My Security Planet » Tags » Information and Security

Feeds

13620 items (0 unread) in 75 feeds

• Jeremy Zawodny's blog
• Mozilla Webdev
• Transcendental Technical Travails
• Ian Bicking: a blog
• Hackosis

WebSecurity

• Watchfire Application Security Insider
• BlogSecurity
• sirdarckcat
• Google Online Security Blog
• CGISecurity.com: Your Web Site and Application Security Resource
• Switch/Twitch
• mybeNi websecurity
• cat slave diary
• SecuriTeam Blogs
• Curiouser and Curiouser
• Alex's Corner
• Billy (BK) Rios
• Chris Shiflett
• christian's weblog
• funkatron.com
• GNUCITIZEN
• The Spanner
• hackademix.net
• Ruby on Rails Security Project
• It's a shampoo world anyway
• Web Security Blog
• ha.ckers.org web application security lab
• Yet Another Infosec Blog
• PHP Security Blog
• Security Thoughts
• Sunnet Beskerming Security Advisories
• Disenchant's Blog
• Sylvan von Stuppe
• Larholm.com
• The Turkey Curse
• Jeremiah Grossman
• Anurag Agarwal - Application Security Evangelist
• Ivan Ristic
• deep inside | security & tools
• omg.wtf.bbq.
• BlueHat Security Briefings
• Tactical Web Application Security
• .:Computer Defense:.

Security

• tssci security
• Plynt Penetration Testing Blog
• Michael Howard's Web Log
• Security Retentive
• BindShell.Net
• Dominic White's .tHE pRODUCT
• SecurityFocus News
• Justice League
• Schneier on Security
• Rational Survivability
• terminal23
• 1 Raindrop
• hiredhacker.com
• Matasano Chargen
• Security Vulnerability Research & Defense
• Michael on Security - Musings on Information Security
• Fortify blog
• The Art of Software Security Assessment
• GDS Security Blog
• Vodun.org
• Robert Penz Blog
• Mark Curphey - SecurityBuddha.com
• Liminal states
• Security Ripcord
• ModSecurity Blog
• IBM Internet Security Systems Frequency X Blog
• Suspekt...
• extern blog SensePost;
• Zero in a bit

SEO

• SEO BlackHat: Black Hat SEO Blog
• busin3ss.name

Tools

• Opensourcetesting.org News

4 items tagged "Information and Security"

Related tags: Software [+], republica08, identity, federated, Web, Touchpoints, Tools, Star, SDL, Random, PHNeutral, OWASP, Network, Mobile, Local, Events, Enterprise, Deepsec, DataCentric, Data, Cyber, Corporate, Content, Conferences, Computing, Cloud, Chamber, Centricity, Breaches, Bluehat, Awareness, Application, All, AJAX, 25C3

Rational Survivability

• 

  Beware the Transparent Proxy...Your Faith In VPNs Might Waiver

  Posted: November 20th, 2008, 6:13am CST by beaker

  Tags:  Information Security   [edit]

  Aviram from the Securiteam blog wrote a post titled "Who's Your SMTP Daddy?" that caught my eye regarding the false sense of security that use of corporate IPSec VPNs brings to traveling road warriors due to the use by providers of so-called transparent proxies.

  Let's say that you've got some sort of IPSec VPN solution installed on your laptop using the standard corporate configuration with your mail client pointing to mail.foo.com.  Your machine has AV, HIPS, firewall, etc.

  You connect to a provider's network (wired, wifi, hotel, airport, etc...) and fire up your VPN client which authenticates just fine.  You then launch your mail client and type a quick note to your CEO about the confidential M&A project you're working on.  A few minutes later you get a response from your CEO to proceed with the tender.

  You disconnect.

  Here's the problem: that SMTP session you thought was encrypted through your VPN back to the corporate mail server was actually sent in the clear.  In fact, it wasn't even sent through your mail relay/server.

  Here's a great example of why taken from Aviram's blog:

  A quick investigation shows the following: The hotel’s network blocks my VPN (as some of them do) but happily resolves any unresolvable host name (such as my SMTP server’s hostname). This is resolved to a catch-all server that proxies everything. Transparently. (well, almost)

  Lesson learned. Changed the hostname to the IP, and will soon switch to SSL based SMTP who will authenticate the server. In the meanwhile - be careful from helpful Beijing wifi providers who are only too happy to forward your mail on! (with some changes, of course).
  

