Moving Cybersecurity from DHS to White House

From here:
http://infosecurity.us/?p=7343

“Forthcoming legislation would wrest cybersecurity responsibilities from the U.S. Department of Homeland Security and transfer them to the White House, a proposed move that likely will draw objections from industry groups and some conservatives.
CNET News has obtained a summary of a proposal from Senators Jay Rockefeller (D-W.V.) and Olympia Snowe (R-Maine) that would create an Office of the National Cybersecurity Advisor, part of the Executive Office of the President. That office would receive the power to disconnect, if it believes they’re at risk of a cyberattack, “critical” computer networks from the Internet. “I regard this as a profoundly and deeply troubling problem to which we are not paying much attention,” Rockefeller said a hearing this week, referring to cybersecurity…”

and a DHS response here:
http://news.cnet.com/8301-13578_3-10048063-38.html

I'm a simple guy and I'm going to over simplify my response. So here goes.

Politics and money aside, because there is alot of both for this issue DHS would be dumb not to fight to keep control of mission for the sheer amount of $ being thrown at it, without strong leadership and authority it wont matter who is in charge of cybersecurity for the US.

When I was just getting interested in security and still in college I went to Black Hat New Orleans 2002, and listened to Erik Birkholz's "How To Fix a Broken Window" talk.

From the talk description:

C:\>net send * “Don’t expect secure networks if you haven’t empowered your internal security team.”

Security vs. usability may finally become a balanced equation. All the usability in the world isn’t worth a damn if your internal network is a wasteland of default configurations and blank passwords. Security teams are now a required internal resource. Contrary to popular belief there are NOT 24 working hours in a day. Security can not be treated as a side order. The excuses need to stop - now.

The amount of the above that still rings true 7 years later is just ridiculous but the important thing I took from that talk 7 years ago that is still true today is don't give people the responsibility of security and no authority to do anything about it.

So what does that have to do with DHS & the White House and who's calling the shots? Well, the fact that DHS and U.S. Cert have all the responsibility but no authority. The U.S. Cert can send .gov organizations alerts, advice, guidance, incidents, threats, whatever all day long, but at the end of the day they really cant make those .gov entities do shit. That is the sad reality, those other agencies in most situations don't have to listen to the cert or can merely say "we took care of it" and there is no secondary investigation to be done or allowed. Additionally, there seems to be no punishment for receiving failing FISMA grades or having numerous amounts of security incidents, unless you call getting extra funding "to fix the problem" a punishment.

The simple version is this:
If things don't change...if the authority to withhold funds, internet access, or the ability to fire people who show gross incompetence or the inability to handle the security responsibility of their organization, if we dont stop putting people in CSO/CIO positions who have no security background, if getting a failing FISMA grade doesn't actually mean anything, and if we dont change the broke ass way that some .gov agencies operate it wont matter who is responsible for cybersecurity or how much money you throw at the problem its still gonna be jacked up. In fact, who's to blame bad guys for breaking into networks that are just so damn easy to break into?

Intrusion Debt and Security ROI and Security Malpractice

Richard Bejtlich has a new post linked to an older post and mentions the idea of intrusion debt as the counter argument to security ROI. I agree with RB that there is no ROI on security (he has lots of posts arguing this and they are good reads), doing things safely is your ROI, operating your network without compromise and data loss (or minimizing it) is your ROI, protecting your IP is your ROI. From the slides on the new post is the question of what if we allowed people who build bridges to operate at the same standards as those who build networks. Scary, right?

"Imagine that you defer that cost by not detecting and responding to the intrusion. Perhaps the intruder is stealthy. Perhaps you detect the attack but cannot respond for a variety of reasons. The longer the intrusion remains active, I would argue, the more debt one builds."

"How many CEOs/CIOs/CTOs/CISOs/CSOs will look at the digital wreckage of an incident and wonder "why didn't we see this happening?"

The key to that is catching it in the first place and being able to adequately respond or have policies in place once you do see it. In 2008, I didn't think we would still be there, but we are and its sad.

I think business and government entities are lucky about how much they are allowed to shield (lie) to its customers and employees about network compromises. If a network has been owned for several months and the appropriate action wasn't taken (so at some point the compromise was discovered) should that be grounds for fines or lawsuits? You know that any domain will have some type of PII, intellectual property, or something worth protecting floating around. What are people to do with network/security malpractice? Is it feasible to hold those CxO people accountable at that level? What are common people supposed to do when there is gross negligence with their information? Current laws, regulation, and fines obviously aren't working or a sufficient deterrent and I'm not sure asking a technology immature legislative system to come up with more unenforceable laws is a good solution either.

Thoughts on what to do?

For a dose of the obvious...

