Alarm clock in front of Windows XP desktop screen

Is XP running your critical systems?

After 12 years of dominating the market for Windows operating systems, more recent Windows versions finally are beginning to replace the popular and venerable XP. But a surprising number of critical systems are still running this workhorse OS in the government enterprise and will need to be protected after Microsoft ends support in April.

Upgrading to Windows 7 or 8 would seem to be the logical solution, but as is so often the case with legacy IT, it’s more complicated than that.

“There are some people who don’t have an option to change,” said John Stubbs, director of software channels for Unisys. Many times the OS is running in automation and process control systems that run business and mission-critical systems, both in private sector and government enterprises. “We were surprised by the percentage of XP devices that are still controlling those types of activities,” Stubbs said.

Pinpointing the number of devices running a particular operating system is difficult, but large-scale trends indicate that XP is not disappearing any time soon.

A 2013 study by software vendor Softchoice found XP running on 58 percent of a sample of 500,000 devices across 7,200 enterprises, down from 68 percent the year before. Most of the difference was made up by the adoption of Windows 7, with only a small uptake of Windows 8. The enterprises surveyed were private sector, but given government’s usual rate of upgrade to new technology, there is no reason to believe that agencies are ahead of this curve, Stubbs said.

The prevalence of XP in critical systems is likely to be higher than throughout the enterprise in general because once critical systems are up and running they often are left alone until they break, and upgrading them can be expensive.

Critical control systems are certified for operating in government as a whole, and a $1,000 XP machine might be running a $1 million system. Upgrading that controller could require a recertification and upgrading of the entire system, which means the software tends to be left in place for as long as possible.

This is fine as long as the OS does not have to work with new apps and protocols, but eventually it exposes the system to increased risk if it no longer is being supported and patched by the vendor.

Not surprisingly, Unisys says it has a solution for that, its Stealth suite of software. Stealth “hides” protected devices by ignoring traffic that is not from an approved Stealth source, so that devices cannot be reached by attackers. The need to isolate and hide vulnerable XP devices is opening a new market for the Stealth suite. Microsoft is also offering an expensive custom support service for XP, and there are third party subscription services that block exploits of unpatched XP vulnerabilities.

These are not permanent fixes for XP, but they can help buy time to upgrade critical systems with an operating system that has more of a future.

Posted by William Jackson on Mar 07, 2014 at 9:46 AM1 comments


NSA-bashing bills could hamstring cybersecurity info sharing

The raft of stories inspired by the Edward Snowden leaks of NSA eavesdropping has done major damage to America’s international relations and stirred up no little ruckus in the United States about illegal wiretapping and government overreach. So far, however, it’s not caused any irreparable splits between government and the IT industry. Big concerns, yes, but no concrete effects yet.

That could change, in a hurry. Bills introduced recently at the state level, if they become law, could bar many technology companies from doing business not only with the NSA, but also with state and local government entities. Even worse, any companies that subcontracted with companies doing business with the NSA or its partners could be affected. These bills also  threaten the sharing of information between industry and government that is crucial to U.S. cybersecurity, one of the nation’s top technology priorities.

California is probably the most important state so far to propose one of these bills, given that it’s the center of the U.S. high-tech industry, and so many of the companies there have some tie-in to civilian and military agencies. Ted Lieu, a Democratic state senator, and Republican Senator Joel Anderson, introduced Senate Bill 828 on Jan. 6 seeking  to throttle the NSA’s activities there.

In a statement the same day , Lieu said that “state-funded public resources should not be going toward aiding the NSA or any other federal agency from indiscriminate spying on its own citizens and gathering electronic or metadata that that violates the Fourth Amendment.” 

Other states that have so far introduced similar bills include Washington, Arizona, Maryland, Missouri, Oklahoma, Tennessee and Vermont. 

It’s not so much the fact that the bills have been introduced that has raised flags but that the language they use is so potentially far reaching. The California bill, for example, would “ban state agencies, officials and corporations providing services to the state from giving any material support, participation or assistance to any federal agency to collect electronic or metadata of any person, unless there has been a warrant issued that specifically describes the person, place and thing to be searched or seized,” according to Lieu.

It’s that “material support” bit that is concerning industry. In a letter to Lieu obtained by GCN, the IT Alliance for Public Sector (ITAPS), formed late last year by the Information Technology Industry Council, said the legislation could effectively ban companies from doing certain business, prohibit state funds going to companies and prevent the state or political subdivisions from providing incentives for companies to invest in California.

Given the vague language the bill uses you can’t get a firm idea on how far down the pipeline this could reach, according to Carol Henton, ITAPS’ vice president of state, local and education, public sector. The fear is that it will affect subcontractors and others who do business with government contractors, including the likes of counties and school districts, “and that could potentially sweep in oodles of activity.”

That includes such things as information sharing. It’s taken years to build the level of trust that’s needed for the kind of sharing about cybersecurity threats faced by industry and government organizations and that pose dangers for critical infrastructure. Companies and state entities such as law enforcement now regularly share information with the NSA. The bills proposed by California and other states could ban that.

And it’s not a straight one-to-one sharing. The NSA shares information back and forth with agencies such as the Department of Homeland Security, the FBI and the military. Would companies also be prohibited from doing business with those government agencies, since under the wording of the legislation that could well be construed as giving “material help” to the NSA? And since the legislation also forbids public universities in the state from being research facilities for the NSA, or acting as a recruiting grounds for it, would that also affect agencies that work with the NSA?

It’s unclear yet how far all of this will go. There are already indications that, given the fears expressed by ITAPS and other industry bodies, California lawmakers are already having second thoughts about pushing ahead with their legislation. Other states aren’t so reticent. An Arizona state senate committee voted out its version of the legislation on Feb. 24 , and it now moves to the full Senate for a vote.

