Those kids and their crazy music…
What a difference a few weeks make in aviation safety… we have gone from closing down large swathes of European air space because any volcanic ash is too much volcanic ash to “a little ash never hurt anyone.” What happened? As usual, New Scientist magazine has a very insightful article explaining the shift in thinking.
Apparently, a little mishap in 1982 in which a BA 747 lost all 4 engines due to ash contamination prompted international regulators to decide that if any volcanic ash was observed or predicted to cross airspace, that airspace needed to be closed. (By the way, the BA pilots managed to restart the engines, but, I am sure that a lot of undies had to be changed by that time). However, no testing was ever done to determine if there is a safe ash concentration level, below which planes can fly without losing their engines.
Fast forward to the past few weeks. The eruption of Eyjafjallajökull was the first one which affected such a large and busy area of active air space, and grounding 6.8 million passengers and causing untold hundreds of millions of dollars in losses to the airlines and businesses which depend on air transport provided a wake up call for regulators – maybe we need to do some risk assessment here. (Ya think?) So now, the aircraft engine makers and regulators are working their fingers to the bone to figure out just how much ash is too much ash for safe jetting about.
So, if Eyjafjallajökull acts up again, how safe will it be to fly? (This is a question near and dear to my heart, as I have a trip to London coming up…) The European Air Safety Agency has published recommendations to operators of jet aircraft which allow flight in airspace with a “low contamination” of volcanic ash. However, the document does not define how low the concentration must be to allow safe operation. Carriers are probably looking to Alaska Airlines for some help in making volcanic operation safe. Since their service are covers volcanically active Washington State and Alaska, they have had ample opportunity to learn how to fly safely during eruptions.
So will I get on the plane if Eyjafjallajökull gets heartburn but the airlines are flying? Yes – I think that the level of awareness and safety checks on the part of carriers and regulators reduce the risk to an acceptable level for the occasional traveler, but I will feel better when testing has been performed to put some firmer numbers around this problem. In the meantime, I plan to curl up with the ICAO Manual on Volcanic Ash Clouds, Radioactive Material and Toxic Chemical Clouds and a cup of tea.
Last post for today… my train is almost to NYC and no volcanoes in sight.
I’m just in a blogging frenzy today – this is what happens when I have 4 hours to kill on the Acela with wifi and power. So here are a few housekeeping announcements…
Another tidbit from Josh Corman’s excellent talk on FUD (Fear, Uncertainty and Doubt) in the information security industry… the following comes from Frank Herbert’s Dune series of scifi novels:
LITANY AGAINST FEAR
Fear is the mind-killer.
Fear is the little-death that brings total obliteration.
I will face my fear.
I will permit it to pass over me and through me.
And when it has gone past I will turn the inner eye to see its path.
Where the fear has gone there will be nothing.
Only I will remain.
I think this is going on my wall…
This weekend, I attended the Security B-Sides Boston conference (which, by the way, I heartily recommend to all info sec types). My favorite session of the day was Josh Corman‘s “Fsck the FUD” talk… this talk was chock full of security thought leadership goodness and will probably result in a number of blog postings here at Paranoid Prose.
In his talk, Josh asked a really thought provoking question: When was the last time that the information security community retired a control? If you take a look at lists of recommended security controls from 10 or even 20 years past, you will see many of the same measures that are found in the latest PCI, COBIT and other prescriptive documents. Each year, a few new must have controls are added, much to the chagrin of CSOs and security personnel (who then have to spend more of their limited time and resources implementing new controls as well as maintaining existing ones) and to the delight of auditors (who get job security and longer audit checklists to fill out, and thus more billable hours). This approach of continuous “improvement” of security “standards” is just not scalable, given most organizations’ unwillingness to fund the corresponding infinite growth of security resources (how unreasonable!).
