Monthly Archives: June 2010

History, Security

When does Cyber Attack become War?

1 Comment

Major David Willson is an attorney in the US Army. He has spent more than a decade providing legal advice to the DoD and NSA on information security. Yesterday at the BSides Denver conference Willson presented a paper titled “When does electronic espionage or a cyber Attack become an ‘Act of War’“. The BSides are an informal gathering of information security professionals from the local area.

His paper provides analysis and context to help with the definition of war, but he also offered concrete suggestions in his presentation for how nations can be better prepared to respond in the event of a cyber attack or cyber war. He calls for an international approach.

The audience response was interesting, to say the least. Most of the opposition came from a small vocal group that raised the following issues:

  • Can an International group be trusted?
  • Can an International group be trusted?
  • And last, but not least, can an international group…be trusted?

I say this in all seriousness. Although I would like to think security professionals are familiar with trust as it relates to controls (how to detect, prevent and verify) the mention of an international approach seemed to send certain people into a spell. A centralized authority model, especially one of international membership, clearly upset the audience; eyes rolled back, arms folded, heads shook.

One person in the audience asked several times “Who will be King?! Who will be the King of the group?!”

King?

It quickly appeared that political science concepts (study of human behavior) could have helped this group see past whatever hurdles they were stuck upon. They struggled to transition from the technical material to more organizational security. While (expectedly) comfortable discussing locksport (picking locks), the mention of human behavior and power relationships resulted in comments that went awry. Here are a few suggestions for what Willson’s presentation might have started with to better prepare this particular audience.

  1. Forms and types of governance (or how to distinguish monarchy from democracy)
  2. Allocation and transfer of power in decisions
  3. Disciplines (or how to distinguish realism from instrumental rationality, positivism and behavioralism)

This might have done the job, explaining why a centralized group with international authority would not easily be compromised by a “bad apple” (pun not intended).

One person shouted:

International authority? Someone could compromise it! Isn’t this a case where the cure is worse than the disease?!

Another person asked:

So the US could just turn off the network in another country?

First, this response suggested to me a group that works with information security can nonetheless be missing key concepts of how to apply security in a real world. Security professional know that controls can be used to detect and prevent unauthorized access. These concepts can be adapted and applied to the model(s) put forward by Willson. His point is that there is a legal framework for technical controls to be introduced. That makes sense and so we could have discussed how those controls might work to achieve the purpose of the model. Instead the audience heckled the speaker about unfamiliar topics they feared: politics, law and trust.

Second, it reminded me of non-interventionalism and isolationist movements in America. After the First World War, for example, instead of ratifying Versailles the US essentially walked away and refused to be involved with international security frameworks such as the League of Nations and International Court of Justice. The 1920s also saw tough tariffs raised on imports and immigration severely restricted.

Another example could be the American Revolutionary War. The alliance with France was essential to victory in the war, yet many in the US strongly distrusted and advocated against ties to foreign states. President Washington spoke out against intervention. Thomas Paine published a book on the subject titled provocatively Common Sense.

With all this in mind President Roosevelt presented the state of international affairs as a cause for intervention in 1940:

Some indeed still hold to the now somewhat obvious delusion that we of the United States can safely permit the United States to become a lone island, a lone island in a world dominated by the philosophy of force. Such an island may be the dream of those who still talk and vote as isolationists. […] On this tenth day of June, 1940, the hand that held the dagger has struck it into the back of its neighbor.

The US President said intervention was justified to fight a power when the goal of that power is to destroy American ideologies. This led to legal arguments like the Fourth Neutrality Act that enabled international support (US aid to France and Britain) for defense against German aggression.

It makes perfect sense to me why a military legal expert like Willson would make a case for a platform of cooperation to fight international cyber attacks and cyber war. It makes sense in non-commercial as well as commercial spheres. Companies that compete can still work together when it comes to fighting fraud and crime. It does not, on the other hand, make sense to me why this particular audience of security professionals was so delusional as to ask “who will be king” or shout “cure is worse than the disease”, unless they represent the philosophical equivalent of mis-guided American isolationists.

