The Security Catalyst

If you’re reading this, you are most likely your family’s and friends local tech support.  It’s our job to serve and protect our local community’s technical needs.  See Alan Shimel’s StillSecure post from 9/24 for a great example (http://www.stillsecureafteralltheseyears.com/ashimmy/2006/09/what_is_the_ave.html). 
I see the same thing.  (“Ask Ron for help. He works with computers.”)  I graduated from Michigan State with a degree in Computer Science. My uncle would ask me questions about his PC.  I’d tell him, “Just because I have a degree in computers doesn’t mean I know anything about them.”  It’s like if you work for a large organization (> 1000 employees) and someone asks if you know someone there.  (“Oh, you work for Microsoft.  Do you know Bill Gates?”)  For more on this, see the Beyond the Summit post, “No, I can’t fix your computer.” (http://beyond-summit.blogspot.com/2006/09/no-i-cant-fix-your-computer.html).

Here are the problems: 
  1. People assume that others know a lot more than they really do. 
  2. Personal Computers running Windows allow anonymous modifications from remote locations.  This makes them unique from any other consumer item in history.

I’ve never taken a course in psychology, so I can’t help with problem #1. The ironic thing is that my wife teaches psych at a local college.  One day I’ll take a class with her.  Then I can brag to the other students that I slept with the professor. 

For problem #2, think about this:  Home computers have a unique feature that hasn’t been seen before in history; they can be modified remotely and anonymously without permission of the owner.*  This didn’t happen in the early days of cars or TVs.  People didn’t have to worry about ads being thrown on or in their cars without their permission. Or their cars being dinked with by someone in China that caused their car to only drive to porn theaters and do so at a slow pace sending their every move back to that guy in China.  TV is a little more similar to Windows PCs in that it has occasionally nefarious content and commercials.  However, they’re limited in time and scope and the commercials didn’t try to take over the TV limiting it to one porn channel.  Computers running Windows are special and not in a good way.

This problem requires both a short-term & long-term solution.
To solve this long-term we need to FORCE MICROSOFT TO FIX THE PROBLEM!  New versions of Windows should not allow anyone but the owner to modify their PC.  AND The owner should not need an MCSE certification to run the damn thing.  Hopefully this is the case with Vista.  (Any Micro$oft people out there wanna chime in on that?) 

The short term solution is a lot harder.  Collectively, we (meaning computer guys & gals) need to (A) suck it up and continue to be our local family and friends tech support. Consider it a great learning opportunity.  (B) Help our customers (i.e., family & friends) protect themselves and their computers on-line.  Both Microsoft & AOL have free tools out there to prevent and detect malicious logic.  See the list on the Resources page (http://www.securitycatalyst.com/consumer-protect/) and provide comment if you have any changes or additions. This may include setting up non-administrator accounts on their Windows PC.  They should use this account for Internet browsing and only use the admin account when modifying their PC.  (C) Educate our customers on the dangers of the Internet. Use the resources to teach them what to do and what not to do on the Internet.  This is especially important for kids.

These problems won’t be around forever.  The computer user-base is getting more educated every day.  Microsoft is trying to fix these problems.  The future is brighter; it’s just the present that occasionally sucks.

Finally:
By working together & helping each other, we all become stronger.

*I know, I know.  This is not really problem with Macs.

Welcome back! Yeah, I know, that’s better said to me than by me. The complications of travel, life and podcasting have conspired against me, but not dimished my passion, the expansion of the blog or the re-creation of the catalyst community.

In this episode, I introduce a new segment: “sites to see” and start pointing out security and security 2.0 websites to use.

This weeks Site to See

Microsoft Security Advisories
http://www.microsoft.com/technet/security/advisory/default.mspx

You can learn why I think it’s worth checking out by listening to the podcast. If you have a suggestion for future sites to see (your own or something you think is valuable), send me your idea (and get credit) by email: securitycatalyst@gmail.com.
Special Report
Did Two Factor Really Fail?

The short answer is: no - listen to learn what could have been done differently and why you should care!

Special Offer
I am offering a substantial discount to the first few people who want to improve the way their company addresses compliance and security (while making themselves look like rockstars) as I am about to unveil Effective Assurance. Listen to the podcast for details - or send me an email at michael.assurance@baldsecurityexpert.com — I look forward to sharing my passion with you and helping you improve compliance through security without wasting another dollar!

**** 17 Days and the Catalyst Community is OPEN!! ****

 

 SC36 [29:42m]: Play Now | Play in Popup | Download

Cutaway sent me a great letter this morning about Security 2.0, and has it posted to his blog. You can (and should) read it here: http://www.cutawaysecurity.com/blog/archives/47

What I really liked about his wording and approach was the concept of “threat source” and how we need to focus on education and other ways to combat the threat sources. I think that most, if not all, of us would agree that technology plays a role in securing our future - but I believe we have been relying on it too much. The end result of this reliance on technology is a total lack of responsibility and accountability which leads to blaming the technology and those who selected it.

Wrong, wrong, wrong!

