about it”. OhhhhKay! Your spending $30K on a booth, collateral & shipping at a Security conference, not to mention whatever employee & lodging costs, and you don’t prepare to talk about your Security products?!?!? Nothing like wasting an investment. 

Contrasting Privacy & Integrity Models

Information Centric Follow-on comments

There was a comment on Rich Mogull’s blog page after he posted Principles of Information Centric Security about existing models for security and integrity, and comments on novelty. I think that is worth delving into in a bit more detail.

The Bell-LaPadula model, as I understand it, defines security states and governs how data moves between these states. Its motivation was to help prevent secure information from leaking by providing handling instructions. In essence it would provide decision support for who gets to do what to the data. This is a policy model for data. If your business application is secure document management, this would embody the business rules you might choose to implement, or one of several you choose to implement.

The Clark-Wilson model, as I understand it, is about data integrity. It advocates a user, application and data set triumvirate, along with a verification process, to ensure data integrity. Data and users are authenticated, and the ‘transformational’ algorithms certified for use with certain user& data combinations. In a nutshell, once data in the system is verified for integrity, every modification is subsequently verified before the transaction is completed. If your business application airline flight scheduling, this would be a framework to ensure that all operational and logistical restraints were met prior to scheduling to ensure consistency.

Conceptually, either model could be implemented in an Information Centric manner, or it could be implemented at the Application level (typical), or it could be implemented at the network/device level (is a DLP-esque way).   Clark-Wilson bases the rules on a controlled system. We are moving to systems that are globally networked and we cannot necessarily rely upon central, organized control. Hierarchical security models with mono-directional establishment of trust do not work.

Clark-Wilson has a couple of weaknesses as by definition it implies a closed ‘system’. It relies upon certain trust relationships that may not be valid, for example, within an SOA framework. How do you ensure the integrity of the transformation model? A Rogue can simply ignore the rules of the game. ‘System’ certified relations may not be trusted, a user does not have a way of certifying the systems because there is implicit trust in the relationships as defined. Could it be augmented to fill these gaps? Probably. But this is the tit-for-tat game we have been playing at for decades.

I could make similar statements for Bell-LaPadula in non-trusted environments, and I would also recognize that Bell-LaPadula could be augmented to deal with the issues raised above. That is neither here nor there. My point is not to point out weaknesses in these two models, and these both do what they were designed to do very well. I do want to show the differences in that wrapping security and integrity up with the data, and providing that bundle enough information on defending itself from un-trusted applications, or subverted access controls.  An Inside-Out model, not Outside-In.

 

Also, on the subject of novelty:

I tend to view many things that may not be novel as revolutionary. The first plasma television picture was shown in a lab in 1970, but even in 2002 I could not have imagined having a 50 color television set hanging on my wall!  Patents for novel concepts often lapse before a genuine embodiment ever appears in front of the public. Information Centricity is not novel as discussions and papers have been made available to the public for at least a decade. That does not diminish what I consider to be a more revolutionary than evolutionary approach to security that Information Centricity provides.

“Shortly after I published my paper on ‘Fuzzy Logic’ I started to hear the murmurs and snickering in the hallways behind my back. Not just students, but professors, my own peers, thought I was a fool for seriously proposing such an idea … several years later the Japanese adopted the concept as an effective method of scheduling trains for their rail systems. I was then lauded as a genius by many ... I don’t believe either group is right in their assessment, but the answer probably lies somewhere in between”.

That quote was made by Professor Lofti Zadeh at the beginning of a lecture I had at Cal in 1998. (Or was it 1999? Perhaps my memory is a bit fuzzy as well). Fuzzy Logic was not novel at the time of adoption, but certainly revolutionary in the approach. The evolutionary changes in IT infrastructure has rendered many of our basic assumptions on trust and reliance invalid. Information Centricity turns the trust hierarchy upside down, and would fit my definition of a revolutionary approach. It has its own set of problems, but it addresses many common problems we have with confidentiality, integrity and security. Not a panacea, but a big step forward.

Vulnerability Assessment

 

It’s not just for security anymore!

