Perfect Forward Secrecy

What is perfect forward secrecy?

In cryptography, Perfect Forward Secrecy is a property of key-agreement protocols that ensures that a session key derived from a set of long-term keys will not be compromised if one of the long-term keys is compromised in the future.

Thus, if your webserver is hacked and the server’s keys compromised, the possession of these keys does not allow the attacked to decrypt prior communications sessions which may have been captured in transit.

When Perfect forward Secrecy is used, both parties to a communication session generate session keys on the fly, and only the two parties have access to the keys.  No one else can, even if they have access to the server's private key determine what the session keys were, and thus decrypt the session if it was captured in transit.

After the session is complete both parties destroy the session keys. The only way to decrypt the communication for the session is to brute force hack the session keys themselves, and breaking strong session keys is clearly much more difficult than obtaining a servers' private keys. Also bear in mind that each session will have different session keys so this makes an attackers job exponentially more time and resource intensive.

Which cipher suites are supported?

SSL supports Perfect Forward Secrecy using two algorithms, the standard Diffie-Hellman (DHE) and the adapted version for use with Elliptic Curve cryptography (ECDHE).   

Why isn't everyone using them, then?

Assuming the interest and knowledge to deploy forward secrecy is there, two obstacles remain:

• DHE is significantly slower. For this reason, web site operators tend to disable all DHE suites in order to achieve better performance. In recent years, we've seen DHE fall out of fashion. Internet Explorer 9 and 10, for example, support DHE only in combination with obsolete DSA keys.
• ECDHE too is slower, but not as much as DHE. (Vincent Bernat published a blog post about the impact of ECDHE on performance. Might have changed since 2011.)

The below graph from the blog post shows performance for 1000 handshakes of various cipher suites (RSA 2048, DHE, ECDHE, optimized ECDHE)

Support for clients

If you're willing to support both ECDHE and DHE, then you will probably be able to support Perfect Forward Secrecy with virtually all clients. But ECDHE alone is supported by all major modern browsers, which means that even with only ECDHE you might be able to cover a very large chunk of your user base. The decision what to do is entirely up to you. Google, for example, do not support any DHE suites on their main web sites.

Conclusion

If the performance hit is acceptable, sites should use Perfect Forward Secrecy as an extra layer of protection against server key compromises.

It security On the cheap

There are a  lot of people or there with a lot of opinions on fancy and expensive security tools which they beleive are required to ensure network security.

It is my opinion that a lot can be done to ensure a secure network with free and open source tools.

Spiceworks cans be installed on a spare pc and perform inventory and patch analysis.   Spiceworks.com

Trisul us a software package that runs on Linux and can monitor network traffic.
Trisul.org

Untangle can be installed on a system to provide a enterprise grade firewall.
Untangle.com

And Microsoft Security essentials us a free anti-virus software from Microsoft

While you can spend thousands to millions on commercial software an support,  there are open source and free alternatives.

Russ Dyer. CISSP CRISC
Security Analyst and Mobile Device Evangelist

DLP not a Golden Bullet

Realized the other day that buying a dedicated DLP solution is not better than using other tools and doing behavioral analysis of  users. We should be alerting on resume and job site access and correlating that against travel site access to try to identify users who are contemplating resigning.  Then monitoring those users for after hours file acces and large traffic volumes on the network. All this can be done without a Dedicated DLP solution.

New Nexus 7

The new Google Nexus 7 us a powerhouse pocket able android tablet that's a steal at 229 dollars.

http://www.google.com/nexus/7/

It's on my wishlist of gadgets for the mobile geek.

Catcher in the Rye

Information Security goes on the Offensive

By S. Russell Dyer BS(MIS) CISSP CRISC

Prologue

It is well documented that the man who shot John Lennon, JFK’s assassin,  and the guy who shot Ronald Reagan all had a copy of the book “Cather in the Rye”.

What if we could identify malicious hackers  by their common access to a single file, or group of files?

Information Security is a constant game of cat and mouse. Unfortunately,  the good guys are frequently one step behind the bad guys.  Hackers discover a security flaw in a particular software and begin exploiting it and eventually Security practitioners detect and classify the activity as malicious. Then with the help of developers either patch the flaw or apply new methods or tools to mitigate the security issue. Then the cycle repeats in a never-ending circle.