I’ve mentioned (or dangled) my new “Effective Assurance” experience a few times. I’ll start creating an overview podcast - since we now have proof that engaging employees in a dialogue of empowerment and teaching them the skills and practices they need to take back responsibility works! Ideally, some of you will be able to hire me and we can work on proving it out together (and then you’ll enjoy rock-star status); but I’ll freely share what I have learned if it helps us all improve. I built effective assurance based on my research into Security 2.0 - and consider it to be the first offering in the suite of Security 2.0 solutions.
Cutaway get’s it - and is willing to talk about it, think about it and improve it.

I’ve started working to expand Security 2.0 - and will soon be talking more about it, writing about it and eventually speaking about it. The future is here.

I’m glad Cutaway is with us, and hope you are too!

*** 17 Days until the Catalyst Community is open; Trusted Catalysts are getting it ready now ***

Understanding Vulnerability
By David E. Stern, CISSP

This is part 3 of a 3 part series about truly understanding vulnerabilities and taking this knowledge to make a difference in the way you practice information security.

How do we protect ourselves?

By now, we should have cleared a lot of the FUD (fear, uncertainty, and doubt) that surrounds vulnerability. At this point, we can begin to discuss the basics of self defense. Information security professionals will give it many colorful names and acronyms, but good self defense boils down to proactive vulnerability management.  To break down this multi-syllable phrase, we will reach into my firefighting background.

Firefighting is a dangerous and complicated profession. Modern firefighters must understand the science of fire, strategy and tactics, and dozens of other skills. However, in the thick of the fight, it all comes down to the basics of locate, confine, and extinguish. These three action words encompass the entire cycle of the fight: find the fire, use various means to keep it from spreading, and finally put it out.  This relates directly to information security self defense.

Locating vulnerabilities in systems is probably the simplest part of the cycle. Your family physician spends most of his time diagnosing and treating common ailments with industry proven tools and techniques. The information security resources available to the industry today are plentiful and system owners are certainly not lacking in access to them.  Standards groups, common criteria, open source and commercial tools, or professional services are all available for the taking. A solid information security practitioner, whether he be an in-house employee or outside consultant, can look at the blueprints to any system architecture, and find commonly known vulnerabilities as well as offer industry recognized solutions. IT departments have dozens of commercial and open source tools to choose from that can scan for and locate vulnerabilities in operating systems and network devices. Finally, application developers have some of the best online resources in the IT industry in terms of recognized secure programming methods.

Confining vulnerability requires technical, business, and interpersonal skills on the part of the information security team. Once a vulnerability has been identified, an IT department has to decide on a plan of action, whether it entails patching, configuration changes, or installation of additional systems. These things take time, and in the interim, compensating controls must be available since adversaries don’t wait long to launch attacks on newly discovered vulnerabilities. An IT organization might increase logging on anti-virus systems, tighten firewalls rules, disable certain functionality, or even establish a “fire watch” to keep a close eye on vulnerable systems. No matter the action, the idea of confining the problem is the key to keeping safe.

The most common method of extinguishing vulnerability involves applying vendor supplied patches. Patches are modules that are installed into a vulnerable system to replace the problematic sections. The process of patching can be extremely involved and time consuming – but we will leave that to another lesson. Sometimes closing out an open vulnerability involves doing nothing at all. In many organizations vulnerabilities exist on systems that cannot be changed due to age, criticality, or required functionality. In those cases, compensating controls are put in place as a permanent confining measure.

Conclusion
This first lesson should have laid down the basics of vulnerability. There is much more to learn and lots of topics to dive deeper into. Understanding the fundamental topics that we surveyed today should better prepare you to make important decisions. In the next session, we will learn how to evaluate vulnerability’s true effect on your environment. In the following session, we will take a peek under the covers at the technical underpinnings of vulnerability. In the final, installment of this inaugural program on vulnerability, we will look more closely at the tools of the trade and how to make them most effective for your organization.

Keep the discussion going in the catalyst community or the comments here!

Digital Common Sense has a pretty impressive (read: long) list of security podcasts. I have to admit, I wasn’t familiar with a lot of them, so I thought perhaps you’d like to know the list was out there. [Link here] I’m excited to see more people podcasting and sharing their passion with all of us. I’ll be making an effort to try to listen to more of them and perhaps even welcome some of them to the Security Round Table from time to time (no need to wait for me to invite you, you’re welcome to shoot me an email with a topic you’d like to discuss).
Some of you reading this might wonder why I would send out a listing of other security podcasters. In fact, more than a few people have suggested to me that other podcasters in general, and security podcasters, in specific, were my “competition.” Not a chance. I don’t see what I and other security podcasters do as a competition. I fully embrace anyone podcasting (okay, well, not anyone, but certainly most) and celebrate more voices coming to broaden perspectives on security. This is about passion, about change, about the future.
I recently read a posting/quote by Seth Godin, when he was interviewed by Guy Kawasaki. [Link here] (Aside, if you’re starting to follow my writings on Security 2.0 and you’re not reading the brilliance of these gents, you should be) Both have top 100 blogs according to Technorati, and Guy asked Seth about his rankings…

This part has stayed with me: