Cyber notes: Progress on identity ecosystem, Android trust and another email vulnerability

Cyber notes: Progress on ID ecosystem, Android trust and another email vulnerability

A public-private working group that has been quietly beavering away for the past few years has finally come out with the first version of an Identity Ecosystem Framework (IDEF).  This  baseline set of standards and policies could finally do away with passwords — the bane of most security systems — and enable better and more secure online transactions.

It’s the first step towards what the four-year old National Strategy for Trusted Identities in Cyberspace envisions as an “identity ecosystem” that uses seamlessly interoperable technology, processes and policies to support a broad range of low- to high-value transactions -- from those that are anonymous all the way to those that are fully authenticated.

At least, that’s the plan. In between now and then comes a range of other steps that must be completed. IDEFv1 is the foundation for the Self Assessment Listing Service (SALS), for example, through which businesses and organizations that sign on to the IDEF basics can report on how well they are conforming to the NSTIC guiding principles for identity solutions that will work in the ID ecosystem.

SALS, gratifyingly, will be available as just a single website and has been developed in parallel with the IDEF work. Assuming everything comes together in good order, it’s slated to go online in January.

Other elements could be tougher to pull together. A key to the success of the NSTIC ecosystem will be the development of various trust networks, each of which will be based on the policies and standards needed for specific communities, such as the financial and healthcare industries. Others could be for the identification of smartcards used for both physical and logical access, another for mobile phone providers and so on.

Each of these trust networks will be supported by one or more private-sector accreditation authorities that will validate identity providers and other parties as meeting all of the policies and standards of a particular trust framework. Those that are validated may be issued a trustmark so that their users will know they meet the requirements of a particular trust framework and the criteria of the overarching IDEF.

Presumably, that could lead to significant cross fertilization. Products and solutions that meet the mobile phone trust requirements, for example, would also have the basics to operate within a healthcare trust framework.

If everything intended for the identity ecosystem comes together — still a big if, with so many different interests to be satisfied — it would go a long way to doing away with the current miasma of unsatisfactory security and trust schemes. That lack of unity is behind many of the vulnerabilities that bad guys now exploit.

Speaking of trust...

There’s been much speculation in the past few months about various vulnerabilities in Android phones that reflect a worsening environment for users of these devices. Now, a paper from the University of Cambridge warns that, on average over the past four years, some 87 percent of Android devices have been open to attack by malicious apps.

The study used data from over 20,000 different devices, from which the researchers concluded that the vulnerabilities occurred because device manufacturers haven’t provided regular, frequent security updates.

This isn’t a new problem, and some companies, particularly Google and Samsung, have committed to regular monthly updates. Of course, the other end of the problem is that users must actually apply those updates, if the phones don’t automatically do that.

Nevertheless, the Cambridge researchers point out, even though Google has done a good job in mitigating many of the risks, it can only do so much. Devices require updates from manufacturers, they say, “and the majority of (Android) devices aren’t getting them.”

Do you use email as a file system?

Illegalities and potential harm to the side, the fact that CIA director John Brennan and DHS Secretary Jeh Johnson — the heads of agencies that are central to U.S. security — can have their private email accounts cracked by a high schooler using fairly basic hacking techniques is cause for some snide giggles.

Not so funny, however, is something one commentator brought up:  many of us seem to use email as an extensive storage system. According to this 20-year tech veteran, Bob Covello, too many people use email as a primary file system for important documents, which offers a very tempting “one-stop shop” for those who want personal information.

After I read this I did a quick survey of my own email. Nothing in it gets remotely to the level of the stuff Brennan and Johnson may have in their inboxes, but there’s enough of consequence that it could prove embarrassing. More embarrassing is the fact I apparently haven’t cleaned out my email in several years.

Novello thinks using a cloud-based storage system for these documents would eliminate many of the concerns with accessibility and redundancy that now exist with email filing systems. Just don’t forget the two-factor authentication logon for that.

All very good advice. But wait a minute -- I see I’ve got emails coming in I’ve got to go handle...

Posted by Brian Robinson on Oct 23, 2015 at 9:37 AM0 comments

Backsliding on cybersecurity?

Backsliding on cybersecurity?

The annual rundown of agencies’ implementation of Federal Information Security Management Act is greeted as a relatively humdrum affair these days. Nevertheless, it gives a good overview of the state of government security and, particularly in these days of hair-raising breaches, should be treated with more respect.

With the proviso that it doesn’t provide a granular view of agency security — most agencies would claim they have good security somewhere in the enterprise — the Government Accountability Office’s report makes for interesting reading. A little depressing also, in the sense that government seems to be backsliding on many of its commitments.

Upfront, the GAO talks about the “persistent weaknesses” at the 24 federal agencies it surveyed , illustrating the challenges they face in applying effective information security policies and practices. In some cases, such as systems configuration management and overall security management, there was a notable improvement in agencies’ overall performance.