Vulnerability Assessment has traditionally been  the way to check your servers and application for their respective patch levels. The motivation was to make sure that security patches were in place to address vulnerabilities, and the typical process to scan the network ports of all servers to detect. There are lots of tools out there that perform this kind of assessment. There are even great free tools out there like Nessus that can provide a fairly good general discovery and assessment services. But there is only so much information available at the network level, and this type of scan no longer provides the depth of information a typical IT administrator needs.

In the database and application realm, Assessment has changed quite a bit in the last year or so. Database Vulnerability Assessment (DBVA) or Application Vulnerability Assessments, are more operationally focused. Sure, Security is still a driver, but what I am seeing is the function is oft put under the umbrella of Compliance or Operations.  In practice, DBVA has evolved into a very different product than your typical network based vulnerability assessment.  They have evolved into agent based, script over SSH, or even JDBC/connection oriented interrogations. The result of being able to see inside the application, and how it uses the surrounding system, provides far better depth of information and allows for greater analysis of security and compliance.

‘Who cares’ you ask? 

Compliance and Audit: Compliance efforts do not differentiate between assessment, monitoring and auditing technologies, only that they have a list of requirements to meet. Preventative controls forms a huge portion of the list and that is typically where assessment is best suited. Assessment provides the method to accurately detect the configuration setting or patch level, as well as a comparison with what industry or (more importantly) company compliance standards are.  They check to ensure that controls are in place, permissions are appropriate, unneeded packages are not present, and that features like audit are turned on when necessary. The tools tend to be far simpler to use than IDS or Monitoring , and thus allow non-technical people to perform policy management without requiring DBA or IT Admin intervention. 

IT Administration & Operations:  Most of the large firms I speak with have corporate standards for how applications are set up, approved versions of software, and a deployment or rollout process.  Software is not updated every time an update comes along, a la Anti-Virus. For eBusiness applications and databases like Oracle, for example, a certification process is run prior to rolling out the patches. How a particular issue is addressed, or even if it is addressed, is a decision made by several stake holders, and that policy decision is implemented in the assessment tool. Assessment is a place holder for corporate IT and compliance standards, and can also provide the data collection and reporting infrastructure to demonstrate policies are being enforced. 

Security:  Subtle trust and configuration issues that lead to security weaknesses that could be exploited are evident from the application perspective, and not visible from the network. For example, features and packages that can be exploited like external stored procedures or DBA roles that also carry OS Admin credentials. We are not just playing the security patch-up & catch-up game, but thinking like a hacker to examine where potential vulnerabilities are and what trust relationships may be subverted. Preventative measures and analysis is the intention to provide more meaningful security in context of the applications business use case.

Assessment is also being used as a ‘Stop Gap’ between the time is patched is the ability to send assessment results to other workflow systems, Monitoring or IDS in order to provide active security until the application is patched.

Notice I did not offer a Database Administrator perspective?  That is because they are one of many stakeholders, and while important to the overall process, not the driver for the business, security and operations issues that I discussed above.

You will also notice that the thrust of many posts I have made are about the coalescing of various security technologies like DLP & DAM under a policy management umbrella. I see security & compliance moving in this direction of a somewhat evolutionary step of policy puppeteer controlling various security and audit tools, and it has more to do with customer perception levels than real security rationale. VA is the closest I have seen to a pure policy engine, but not ultimately what I envision. I imagine we will see a lot of new offerings introduced to the market this year, but today Assessment acts as a very nice bridge between non-technical, quasi-technical and technical stakeholders who need to perform various certifications, audits and checks. It can also provide some degree of separation of duties in context to the security or compliance process.

Finally, preventative measures are a good starting place for security and compliance programs, helping to focus the more process intensive DLP or Monitoring solutions.  Fix what you can, Monitor what is vulnerable. As Rich Mogull noted in his series of posts on ‘Understanding Database Activity Monitoring’, Vulnerability Assessment that works at the application level provides both a depth of information pertinent to multiple stakeholder, and forms a very nice complement to Database Activity Monitoring and Auditing.  In fact, neither should really stand alone, but need to be complemented by one-another.