2000 to 2013: The Moving Sands of Information Security

I am been in the information security game for a very long time, many of the fundamental security controls haven’t really changed a great deal, and continue to remain best practice, such as deploying anti-virus, patch management and decent firewall management, the business environment where these security controls are applied has radically shifted, especially over the course of the last decade.

 

So lets take a trip down memory lane back to the year the 2000, the world has just found out that the Y2K bug was a complete none starter, aside from making IT contractors a bob or two. Meanwhile the Internet is starting to find its way into mainstream business, even so secretaries were still being asked if they had any experience in using the Internet during job interviews. And if you had a job title with the word “Cyber” in it, people assumed you were some sort of a Dr.Who extra.

Policies
Starting with the cornerstone of all good information security management, the information security policy, what’s changed? 

Back in the year 2000 the responsibility of information security within a typical UK business sat within the mystic realm of the IT department. The policy document would be called the “IT” Security policy, and it tended to be a single document, only a few pages in length and only understandable by the techno geek who wrote it. Today information Security policies are typically spilt into an array different documents, often breaking down into frameworks of standards and guidance, 100s of pages in length, and they are no longer owned by the IT department, rather they are used to instruct IT. Well this is true in many UK businesses that are serious about their InfoSec. Indeed risk and information security has finally become a separate business governance function, sitting at the very top of many businesses. But there is still a way to go with the InfoSec revolution in the UK, as still too many businesses are lacking decent information security management, and as result struggle deliver airtight security best practices.

Personal Device Usage in the Workplace
In the year 2000 a typical policy would warn employees against using the company's 128K Internet access for personal usage, and not to connect their own devices to the network, a rule insisted upon by the business management not based on rational risk or a threat, but based on concerns about staff productivity and hogging the limited bandwidth. There wasn't the proliferation of personal devices we see today, although I recall there was the odd Palm Pilot around. In 2013 users are permitted to use the Internet for personal usage, and are actively encouraged to bring their own devices into the workplace in many businesses in the UK. The business cost saving Bring Your Own Device (BYOD) culture has risen from nowhere in recent years, and has taken a grip up and down the land as business desire to cash in on the benefit of not having to provide expensive smart phones and laptops to their staff.

Laptops
In 2000 the idea of encrypting a laptop’s hard drive would be considered a crazy notion from the realm of a James Bond plot. Laptops of the day tended to really struggle performance wise, and yet even though laptop theft by shell suit clad spotty teenagers was just as common as it is today, businesses were not over concerned about the loss of data via laptop theft. The business was more concerned about the cost of replacing the laptop, meanwhile employees were only concerned about the cost of fixing their smashed car windows. 

Today most UK businesses are no longer over concerned about the laptop replacement cost, but are more anxious about the potential regulatory fines and the media embarrassment that awaits with any loss of a laptop that is not encrypted. The Nationwide fine of £1,000,000+ in 2007 by the FCA (then FSA) marked a sea change in laptop encryption adoption in the UK, and after which many businesses decided to take no chances and increasingly adopted an enforced mandatory hard disk encryption across their entire laptop estate.

Storage Media
Back in the year 2000 the storage media everyone had floating around their desks was CD-Rs, the idea of encrypting them was pretty much unheard of in most UK offices. Main stream business got a wake call when one day in 2007, the HMRC lost a couple of unencrypted CD-Rs which held millions of UK citizen’s personal data, a huge media storm ensued highlighting the government’s bad security practices, and to this day those HMRC CD-R have never been recovered. But the HMRC breach served to wise up many UK businesses to the huge potential reputational damage that losing those circle pieces of silicon could generate. MDs in boardrooms quaffed “look how stupid the government (HMRC) are” then asked their executives “we encrypt all our CDs, don’t we?”

Just like with laptop encryption, businesses took a “take no chances” approach and most now enforce encryption on all media, including USB storage devices, which had exploded onto the scene in mid 0s.

Automated Security Management
IT Security controls have become easier to implement since 2000, no longer is applying anti-virus and software patches a manual 'walking on eggshells' task, but can be done with confidence, centrally managed and fully automated. It doesn’t stop there either, system monitoring and alerting has improved leaps and bounds, with security managers now having access to a NASA style mission control suite of screens brimming with real time stats and turnkey reporting metrics.