Perhaps we can shift this paradigm in favour of the good guys. Or even turn it upside down entirely where the hackers are the ones trying to catch up and figure out what is safe for them to touch and what is not?

Background

Firstly, we must understand the typical process a hack follows and match this process to the attacker’s high level goals.

For a hacker to be successful he, or she, will undertake the following tasks.

1. Exploit a software or configuration flaw to gain access to a host system.
2. Make changes to ensure access survives a reboot of the system.
3. Hide any traces of activity to enable longevity of access.

Once these three objectives are accomplished, the hacker can start poking around and looking for valuable information. Also, using this compromised system as a pivot point to move deeper into the network and compromises more valuable hosts.

Flipping the Paradigm

While we endeavor to have all our network assets and infrastructure patched and secured, there will always be one or two systems which slip through the cracks. Whether it’s a server running an older operating system that’s due to be replaced in the near future, or an application running on a server which isn’t quite on the latest patched version. There will be cracks and these will be exploited in an attack.

Honeypots have been around for a while and are an ok system to use in an attempt to entice and detect hacking activity; they rely on the hacker focusing on the honeypot,  and activity on that honey pot server being used and an indicator that there has been a security breach. But there is no way to guarantee that an attacker will target the honeypot and not a different, more important system.

I propose a new take on the honeypot, the Honey file.

Honey files can be placed on each system and monitored at a heightened level to serve as an alarm and strong indication that the system has been compromised by an attack.

The honey file is a specially created file which meets the following criteria.

1. Not accessed or used by the host hardware, operating system or any installed applications on the system on which is resides. (Thus any accesses or changes to the file can be assumed to be either accidental maintenance related or malicious hacker activity)
2. Must not contain any information that would be of actual value to an attacker.
3. Any alterations, additions or event complete removal of this file must in no way affect the host system or application in any way.
4. This file may contain authentic looking but fake information useful for tracking follow on malicious activity.
5. Taylor the honey file to the host system so as to project an air of authenticity and criticality. This increases the chance it will be accessed by a hacker.  Also don’t put obvious windows server type files on a unix server or vice versa.

The time and effort invested in creating the honey files will directly impact the effectiveness of the files when in use.

Think of scenarios where developers or server admins might have “accidently” left valuable information on a server prior to it going live and then forgotten to remove it later on.

It is recommended that several types of honey file be employed to increase overall effectives.

1. Fake Database honey file. A database that contains bogus information and can be monitored strictly. Databases are high priority targets for hackers
2. Fake Procedure documents with embedded fake login information. Any access attempt by credentials listed in these documents can be considered malicious hacker activity and show a hacker has file system access on the system.
3. Fake configuration text files. Specific Unused IP addresses can be listed in these files and monitored to alert on attacks.

So what is the logic behind this ?

The goal is to seed juicy files throughout your environment and configure a high level of alerts and monitoring on these files.  These files will be the tripwire which set off the alarm bells and represents a strong indication of malicious activity.

Most systems have minimal logging enabled due to issues with load and resource utilization.  By using distributed honey files we alleviate the need to turn up logging on the majority of systems and have a more targeted and accurate indication of malicious activity with a vastly reduced number of false positives when compared to the traditional Intrusion Detections systems. 

Notes

Honeyfiles: Deceptive Files for Intrusion Detection  -

http://www.dtic.mil/cgi-bin/GetTRDoc?AD=ADA484922

Differentiating mobile devices

Disclaimer: These be the thoughts and ramblings of the author, not necessarily those of his employer, management or any other fellow lackies.

When company management seeks to differentiate between devices and attempt to ban certain categories of device from the workplace they can often fail to realize that categories have merged and cannot easily be separated.

Apple mobile devices, for instance, all run the same operating system and apps So banning IPad tablets but not IPhones does nothing from a security, capability or risk standpoint. The same apps and capabilities exist on the phones as the tablets.

In fact, phone calls can be made from an iPad using google voice to any landline, so would that not make an iPad fit into the phone category?

If you say no then would you be classifying the IPad as a tablet on a mere size basis ?

Phones are getting bigger. The galaxy note 2 phone is 5.5 inches. The new iPad mini is only 7.8 inches and has a cellular radio option available. The ipod touch is only 4 inches but has no cellular radio. Which is a phone and which is a tablet ?

I would argue that the whole phone / tablet differentiation is bogus as tablets can have the same operating system , hardware and uses as a phone.

