A Caravanaseri at the Crossroads of Alternate Futures: A Report on the CyLab Silicon Valley Briefing

A Caravanaseri at the Crossroads of Alternate Futures: A Report on the CyLab Silicon Valley Briefing

By Richard Power

As we hurtle forward into the 21st Century (a mere synonym for the Information Age), there is a profound challenge before us. Year by year, day by day, moment by moment, the importance of digital information and cyber systems increases in almost all aspects of human life; and likewise, the spectrum of related risks and threats deepens and broadens year by year, day by day.

Will we develop the 21st Century cyber security technologies and strategies required to cope with this runaway risk and threat matrix? Or will we continue to try and make do with 20th Century visions of cyber security and its digital thumb in the dike approach? Which of these alternate futures will we find ourselves in at the end of the second decade of the 21st Century?

Recently, an impressive gathering was held at the Carnegie Mellon Silicon Valley Campus in NASA Research Park. The presenters were all CyLab researchers. The other participants consisted of CEOs, VPs, CTOs, CSOs and leading technologists from a range of companies from Cisco and Microsoft to WhiteHat Security and iSEC, along with regional representatives from the Federal Bureau of Investigations and the U.S. Secret Service, as well as Board of Directors members from the local chapters of Information Systems Security Association (ISSA) and the American Society for Industrial Security (ASIS). The ultimate aim of the gathering was to push for the better of those two possible futures.

Attendance was RSVP, and by my personal invitation; there was no advertising for this event, no marketing, no hype. It was limited to 50 people, and the attendees were selected to provide a cross-section of concerns, knowledge, influence and experience. If you have been in cyber security for any length of time, you know there are many circles, there is the law enforcement circle, the security professional circle, the technical expert circle, the technology vendors circle, etc. It is at the points where these circles intersect that the most vital work is done. At the CyLab Silicon Valley Briefing, all of these circles intersected, and the dialogue that ensured was rich and rewarding.

Jeremiah Grossman, Founder and CTO of WhiteHat Security: "The speakers were highly informative and very qualified. Definitely good data to be had and I'm happy to we attended. I personally learned several things. Even the audience was well qualified, which is not something ones tends to find at smaller events."

Leslie Lambert, former CSO of Sun Microsystems: "The dialogue with the attendees was rich, as well. The event was very valuable and has the opportunity to increase the interactions between industry folks, government folks, and CMU folks. Good use of my time."

The theme of the event was "Harnessing the Future to Secure the Present," and the agenda highlighted four of CyLab's research thrusts: Trustworthy Computing Platforms and Devices, Software Security, Privacy Protection and Mobility. (Driven by over fifty faculty researchers, working with over one hundred graduate students, CyLab's program, is organized around seven research thrusts and seven additional, cross-cutting thrusts.)


Adrian Perrig, CyLab Technical Director spoke on "Building Secure Applications with Attestation."

"The problem I am going to address is how do we trust the computer we are currently using? How do I really know, as a human user? The goal is that we want to provide the user with strong security properties, such as execution integrity, data secrecy and authenticity.

"Virgil Gligor, CyLab Director, has coined the phrase Cyber-Secure Moments (© Virgil Gligor). So when you connect to your bank account, you want to have a Cyber-Secure Moment, you want to make sure that you have connected to the correct bank, that there is no man in the middle attack, no malware on your local system, stealing your credentials.

"You will also want to make sure that there are no transaction generators, that is one of the most recent attacks; malware is on your system, it waits for you to log-in to your bank account, and as soon as you are logged in, it conducts transactions with your secure login. How can you make sure that no one these malicious activities are happening? So how can you live these Cyber-Secure Moments?

"But you also want to be compatible with existing systems ... we can't easily change all the hardware or change all the operating systems ... We also want efficient execution. There are some solutions, which people have proposed that would slow down your system ten-fold, but obviously we want performance.

"So ideally in the presence of malware, we can still perform secure operations ..."