Why is this happening? Josh’s theory (with which I agree) is that auditors and standards writers tend to be very conservative. In their minds, once a control is written down, it becomes revealed truth, and having more controls must ensure a higher level of security, right? As a result, many organizations (especially those in heavily regulated industries like Finance, Health Care and payment card processing) seem to fear their auditors more than the attackers who the security folks are supposed to be fending off. We have to make sure that we can check all of the boxes and get “good grades” on our audits and assessments, whether or not the controls being tested are relevant and provide real protection.
This model leads to a stifling of innovation in the info sec industry, according to Corman. Since most info sec spending is concentrated around passing audits and fulfilling regulatory and compliance requirements, we continue to spend most of our time and money on legacy controls which may or may not be very effective at addressing evolving (and quite dangerous) threats. We get that warm and fuzzy feeling from passing the audit, but that does not necessarily mean that we are well protected. Security vendors respond to this pattern and concentrate their product offerings in spaces which address the tried and true controls they know that their customers need to meet. They are simply not incented to come up with new ideas and better products and their marketing departments spend most of their time figuring out how to spread FUD and convince CSOs that their existing products somehow address the mind numbingly scary threat du jour.
A couple of examples come to mind:
Anti malware software – signature based anti malware software is having a harder and harder time keeping up with the threats we expect it to protect against. More and more evil code is produced from toolkits which generate custom versions that differ from the AV vendors’ signatures just enough to slip by the defenses. In a number of recent cases, totally customized, highly targeted code has been used to infect machines of interest and extract valuable information. It seems to me that signatures are becoming less and less effective as controls against malware and that protections based on system behavior make much more sense. Yet we still buy, deploy, maintain and update lots of signature based AV software, so that we can check the proper audit boxes and vendors don’t have real incentive to come up with new and more effective defensive products.
Passwords – One of the most frequent complaints I get from users at my company is that our password policies (long passwords with different types of characters that need to be changed pretty frequently) are a pain in the posterior. I feel for them… complicated passwords that are changed frequently do provide protection against some threats, but it seems to me that the main threat to passwords today is malware which grabs the password as it is typed – and it doesn’t matter how long, complicated and frequently changed the password is. Yet, we still enforce our password policy. Part of the reason is that the policy does provide a certain level of protection against some threats, but in reality, we have kept the policy mainly because our business partners (customers, regulators, etc.) expect us to have such a policy and would look askance at us if we didn’t. (In spite of recent research suggesting that the negative economic effects of these policies may exceed their protective benefit).
So… what do we need to do as an industry? I think we need to start a dialog in which we take a long, hard look at the security controls we “require” and answer some key questions about them:
- What is the threat that this control addresses?
- Is the threat we are protecting against still a threat? If so, has the nature of the threat changed significantly?
- How can we update the control requirements to better address the threat using currently available technology or processes?
- What new technology (if any) do we need from vendors in order to address the threat as it stands today?
The big question is how to get this discussion going… conferences like Security B-Sides, Defcon and the like are great places to start talking, but we need to find a way to get the mainstream security media and standards bodies to participate… going to be giving this a bit of thought and would love to hear from you with ideas!
Stories of data breaches have become annoyingly normal, so when Affinity Health Plans announced the accidental disclosure of personal information on over 400,000 employees, former employees, customers, applicants and business partners, most security folk just sighed, thanked their lucky stars that they didn’t work for that particular company and moved on. However, this breach was different than many of the other data losses that have been in the news recently.
Unlike your standard lost or stolen laptop or misplaced USB thumb drive, this breach resulted from the return of a leased multifunction copier to its owner. Like most business copiers, this one had a hard drive on which copies of documents copied, faxed or scanned were retained. When the copier was returned to the leasing company, Affinity failed to scrub the hard drive of this stored information, which “may have included Social Security Numbers, dates of birth and medical information,” according to a company press release.