Trying to restrict tablet use only serves to alienate a subset of workers and show managements lack of a true understanding of modern mobile devices.

S. Russell Dyer BS CNE CISSP CRISC Security+ CICP
Mobile device Guru.

The wire is the key

Disclaimer: These be the authors thoughts and ramblings, no other may claim ownership of them. They are not necessarily the thoughts, policies or mindset if the authors employer, management, or fellow slaves.

The wire is the key to enterprise security. Whoever owns the wire holds the keys to the kingdom. Make sure your network security department has the tools to " own the wire".

The majority of Data leakages and breaches happen over the wire, and the wire is what we must maintain a laser focus on.

Sure, log correlation can yield valuable information in a post breach scenario, but the real time relevancy if the traffic on the wire far outweighs the patch detain of server, workstation and device logs.

Think if the fox in the henhouse. Does the farmer want his first alert of trouble to be screaming gens getting slaughtered or would he rather see the fox approaching across an open field and gave time to prevent the slaughter.

This is why a system that monitors the traffic on the wire is an enterprise imperative. Such s system can be a hard sell to executives, as it may not be a regulatory requirement, or helpful to external auditors focused on logs and reports. But the seemingly high cost of such a system pales into insignificance alongside the financial and reputation costs of even a small data breach.

So the enterprises should invest in network monitoring software which can show, alert, and capture, traffic on the wire. This allows the information security teams to identify, intercept and prevent breaches.

All information security teams prefer Prevention of breaches, but are often limited by prior management funding and system acquisition decisions to post breach analysis.

That's all for now

S. Russell Dyer BS CNE CISSP CRISC Security +

Location:Okemos Rd,Okemos,United States

BYOD 5 Commandments

The 5 commandments of Bring Your Own Device.

1. Issue an approved Tablet and Phone to every employe.

- The only way to standardize on one platform and reduce your support, Audit and training costs is to standardize on one platform. Today e options are Apples IOS or Microsofts Windows 8, or Googles Android. I'd recommend Apples IPAD and IPhone as their build quality and security are a much higher level than Android or Windows Phone.

2. Monitor Devices.

- security requires centralized monitoring, alerting and management. Invest in a mobile device management solution with a proven track record.

3. Audit Devices.

- audit regularly to ensure the security profile of the devices is maintained and patching is effective.

4. Update

- ensure devices are bing patched and over time, perhaps every 2 or three years, the devices will will need to be replaced / updated with newer, faster and more productive devices

5. Relax.

Employees are not enherently evil or criminally inclined. Allor employees a few minutes each hour to check personal email and blow off som steam. If managers walk but, don't expect mployees to b buried in work for the full tidiness the office. Expecting this will result in micromanagement impacts, like employees becoming paranoid, timekeeping taking precedence over productivity, and employee morale spiraling into the gutter. This can in turn lead to employees leaving and the dreaded brain drain.

Disclaimer: The views xpressed in his article are those of the author, and not his employer, management or fellow worker bees.

S. Russell Dyer. BS CNE CISSP CRISC Security+

Mobile Device Guru, Security Analyst and Slave to all things Tech.

<img src="file://localhost/var/mobile/Applications/FD73DEEB-8A71-487D-B1D3-4E05250BB76A/Documents/BPImageUpload%20Image%20Uploads/2A5E0112-AC43-4F8B-95E3-103C66784DE3">Liar on the wire

Disclaimer: The views expressed in this article are those of the author and not of his employer, fellow employee lackies or friends and cohorts.

Malware and other techniques used by hackers continue to evolve and each evolution sees adaption of methods to evade attempts a detection.

How long until the bad guys integrate code to trick operating systems into generating false log entries to obviscae the real attack.

This is another reason to watch he traffic on the wire and not rely on log entry correlation as a defense.

S. Russell Dyer.  BS CE CISSP CRISC Security+

Security Analyst and I.T Guru.

What makes work suck

Disclaimer: The views expressed in this reticle are the authors alone and not of his employer, management or fellow order lackies.

Workplace paranoia is a constant battle and when workers are constantly looking over their shoulder worrying that a manager will walk by and see a worker taking a couple of minutes to check his or her ank account and assume that's all the worker is doing all day, the work environment becomes painful.

Management needs to concentrate on th big picture, and not stoop to micromanagement which kills employee morale.

When one departments employees see that thy are targeted for rules that other departments are not given, it makes for a poor working environment.

