InfoSecurity Europe is over for another year. Once again there were several interesting companies and sessions worth noting. The 'themes' (if they can be called that) or 'hot topics' were cloud security again, social media and mobile access/the consumerisation of IT. The big difference seemed to be in the attitudes of people - more 'how can we reduce the risks to an acceptable level?' rather than 'we can't secure it, so we won't allow it!'
We are seeing a shift in the types of systems end users are accessing the corporate network from. The IT department are no longer dictating what will or will not be allowed. More and more users want to use their own personal devices, such as iPhones or iPads, on the network. In the past IT departments have resisted this and said no to the users. However, this attitude is beginning to change and there were a raft of organisations with solutions to help secure these devices and manage the data they contain. However, an awareness of risk and what it means to consumer devices and ownership must be understood beforehand.
With cloud security a big issue, and still stopping some organisations from adopting cloud services, I decided to speak to some of the cloud services providers about their security. Many of them couldn't give me the real technical details, but some of them did have some reassuring things to say. Unfortunately, not all services are equal and organisations are still going to have to do a lot of research on the providers and make sure that they ask to see independant reports on the security of any potential provider. Make sure you ask them the difficult technical questions and only use their service if you are happy with their answers. Again, always remember that you can't outsource risk, so think carefully about what you want to use the cloud for.
Social media is still an issue that some organisations are solving by blocking it and others are ignoring. With the latest generation of products, again we can be quite granular with the level of access granted to social media, so a default blocking isn't necessary in all circumstances. The (ISC)2 have conducted a very interesting survey on security that shows some interesting trends, not least of which is that 49% of organisations block Facebook and around 20% don't monitor social networks at all. As social engineering and backdoors through user activity are some of the main causes of problems, this is worrying. Indeed, the survey showed that security professionals put education and policy mechanisms as the top 6 security security solutions required, with software and technologies coming in 7th and 8th respectively.
Showing posts with label Cloud Computing. Show all posts
Showing posts with label Cloud Computing. Show all posts
Friday, 29 April 2011
Friday, 30 April 2010
InfoSecurity Europe 2010
Once again InfoSecurity Europe was an interesting place to visit. Lots of good sessions and interesting people to talk to. Most of the usual protagonists were there and the organisers have increased the educational part of the exhibition as well, which is good.
I thought I would put down a few things that I thought were noteworthy from the exhibition. I've already blogged about the GrIDsure anti-phishing sender verification and the new 3M mobile phone privacy filters, but there were a few other things I want to mention.
The first one is Panda Security's new Panda Cloud Internet Protection. This is a cloud-based service that provides consistent security and access policies to all machines within an organisation. The key thing is that it will protect mobile machines that are outside the corporate network with the same policies as those within the network. Protecting corporate machines when mobile is a big concern and a good way to reduce malware or hacking problems on the main network.
The usual problem is that mobile devices connect to public, unsecured (or badly secured) networks and either pick up some malware that they bring back with them, or they connect back remotely and open a soft doorway into the corporate network. By securing machines with this cloud service, it should stop them from being a soft target and weak link in your security chain. If you already do something similar by allowing VPN access into the corporate network and allowing them to create connections out, you are using additional bandwidth for this traffic and having to open a VPN connection, which isn't always wise.
Another topic talked about (mainly by Sophos) was the security, or lack thereof, when using social media. Graham Cluley gave a really good talk on the subject on the Sophos stand including the use of SPAM avatars on sites such as Twitter. The attack is centred around the fact that anti-SPAM filtering finds it hard to scan the content of images, e.g. by doing Optical Character Recognition (OCR). So, people have been putting written messages in their ID picture to get past any filtering. You can find out more from his blog.
The final mention has to go to Ian Mann from ECSC. He, once again, talked about several Social Engineering techniques to get past security. He stated that he always likes to see security guards when trying to gain unauthorised access, as it usually makes the system much less secure. He gave a talk in one of the main theatres as well as several talks on the ECSC stand, all of which were interesting. He has written a book called Hacking the Human, which is worth a read if you want to find out more.
Beyond that, most of the usual suspects were there and many things were as before with incremental changes and updates. There didn't seem to be a central theme or message from all the vendors or industry in general. Everyone seemed to be concentrating on their own topics and products. One new addition to the exhibition was the University Pavilion. I think this could be put to good use to show people what's coming over the horizon or how these technologies that the vendors are pushing actually work.
I thought I would put down a few things that I thought were noteworthy from the exhibition. I've already blogged about the GrIDsure anti-phishing sender verification and the new 3M mobile phone privacy filters, but there were a few other things I want to mention.