Perrig went on to explore Attestation, a promising approach for building secure systems, based on the recent development of a Trusted Platform Module (TPM) by the Trusted Computing Group (TCG). In particular, Perrig highlighted four related CyLab projects Flicker, XTREC, Sec Visor and Lockdown, and demonstrated the roles each can play in creating those precious Secure Cyber Moments.

CyLab researcher Alessandro Acquisti (who rocked the world last year with his revelations on predicting Social Security Numbers) spoke on "The Economics (and Behavioral Economics) of Privacy." In his talk, Acquisti outlined evolution of the economics of privacy, and highlighted some experiments in investigating privacy valuations and decision making through the lenses of behavioral economics.

"Contrary to the assumption in much social science that people have stable, coherent preferences with respect to personal privacy, we find that privacy valuations and concerns are highly sensitive to contextual and non-normative factors, and even internally inconsistent. This research raises questions about whether individuals are able to navigate in a self-interested fashion increasingly complex issues of privacy, as well as information security."

CyLab researcher David Brumley spoke on "Safe Software and Systems."

"A major focus of my research is developing techniques for protecting vulnerable applications when the program is only readily available as binary (i.e., executable) code. Since most programs are available in binary form, and binary-only analysis does not require cooperation of the source code vendor, this line of research is likely to impact a wide audience."

Brumley described two new security applications of binary code analysis: "automatic patch-based exploit generation, demonstrating how binary analysis can be used to automatically generate exploits based upon patches released from Windows Update, allowing attackers to create new exploits before all vulnerable hosts can receive a patch, and automatic input filter generation, which offers a way to defend against exploits by automatically generating input filters."

After a delicious Middle Eastern buffet luncheon, which was a abuzz with dialogue spinning of the morning's presentations, there were three more sessions.

Martin Griss, Director of the Silicon Valley Campus and the CyLab Mobility Research Center (MRC) spoke on "Creating a Truly Mobile Companion."

Griss' research is focused on the vision of a mobile device, with an integrated suite of applications on the device and services in the cloud and on telecom infrastructure.

"It must be context-aware. It must understand where I am, and what I am doing. It must be adaptable and able to learn, so that I do not have to repeat the same things over and over again. Machine-learning ...

"It should be pro-active; it should do thing for me, but it shouldn't constantly do things for me or to me; so it should be considerate. So we are trying to define what it is to be a proactive but considerate system. There is this balancing act between too helpful and not helpful enough.

"It must be secure and private, of course. Because as people use it for more and more things, and as you carry it more and more of the time, it knows more and more about you.

"It must be social; it must interact well with me and others as well as with other devices and with the social networks. It should be a device that recommends, reminds and advises. The obvious example is having turn by turn driving instructions on your phone, but we can do much more than that.

"And it should act for me, when needed. So, in extreme cases, I tell it to do something, and then I go off and do something else, while the phone, or the phone and the services are doing things for me, it will negotiate in the background. So when I would like to make a meeting, I would rather not go poking around on my calendar, I could just tell it 'meeting with my friends,' and at some point later it would say, 'meeting with your friends.'"


CyLab researcher Collin Jackson spoke on "Securing the Web Platform."

He outlined his work on Browserscope, an ongoing collaboration with browser vendors to improve browser encryption, defend against the most common web application vulnerabilities, and develop building blocks for securing third-party advertisements and applications; Browserscope has been deployed in many of the world's most popular browsers, including Firefox, Google Chrome, and Safari.

Patrick Tague spoke on "Guaranteeing Availability and Reliability in Mobile Wireless
Networks." He delivered an overview of issues related to availability and reliability of service in mobile wireless networks, and presented a variety of vulnerabilities and attacks of interest at the network layer and below, including interference and jamming by external adversaries and data- and control-plane routing attacks by internal adversaries."

Perrig and Brumley flew in from Pittsburgh, PA. where the main campus of Carnegie Mellon University is located. Griss, Jackson and Tague are based at the Silicon Valley Campus. Underscoring the bi-coastal nature of Carnegie Mellon's program, Acquisti spoke via video conference from the Pittsburgh campus.

