laptop connection

The Internet of malware-infected things

Body cameras are having a bumpy introduction. Most people on both sides seem to agree, in varying degrees, that such systems provide more transparency in incidents where law enforcement officials interact with the public as well as in training and evidence gathering. Technically, however, there are quite a few issues to still iron out.

Customs and Border Protection recently published findings of a feasibility study it had conducted to see how cameras could help its agents with their operations. Though the potential advantages were great, CPB said it found “significant challenges” to a rollout of the cameras because of cybersecurity, data processing and other issues.

The cameras generally lack adequate security features, the study found, and vulnerabilities could be introduced by streaming video or the interface between the cameras and non-approved devices. The cameras’ signals were also susceptible to hacking.

There also seems to be a question about whether some of the camera manufacturers understand any of this -- or even know what’s embedded in the devices they make. One recent case involved a company called Martel Frontline Camera, which makes $500 body cameras whose systems were found to be infected with the Conficker worm right out of the box.

Bear in mind that Conficker was state of the art back in 2008. These days, it’s a well-known threat that should be fairly easily caught by standard antivirus and firewall software. Any government security professionals who allow the Conficker worm into agency systems would rightly have their competency questioned.

Florida integrator iPower Technology had bought several of Martel’s cameras with which to test a cloud-based video system it was developing for government agencies and police departments. During testing and evaluation of the Martel product, the company discovered that the body cameras had been preloaded with the Win32/Conficker.Blinf worm.

iPower’s own antivirus software immediately discovered the worm but, as the company pointed out, any computer that didn’t have antivirus installed would have immediately been infected and could have spread the worm to other systems and across the network.

When iPower reached out to Martel, which has been in business for three decades, Martel technicians were incredulous, according to iPower’s owner and president. In fact, Jarrett Pavao told Threatpost, Martel didn’t even think there was software in the camera.

In iPower’s own release on its findings, Pavao made several good points.

“…as the Internet of Things continues to grow into every device we use in our businesses and home lives each day, it becomes even more important that manufacturers have stringent security protocols,” he said. “If products are being produced in offshore locations, what responsibilities lie with the manufacturer to guarantee our safety?”

Supply chain security has become a major worry for government. With so many IT components now made outside the United States, there’s a clear path for criminals and foreign states to plant malware that could infect U.S. systems and provide a way for people to steal information or commit espionage against U.S. government and private-sector organizations.

A Justice Department statement, for example, recently revealed that two Defense Information Systems Agency contractors had been fined for using unauthorized programmers to write software for Defense Department communications systems, which a separate Public Integrity investigation found actually involved Russian programmers. The code they provided — surprise — included numerous viruses.

Any company with modern security systems can easily deal with threats such as Conficker. As Pavao pointed out, however, there are many organizations that have much older, legacy systems and software that will have far more difficulty in detecting and dealing with threats. That’s a problem in many government agencies -- one that can’t be easily solved because many of those legacy systems are still running mission-critical applications.

With the most deadly threats today far more sophisticated than Conficker, however, the potential for havoc is absolute. Could it be that future breaches could stem from such non-obvious sources as police body cameras or similar devices?

Posted by Brian Robinson on Nov 20, 2015 at 1:47 PM2 comments

Is mobile security finally getting some respect?

Is mobile security finally getting some respect?

It looks like mobile security may at last be getting some attention in government, and it’s long overdue. While other aspects of IT security have been ratcheted up over the years, for some reason mobile security has proven a much tougher nut to crack -- and has lagged in the race for attention and funding.

Mobile security has proven a pain for most agencies, particularly with the once-hyped bring-your-own-device trend, in which government employees used their personal phones and tablets to do government work. With access and data security much harder to employ in mobile than for desktop devices, that threw up all kinds of concerns for organizations.

So much so, in fact, that some agencies simply tried to mitigate those concerns by banning most BYOD altogether. Well, no one expected that was going to work for the long run. And as a recent survey by mobile security firm Lookout found, many employees use their own devices no matter what the agency policy is. Fully half of the employees the company surveyed used their own devices to get government email, and nearly as many used them to download work documents.

In its Oct. 30 memo laying out a “Cybersecurity Strategy and Implementation Plan” for the civilian side of government, the Office of Management and Budget directly addressed mobile in a section on new cybersecurity shared services. Mobile devices, it said, have become as powerful and connected as desktop and laptop computers and require the same level of security attention.