The first one is Panda Security's new Panda Cloud Internet Protection. This is a cloud-based service that provides consistent security and access policies to all machines within an organisation. The key thing is that it will protect mobile machines that are outside the corporate network with the same policies as those within the network. Protecting corporate machines when mobile is a big concern and a good way to reduce malware or hacking problems on the main network.
The usual problem is that mobile devices connect to public, unsecured (or badly secured) networks and either pick up some malware that they bring back with them, or they connect back remotely and open a soft doorway into the corporate network. By securing machines with this cloud service, it should stop them from being a soft target and weak link in your security chain. If you already do something similar by allowing VPN access into the corporate network and allowing them to create connections out, you are using additional bandwidth for this traffic and having to open a VPN connection, which isn't always wise.
Another topic talked about (mainly by Sophos) was the security, or lack thereof, when using social media. Graham Cluley gave a really good talk on the subject on the Sophos stand including the use of SPAM avatars on sites such as Twitter. The attack is centred around the fact that anti-SPAM filtering finds it hard to scan the content of images, e.g. by doing Optical Character Recognition (OCR). So, people have been putting written messages in their ID picture to get past any filtering. You can find out more from his blog.
The final mention has to go to Ian Mann from ECSC. He, once again, talked about several Social Engineering techniques to get past security. He stated that he always likes to see security guards when trying to gain unauthorised access, as it usually makes the system much less secure. He gave a talk in one of the main theatres as well as several talks on the ECSC stand, all of which were interesting. He has written a book called Hacking the Human, which is worth a read if you want to find out more.
Beyond that, most of the usual suspects were there and many things were as before with incremental changes and updates. There didn't seem to be a central theme or message from all the vendors or industry in general. Everyone seemed to be concentrating on their own topics and products. One new addition to the exhibition was the University Pavilion. I think this could be put to good use to show people what's coming over the horizon or how these technologies that the vendors are pushing actually work.
Wednesday, 11 November 2009
Secret Sharing Algorithm for Protecting Files in the Cloud
Data stored in the cloud can be compromised or lost (see my previous post). So, we have to come up with a way to secure those files. We can encrypt them before storing them in the cloud, which sorts out the disclosure aspects. However, what if the data is lost due to some catastrophe befalling the cloud service provider? We could store it on more than one cloud service and encrypt it before we send it off. Each of them will have the same file. What if we use an insecure, easily guessable password to protect the file, or the same one to protect all files? I have often thought that secret sharing algorithms could be employed to good effect in these circumstances instead.
What are secret sharing algorithms? They are algorithms that will share a secret between several parties, such that none of them can know the secret without the help of others. Either all or a subset of them will need to get together and put their parts together to obtain the original secret. A simplistic solution can be achieved by XORing the secret with a random number, then giving the result to one party and the random number to the other. Neither one can find out what the secret was without the other. To retrieve the secret they only need to XOR the two parts together again. This can be extended to any number of parties.
A more sophisticated way would be to allow the secret to be retrieved from a subset of the parts distributed. In the previous example, if any of the parties loses their part, or refuses to disclose it, then nobody can reveal the secret. This isn't much good if one of our cloud service providers fails. On the other hand, if we can share the secret between three people, but only require any two to regenerate the original, then we have some redundancy. This is an example of a (k,n) threshold scheme with k=2 and n=3.
How do we achieve this though? Well, Adi Shamir proposed a simple secure secret sharing algorithm. It is based on drawing graphs. To uniquely define a straight line, you need two points on that line. Similarly, to define a parabola you need three points. A cubic requires four, etc. So, we can distribute points on a line to each party we want to share the secret with. The order of the line will determine how many of them need to get together to regenerate it. So, we could define a random straight line and distribute three points on it to three different parties. However, only two of them need to get together to regenerate the original secret.
We set up a (k,n) threshold scheme by setting the free coefficient to be the secret and then choosing random numbers for each of the other coefficients. The polynomial then becomes the following:
where a0 is our secret. Now we can distribute points on the line to each of the n parties simply by calculating y for a series of different values for x. We can use the Lagrange Basis Polynomials to reconstruct the equation of the line from k points. However, we do not need to reconstruct the whole line, we are only interested in the free term. This simplifies the equations that we need to use. For example, if we have a straight line, then we only need two points (x0,y0) and (x1,y1). We can then calculate a0 as follows:
Similarly, for a parabola and three points (x0,y0), (x1,y1) and (x2,y2) we have:
This should be fairly simple to implement and use. You would need to sign up to a few cloud services, but you wouldn't have all your eggs in one basket and you wouldn't be reliant on weak passwords.