Employees need space and time to refocus during the work day and this can in several different forms.

Personal devices can be used to check personal email and share non work news with fellow workers.

Walk outside or inside of the building can be a good re-energizer.

More later,

S.Russell Dyer BS CNE CISSP CRISC Security+

Security slave to the cause.

Winston Churchill quote

1) “Success is the ability to go from failure to failure with no loss of enthusiasm.” Winston Churchill, former prime minister of Britain

<img src="file://localhost/var/mobile/Applications/FD73DEEB-8A71-487D-B1D3-4E05250BB76A/Documents/BPImageUpload%20Image%20Uploads/30DBFF4E-F2B1-4328-8D39-8EE221C6CA86">&nbsp;Enterprise security 10 commandments.

1. Define a security policy

This is the document which governs all data security within the company. Some tips? It shouldn't be too lengthy (no employee is likely to engage fully with a fifty page document); it should not demand the impossible; and it should show that you value your employees. (A further recommendation: have an executive or the HR department deliver it, rather than IT support.)

2. Make use of security technologies

These are the basis for the security of the company's data/information. A network that does not have antivirus protection, firewalling or antispam will be exposed to too many risks for other controls to cover adequately. According to data presented in the ESET Security Report Latin America, 38% of enterprises in the region were infected with malware last year.

3. Educate your users

Moreover, educate all your users. Technically adept users or the IT Department are often not included in security training, as if it were proven that they are less vulnerable to threats. According to ThreatSense.Net statistics, 45% of the threats detected in the region last year made use of social engineering, which against which technical but security-unrelated expertise may offer no defence at all.

4. Take control of physical access to information

Information security is not a problem that should be considered only in terms of "virtual" information, but should also consider the physical media where it is stored. Where are the servers? Who has access to them? Without a doubt, physical access is crucial. Printed data should also be considered in this respect. For example, physical access to offices where confidential information is held (Management, accountants etc.) or where there is access to printers (someone could take "accidentally" see or steal confidential information).

5. Maintain your software

Software vulnerabilities are the gateway to many attacks against the organization. According to the report on the state of malware in Latin America, 41% of USB devices are infected and 17% of the malware used exploitation of vulnerabilities. Keeping the operating system and other applications up to date with the latest security patches is a vital security measure.

6. Don't just rely on IT to defend your systems

One of the most common security errors is to fail to understand that security is not purely a technological problem. There should also be a team whose sole purpose is to manage information security, and this should be given full consideration rather than ignored in favour of issues such as usability and convenience. Security is not the only business need, but it is important.

7. Don't give ordinary users administrative rights

If users don't have administrative rights they don't need, the impact of an intrusion into the system will be limited. Once again, we should emphasise the importance of implementing this control for the entire company: members of the IT department and senior management should also have limited privileges for day-to-day computer usage, using administrator accounts only where the job in hand requires them.

8. Think before you sacrifice security to save money

Security should be designed to protect business information and, therefore, the business. When investing in security, take into account the value of the information that is to be protected, the likelihood of a breach, and the likely consequences of such a breach. 

9. Don't finish a security project

That may seem a strange thing to say, but it isn't, because you shouldn't start a project either. Security must be seen as a continuum, not a process with a fixed start and end point. It is true that small implementations of security controls may need to be implemented as projects, but general protection of information protection should not be perceived as a project, but as a continuous process and ongoing business requirement.

10. Don't underestimate the importance of information security

Our last and possibly most important point is to urge you to understand the importance of well-protected busines information. One of the worst mistakes that an executive can make is to thinking that a control should not be implemented because "I don't think I happen". Many companies, especially small and medium-sized enterprises, may not recover from a severe information breach.

Low cost event correlation

Disclaimer: the views expressed in this article are those of the author and not his employer, management, fellow lackies, or family.

So you have a boat load of vents or correlate, and no big budget automated tools. Well , you may have some tools, but its likely that they aren't login up to to sales hype.

Lets look at some basic tools. Your event is typically a source IP address, a destination IP address and maybe a port number.

First off, work out the DNS names. You can use nslookup for internal IP addresses and websites such as ipvoid and speedguide.net for external addresses.

Google the port number and see what the web says are common sues of the port.

For internal windows systems, get sysinternals tools, particularly psloggedon.exe which can tell you who's logged onto the internal system.