The Crown Jewels that doesn't tour, now on tour
The security doctrine of 2000 was all about protecting the important data within the onsite network, a castle and moat approach to security was taken. Great care was taken with remote access, securing perimeter firewalls and with any connectivity to third parties who you dared to share your network and sensitive data with. Those were the security battlefields, with firewalls rule-sets and VPNs the weapons of the day. 

Although perimeter security is still equally as important today, a momentous shift has occurred, in that the crown jewels of the important data has moved to the outside of the business physical site fortress, and can be found in often blindly trusted third party data centres and unvetted cloud service providers. In 2000 placing trust in a third party would have seemed a dubious idea at best, if it had to be done, great care and checks was taken. I think this is one area where a backward step has occurred.

One of the reasons marketing use the word ‘Cloud’ so much, is it makes something that is in reality highly complex, sound very simple to the service user. However businesses need to take a good look under the bonnet of the simple ‘cloud’ front, properly assess and vet the security of third party service provider, applications and infrastructure, ensuring their third parties are aligned to their business risk appetite, and have at the very least the same appropriate level of security controls as their business's internal infrastructure and systems.

Security Awareness
I think it is fair to say there hasn't been a vast improvement in staff security awareness in since 2000. Of course we seen some changes with the introduction of Computer Based Training Courses and employees signing declaration forms, but nothing ground breaking has really happened. Security awareness still tends to be a flash in pan campaign and a tick box assurance, and is often a poorly done afterthought rather than a sustained process. Yet for me it would appear we are coming full circle, and we are placing security control and trust firmly back into the hands of employees, with personal cloud solutions and personal device usage making it more easier than ever for employees and contractors to bypass the once clever endpoint castle moat extending security controls.
The Biggest in the last Decade
Finally, and perhaps the biggest evolution over the years has been with the humble information security professional. Back in the day I remember it being a struggle to be even recognised as a information security profession in the UK, hence why this blog which I started in 2007 is called “IT Security Expert” not “Information Security Expert”. 

Not only is there an ever increasing army of information security professionals, but the quality of how these professionals practise their trade has much evolved for the better. We have seen security professionals go from a ‘health and safety’ mentality of blurting “No” all the time to the businesses they serve, to a business conscious “can do” attitude, having the knowledge and expertise to devise solutions to fit their business needs and risk appetite, well the successful information security professionals are doing this.

Security by Staff Responsibility instead Enforced IT Controls

Today IT security controls are enforced on the end user without prejudice, all for the purpose of migrating the human risk. These controls, especially endpoint security controls, are typically applied because it is best practice to do so, and not as a result of a risk assessment. 
What if the application of technically enforced security controls was taken as an action of last resort? Can human responsibility be be just as affective as an enforced control? Can it be more advantageous in managing the same risk?  These our my thoughts.

Lets take a English FA Premier League football match, there is a risk that spectators in the stands will invade the pitch, and impacting on the match and threatening safety  Yet spectators rarely invade football pitches at English matches, even though they aren't fenced in. A fence is an example of an enforced control meant to prevent fans from accessing the pitch. 

My argument is the fans are self responsible and trusted, meaning the control of fences is not required, further that the risk of pitch breach is less than when the fence control was in place.

No fences at English Football Grounds

In comparison to the English game, it is a very different story at most football matches on the European continent, where fans are fenced in from accessing the pitch.  It use to be that way at English football grounds, I remember attending football matches all around the country in the late 1980s, and as a fan I was fenced in from accessing the pitch at every ground, Chelsea FC even had an electric fence, now that's what I call a enforced control. But even with the fencing I recall there were many pitch invasions during that period of time than today, either on mass or by the sole persons.

European football ground fencing example

One of the darkest days in the English game occurred at Hillsborough in 1989, when 96 Liverpool fans died after being crushed, this was partly due to presence of the pitch side fences, which prevented the fans from escaping. After the disaster, and quite rightly, all the fences were removed from all football grounds in England.

Q. How did English football clubs manage the pitch invasion risk without using the enforced control of fences? 

It was achieved by placing responsibility onto the fans.