The actual risk to the people whose information was found on this particular copier is actually quite small; the documents were found on one of four copiers purchased by a CBS News investigation team in NJ. The other three copiers’ hard drives contained data from the Buffalo, NY Police Department (Narcotics and Sex Crimes related documents) and a construction company (building plans, checks, pay stubs and employee info). However, the records described in this disclosure represent only a tiny fraction of the sensitive information routinely disposed of without proper security measures when copiers are sold or returned to lessors.
Affinity (and I would assume the other organizations whose data was found) have started taking corrective actions, such as inventorying its copiers to identify those with onboard storage, finding any other copiers which may have been returned to vendors recently, and making arrangements to ensure that devices are scrubbed before they are returned to vendors.
These types of data breaches are eminently avoidable; Manufacturers of multifunction devices such as Xerox and Sharp provide security software for their products which implements encryption and secure deletion of stored documents. By making sure that your devices come with these features and properly configuring them, you can plug this potentially damaging and embarassing hole in your information security defenses.
So, what are the takeaways for security professionals?
First, take a look at your existing multifunction copiers and make sure that they are equipped with the manufacturer’s security software and that the security features are properly configured and active.
Next, make sure that your organization’s specifications for the purchase or lease of copier/scanner/printer devices require security features such as encryption of stored information as well as the ability to securely erase all information from the hard drive.
Then, make sure that configuration process for new multifunction copiers includes setting the security options properly.
Now, add these devices to the list of things with blinking lights that are examined during security assessments. While you are at it, remember that these devices have network interfaces as well as upgradable software which could have vulnerabilities. Are you patching your multifunction devices?
Finally, have a process for decommissioning multifunction devices which includes wiping all data from them before they are returned to lessors, sold, donated or recycled.
As the non computer devices in our offices and homes get more intelligent, they also become more interesting to attackers. As an infosec professional, they should be more interesting to you – before your organization makes the news.
From the BBC News website… this map shows today’s ash situation… does not look too good as far as trans Atlantic flights from the States to Northern Europe and vice versa, but I am hearing that some trans Atlantic services are resuming (see @AirlineRoute for updates).
However, it looks like the European travel situation should be getting better tomorrow, as the EU replaces a blanket ban on air travel with a more focused and layered approach. European air space will be divided into sectors described as “no fly zones,” “limited service zones,” and “open airspace,” based on the amount and dispersion of ash from Iceland’s volcano, according to the BBC. I get the first and last categories, but I don’t know that I would want to go on a flight in the “limited service zones” – does this mean they are sorta safe? In a press release issued today, Eurocontrol (the air traffic agency for the EU) had this to say…
“…while the initial reaction by the States was prudent and reduced risk to an absolute minimum, it was now time to move towards a harmonized European approach (set out below) that permitted flights – but only where safety was not compromised… Accordingly a limited “No-fly zone” will be established by the States concerned, based on forecasts from the VAAC. EUROCONTROL will provide the data and the forecast to States every 6 hours. Aircraft Operators will be permitted to operate outside this zone. In their decision as to whether to fly, they will be supported by shared data including advice from the scientific community (meteo, volcanic ash proliferation etc.) – including safety assessments supported by tests under the oversight of the competent Safety Authorities. The conference also concluded that, in time, it should be possible to move towards an approach in which full discretion is given to Aircraft Operators.”
Earlier today, a mislabeled webcam in Iceland led to false news reports of yet another volcano erupting. Turns out that it was the same volcano continuing to erupt. D’oh!