What are secret sharing algorithms? They are algorithms that will share a secret between several parties, such that none of them can know the secret without the help of others. Either all or a subset of them will need to get together and put their parts together to obtain the original secret. A simplistic solution can be achieved by XORing the secret with a random number, then giving the result to one party and the random number to the other. Neither one can find out what the secret was without the other. To retrieve the secret they only need to XOR the two parts together again. This can be extended to any number of parties.
A more sophisticated way would be to allow the secret to be retrieved from a subset of the parts distributed. In the previous example, if any of the parties loses their part, or refuses to disclose it, then nobody can reveal the secret. This isn't much good if one of our cloud service providers fails. On the other hand, if we can share the secret between three people, but only require any two to regenerate the original, then we have some redundancy. This is an example of a (k,n) threshold scheme with k=2 and n=3.
How do we achieve this though? Well, Adi Shamir proposed a simple secure secret sharing algorithm. It is based on drawing graphs. To uniquely define a straight line, you need two points on that line. Similarly, to define a parabola you need three points. A cubic requires four, etc. So, we can distribute points on a line to each party we want to share the secret with. The order of the line will determine how many of them need to get together to regenerate it. So, we could define a random straight line and distribute three points on it to three different parties. However, only two of them need to get together to regenerate the original secret.
We set up a (k,n) threshold scheme by setting the free coefficient to be the secret and then choosing random numbers for each of the other coefficients. The polynomial then becomes the following:
where a0 is our secret. Now we can distribute points on the line to each of the n parties simply by calculating y for a series of different values for x. We can use the Lagrange Basis Polynomials to reconstruct the equation of the line from k points. However, we do not need to reconstruct the whole line, we are only interested in the free term. This simplifies the equations that we need to use. For example, if we have a straight line, then we only need two points (x0,y0) and (x1,y1). We can then calculate a0 as follows:
Similarly, for a parabola and three points (x0,y0), (x1,y1) and (x2,y2) we have:
This should be fairly simple to implement and use. You would need to sign up to a few cloud services, but you wouldn't have all your eggs in one basket and you wouldn't be reliant on weak passwords.
Tuesday, 27 October 2009
Security Questions for your Cloud Services Provider
Cloud Services or Cloud Computing are getting a lot of attention in IT circles, promising cost-effectiveness, flexibility, and time-to-market advantages over traditional alternatives. However, they also increase your security risk by expanding your security perimeter to include that of your service provider. This video blog poses some key questions to ask your Cloud services/Cloud Computing provider regarding data security as well as advice to reduce the risk to your business introduced by Cloud Computing.
See my third video blog for Comodo Vision here.
Thursday, 14 May 2009
InfoSecurity Europe 2009
Well, a couple of weeks ago I went to InfoSecurity Europe 2009 at Earl's Court, as I do every year. If you've never been, but are at all interested in network and information security or are looking for vendors, then I highly recommend visiting. To my surprise, and for the first time I can remember, Microsoft wasn't there. Apart from that, however, all the usual players were there and, to be honest, it was all much the same as before. There was no new emerging technology or hot topic, just new developments of old technologies. A couple of years ago we had the hot topic of 'social engineering' and 'securing the user'; ok, we all knew that the users were our weak link and phrases like "we spend all our time securing the first 2000 miles and forget about the last 2 feet", and "our network would be totally secure, reliable and fully functional if we didn't let users login", have always been commonplace, but there were new mass threats, new education programmes and new tools at the disposal of net admins to deal with them.
However, this year was different; nothing really sprang out. OK, cloud computing and Software-as-a-Service (SaaS) has expanded and matured, but other than that we see the same products and services as before. What amazes me is how some vendors and speakers can get it so wrong and don't appear to understand the actual level of security offered or operating environment in which their products will be used. I'm not going to list actual vendors here, but how can an encryption solution for mobile users that doesn't encrypt the data at rest be viable? Encrypting network traffic is commendable, but not the only safeguard required. What if they now lose their laptop, mobile or pen drive? A secure USB pen drive vendor admitted, when questioned, that files were decrypted into the C:\Temp folder while in use, then deleted after encrypting for storage on the drive again. They couldn't tell me if this was a secure delete or a simple removal of the pointer in the file allocation table as normal. Regardless of the deletion process, however, how many applications can read and write to that folder? What's to stop me from writing a very small bit of code to monitor that folder every few seconds and take copies? This might be secure enough if it is on a corporate machine, but why not just store the file on it then and not bother with the drive?
