Man unhappy with lemon on plate

When software development produces a lemon, make lemonade

In January 2002, Microsoft’s Bill Gates—then chairman—sent out his trustworthy computing memo, spurred by a growing wave of dissatisfaction about the security failures of the company’s operating systems and applications. As a result of past failures, Microsoft has helped to change the way we think about software development.

The late 1990s and early 2000s were difficult times in Microsoft security. A major vulnerability in the Universal Plug and Play feature of Windows XP was found just months after the release of the OS in 2001. In January 2002 the Electronic Privacy Information Center in Washington sent a letter to state attorneys general complaining of the lack of privacy controls in Microsoft’s Passport, Wallet and .Net services.

“I remember at one point our local telephone network struggled to keep up with the volume of calls we were getting,” Matt Thomlinson, vice president of security for Microsoft, said of the impact of the XP bug in an online history Microsoft’s security initiative. “We actually had to bus in engineers, many of whom were working on the next version of Windows, from their offices around campus to the call center. We needed every person available to talk to customers and walk them through how to get their systems cleaned.”

On Feb. 1, 2002, Richard Purcell, head of Microsoft’s corporate privacy office, announced in Washington a month-long moratorium on new coding.

Gates, Purcell told the audience at a privacy and data security conference, “is really annoyed by the incredible pain we put everyone through in computing.” As a result, “we are not coding new code as of today for the next month,” he said. The company instead would spend the time going over old code as a first step in cleaning out bugs. “It’s time to get the garage cleaned out.”

Twelve years later, the Trustworthy Computing initiative is not finished, and probably never will be. David Aucsmith, senior director of Microsoft’s Institute for Advanced Technology for Governments, said recently in in Washington, “I do not believe you can create a secure computer system.”

The problem is, “we build systems far more complex than our ability to understand them,” Aucsmith said. Because we don’t know what we don’t know, built-in security inevitably will be incomplete, and software and hardware will always have to adapt to newly discovered threats and exploits. “Nothing static remains secure.”

But the Secure Development Lifecycle (SDL) that grew out of the Microsoft initiative has helped to change the way developers think about software security. The SDL process now shows up as a requirement in government procurements, and the National Security Agency says it has made an impact on OS security.

“A fundamental goal of the SDL process is to reduce the attack surface,” NSA said in an evaluation of Windows 7 security for the Defense Department and the intelligence community.  “Since adoption of the SDL process, the number of Common Vulnerabilities and Exposures on Microsoft products in the National Vulnerability Database has declined.”

“A preliminary System and Network Analysis Center analysis has determined that the new Windows 7 security features, coupled with the use of the SDL process throughout the development cycle, has assisted in the delivery of a more secure product,” the assessment concluded.

We still are a long way from being as secure as we want to be or can be. But there has been progress.

Posted by William Jackson on Mar 21, 2014 at 6:32 AM1 comments

child and adult iris scans

Blurred future for iris recognition?

The use of iris recognition to ensure security is a familiar concept, and is already used by some federal agencies. Pressured by Congress, the National Institute of Standards and Technology has been developing the necessary standards to enable it to be deployed throughout government.

But there’s a snag. Unlike with fingerprints, which have been used in identity and forensic investigations for decades and are well understood, iris recognition isn’t. Even though the uniqueness of the iris was noted at the same time as that of the fingerprint back in the late 1800s, the technology to exploit the iris has only been developed recently. People are still grappling with some of the fundamental definitions.

One of the question is how long the various iris templates used in biometrics databases are valid, because (so some people insist) the iris changes as people age. That’s not a minor problem. If it’s true, then a significant number of those inaccurate templates could exist at any one time, potentially throwing out false red flags that could cause security chaos.

That particular debate seems to be coming to a head. University and NIST researchers have recently been playing ping pong in an academic argument over this aging effect. Researchers at the University of Notre Dame, for example, produced a study questioning the value of current iris templates. NIST, which runs the Iris Exchange (IREX) as a support for iris-based applications, countered with its own study that downplayed those results. The Notre Dame researchers then came back with their own counter, basically saying NIST had screwed up the methodology it used.