Although there is a colorful past of non-interventionalism movements in America, no argument of logic or historic reference was raised by the hecklers. They simply, and ironically, expressed that they have a fear of authority and of foreigners. I suspect if they were prepared better, or approached in a different way such as how to build a secure lock for a door of their car, they would be full of ideas how we might build authentication and authorization. Instead they sat and spun in fear.

Energy, Security

The Reason for US Dependence on Oil

Leave a comment

John Stewart gives a brief review of US Presidential resolve to achieve independence from foreign oil:

The Daily Show With Jon Stewart Mon – Thurs 11p / 10c
An Energy-Independent Future
www.thedailyshow.com
Daily Show Full Episodes Political Humor Tea Party

Why didn’t it work? Stewart analysis:

  • We have the ideas
  • We are good people
  • Deadlines were missed

The President most likely to succeed at this (he created the EPA, Clean Water Act, Marine Mammal Protection Act) was unsuccessful getting Americans to reduce petroleum consumption because….

Watch and find out the reason for US Dependence on Oil.

Security

The Future-Past of Cloud Security

2 Comments

CSO Online says they have four examples of “Cloud security in the real world”.

I think this one is my favorite:

“We know one of their three data centers have our data; it’s not just sent into the cloud and we don’t know where the data is,” he says.

Ok, that is just scary. The data is not in the big bad amorphous cloud, it is in one of three data centers. That is much more specific. We should trust controls in three data centers?

This seems to me like saying you know your child is staying in one of three cities, not just sent into a country but you don’t where. A city can be a very, very large place with many risks. The fact that you know the name of the city that the child is in does not mean it is safer than being inside a country.

In other words, a city could have controls and some secure areas but that does not mean a) the city is safe in general and b) your child stays in the safe areas. Does this analogy work?

A really good example of what I am talking about is in my visualization post from the other day; what’s your data altitude? Here is San Francisco:

The point (pun not intended) is that we must to attest to the security of the environment our data lives in. When someone says the data will be in one of three datacenters then those three datacenters will be in scope of an audit. Instead of looking at a neighborhood, or a house, we will now look at security in an entire city. Ouch.

That is a lot of real estate.

Another example in the same article gives a sightly different angle on this elephant:

“Because the rules haven’t changed to reflect cloud computing, regulations still require visits to the physical box, and you can’t do that in the public cloud,” he says. For data that falls under compliance regulations, Kavis plans to use a virtual private cloud. “The vendor will say, “Here’s your server, locked in a cage, and if you ever have an audit, you can bring in the auditors to look at it.’ We’ll use that for passing audits, but everything else will be in the public cloud.”

Ah hah! Don’t look at three data centers, just look at this one specific area. Smart, sort of.

Let me set aside the fact that this guy is clearly trying to appease the auditor rather than run a secure environment. That reminds me of this Far Side cartoon:

See a problem?

The issue I have here is how upside down and backwards this second example sounds.

I hate to hear people say the rules haven’t changed to reflect cloud. Consider that the examples in the article of real world cloud security involve the following concepts: authentication, firewalls, encryption. OMG! Can rules handle such new and different concepts in security? A firewall! What is that? What will auditors do now? When will they catch up to the cloud innovation?

Seriously, though, the hidden issue here is that clouds are still in their infancy and that means they are about sharing, not caring. Their value proposition thus far works through more open access to more resources. This should sound familiar to anyone who used very early operating systems. Security demands controls around data, regardless of where it goes. This also is far from being a new concept.

The rules do not have to change, the cloud has to change to meet the rules.

Clouds simply have not matured to accommodate the usual security requirements. Providers are finally approaching the point where they can handle the fundamentals of delivering primary services – making things actually work.

Security will start to come into better focus after the system is operating. It’s like watching the single-user operating system (DOS) evolve into the multi-user operating system called Windows — cloud products should soon start to handle the rules better. Not the other way around…and look how secure Windows is now after years of progress from the early days of sharing data. Am I being too sarcastic?

Sharing is better when there is caring. Let’s hope the cloud vendors can soon offer services and products that help them catch up to the rules.