From: http://www.nextgov.com/nextgov/ng_20081015_7578.php?zone=NGpopular

"The FBI's newly appointed chief of cybersecurity warned today that "a couple dozen" countries are eager to hack U.S. government, corporate and military networks...

Henry said certain countries have mounted aggressive campaigns to attack U.S. Internet assets like the .gov, .mil and .com Web domains. Some are interested in sensitive research and development data, while others, like terrorist organizations, see the value in stealing and selling sensitive data to fund physical attacks."

duh! 2001 called to say told you so.

Sex Offender Registry Law = FAIL

more adventures of non-technicians making technical policy FTW!

"Registered sex offenders will have to start providing their e-mail addresses to a national database available to social networking sites, under the misleadingly titled "Keeping the Internet Devoid of Sexual Predators Act of 2008" — a bill authored by Senator John McCain and signed by President Bush on Monday.

The idea behind the law (.pdf) is that a social networking site can query the database to keep registered sex offenders from signing up, and thus prevent them from preying on underage users. Needless to say, the law does nothing to stop first-time predators. But it's doubtful that even recidivists will be affected. Pedophiles looking to victimize children — a felony worth years, even decades, in prison — won't be afraid to violate this new law by using an unregistered Gmail address. And now law enforcement will have to struggle to discern whether an offender is using a disposable webmail account to commit new crimes, or just to shunt the blacklist and network with their adult friends and family."

http://blog.wired.com/27bstroke6/2008/10/mccains-sex-off.html

(edit) making laws that are not enforceable or are easily bypassed are a waste of time and money just like regulations that can be followed or enforced. Once we all have a john.smith@person.usa email address AND we all had to use it this might be a law worthy of some effort put into it.

California RFID Law = FAIL

I've been looking for something good to give the "FAIL" to and here it is:

From Wired Threat Level:

"California followed Washington State's footsteps this week to become the second U.S. state outlawing so-called Radio Frequency Identification Device skimming.

Skimmers can easily pilfer information from non-encrypted RFID tags that are growing commonplace. California's bill was adopted and signed by Gov. Arnold Schwarzenegger this week after a demonstration showed that personal information skimmed from entry-card badges from statehouse workers allowed hackers access to secured areas of government offices.

Still, California's measure (.pdf) and the one Washington State adopted in March, don't mandate any RFID encryption. So the vulnerabilities of the Golden State statehouse's entry system remains."

http://blog.wired.com/27bstroke6/2008/10/rfid-anti-skimm.html

All I can say is wow (or fail). The only people this is going to hurt is the security consultants trying to find and fix insecure RFID applications for customers. Much akin to banning guns so only the bad guys have them. Non-technicians making technical policy FTW!

McCain Can't Use the Internet

you know i don't require my elected leaders to be a NOP or be able to write an 0day but to not be able to "get online" or read email. :-(

http://blog.wired.com/27bstroke6/2008/07/mccain-says-hes.html

how the F is someone that cant even get online supposed to be able to make good decisions for our country about all the different numbers of issues that come up with regard to the internet, privacy, security, etc

guilty until proven innocent and encryption in the digital age

"A federal judge in Vermont has ruled that prosecutors can't force a criminal defendant accused of having illegal images on his hard drive to divulge his PGP (Pretty Good Privacy) passphrase."
The Washington Post just revived this article and there is also a good article on cnet.In Child Porn Case, a Digital Dilemma; U.S. Seeks to Force Suspect to Reveal Password to Computer Files
http://www.washingtonpost.com/wp-dyn/content/article/2008/01/15/AR2008011503663.html
Judge: Man can't be forced to divulge encryption passphrase
http://www.news.com/8301-13578_3-9834495-38.html?tag=tb

you may have to register for the post one, but the cnet one you can view

if you are unfamiliar with the case, like i was, basically Sebastien Boucher was stopped coming into America at the Vermont border. The border agents looked at his laptop which appeared to have been on, and saw what appeared to be preteen child porn. Of course the arrested him. At some point the laptop was turned off and now they cant answer some "Z" drive that supposedly holds the evidence. They now want Boucher to give up his PGP passphrase, which his lawyers argue will be violating his 5th amendment rights (right not to incriminate yourself).

I'll try to keep this on the technical level even though i have some strong other opinions on it.

We are forced to conclude that he has some sort of have to decrypt to boot or log into the laptop option even though they dont specifically say that. If they could log into the regular windows drive but not the "Z" drive, if this guy really has been engaging in that kind of activity it should be visible in IE history, saved passwords, temp files, irc logs, p2p client logs. there should be PLENTY of evidence. They could also subpoena ISP logs and search his home for backups. One of the articles says he is out on bail, a perfect opportunity to monitor now (another argument --but they should have no problem getting a warrant given the circumstances) if he truly is a pedophile hell get right back into it and they can catch the guy with real evidence.