But mobile security “has unique challenges that require different solutions than existing programs offer,” OMB said. “This service (or services) could address authentication, application management, device management, and encryption, and may include approved tools, best practices, and implementation support.”

Bob Stevens, vice president for federal systems at Lookout, said he’s encouraged by OMB’s statement, and by the formation of a forthcoming cybersecurity shared service center.   “Until now," he said, "most legislation and mandates around cybersecurity have been looking to solve problems that existed in 2009, not the problems that plague us today.”

A few days after OMB published its memo, the National Institute of Standards and Technology chimed in with a draft guide for securing mobile devices, based on a “typical” scenario drawn up and tested by engineers at NIST’s National Cybersecurity Center of Excellence. Examples in the guide show how organizations can configure a trusted device and, equally important, how to remove device details from IT systems if those devices are lost or stolen.

Public comment on the draft, part of the Center’s new Special Publication Series 1800 Cybersecurity practice Guides, is open through Jan 8, 2016.

These initiatives won’t be enough by themselves, given that agencies are so far behind the curve on mobile security. But at least now they’ll have a good place to start.

Posted by Brian Robinson on Nov 06, 2015 at 10:54 AM0 comments

Cyber notes: Progress on identity ecosystem, Android trust and another email vulnerability

Cyber notes: Progress on ID ecosystem, Android trust and another email vulnerability

A public-private working group that has been quietly beavering away for the past few years has finally come out with the first version of an Identity Ecosystem Framework (IDEF).  This  baseline set of standards and policies could finally do away with passwords — the bane of most security systems — and enable better and more secure online transactions.

It’s the first step towards what the four-year old National Strategy for Trusted Identities in Cyberspace envisions as an “identity ecosystem” that uses seamlessly interoperable technology, processes and policies to support a broad range of low- to high-value transactions -- from those that are anonymous all the way to those that are fully authenticated.

At least, that’s the plan. In between now and then comes a range of other steps that must be completed. IDEFv1 is the foundation for the Self Assessment Listing Service (SALS), for example, through which businesses and organizations that sign on to the IDEF basics can report on how well they are conforming to the NSTIC guiding principles for identity solutions that will work in the ID ecosystem.

SALS, gratifyingly, will be available as just a single website and has been developed in parallel with the IDEF work. Assuming everything comes together in good order, it’s slated to go online in January.

Other elements could be tougher to pull together. A key to the success of the NSTIC ecosystem will be the development of various trust networks, each of which will be based on the policies and standards needed for specific communities, such as the financial and healthcare industries. Others could be for the identification of smartcards used for both physical and logical access, another for mobile phone providers and so on.

Each of these trust networks will be supported by one or more private-sector accreditation authorities that will validate identity providers and other parties as meeting all of the policies and standards of a particular trust framework. Those that are validated may be issued a trustmark so that their users will know they meet the requirements of a particular trust framework and the criteria of the overarching IDEF.

Presumably, that could lead to significant cross fertilization. Products and solutions that meet the mobile phone trust requirements, for example, would also have the basics to operate within a healthcare trust framework.

If everything intended for the identity ecosystem comes together — still a big if, with so many different interests to be satisfied — it would go a long way to doing away with the current miasma of unsatisfactory security and trust schemes. That lack of unity is behind many of the vulnerabilities that bad guys now exploit.

Speaking of trust...

There’s been much speculation in the past few months about various vulnerabilities in Android phones that reflect a worsening environment for users of these devices. Now, a paper from the University of Cambridge warns that, on average over the past four years, some 87 percent of Android devices have been open to attack by malicious apps.

The study used data from over 20,000 different devices, from which the researchers concluded that the vulnerabilities occurred because device manufacturers haven’t provided regular, frequent security updates.

This isn’t a new problem, and some companies, particularly Google and Samsung, have committed to regular monthly updates. Of course, the other end of the problem is that users must actually apply those updates, if the phones don’t automatically do that.

Nevertheless, the Cambridge researchers point out, even though Google has done a good job in mitigating many of the risks, it can only do so much. Devices require updates from manufacturers, they say, “and the majority of (Android) devices aren’t getting them.”

Do you use email as a file system?

Illegalities and potential harm to the side, the fact that CIA director John Brennan and DHS Secretary Jeh Johnson — the heads of agencies that are central to U.S. security — can have their private email accounts cracked by a high schooler using fairly basic hacking techniques is cause for some snide giggles.

Not so funny, however, is something one commentator brought up:  many of us seem to use email as an extensive storage system. According to this 20-year tech veteran, Bob Covello, too many people use email as a primary file system for important documents, which offers a very tempting “one-stop shop” for those who want personal information.