• Firstly a law was passed, providing a deterrent, making it a criminal offence for fans to encroach onto the pitch, along with lifetime bans from matches for doing so.
• Then fans were educated, so they clearly understood the new rule and why the rule was required. There was a consensus amongst the majority of fans at all clubs, that the rule was for their benefit, their safety, so was righteous.
• It was strictly enforced, so fans knew there was a conscience for breaking the rules.
• There was a perceived threat that the fences (the control) would come back if the fans didn't follow the rule they agreed with. This led to a peer pressure against anyone that broke the rule by the general mass of the fans.  So when a fan ran onto a pitch, a chorus boos and abuse from stands would occur, followed by cheers when a steward or police officer would apprehend the pitch invader. Back in the 1980s, when the fences were in place, they would be a chorus of cheers by crowd with such infractions, followed by boos once the police intervened.
• The absence of a pitch side fence was regarded as responsibility and luxury by the fans, as the lack fences meant unrestricted viewing for the first few rows in the stands, and allowed fans to get closer to action. There was high degree of trust and responsibility placed on the fans, as there was nothing to prevent them invading pitches but their own self control and self regulation.

The point I am making, to mitigate risk, it may not always be the right and most effective solution to reach for the IT control, but to first consider whether staff can be trusted and be self responsible to managing the risk. Affording responsibility can be regarded as a privilege, a privilege staff will actively seek to protect, as they seek to avoid the inconvenience that some security controls cause them. Group peer pressure of metaphoric boos can be effective against any minority of individuals that seek to stray from the rules, as they threaten the benefit and trust afforded to the majority.

I am not saying this will give 100% security, nothing will, not even the strongest of enforced IT controls, but there are many additional benefits in having business staff onside, responsible, trusted and security sharp, rather than fencing them in like sheep with IT controls.

iPhone 5S "Touch ID" Fingerprint Security

Apple announced the new iPhone 5S today, the introduction of a new fingerprint recognition access system on the smartphone, called "Touch ID", grabs the security attention.

Fingerprint reader is the main button

Security of the Fingerprint Reader

The fingerprint reader is not like the traditional readers you see on laptops, and is actually part of the main button on the phone. The reader is no security gimmick as it is not a outdated optical reader, which works by taking and comparing a picture of your fingerprint, it is a capacitance reader,which is a more advanced and secure technology. Capacitance readers uses an electrical current to map your fingerprint, measures the minuscule differences in conductivity caused by the raised parts of your fingerprint, which makes it very difficult to defeat. I don't like to advocate the security of anything without inspecting, researching and testing a device myself, but I will say this reader has certainly been designed with security in mind.
Apple has faith in Reader's Security

Apple have a lot faith in the security of reader, which is a good sign, stating it will not only be used to unlock the iPhone, but to verify user's Apple IDs to make account purchases. This method of device authentication, if proven, makes an interesting development for within the mobile device payments space, and perhaps could be a viable alternative to website passwords.

The Phone Lock Benefit

Given how fast the authentication works in comparison to using a passcode or password, then I see additional security benefit to be had with the account lockout time-limit. Setting the phone lockout timeout to 5 minutes or even 1 minute of inactivity becomes more viable, as the current trade off in accessing the phone with a slowly entered passcode/password is replaced by near instance touch authentication and access.

Increased Access Control Security with Two Factor Authentication

For security aficionados, the fingerprint reader may allow two factor authentication, namely combining the fingerprint reader with a passcode/password to authenticate, this would really ramp up the access control security on the device.

In all a very interesting and innovative security addition by Apple, so much kudos to them. Now I need to get my hands on an iPhone5S to test it.

Square Enix Final Fantasy XIV Accounts Security Warning

Last week I posted on How to keep your Final Fantasy XIV Online Account Safe & Secure

Today (9th Sept), Square Enix posted an urgent security warning concerning account security for the game. Confirming a "third party" was using account names and passwords, which they believe to have been obtained from security breaches of other companys' online services.

Square Enix's advice mirrors my own, setup and use their one-time password system, or ensure your password is unique to your Square Enix account

Since my post I have been asked... 

Why would anyone be interested in hacking gaming accounts like FFIX?