However, the GAO’s own work and that of agency inspectors general “highlight information security control deficiencies at agencies that expose information and information systems supporting federal operations and assets to elevated risk of unauthorized use disclosure, modification and disruption,” the GAO said.

Most disappointing of all, perhaps, was the slide in the amount of security awareness training the agencies are providing their employees. A workforce well educated in what’s needed for good security is touted by all sides as a backbone requirement for overall cybersecurity, and the lack of such knowledge is blamed for a spate of “bad cyber hygiene” that has enabled successful phishing attacks on  government systems.

For fiscal year 2014, GAO reported, fewer agencies than in previous years said at least 90 percent of their users had received such awareness training. Perhaps the most worrying item was the fact that, according to the Office of Management and Budget, the 24 agencies surveyed had provided training for just 80 percent of their personnel who have significant security responsibilities, versus 92 percent in fiscal 2013.

It’s not as if government is oblivious to the need for security. Overall it spent $12.7 billion in fiscal 2014 on cybersecurity, the GAO said, and while that’s not as much as in some years past, it was still a big jump from the $10.3 billion of fiscal 2013.

Even that doesn’t tell the whole story, however. In the area of “shaping the cybersecurity environment” — which includes building a strong information security workforce and supporting broader IT security efforts — agencies were all over the place, with some spending significant amounts of their total on this and others almost nothing.

Except for the Defense Department. Of the nearly $9 billion total it spent on security in fiscal 2014, more than $5 billion went to shaping the environment. Even the Department of Homeland Security was relatively light in this area, and only the much smaller National Science Foundation spent relatively more on the environment than the DOD.

It’s not surprising, therefore, that the DOD seems to be taking the lead in many areas of security implementation, not least when it comes to shaping its environment. Officials have recently talked about “drawing a line in the sand” about users who don’t practice good cyber hygiene and have threatened to throw people off DOD networks if they don’t improve.

Another way DOD is trying to reduce the threat from insiders is by cutting the number of people in the agency who can access classified information. Some 100,000 were dropped from these rolls in the first six month of fiscal 2015. That still leaves 3.8 million with access, though it’s down 17 percent from just two years ago.

That’s apparently at least partly in response to the White House National Insider Threat Policy launched in 2012 after the WikiLeaks affair. Since then, however, it’s been broadly acknowledged that security is also at least equally in danger from ignorant insiders who unknowingly give network access to attackers, simply because they don’t understand the implications of clicking on email attachments.  (A recent exercise by the U.S. Postal Service's Office of the Inspector General, which sent phishing emails to USPS personnel to test their response, found that 25 percent of employees clicked on the potentially dangerous link.)

And it only takes one errant click to give up the keys to the kingdom. In an increasingly connected world, even DOD won’t be safe, despite all its outlays, if just one of its partner organizations has a lesser focus on education and awareness.

Posted by Brian Robinson on Oct 09, 2015 at 5:27 AM0 comments

Can feds give cybersecurity the attention it deserves?

Can feds give cybersecurity the attention it deserves?

The insider threat to agency data, whether from people actively trying to steal it or from those who witlessly allow others to access it, is hardly a new issue. But it seems to be one that still causes more headaches than perhaps it should.

A Symantec-sponsored report found that just under half of the federal IT managers surveyed said their agency had been the target of an insider incident over a 12-month period. One in three said they had lost data to such an incident.

Sound familiar? The potential damage caused by malicious threats from insiders was certainly noted after the Wikileaks incident and hammered home by the Snowden affair. More recent breaches at the Office of Personnel Management and at the Pentagon were blamed, at least in part, on “bad cyber hygiene” by agency insiders.

Yet the report found that most agencies still don’t employ basic security measures. Well under half of them offer annual in-person security training to their employees or  employ obvious technologies such as two-factor authentication or agencywide endpoint encryption. Plus, they can’t tell when documents have been shared or how.

According to Symantec Public Sector Unified Security Practice Manager Ken Durbin, that’s largely because of the many competing issues agency IT managers must juggle.

“They’re under a lot of pressure on a lot of different fronts and have a lot of mandates and guidance they have to balance,” he said. “It’s a constant struggle for them to figure out where to put their resources, and what [security] area they need to tackle first.”

The good news is that the survey found over 75 percent of agencies seem be more focused on the insider threat now than a year ago. Despite that, however, two-thirds also said it is common for employees and contractors to email documents to personal accounts, and over half said appropriate security protocols simply are not followed. Some 40 percent say unauthorized employees access government information they shouldn’t on at least a weekly basis.

It’s these kinds of behaviors that have caused agency executives increasingly violent conniptions, and some have started to threaten fairly draconian action if their workers don’t start getting their security act together. Defense Department CIO Terry Halvorsen, for example, has said he could throw people who don’t practice good cyber hygiene off DOD networks. More recently, the Department of Homeland Security’s chief information security officer has talked about revoking repeat offenders’ security clearances.

It’s not clear how far that approach would go with all agencies. Some would no doubt want to wield that kind of big stick, but others will prefer to dangle carrots in front of people. It’s unlikely there will be anything like consensus.