Looking for some stories and advice from the people affected by this whole mess? Searching for #ashtag on Twitter yields a fascinating real time look at what’s going on – and makes you glad not to be traveling…”
Oh, and by the way, here is how (and how not to) pronounce the name of the Icelandic volcano…
One of my responsibilities at work is to make sure that our employees are safe while traveling. Until today, this week’s Icelandic volcanic eruption was a no brainer… flights in the affected area were cancelled for safety reasons. Now, the airlines and the EU have been performing test flights to see if it is possible to restart flights in Northern Europe in spite of the continuing eruption. KLM flew a plane (with no passengers on board) from Duesseldorf to Amsterdam on Saturday without incident, although at lower altitude than normal. Similar flights by BA, LH and AF also landed without incident. Given the magnitude of the economic losses and travel chaos being caused by the cessation of air traffic, I can understand why folks are anxious to get planes back into the air. However, not everyone is a fan of this plan… the Finnish airforce ran their own tests using F-18 fighters and concluded that even short term exposure to the ash cloud caused damage to the planes’ engines. And tests run by NASA showed that even very thin clouds of ash could significantly damage jet engines.
So… what if the EU decides to reopen Northern Europe’s airspace? What travel advice do I provide to my colleagues? Should people currently stuck waiting for flights to or from the region take one of the first flights? Personally, I would not be ready to get on a flight to LHR today if the air space were to reopen whilst Eyjafjallajökull is still being uppity. And I would be hesitant to get on a plane which had flown through the ash for some time after the eruption ceases, since damage to engines may manifest itself over time. For now, the airways are still closed, so this is a hypothetical question. But if the EU and airlines decide that the risks are acceptable, people are going to want to get home or make trips for business. Coming up with a travel policy which balances risk with the need to conduct business is going to be a challenge – especially if this eruption continues for a long period of time or if it is a precursor to a much larger volcanic event. Stay tuned…
It seems that scientists found some evidence for the proverb “The eyes are the windows of the soul.”
In experiments conducted by researchers at University College London 11 volunteers were asked to answer a variety of personal questions with some truthful answers and some lies. While they were interviewed, the volunteers wore special eye tracking glasses which recorded their blink rate, where they were looking and for how long, and the sizes of their pupils. The scientists then created videos of computer generated avatars speaking the answers given. In half of the videos, the avatars’ eyes were fixed on the listener. In the other videos, the avatars’ eyes moved and reacted using the data from the eye tracking glasses.
The result? Of the 27 people shown the videos, 88% were able to identify truthful statements when eye movement was present, as opposed to a 70% detection rate when the avatars’ eyes were fixed. When asked to identify untrue statements, 48% of viewers had success when eye movement was present versus 39% when the avatars’ eyes were fixed.
While the researchers are not sure how the eye movements helped viewers in telling truth from lie, they did note that truth-tellers tended to hold the interviewer’s gaze for longer than fibbers and that the speaker’s pupils dilated more when they were prevaricating. The pupil response may be linked to the increased cognitive load needed to tell a lie.
The researchers state that their work could be helpful in making virtual worlds such as Second Life more useful for interactions like business meetings, where a level of trust between participants is required. My takeaway, of course, is that a cyber savvy virutal con man could make use faked avatar eye movements to gain his cyber victims’ trust. Back here in the real world, when the used car salesman tells you that the little beauty you are looking at was only driven by a little old lady to church on Sundays, watch those pupils!
So after meeting Bob Maley, the former CISO of the Commonwealth of Pennsylvania, at this week’s CSO Perspectives conference in Santa Clara, CA, I am having some second thoughts regarding my earlier posting regarding his firing. While I still feel that the Commonwealth was technically within its rights in firing him, it seems to me that the people of Pennsylvania were done a disservice by the Commonwealth’s actions. Bob seems very passionate about the responsibilities of stewardship of citizens’ information and it sounds like he implemented a number of impressive initiatives to better protect that data. Yes, he did speak at RSA in spite of being told not to, but it seems to me that his heart was in the right place and that he took a calculated risk in order to highlight the need for application security in e-government. There also seems to be a political element t0 all of this (transition of administration stuff) as well. In the end, after meeting the guy, I came away impressed that he was willing to gamble his job (and lose that gamle with grace) in an effort to make e-gov initiatives safer for us all.
The nice folks at CSO Magazine published a good article on the topic… read it and decide for yourself.