If psloggedon doesn't work, try connecting to the c$ administrative share of the windows system and looking at the user profiles folders under the users folder.

These basic tds can get your started.

For a small network, see if you can get a security onion system or a Trisul system with is span port on the outside o you dmz. This can give you all this info and more with the click of an icon or two ifrerly configured.

Cheers and more next time.

S. Russell. Dyer BS CNE CISSP CRISC Security+ CICP

Information Security Analyst and mobile device geek.

An issue of Priorities

Disclaimer: These ramblings are the authors and his alone, and are in no way attribatible to the authors employer, management or friends. 

As we navigate the ever changing landscape of information security, we must continually balance the many priorities thrust upon us by management, other teams and external customers.

Often times, we beleive directives handed down from management should be modified to meet the goals we believe are the desired end. Whether it is through the use of differing tools than those suggested or an alternative procedure which would reduce time and improve efficiency, it is often difficult to convey this information successfully back up the management chain. When this happens, resistance and animosity can run rampant.

Management invariably gives us just the information thy beleive we need to know and this may leave us in the dark as to the true goals of a task. 

Example 1: 

Management directive for analyst eyes on glass for event monitoring with a requirement to process a certain number of events per day.

Upside: Management  needs metrics to show upper management that security is working.

Downside: in an effort to produce metrics, and indeed increase events processed we may focus on volume over quality. An event showing ssh access from another country may be logged and initial log review may show nothing suspicious, so it is filed and the analyst moves to he next event. When further investigation for a day or two may show a pattern and indicate possible progress by an attacker which could warrant defensive action.

Example 2: External influences reducing the effectiveness of the Security Team.

Other teams who are directed to resolve the findings from security team tests, may seek to limit the effectiveness of the tests by influencing the decision on the tools to be used. This can be done at upper management levels which are not visible to the security team, and may result in a task to scan certain systems with a less effective tool than others which are available, or timing parameters which limit the granularity of the testing.

Other vectors for issues are purchasing decisions where the security capabilities of tools are not given sufficient weight.

So, what options are open to security teams to guide and assist their management in producing what we beleive are optimal data most efficiently and effectively.

1. Communication is the primary tool to ensuring smooth running and optimal success.

- regular meetings, say weekly, can foster success providing they are run effectively.

Meeting must be open with all team members and the team management being in attendance. Team members must be able to speak freely and openly about their thoughts on topics. Each team member should be allowed equal time and weight for their input, which can be difficult as here are often big talkers who can monopolies the discussion. It is managements task to ensure equal access during discussions.

Meeting agenda should also be available at least 2 Amy's in advance so team members can be suitable prepared. 

2. Information dissemination from management needs to include all relevant data. This is difficult for management as they often seek to limit information so the discussions reach their preconceived desired result. Sometimes confidentiality issues prevent information dissemination also. Management may also b swayed by input from other departments.

3. The information Security Team needs to present a united front externally. 

Decide on the optimal combination of tools, procedures and policies, and don't try to change tools every year or two. Because you want to have the optimal toolset, the decision on the tools needs to be a team one, and not a management directive. Take feedback from the analysts and engineers who ha used all the tools and give then the necessary weight and credence. An engineers opinion of a tool he does not use day I and out, should have very little weight when compared to an analysts advice who uses the tool every hour of every day.

Information security is not easy and at times it may seem the biggest obstacles to success are forces inside the enterprise. Yet we must use all the tools in our arsenal to improve security and prove tht security is a valuable department or the Enterprise.

That's all or now.

S. Russell Dyer BS CNE ISSP CRISC Security+ CICP

Remember the Disclaimer!

What's in a Cube

Disclaimer: The following ramblings are those of the author and we in no way the opinions, views, policies, or anything else related to the employer of the author, the authors management or fellow minions.

These days the most common work environment for company employees is an office cube. A bland space which employees endeavor to make their home away from home with pictures, keep sakes and other reminders of their family, and outside life. Office cubes are not the optimum environment but due to economies of space, thy are the best option available.

Some office cubes can be of a less private style with 4 foot walls which customer service departments often prefer. While these can Enable more over the all communication, they remove another level of self worth from the employee and seem to degrade the quality of work.

Then there is the alternative of crowding several people into a room in an effort to allow closer communication and more work output. This is a double edged sword which will invariably result in perhaps a greater volume of work output but output which is of less quality. Without the privacy and calm of their own individual workspaces which foster a deeper and more inciteful thought process the result of certain tasks is not as good.