Meanwhile, agencies must do what they can. Down the road, effective help is heading their way in the form of the DHS Continuous Diagnostics and Mitigation program, which will seed all agencies with a capability to know in real time if there are any problems on their networks and what they can do about them. That has the added attraction of something that DHS will pay for but, as Durbin also pointed out, it’s being rolled out much more slowly than many would like.

So, what to do in the meantime?

“Access control makes a lot of sense, limiting the kind of access that could otherwise be taken advantage of,” Durbin said. “Two-factor authentication gives a higher confidence that someone is who they say they are, and limiting escalated privileges means that, if someone is comprised, attackers can’t get access to (vital) network privileges.”

Even with all of that, he admits, it’s still a porous border. A better balanced scenario would be for agencies to put at least some of this in place, but also focus on their most sensitive data and put the strongest protections around that.

However, that requires agencies in the first place knowing what data they have and where it is. Which is the subject for a whole other story.

Mission: Impossible, the DARPA way

The problem with putting data on a chip for security sensitive organizations like the DOD is that the data is persistent, and if equipment containing the chips is captured, so is the information they contain. So the Defense Advanced Research Projects Agency, perhaps having watched old TV shows or recent Tom Cruise movies, is trying the destructive approach.

Following a contract with IBM to create self-destructing chips that use strained glass substrates, it recently demoed a working version of such a chip. It uses a circuit that, when triggered, causes a resistor to heat the chip and shatter.

At least in battlefield situations, spinning disk drives will soon be a thing of the past, with more robust solid state drives — chip-based memory — taking their place. That’s their advantage, but also their problem, one the DARPA program aims to solve.

It may take a few seconds longer for these chips to self-destruct than the MI devices required, however. And DARPA’s not saying if said destruction will be accompanied by those cool clouds of smoke that Jim Phelps had to endure.

Posted by Brian Robinson on Sep 25, 2015 at 10:32 AM1 comments

spear phishing

Phish me once, shame on you. Phish me twice…

What should we make of the most recent announcements of government “awareness campaigns” about phishing? The National Counterintelligence and Security Center (NCSC) is the latest to say it will launch such a program, following damaging breaches this year the Office of Personnel Management and other agencies.

NCSC director Bill Evanina told the audience at a recent conference that the vast majority of significant breaches in both the public and private sector have started with spear phishing, where malware-laden emails are sent to specific people in organizations. Even keeping  just a few people from clicking the links in those emails, Evanina said, may prevent a massive breach in the future. The NCSC, he said, has begun a four-part campaign to make people more aware of cyber threats, including spear phishing.

Earlier this year, the Defense Department’s CIO Office said it was “drawing a line in the sand” about users with poor cyber hygiene, meaning those who didn’t follow basic security practices would be thrown off DOD networks. That follows a March memo from CIO Terry Halvorsen specifically warning DOD personnel and their families about phishing dangers.

However, it seems we’ve been here before. Phishing threats have been known for some time. The National Institute of Standards and Technology has published cybersecurity guidelines highlighting the dangers and, broadly, what agencies can do about them. Federal Information Security Management Act policies also mandate that agencies provide comprehensive awareness and training programs for their workers.

Getting from there to an actual increased defense against phishing is a another matter, however. Telecom provider Verizon, in its 2015 Data Breach Report, found overall that some 23 percent of recipients of phishing emails open them, and nearly half of those actually click on the attachments that contain the malware. A campaign of just 10 phishing emails has a greater than 90 percent chance that at least one user will become a victim.

And training may not be the answer. Security company KnowBe4 made its own study and found that educational and awareness campaigns deliver significantly less than they promise. Too many organizations “still rely on a once-a-year breakroom ‘death by PowerPoint’ training approach or just rely on their filters, do no training and see no change in behavior,” the firm said.

Anecdotal evidence from both current and recently retired government employees seems to confirm that. Agencies provide those training sessions, for sure, but there’s little or no follow-up in the time between them. In too many cases, awareness and educational training seems to be just one more box to tick on agencies’ compliance list.

It’s not that government employees willfully disregard the dangers, but when they have so much to do during the day just to get their jobs done, and when the awareness isn’t reinforced, those dangers tend to recede in the face of more immediate needs. Clicking on an email that has been artfully designed to look like it’s from an official source is then an easy mistake to make.

The proof of the NSCS’s campaign and Halvorsen’s tough talk will be in the eventual application of consequences. For example, despite the March CIO memo and later crack-down comments, the Pentagon found itself in July investigating an attack on its senior officers’ unclassified email network, prompting a temporary shutdown of the Joint Chiefs of Staff’s 4,200 email accounts.

The hack was believed to have come through a phishing attack. The usual suspects –in this case Russia – were thrown out as possible sources of the attack, but it was surely also a case of “bad cyber hygiene” on the part of the Pentagon brass. So, when can we expect the Joint Chiefs to be thrown off that particular part of the DOD network?

Posted by Brian Robinson on Sep 11, 2015 at 10:47 AM2 comments