  Aviram is in China, but this example is valid in many countries and you can probably expect that given the behavior of some domestic ISP's, Telcos and Mobile Operators that it is or will go on here too.  It could easily work with other protocols that aren't sensitive to session tampering/MITM.*  Further, Aviram's example was about interception.  There's every reason to believe that one could expect the content of your email to be modified also...

  I personally use SSL authenticated SMTP with valid issued certificates so at least if there is tampering with my session, my mail client barfs letting me know something is wrong.  That error probably wouldn't help the average sales droid in the field as he/she would just click OK like most people do to any security error that pops up, but it's worth considering.

  /Hoff

  * Obviously this example presents a worst case scenario with certain configuration assumptions and license taken for illustration, but take the message for what it's intended: blind faith in VPNs can cause you some serious heartache.  Transparent proxies work very well...

  
• 

  Down Under: Where Security Is SO Last Tuesday...

  Posted: May 7th, 2008, 8:15pm CDT by beaker

  Tags:  Information Security   [edit]

  I read this article from Network World (Australia) where the author relayed the pinnings of C-levels from Australia and New Zealand by titling his story thusly: "If only reducing costs was as easy as security, say CIOs"

  It seems that based upon a recent study, IDC has declared that "...conquering IT security is a breeze for CIOs." 

  I'm proud of my Kiwi lineage, but I had no idea my peeps were so ahead of the curve when it comes to enlightened advancements in IT security governance.  They must all deploy GRC suites and UTM or something? 

  Anton, there must be something in the logs down there!

  As per that famous line in "When Harry Met Sally," I respond with "I'll have what [s]he's having..." 

  Check this out:

  The IDC Annual Forecast for Management report surveyed 363 IT executives from Australia (254 respondents) and New Zealand (109 respondents) across industries including finance, distribution, leisure and the public sector.
  
  Information security was rated last place in the Top 10 challenges for CIOs.
  
  Threats targeting the application layer were cited as the biggest concern (36%), while spyware (16%) was rated as a bigger threat than disgruntled employees, remote access, and mobile devices.
  
  The CIOs top priority for the next 12 months was reducing costs and addressing a lack of resources. This was followed by meeting user expectations and developing effective business cases.
  
  The top four IT investments for the next year will be in collaborative technologies and knowledge management; systems infrastructure; back office applications; and business intelligence.

  I'm no analyst, but allow me to suggest that just because security is not the top priority or "challenge" does NOT mean they have the problem licked.   It simply means it's not a priority!

  Perhaps it's that these CIO's recognize that they've been spending their budgets on things that aren't making a difference and should instead be focusing on elements that positively impact corporate sustainability and survivability as an on-going concern instead?

  The most hysterical thing about this article -- besides the re-cockulous premise they overly-hyped and the (likely) incorrect interpretation of results the title suggests -- is that on the same page as this article which suggests the security problem is licked, we see this little blurb for a NWW podcast:

  

  So, there we have it.  A direct tie.  Security is solved and failing, all at the same time!

  Sigh.

  /Hoff
  

Justice League

• 

  Security And Market Forces

  Posted: March 6th, 2008, 5:04pm CST by jOHN

  Tags:  Software Security Software Security   [edit]

  Gunnar Peterson wrote an excellent post lamenting the lack of market forces in the security space.

  I don’t know when we’ll see such market forces affecting companies but do agree they would have a positive impact. Certainly, I get why the security space hasn’t been subject to market forces yet though:

  • People haven’t historically been ready to pay for it
  • Companies haven’t entered the market with something valuable enough to invest in

  First: what people are willing to pay for. Simple question: if a development team has a $10M budget, how much does it, say, spend on quality? 10-40%? OK. How much does it spend on software security?

  Second: The security space, at least with respect to Software or Application Security, has indeed moved beyond its purely missionary roots: people know they face a problem. People do not, however, know what to do about it.

  Lack of direction hasn’t resulted from the vendors’ failed productization of a tool set or services though. No, it’s resulted from the lack of mature solutions in the space. Penetration testing companies were gobbled up last year but my experience has been that, for the most part, customers haven’t been willing to invest in these tools far beyond their initial purchases and the smallest amount of shepherding.