I beleive that the full size cube is currently the best option and crowding more people in a closer working environment results in diminished productivity, lower morale of employees and in the long term, a hight turnover in staff.

Disclaimer: The abov ramblings are the Authors alon, and in no way represent the opinions of the authors employer, management, fellow employees or friends and strangers.

S. Russell Dyer BS CNE COSSP CRISC Security+ CICP

Security Analyst, Computer enthusiast and mobile device addict.

<img src="file://localhost/var/mobile/Applications/FD73DEEB-8A71-487D-B1D3-4E05250BB76A/Documents/BPImageUpload%20Image%20Uploads/661415F9-7463-4BE1-818F-191EB6481557">Metrics vs Productivity

Disclaimer: The views expressed in this article are those of the author and NOT necessarily those of his employer or management or even fellow employees.

The emphasis on metrics

As companies seek to reduce th bottom line costs and increase efficiencies, the reliance on metrics increases. Information security departments are often thought of as an overhead and drain on the bottom line and this are striving to product metrics to support their distance. This striving to show value through metrics is a doubl died sword.

On the plus side, metrics can indicate positive performance in the effort to increase the overall security posture of Enterprise.

Such metrics can be the number of tickets closed by an administrator, or he number of incidents reviewed by an analyst.

On the negative side, there can be a tendency to drop important tasks which can be hard to show metrics on and concentrate on routine tasks which are easy to produc metrics on but in reality do not enhance the overall security of the enterprise.

The incident metrics often do not reflect the complexity of each incident or the result of the investigation. This can not easily be quantified and thus an emphasis on numbers and not on quality has a negative impact on the enterprise security posture.

So in summary, Metrics can be good or bad and the decision on which metrics and level / quantity of each metric needs to be carefully discussed before implementation.

DISCLAIMER: These at the authors personal views and not necessarily those of his employer.

S. Russell Dyer

BS CNE CISSP CRISC Security+ CICP

Security Analyst, And Dad to Makayla, Tristan and Michael.

The Best Defense

Disclaimer: the article represents the views of the author and not those of his employer, management or fellow minions.

Information security is evolving but on one front it still lags behind. The area of offensive defenses.

My point is at the best defense I a good offense.

Through the use of honeypots and red herring links in applications we can force web based scanners and the hackers at their controls to waste massive amounts of time and becom disinterested enough to move to an easier target.

Writing links and adding additional extra pages in applications which the end user never sees can be a great tool. These pages can b outside of user navigation paths, and can simulate login pages with links to honeypot databases and file systems with heightened logging. Using this technique the security team will have more info and time to back track attackers and analyse the evolving landscape of web based attacks.

An escalation could be these fake systems launching exploits against whoever is accessing them. Attack is a viabl defense in my opinion.

It's time to go on the offensive against hackers.

S. Russell Dyer BS CNE CISSP CRISC Security+ CICP

Security Analyst, but I'm by no means an expert  ;-)

Epic Fail

Disclaimer: The views expressed in this article are those of the author, and not his employer, management or fellow employees. 

Having worked in information security and in the IT field for 20 years, I'm struck with the frequency that systems designed to assist us end up becoming a sink hole for time, money and energy.

Lofty goals often result in the purchase of massively complicated systems with vast ranges of capabilities that should work and perform as the salesman says. Unfortunately the systems that attempt to be all things to all people are often useful things to very few people and a major pain in the butt to everyone else.

Today I'm advocating the selection of a few simple tools to cover what is needed. 

Don't try to combine log archiving and event correlation network monitoring. It's just too cough to be effective. RSA envision tries and fails and Arcsight is only for the rich.

Archive your logs by all means but don't presume that this is easily harvested and turned into events and dashboards and monitoring.

If your goal is network monitoring, then select a network monitoring tool, like net witness or the cheaper Trisul. See the events from the wire and not from logs from the past.

That's all I have to say on this for now.

KISS - keep it simple stupid, 

And avoid the Epic Fail.

S. Russell Dyer

BS CNE CISSP CRISC Security+ CICP

I.T insider, Former Network Engineer, and Security Analyst.

Personal Mobile Devices in the Enterprise

The portable device conundrum and a logical solution

Disclaimer: This article represents the observations, views, opinions and general ramblings of its author and is not the policy, opinions or views of the authors employer, management or fellow employees.