Similarly, email security is always a problematic area, with almost no solution fitting the technology properly. The big advantage of email, and the reason we all use it, is that it is independent of firmware - i.e. it doesn't matter what hardware, OS or email app we use, it still works. Unfortunately, security was never built in to email, so every email is like sending an electronic postcard. However, I would argue that a solution that only allows you to send encrypted email within your organisation is of limited value. What about all your customers and partners? There are also still solutions that store your files on their servers and send a link to the recipient. Why trust your files to them? I asked several vendors how they deal with password transfer, only to be told that they don't. "It's up to the user how they tell the recipient what the password is," was a common reply. We know users are unreliable, why leave it to them? I had to transfer some confidential files to someone via email recently (the only transport method they would accept), only to be told that they didn't want the hassle of decrypting it, so could I send them in plaintext. Having got over that hurdle, they wouldn't give me a mobile phone number so that I could transfer the passphrase via a call or SMS (as people seem to need them written down), asking me to email it to them. I know there are technologies out there to solve these problems, but they aren't without any problems.
This is turning into a bit of a rant and I'm getting off topic, so back to InfoSec. I was pleased to see that there were some voices of caution out there about the wholesale adoption of virtualisation without considering the security implications. One that springs to mind is Steve Moyle who has produced 10 points to consider implementing on his blog here. Virtualisation is a good technology for a number of reasons, but it does bring in new security threats and it must be implemented with these in mind and secured accordingly. I do also think that cloud computing and SaaS could be very important to SMEs (Small to Medium-sized Enterprises) who don't have the in-house expertise or large budget. They can still have large enterprise-level configurability and security, without the overheads. Finally, people seem to be taking information governance and user education seriously rather than just paying lip-service to them. In all, the show was encouraging, but many vendors are not quite there yet, which only goes to highlight that the majority of organisations are not taking the new threat-landscape seriously enough and countermeasures must be lacking.
However, this year was different; nothing really sprang out. OK, cloud computing and Software-as-a-Service (SaaS) has expanded and matured, but other than that we see the same products and services as before. What amazes me is how some vendors and speakers can get it so wrong and don't appear to understand the actual level of security offered or operating environment in which their products will be used. I'm not going to list actual vendors here, but how can an encryption solution for mobile users that doesn't encrypt the data at rest be viable? Encrypting network traffic is commendable, but not the only safeguard required. What if they now lose their laptop, mobile or pen drive? A secure USB pen drive vendor admitted, when questioned, that files were decrypted into the C:\Temp folder while in use, then deleted after encrypting for storage on the drive again. They couldn't tell me if this was a secure delete or a simple removal of the pointer in the file allocation table as normal. Regardless of the deletion process, however, how many applications can read and write to that folder? What's to stop me from writing a very small bit of code to monitor that folder every few seconds and take copies? This might be secure enough if it is on a corporate machine, but why not just store the file on it then and not bother with the drive?
Similarly, email security is always a problematic area, with almost no solution fitting the technology properly. The big advantage of email, and the reason we all use it, is that it is independent of firmware - i.e. it doesn't matter what hardware, OS or email app we use, it still works. Unfortunately, security was never built in to email, so every email is like sending an electronic postcard. However, I would argue that a solution that only allows you to send encrypted email within your organisation is of limited value. What about all your customers and partners? There are also still solutions that store your files on their servers and send a link to the recipient. Why trust your files to them? I asked several vendors how they deal with password transfer, only to be told that they don't. "It's up to the user how they tell the recipient what the password is," was a common reply. We know users are unreliable, why leave it to them? I had to transfer some confidential files to someone via email recently (the only transport method they would accept), only to be told that they didn't want the hassle of decrypting it, so could I send them in plaintext. Having got over that hurdle, they wouldn't give me a mobile phone number so that I could transfer the passphrase via a call or SMS (as people seem to need them written down), asking me to email it to them. I know there are technologies out there to solve these problems, but they aren't without any problems.
This is turning into a bit of a rant and I'm getting off topic, so back to InfoSec. I was pleased to see that there were some voices of caution out there about the wholesale adoption of virtualisation without considering the security implications. One that springs to mind is Steve Moyle who has produced 10 points to consider implementing on his blog here. Virtualisation is a good technology for a number of reasons, but it does bring in new security threats and it must be implemented with these in mind and secured accordingly. I do also think that cloud computing and SaaS could be very important to SMEs (Small to Medium-sized Enterprises) who don't have the in-house expertise or large budget. They can still have large enterprise-level configurability and security, without the overheads. Finally, people seem to be taking information governance and user education seriously rather than just paying lip-service to them. In all, the show was encouraging, but many vendors are not quite there yet, which only goes to highlight that the majority of organisations are not taking the new threat-landscape seriously enough and countermeasures must be lacking.
Subscribe to:
Posts (Atom)