This isn’t the only potential problem with iris recognition. Security researchers have also identified ways that bad guys could essentially copy the digital code for iris scans and reproduce them at will, essentially eliminating that biometric from the identity profile of any affected individual.

It’s not clear if any of this will affect the rollout of iris scanning systems, and the claim for iris recognition as one of the basic biometric supports of future security systems, along with fingerprint, voice and face recognition. Based on the previous assumption of iris recognition as a rock-solid science, agencies have already planned for its extensive use.

The Defense Department has been using iris scans for over a decade in Iraq, Afghanistan and other places to detect terrorists, and it plans to use it for physical access to facilities in combination with Common Access Cards. The FBI wants to use iris recognition in its Next Generation Identification System, the eventual replacement for its famed Integrated Automated Fingerprint Identification System. And Congress has been pushing NIST to come up with the necessary standards for other government uses of iris recognition, chiding officials in committee hearings about not living up to earlier promises.

Other governments around the world aren’t waiting. India has already enrolled hundreds of millions in a national identity system that includes iris recognition. Mexico began using iris scans on ID cards several years ago, and Argentina is also using it in its national identity system.

There are other incentives brewing, not least the use of iris recognition in mobile systems. Apple is reportedly looking at adding iris scans in future systems to the fingerprint identification it already uses, while Samsung on the Android side of things is rumored to also be interested. Since more and more government IT seems to be driven by consumer innovations, that could also accelerate the use of iris recognition in government apps.

However, if there are problems with iris recognition, what would that mean for security? No security technology is foolproof but, based on that “rock-solid” assumption, iris recognition is perceived to be as close to it as you can come. If there really are major flaws that can be exploited, then agencies will be building security systems with unexpected holes in them.

Posted by Brian Robinson on Mar 14, 2014 at 9:43 AM4 comments

Alarm clock in front of Windows XP desktop screen

Is XP running your critical systems?

After 12 years of dominating the market for Windows operating systems, more recent Windows versions finally are beginning to replace the popular and venerable XP. But a surprising number of critical systems are still running this workhorse OS in the government enterprise and will need to be protected after Microsoft ends support in April.

Upgrading to Windows 7 or 8 would seem to be the logical solution, but as is so often the case with legacy IT, it’s more complicated than that.

“There are some people who don’t have an option to change,” said John Stubbs, director of software channels for Unisys. Many times the OS is running in automation and process control systems that run business and mission-critical systems, both in private sector and government enterprises. “We were surprised by the percentage of XP devices that are still controlling those types of activities,” Stubbs said.

Pinpointing the number of devices running a particular operating system is difficult, but large-scale trends indicate that XP is not disappearing any time soon.

A 2013 study by software vendor Softchoice found XP running on 58 percent of a sample of 500,000 devices across 7,200 enterprises, down from 68 percent the year before. Most of the difference was made up by the adoption of Windows 7, with only a small uptake of Windows 8. The enterprises surveyed were private sector, but given government’s usual rate of upgrade to new technology, there is no reason to believe that agencies are ahead of this curve, Stubbs said.

The prevalence of XP in critical systems is likely to be higher than throughout the enterprise in general because once critical systems are up and running they often are left alone until they break, and upgrading them can be expensive.

Critical control systems are certified for operating in government as a whole, and a $1,000 XP machine might be running a $1 million system. Upgrading that controller could require a recertification and upgrading of the entire system, which means the software tends to be left in place for as long as possible.

This is fine as long as the OS does not have to work with new apps and protocols, but eventually it exposes the system to increased risk if it no longer is being supported and patched by the vendor.

Not surprisingly, Unisys says it has a solution for that, its Stealth suite of software. Stealth “hides” protected devices by ignoring traffic that is not from an approved Stealth source, so that devices cannot be reached by attackers. The need to isolate and hide vulnerable XP devices is opening a new market for the Stealth suite. Microsoft is also offering an expensive custom support service for XP, and there are third party subscription services that block exploits of unpatched XP vulnerabilities.

These are not permanent fixes for XP, but they can help buy time to upgrade critical systems with an operating system that has more of a future.