User's want the freedom to bring in personal portable devices for business and personal reasons, both of which can improve the employees overall quality of life, work and job performance.

Be of no double that this does pose a security risk, BUT when properly mitigated there can be a measurable benefit to the enterprise. Happier employees are without doubt more productive employees. They are also healthier employees which impacts the companies bottom line for health insurance coverage.

The initial thrust of personal device introduction to the enterprise came with personal cell phones. These phones are now smart phones and susceptible to attack and compromise in much the same ways as computers and laptops. 

Personal laptop computers and more recently tablets, like the IPad line from Apple, represent a more vulnerable threat vector than cell phones, but developers and IT personnel often utilize these tools for work and also for brief periods during the day to refresh their focus. Short breaks during the day can positively impact personnel performance.

A practical solution

The issue of personal devices at work can by addressed piecemeal, by a patchwork of policies and controls, or Boldly and I would argue successfully by a single, all encompassing management led solution.

I propose that the enterprise that wishes to solve this issue cold do so with the following simple steps which would have the added benefits of raising employee moral, reducing support costs and eliminating much of the portable device risk.

1. Give an apple IPhone and Apple IPad to every Employee. Employees who do on call support will have company subsidized devices, and other employees would have to use the phones at thier own cost. The benefits to support are that all users will become familiar with the same operating system and can gain advice and support from each other in addition to the usual channels.

2. Buy a mobile device management solution for apple devices only. 

3.  Regulate to prohibit through policies and enforcement, that use of any other devices within the confines of the enterprise in prohibited and provide a quarantine area when prohibited devices can be dropped off by users and picked up after their work day ends.

4. Add additional value by creating an apple development group and producing applications for your in house systems which customers need to access.

The main point is to standardize on a single platform and reduce support costs. It is an added bonus that Apples IOS is less exploited by hackers than windows.

S. Russell Dyer BS CISSP CRISC

Security wanderer and event handling Lackey.

DISCLAIMER: The views expressed in this article are solely those of the author and not those of his employer, company management or fellow employees. 

Scan Everything&nbsp;

Previously I proposed that monitoring the wire is vastly more effective for alerting and generating events.

Now I'll cover the other piece of he equation, Vulnerability scanning.

Disclaimer: the views and opinions in his article are entirely mine and not those of my employer, fellow employees or management. 

Back to Scanning.

Firstly, scanning has to be all encompassing, regularly repeated, and something has to be done with the results.

The first caveat of cunning is that you you can't scan when you do not know about. The network needs to be accurately documented and Visio diagrams are a must if no automated solution is in place to dynamically enumerate the network.

The second caveat is that everything gets scanned repeatedly, and preferably on a Weekly basis.

Weekly scanning will more rapidly show you what is changing and the new vulnerabilities. You can then match these vulnerabilities to traffic alerts on your network and you will know when to be concerned.

The third caveat is that you need a good scanning solution that has audits updated more than weekly, and that doesn't crash or fail you when you need results. The solution needs to be all encompassing and able to scan internal and external facing systems regardless of their operating system, level of hardening or age. Just because its only been around for a year or so is no excuse for a scanning vendor not to support scanning of it. The scanning solution must be able to do credentialed or uncredentialed scanning. A solution which can select from a list of credentials depending on the detected system type is a valuable feature.

Finally, vulnerability scanning seldom lay causes issues on target systems and limiting scans to a narrow weekend window gives no flexibility to work around other network or system changes. 

So what scanning solutions hav I used? 

1. EEye Retina and REM was ok but has stability and support issues so I cannot recommend it.

2. Tenable Nessus has a few more features and the government likes it, but alas I do not. There is a better option.

3. Core Impact. While you can in theory scan for vulnerabilities with core its a penetration testing tool and not a vu operability scanner. You may as well tie your shoe laces with mittens on. While you may have success, you won't excel and the results will be mediocre.

3. Rapis7 Nexpose. Options available to scan internal and externally facing systems. Can select credential from a list depending on system detected. Integration with Metasploit for pen testing and validation. This is the preferred commercial solution.

For a cheap alternative..... Can't think of any at the moment.

Thanks for reading and once again, these are my personal views and not those of my employer, its management or fellow employees.

S. Russell Dyer BS CSSP CRISC

Information security guru and slave to the cause of securing networks and users.