1. For the Money. Rare in game items, which it can take many hours of gameplay and luck to obtain, can be sold off in game auction houses for a great deal of game currency. Players over the course of time built up lots of such items and lots of in game currency (gold/gill), these rewards for sometimes hundreds of hours of gameplay have a value. This in game currency can be transferred out of the character/gaming account and then sold on for real currency online. Some gamers buy in game money from third party operators, this is already available in FF14, just google it. Typically $8 will buy you 100K gill (in game money), $500 will buy $6M, the latter allows you to operate a reseller, using the in game chat systems to sell it. Yes this is strictly against the game rules, but it goes on in every game of this type. The bottom line, access to your gamer account = Cash to the bad guy.

2. Good old fashioned Revenge. People piss other people off within the game, as a way of getting back at a player, some will try to hack other player's gamer account. If successful, they strip the character of items, steal all their gaming money, lock them out from playing, and even delete their character.

3. Personal data is always of value, names, home address, email address, DoB, account password, password reset question etc.

GCHQ Cracks SmartPhone Codes, Privacy Outrage or Lifesaver?

The Edward Snowden fallout continues with the steady trickle of classified revelations released by the media.  The latest appears to be confirmation of GCHQ ability to crack or bypassed the encryption on Blackberry and Android smartphones.

This news isn't really that shocking given cracking encryption is a core part of what GCHQ has done for decades. It is also important to understand that nowhere does the released documentation say GCHQ have been breaking into everyone’s smartphones and harvesting our private data on mass, I doubt they’ll have resource and funding in the UK to do that.

My assumption is breaking smartphone encryption is a necessary GCHQ tool for gathering information on specifically targeted bad guys, for example suspected and known terrorists.  Several terrorist plots have been foiled since the 7/7 atrocities, so what if GCHQ's ability to access encrypted smartphone electronic messaging and call information, had played a key part in preventing terrorist plots from succeeding, then it could be argued GCHQ actions are not only in the UK public interested, but may have actually helped saved innocent lives. Further it makes sense that GCHQ wouldn’t want to advertise their capabilities to the general public and to the bad guys. There is an argument that the release of such classified information by the media for their own ultimate purpose of profit (selling papers), is not only immoral, but could be placing lives at risk.

It is easy and desirable to jump on the privacy bad wagon for the purpose of bashing the government of the day, even though most of us give up vast amounts of our personal information to the likes of Facebook and Google.  But we need to consider the full picture of why we want our government to e-spy in the first place.  We can’t have our cake and eat it, either we want to engage our security services in stopping terrorism at our privacy expense, or not. It is worth remembering the likes of GCHQ are usually the first to be blamed when a terrorist plot succeeds for not doing enough, ironically by the media. 

Bullrun & Edgehill: US NSA & UK GCHQ have broken Internet Encryption

I have always suspected this and now according to newly leaked documents by Edward Snowden, the NSA and GCHQ are said to have defeated most of the online encryption used by internet users and the likes of Microsoft, Google, Yahoo and even banks. The usage of supercomputers, court orders and the good old application of pressure to internet service providers, are all said to be tools used to gain access to encrypted data by the government agencies.

"In recent years there has been an aggressive effort, lead by NSA, to make major improvements in defeating network security and privacy involving multiple sources and methods, all of which are extremely sensitive and fragile"

"NSA has introduced the BULLRUN CoI to protect our abilities to defeat the encryption used in network communication technologies"

The US programme name is Bullrun, and is said to have a £150m annual budget, while the UK GCHQ counterpart is called Edgehill. These codewords come from battles in each county's civil wars, not only showing the US-UK collaboration on this, but perhaps is an interesting reflection on the owners of the information they seek to intercept and access.

"It is imperative to protect the fact that GCHQ, NSA and their Sigint partners have capabilities against specific network security technologies"

It appears heavy investment into these covert programme started in early 2000, when the US agencies were told they were legally not allow to place backdoors within online systems.

On the British side, it the documentation says the UK had broken 30 VPN links and stated the UK desired to move away from encryption cracking, and to go after the fibre internet traffic, which matches in with my own theory on the PRISM programme.

A statement made by the NSA within the documentation shows their intent, and perhaps makes a good mission statement for the programme, "Every new technology required new expertise in exploiting it, as soon as possible"

This story is going to run over the next few days, so I'm sure more will come out as the documentation is scrutinised.