And it seems unlikely this will go away any time soon. The legislation that’s already proposed is apparently based mainly on a template developed by Off Now, a coalition of national and state groups that’s aimed at “nullifying” NSA activities, and it seems to be gaining support from across the political spectrum. As California showed, the bills have some bipartisan support. 

Given that we are moving into what will be contentious mid-term elections, and then will go straight into the buildup for an even more contentious 2016 presidential election, something that’s as popular now as NSA bashing will be an attractive target at least until then. 

What that means for critical government IT and cybersecurity efforts still has to be worked out.

Posted by Brian Robinson on Feb 28, 2014 at 10:50 AM1 comments

Google Glass

The next security perimeter? You're wearing it.

The idea of wearable technology is not new to government. In the military, the concept of using hands-free technology to integrate soldiers in the field into mobile ad hoc networks is part of the Defense Department’s vision of network-centric warfare. But what happens when unmanaged personal or wearable devices are brought into the workplace to connect with the enterprise network?

The result is another layer of security concerns for agencies that still are struggling with the challenges presented by the bring-your-own-device movement.

Some of the challenges presented by products such as Samsung Galaxy Gear and Google Glass are not new. In many ways, “it’s just an alternative form factor,” said Paul Christman, Dell Software’s vice president of public sector. “They are fairly consumer oriented, and they tend to be fairly low tech,” mostly acting as sensors to gather data such as location and health metrics.

The challenge with these devices is not only to secure the data they gather and the connections they use but also to decide who owns and controls the data. 

Joggers who wear a fitness monitor might assume the data is theirs; but odds are they are sharing it with someone else, whether they know it or not. As devices become more sophisticated and are used to access data at work, they will have to be managed and the data they access secured.

Progress is being made in addressing the workplace security challenge in traditional BYOD, often by compartmentalizing the devices to create separate personal and work partitions. Typically, the user cedes a degree of control over the personal device so that workplace IT administrators can enforce policy in the partitioned workspace.

“The same model can apply” in wearable technology, Christman said. “But how do you compartmentalize Google Glass?”

Technologically, the challenge is not that great. Based on their experience with laptops and smartphones, IT pros can port existing security tools to the new form factors as the devices become sophisticated enough to accept them. The real hurdle is making the decision to do so and doing it early enough that administrators do not find themselves in an endless loop of catch-up as the new technology comes online.

Fortunately, the call for security is going out early. “There are a lot of people sounding the alarm from the get-go,” Christman said. “Geolocation data is getting a lot of attention now. That’s one of the things that needs to be addressed first.” The security of local wireless connection protocols used by small devices, such as Bluetooth and near field communication, also needs to be addressed.

And along with the technology fixes there will have to be “polite rules of society” for when and where we use technology and when it’s time to take the glasses off, Christman said. Rules such as “turn the camera off in the locker room” are probably a good idea.

The social and legal niceties of mobile devices are no trivial matters. A man was shot to death in Florida last month in an apparent argument over texting in a movie theater, and a California woman was ticketed late last year for driving with Google Glass. The charge against the woman was dismissed in January, but the questions about liability and legality remain unanswered.

Posted by William Jackson on Feb 21, 2014 at 12:31 PM1 comments


Where do you draw the line on securing critical infrastructure?

The National Institute of Standards and Technology released its Cybersecurity Framework for critical infrastructure this week, a set of voluntary standards and best practices that the administration would like to see widely adopted by operators of systems critical to the nation’s economy and security.

The framework is a good and necessary step toward improving the nation’s cybersecurity, but it would be a mistake to think that it can achieve real security by itself. Multistage attacks against high-value targets are exploiting upstream vulnerabilities to provide easy access to critical resources in government as well as in sensitive private-sector systems. 

Enforceable baseline standards for a much wider range of systems are necessary to prevent these attacks. 

This vulnerability was brought home with the breach of RSA in 2011 that exposed critical data about the company’s SecurID authentication token. That began with a spear phishing attack against RSA’s parent company EMC, deploying a zero-day exploit to give attackers a foothold inside the company. This exposed RSA, and data stolen from the security company later was used in an attack against defense contractor Lockheed Martin.

A more recent example is the theft of information about tens of millions of credit cards. The attackers apparently used a network link with a heating, ventilation and air conditioning contractor to penetrate card payment systems at Target stores and possibly other retailers. The attack did not use HVAC control systems; the initial compromise could have been in almost any type of connected system.

The interconnections among information systems today make it difficult, if not impossible, to set limits on what infrastructure should be designated critical for government and the private sector. Multistage attacks can be simple or sophisticated, but they all exploit weak links that might in themselves be of little value. These attacks can  then escalate access to critical resources without having to penetrate a hardened perimeter. They can avoid setting off intrusion alarms and can make the breaches more difficult to detect.

This does not mean that critical systems should not get close attention when it comes to cybersecurity. Effective security needs to be risk-based, which means that those systems presenting the greatest risk get the most attention. But it does illustrate the risk of sharply defining the perimeters of critical, high-value systems without considering what those systems are connected to, what those secondary systems are connected to and what those systems are connected to.

Cybersecurity is a big job, and when approaching a big job it makes sense to prioritize. But don’t be lulled into thinking the job is done when the top priority is completed. Priorities are like an old fashioned rail fence: If you take off the top rail, you’ll find another top rail beneath it. Even if our critical infrastructure is protected, we cannot assume that we are secure until the infrastructure that connects to it is secure, down to the HVAC contractors if necessary.

Posted by William Jackson on Feb 14, 2014 at 11:52 AM0 comments