Posted by William Jackson on Mar 07, 2014 at 9:46 AM1 comments


NSA-bashing bills could hamstring cybersecurity info sharing

The raft of stories inspired by the Edward Snowden leaks of NSA eavesdropping has done major damage to America’s international relations and stirred up no little ruckus in the United States about illegal wiretapping and government overreach. So far, however, it’s not caused any irreparable splits between government and the IT industry. Big concerns, yes, but no concrete effects yet.

That could change, in a hurry. Bills introduced recently at the state level, if they become law, could bar many technology companies from doing business not only with the NSA, but also with state and local government entities. Even worse, any companies that subcontracted with companies doing business with the NSA or its partners could be affected. These bills also  threaten the sharing of information between industry and government that is crucial to U.S. cybersecurity, one of the nation’s top technology priorities.

California is probably the most important state so far to propose one of these bills, given that it’s the center of the U.S. high-tech industry, and so many of the companies there have some tie-in to civilian and military agencies. Ted Lieu, a Democratic state senator, and Republican Senator Joel Anderson, introduced Senate Bill 828 on Jan. 6 seeking  to throttle the NSA’s activities there.

In a statement the same day , Lieu said that “state-funded public resources should not be going toward aiding the NSA or any other federal agency from indiscriminate spying on its own citizens and gathering electronic or metadata that that violates the Fourth Amendment.” 

Other states that have so far introduced similar bills include Washington, Arizona, Maryland, Missouri, Oklahoma, Tennessee and Vermont. 

It’s not so much the fact that the bills have been introduced that has raised flags but that the language they use is so potentially far reaching. The California bill, for example, would “ban state agencies, officials and corporations providing services to the state from giving any material support, participation or assistance to any federal agency to collect electronic or metadata of any person, unless there has been a warrant issued that specifically describes the person, place and thing to be searched or seized,” according to Lieu.

It’s that “material support” bit that is concerning industry. In a letter to Lieu obtained by GCN, the IT Alliance for Public Sector (ITAPS), formed late last year by the Information Technology Industry Council, said the legislation could effectively ban companies from doing certain business, prohibit state funds going to companies and prevent the state or political subdivisions from providing incentives for companies to invest in California.

Given the vague language the bill uses you can’t get a firm idea on how far down the pipeline this could reach, according to Carol Henton, ITAPS’ vice president of state, local and education, public sector. The fear is that it will affect subcontractors and others who do business with government contractors, including the likes of counties and school districts, “and that could potentially sweep in oodles of activity.”

That includes such things as information sharing. It’s taken years to build the level of trust that’s needed for the kind of sharing about cybersecurity threats faced by industry and government organizations and that pose dangers for critical infrastructure. Companies and state entities such as law enforcement now regularly share information with the NSA. The bills proposed by California and other states could ban that.

And it’s not a straight one-to-one sharing. The NSA shares information back and forth with agencies such as the Department of Homeland Security, the FBI and the military. Would companies also be prohibited from doing business with those government agencies, since under the wording of the legislation that could well be construed as giving “material help” to the NSA? And since the legislation also forbids public universities in the state from being research facilities for the NSA, or acting as a recruiting grounds for it, would that also affect agencies that work with the NSA?

It’s unclear yet how far all of this will go. There are already indications that, given the fears expressed by ITAPS and other industry bodies, California lawmakers are already having second thoughts about pushing ahead with their legislation. Other states aren’t so reticent. An Arizona state senate committee voted out its version of the legislation on Feb. 24 , and it now moves to the full Senate for a vote.

And it seems unlikely this will go away any time soon. The legislation that’s already proposed is apparently based mainly on a template developed by Off Now, a coalition of national and state groups that’s aimed at “nullifying” NSA activities, and it seems to be gaining support from across the political spectrum. As California showed, the bills have some bipartisan support. 

Given that we are moving into what will be contentious mid-term elections, and then will go straight into the buildup for an even more contentious 2016 presidential election, something that’s as popular now as NSA bashing will be an attractive target at least until then. 

What that means for critical government IT and cybersecurity efforts still has to be worked out.

Posted by Brian Robinson on Feb 28, 2014 at 10:50 AM1 comments