  In fact, most organizations I’m working with have seen either a reduction in reliance on or an outright backlash towards penetration testing. Use of static analysis tools and code review, while on the rise, has not reached ubiquity in response (We’ve yet to see what will happen in a broader context, having only completed what I consider to be the early-adopter phase).

  What do we do about it? Partnering more closely with customers has been something I’ve felt very strongly about. Listening more closely to them remains crucial. Even involvement at this level can be tricky to fund at all but the most interested customers.

  There’s work to do as vendors too. Because, while we’re through the missionary phase, we’re not through the education phase in security. We must spend more time helping clients understand what attainable next steps look like for them. Moreover, I think we have to work with them to solve some of the problems we’ve avoided: we need to clarify salient next steps ;-)

  How are we really going to get enough security knowledge in the hands of developers to change their behavior in a sustainable way? How are we going to scale code analysis so that it has some of depth of expertise, manually applied, but all of the consistency and speed of automation?

  Technorati Tags: software security

Rational Survivability

• 

  OMG, Availability Trumps Security! Oh, the Horror!

  Posted: February 1st, 2008, 7:40pm CST by beaker

  Tags:  Information Security   [edit]

  Michael Farnum's making me shake my head today in confusion based upon a post wherein he's shocked that some businesses may favor availability over (ahem) "security." 

  Classically we've come to know and love (a)vailability as a component of security -- part of the holy triumvirate paired with (c)onfidentiality and (i)ntegrity -- but somehow it's now incredulous that one of these concerns can matter more to a business than the others.

  If one measures business impact against an asset, are you telling me, Mike, that all three are always equal?  Of course not...

  Depending upon what's important to maintain operations as an on-going concern or what is required as a business decision to be more critical, being available even under degraded service levels may be more important than preserving or enforcing confidentiality and integrity.  To some, it may not.

  The reality is that this isn't an issue of absolutes.  The measured output of the investments in C, I and A aren't binary -- you're not only either 0% or 100% secure.   There are shades of gray.  Decisions are often made such that one of the elements of C, I and A are deemed more relevant or more important.

  Businesses often decide to manage risk by trading off one leg of the stool for another.  You may very end up with a wobbly seat, but there's a difference between what we see in textbooks and what the realities in the field actually are.

  Deal with it.  Sometimes businesses make calculated bets that straddle the fine line of acceptable loss and readiness and decide to invest in certain things versus others.  Banks to this all the time.  Their goal is to be right more often than they are wrong.  They manage their risk.  They generally do it well.  Depending upon the element in question, sometimes A wins.  Sometimes it doesn't.
  
  Here's a test.  Go turn off your Internet firewall and tell everyone you're perfectly secure now.  Will everyone high-five you for a job well done? 
  
  Firewall's down.  Business stops.  Not for "security's sake."  Pushed the wrong button...

  Compensating controls can help offset effects against C and I, but if an asset or service is not A(vailable) what good is it?  Again, this depends on the type of asset/service and YMMV.  Sometimes C or I win.

  Thanks to the glut of security band-aids we've thrown at tackling "security" problems these days, availability has become -- quite literally -- a function of security.  As we see the trend move from managing "security" toward managing "risk," we'll see more of this heresy common sense appear as mainstream thinking.

  Since we can't seem to express (for the most part) how things like firewalls translate to a healthier bottom line, better productivity or efficiency, it's no wonder businesses are starting to look to actionable risk management strategies that focuses on operational business impact instead.

  Measuring availability (at the macro level or transactionally) is easy.  IT knows how to do this.  Either something is available or it isn't.  How do you measure confidentiality of integrity as a repeatable metric?

  In my comment to Michael (and Kurt Wismer) I note:

  It???s funny how allergic you and Wismer are toward the notion that managing risk may mean that ???security??? (namely C and I) isn???t always the priority.  Basic risk assessment process shows us that in many cases ???availability??? trumps "security." 

  This can???t be a surprise to either of you.

  Depending upon your BCP/DR/Incident Response capabilities, the notion of a breakdown in C or I can be overcome by resilience that also has the derivative effect of preserving A.

  Risk Management != Security. 

  However, good Security helps to reinforce and enforce those things which lend themselves toward making better decisions on how to manage risk.

  What???s so hard to understand about that?

  Sounds perfectly reasonable to me.

  Security's in the eye of the beholder.  Stop sticking your thumb in yours ;)

  Speaking of which Twitter's down. Damn!  Unavailability strikes again!

  /Hoff