Integrating information security into your business processes

Just thought I'd jot down a list of ways in which you can embedd information security practices in business processes and "be an enabler not a blocker "

- Changes detected by integrity monitoring with tripwire or similar can feed into change management processes to help identify security incidents to further investigate and non-compliance with change management procedures. Administrators making unauthorised changes to production is a high risk and can easily result in extended outages.

- Security patterns should be part of enterprise architecture, so that solution architects can copy them and tailor for the solution to maximise re-use of infrastructure and reduce complexity.

- Provide templates and instructions for risk assessments, security test plans and security reports so that project managers and test managers can be empowered to perform security tasks on a "trust but verify" basis with security to assist .

Anonymous, DOS of pm.gov.au

In case you haven't heard, in response to the Australian government's proposal to implement mandatory internet filtering, the Prime Minister's website was subject to a minor Denial of Service (DoS) attack by a group of internet malcontents called Anonymous. Our PM is called Kevin Rudd, affectionately I will refer to him as KRudd in this post.

http://www.theage.com.au/technology/security/rudd-hackers-escalate-threats-against-govau-websites-20090911-fk2x.html

http://www.theage.com.au/technology/security/hacked-by-hoons-how-attack-on-pms-website-unravelled-20090910-fipj.html

http://www.crikey.com.au/2009/09/10/pm’s-website-hacked-no-just-script-kiddies/

And a quick note media, if you had googled Anonymous you would find that it is not one individual "hacker known as anonymous", but a "loose coalition of Internet denizens" "doing it for the lulz".

I like the following quote, it sort of reminds me of "flash mobs" http://en.wikipedia.org/wiki/Flash_mob and the "Stand Alone Complex" from Ghost in the Shell and even the Panther Moderns from Neuromancer

[Anonymous is] the first internet-based superconsciousness. Anonymous is a group, in the sense that a flock of birds is a group. How do you know they're a group? Because they're travelling in the same direction. At any given moment, more birds could join, leave, peel off in another direction entirely.
—Landers, Chris, Baltimore City Paper, April 2, 2008.[6]

http://www.abc.net.au/news/stories/2009/09/10/2681642.htm

I guess its one of the good things about Australia is that we just don't really care much about our politicians. We've got royalty already, the original British kind. We don't need our politicians to look good and say inspiring stuff. We just want them to stay out of our way and continue to run universal health care, state funded mental health care etc etc.

If Obama's website had been taken off the air, the Yanks would be starting operation sundevil part 2 maybe with or without waterboarding of "digital terrorists"? When our PM's website got DOSd probably a DSD graduate had to cancel a saturday night out and go check some logs down at a hosting provider.

Of course Obama can't get DOS'd too easily because whitehouse.gov is distributed out over lots of Akamai web servers around the place. Our PM's web site is hosted on say a single windows 2008 box down at Macquarie Telecom ( lowest compliant tenderer I bet ) http://toolbar.netcraft.com/site_report?url=http://www.pm.gov.au

So c'mon Aussie, let's all band together to hook up KRudd a website with bulletproof hosting, so that in case of ummm invasion by our northern neighbours or something he can still get a message out. If Krudd does have something to share of importance, his twitter account with a link to pm.gov.au is going to get the word out quicker than any media outlet.

I hear Telstra have a DoS protection solution, perhaps the new Telstra CEO could extend an olive branch? http://www.telstraenterprise.com/SiteCollectionDocuments/Brochures/TEGO1269_DOS_Web.pdf

Today Tonight Senetas and MAN/WAN eavesdropping

So Today Tonight did a story called "The Big Take" http://au.todaytonight.yahoo.com/video#

Have a watch and share in the anger provoked by unmitigated vendor Fear Uncertainty Doubt (FUD) sell. Pretty much it featured some guys from Senetas (who I remember best from one of them embarrassing himself at a professional association by pretty much heckling a security professional from a banking institution during question time after a fantastic presentation he had delivered).

Well in the story they demo'd tapping a fiber optic cable (whoop de fricking doo, you can tap the copper out the front of your house with a linesman's handset as well) and running a sniffer.

Then they packed up the gear in a van and donned workmen's gear and went for a tour around Sydney. The video shows them posing for the cameras with an open laptop on top of a telco cable pit, and using some cable snips on a cable etc. Then the "reporter" makes some insinuations about fiber connected ATMs and diagrams within buildings (OMG the sky is falling!! quick buy some expensive hardware encryption devices to go on each end of my MAN links).

So what are you going to get if you start tapping a telco link in a CBD cable pit?

Umm well you will probably have multiple customers going across the link, probably ATM maybe SONET. Maybe even ethernet over MPLS over ethernet on fiber. So what are you going to use to decode all that and how are you going to make sense of all the exchange server replication, SMB chatter etc. etc? Wireshark just aint going to cut it.

Not as easy as putting a sniffer on and looking for known plaintext (like in the demo the Senetas whores benched up)

Database replication these days is even trickier to intercept with SAN snapshots replicating over fiber between datacenters using proprietary protocols.

Remember that most sensitive Personally Identifiable Data like cardholder data is submitted via web forms that are encrypted with TLS (oh and PIN blocks are encrypted with 3DES, not that that there are many if any Metropolitan Area Network connected ATMs around anyway). Didn't see them cracking out Dug Song's webmitm and arp-spoofing gateways (now that would be a challenge with all the Layer 2 wackiness going on on a MAN). You'd be camped out for a month in a cable pit to get that working and capture anything worth-while.

Then what if someone has just put some host to host IPSEC in (windows servers can do that you know out of the box, it's even in the MS guide) or a VPN over the MAN/WAN?

Overall it sounds simple to the layperson, but in practice its impractical. Best case you could write some custom software to record a few credit card numbers flying by in _email_.

Now what they could have reported on would be the risk of someone taking an axe to some fiber in a metro area, much more likely to occur and more damaging. This has happened in a number of places and even in Tasmania I believe

IMHO unless you are a global organisation who has to worry about nation state sponsored corporate espionage or you are in the defence/intelligence community don't worry about this fantastical theatrical issue. If you are in that category why not wack a digital certificate into your email clients (they all support S/MIME these days) sign some emails and add your colleagues certs to your contacts in your mail client and enjoy secure communications by default.
A bit of IPSEC VPN might not go astray either if you're in that category.

I suggest the next time anyone sees "journalists" or vendors prancing around breaking the law, prising up cable pit covers, etc. call the cops and you-tube the whole debacle.

Technical Clarifications/Comments/Flames/Tin Foil Hat wearer conspiracies welcome

Back on the air with securitybloggers.net ?

Got a few bees in my bonnets to share so wanted to get this out there. Before I forget things that have made me angry:

- today tonight and senetas going all FUD to get ratings and sell optic fiber encryption hardware to private sector
- Our prime ministers website getting DOSd for the second time this week (have we no pride Australians??!!)
- the poor state of public website security (in general). Why oh why is it so hard to validate input on brochureware sites!