Its a shame that the importance of this case will be overshadowed because of KP. The protect the kids crowd who, by reading alot of the comments on the Washington Post, have already convicted the guy and are fine with giving up liberties for people who are terrorists, pedophiles, or have something to hide --unless it was them. If the guy was accused of some white collar crime, i think most people would be like "hell no he doesnt have to give up his pass phrase" but because of KP, they want to hang him out to dry.

I for one dont blame the guy for at this point not wanting to give up his passphrase, even though its been over a year and i would have been trying really really hard to forget that thing the last year if it was me (it usually takes me a few tries anyway). The are obviously on a witch hunt at this point, and like he sort of says you never have no idea what is in your temp files, especially if you visit porno sites. It wont matter to the prosecution if the is questionable stuff in his temp files (and i'm sure that will be glossed over in any trial), it will be there even if everyone knows you can be redirected to questionable sites even when trying to access "clean" sites let alone "adult" sites.

This is an intersting bit from the cnet article:
"Boucher was read his Miranda rights, waived them, and allegedly told the customs agents that he may have downloaded child pornography. But then--and this is key--the laptop was shut down after Boucher was arrested. It wasn't until December 26 that a Vermont Department of Corrections officer tried to access the laptop--prosecutors obtained a subpoena on December 19--and found that the Z: drive was encrypted with PGP, or Pretty Good Privacy."

This link says it was a forensic copy:
http://volokh.com/posts/1197670606.shtml


Hopefully the Constitution and real justice will prevail if the people in Vermont cant gather up some real evidence in the case but i will agree the guy screwed himself for the most part by letting people look at the laptop and admitting to having things on the laptop he shouldnt.

Here are some great quotes to help you get to sleep tonight:

"Criminals and terrorists are using "relatively inexpensive, off-the-shelf encryption products," said , the FBI's assistant director of public affairs. "When the intent . . . is purely to hide evidence of a crime . . . there needs to be a logical and constitutionally sound way for the courts" to allow law enforcement access to the evidence, he said."

"Mark D. Rasch, a privacy and technology expert with FTI Consulting and a former federal prosecutor, said the ruling was "dangerous" for law enforcement. "If it stands, it means that if you encrypt your documents, the government cannot force you to decrypt them," he said. "So you're going to see drug dealers and pedophiles encrypting their documents, secure in the knowledge that the police can't get at them.""

Lee Tien, senior staff attorney at the EFF, a civil liberties group, said encryption is one of the few ways people can protect what they write, read and watch online. "The last line of defense really is you holding your own password," he said. "That's what's at stake here."

and my favorite from one of the comments:

"Maybe it would be simpler just to declare the ever-dwindling number of people who happen to live outside prison walls criminals. Then we could dispense with this inconvenient notion of civil liberties altogether."

Politics: Yahoo & China

So I've been kinda keeping up with the whole Yahoo giving up a journalist name to the Chinese government (at least what is on CNN) and that guy getting 10 years in prision.

if you are unfamiliar with it:
http://www.cnn.com/2007/US/10/16/yahoo.congress/index.html
http://www.cnn.com/2007/POLITICS/11/06/congress.yahoo.ap/index.html
http://www.cnn.com/2007/WORLD/asiapcf/11/13/yahoo.china/index.html

here is the short version:
"Shi Tao got in trouble three years ago, when the Chinese government told journalists not to report on the Tiananmen Square anniversary. He forwarded the notice to human rights groups. The regime then pressured Yahoo to give up the account holder who did that. Yahoo complied."

I caught a bit of the senate testimony online and it was the CEO getting his ass chewed by the senators basically saying he was a complete traitor to the US and what not.

Now, I am pro-American and anti communist but here are some things I thought about after reading the above articles and seeing it on TV:

-did the CEO personally give up the information freely or did one of Yahoo's employees in China do it after a direct warrant type request from the Chinese government. Do all of those types of requests go thru any type legal or ethics review? or any review by the CEO? -I doubt it.

-what was the extent of the data given. did they ask for an IP address? username? sign up info? etc. how much of that is given out normally and how sensitive is that information usually? did Yahoo know what the government wanted to do with it?

-if a foreign company operating inside the US was asked by the FBI to give up information about a US Citizen suspected of terrorism and was given a warrant to provide that information, they would be expected to give up that information...yes? i think they would be expected to do just that. isnt that the same thing?

-expectation of privacy is low i think on those free email services. anytime another entity stores and sends your email for you, there shouldnt be much of expectation of REAL privacy. if you dont own/control the server and cant encrypt your emails or data then privacy is at a minimum. In a place like China, being stealthy and careful must be at a premium especially if you are doing anti-govt type activities.

-if you want some real scary stuff check out Mark Rasch's current article on security focus on email privacy:

http://www.securityfocus.com/columnists/456

things might not be so different after all.

thoughts?

-CG