After I read this I did a quick survey of my own email. Nothing in it gets remotely to the level of the stuff Brennan and Johnson may have in their inboxes, but there’s enough of consequence that it could prove embarrassing. More embarrassing is the fact I apparently haven’t cleaned out my email in several years.

Novello thinks using a cloud-based storage system for these documents would eliminate many of the concerns with accessibility and redundancy that now exist with email filing systems. Just don’t forget the two-factor authentication logon for that.

All very good advice. But wait a minute -- I see I’ve got emails coming in I’ve got to go handle...

Posted by Brian Robinson on Oct 23, 2015 at 9:37 AM0 comments

Backsliding on cybersecurity?

Backsliding on cybersecurity?

The annual rundown of agencies’ implementation of Federal Information Security Management Act is greeted as a relatively humdrum affair these days. Nevertheless, it gives a good overview of the state of government security and, particularly in these days of hair-raising breaches, should be treated with more respect.

With the proviso that it doesn’t provide a granular view of agency security — most agencies would claim they have good security somewhere in the enterprise — the Government Accountability Office’s report makes for interesting reading. A little depressing also, in the sense that government seems to be backsliding on many of its commitments.

Upfront, the GAO talks about the “persistent weaknesses” at the 24 federal agencies it surveyed , illustrating the challenges they face in applying effective information security policies and practices. In some cases, such as systems configuration management and overall security management, there was a notable improvement in agencies’ overall performance.

However, the GAO’s own work and that of agency inspectors general “highlight information security control deficiencies at agencies that expose information and information systems supporting federal operations and assets to elevated risk of unauthorized use disclosure, modification and disruption,” the GAO said.

Most disappointing of all, perhaps, was the slide in the amount of security awareness training the agencies are providing their employees. A workforce well educated in what’s needed for good security is touted by all sides as a backbone requirement for overall cybersecurity, and the lack of such knowledge is blamed for a spate of “bad cyber hygiene” that has enabled successful phishing attacks on  government systems.

For fiscal year 2014, GAO reported, fewer agencies than in previous years said at least 90 percent of their users had received such awareness training. Perhaps the most worrying item was the fact that, according to the Office of Management and Budget, the 24 agencies surveyed had provided training for just 80 percent of their personnel who have significant security responsibilities, versus 92 percent in fiscal 2013.

It’s not as if government is oblivious to the need for security. Overall it spent $12.7 billion in fiscal 2014 on cybersecurity, the GAO said, and while that’s not as much as in some years past, it was still a big jump from the $10.3 billion of fiscal 2013.

Even that doesn’t tell the whole story, however. In the area of “shaping the cybersecurity environment” — which includes building a strong information security workforce and supporting broader IT security efforts — agencies were all over the place, with some spending significant amounts of their total on this and others almost nothing.

Except for the Defense Department. Of the nearly $9 billion total it spent on security in fiscal 2014, more than $5 billion went to shaping the environment. Even the Department of Homeland Security was relatively light in this area, and only the much smaller National Science Foundation spent relatively more on the environment than the DOD.

It’s not surprising, therefore, that the DOD seems to be taking the lead in many areas of security implementation, not least when it comes to shaping its environment. Officials have recently talked about “drawing a line in the sand” about users who don’t practice good cyber hygiene and have threatened to throw people off DOD networks if they don’t improve.

Another way DOD is trying to reduce the threat from insiders is by cutting the number of people in the agency who can access classified information. Some 100,000 were dropped from these rolls in the first six month of fiscal 2015. That still leaves 3.8 million with access, though it’s down 17 percent from just two years ago.

That’s apparently at least partly in response to the White House National Insider Threat Policy launched in 2012 after the WikiLeaks affair. Since then, however, it’s been broadly acknowledged that security is also at least equally in danger from ignorant insiders who unknowingly give network access to attackers, simply because they don’t understand the implications of clicking on email attachments.  (A recent exercise by the U.S. Postal Service's Office of the Inspector General, which sent phishing emails to USPS personnel to test their response, found that 25 percent of employees clicked on the potentially dangerous link.)

And it only takes one errant click to give up the keys to the kingdom. In an increasingly connected world, even DOD won’t be safe, despite all its outlays, if just one of its partner organizations has a lesser focus on education and awareness.

Posted by Brian Robinson on Oct 09, 2015 at 5:27 AM0 comments