As the host of the event, I was delighted that the level of engagement between the presenters and the attendees was so genuine that I had to cut-off the Q and A at the end of every session to keep on the event on track.

Indeed, "Harnessing the Future to Secure the Past: A CyLab Silicon Valleuy Briefing" was a compelling re-affirmation of academic research's vital role in helping us choose the better of the alternate futures that stretch out before us, i.e., the one that demands 21st Century responses to 21st Century challenges.

RSA 2010: Lost in the Cloud, & Shrouded in the Fog of War, How Far Into the Cyber Future Can You Peer? Can You See Even Beyond Your Next Step?

The Rosetta Stone Photo Credit: Hans Hillewaert CC-SA-BY-3.0 (Theme of RSA 2010)

RSA 2010: Lost in the Cloud, & Shrouded in the Fog of War, How Far Into the Cyber Future Can You Peer? Can You See Even Beyond Your Next Step?

By Richard Power

Some final observations on RSA Conference 2010:

The presentations I wanted to get to, but couldn't, because of time constraints: "Local is the New Organic - A Bottom-Up Model for Information Sharing," in which Michael Hamilton of the City of Seattle introduced a model for the automated collection of security event data from public and private entities across a metropolitan area, and "Crowd Sourcing Fraud and Abuse Detection," in which Lee Holloway of Project Honey Pot presented early success in breaking down barriers and facilitating the free flow of abuse information between organizations. I hope that even today we live in a world that still allows for the possibility that such ideas can be propagated and exploited for the good of the many as well as the few.

The more and more I hear about the Cloud, from the C-level ("C" for Cloud as well as "Chief") keynoters, the more and more I wonder just where it is we will find ourselves as we migrate lock, stock and barrel into the Cloud (and make no mistake about it, that is where we are all going, or at least that is where most of our IT infrastructure is going).

What are the implications, beyond the obvious security issues? (Indeed, for some enterprises, security in the Cloud will be better than what they have on their own? For example, will all of us find ourselves enveloped in a billowing Cloud so thick it will trump Net Neutrality?

And what about the security and privacy established inside that billowing Cloud, and guaranteed by a cluster of major corporations and massive law enforcement agencies? Will it protect you and I from everyone and everything except (perish the thought) ethically challenged corporations and misdirected law enforcement agencies? Don't get me wrong. We are all going into the Cloud, like it or not.

I just hope you keep one eye on the exits, and remember where everything is (or was) outside that Cloud.

I have covered the RSA Conference annually since the early 1990s. I remember when it consisted of couple of meeting rooms, at the Sofitel Hotel, crammed with cryptographers and a few developers. Then it became an e-commerce conference disguised as a security conference. Then it became the defining event of the year for the IT security sector. And now, it has become even something even bigger; it has become a cross-roads for whole industries, and for government and business, and a window on cultures (corporate, institutional and popular). Swirling in the din that rises up from this Barnum & Bailey production, you can detect intermingled strains of music that are both disturbing and inspiring.

After four CyBlog posts (one for every day of the conference), and over 60 tweets, I will close with a few brief excerpts from a presentation on "Wired for War: The Robotics Revolution and 21st Century Conflict," delivered by Dr. Peter Warren Singer, a Senior fellow and director of the 21st Century Defense Initiative at the Brookings Institution.

Dr. Peter Warren Singer, Brookings Institution: There is something big going on in war today, and maybe even in the overall history of humanity itself. The US military force that went into Iraq in 2003 had a handful of drones ... we now have over 7,000 in the U.S. military inventory. The invasion force on the ground utilizied zero unmanned ground vehicles, we now have over 12,000 ... This year, the U.S. Air Force will train more unmanned systems operators than it will train manned bomber and manned fighter plane pilots combined ... These Predators, [etc.], are the first generation, they are a lot like the Model-T Ford or the Wright Brothers Flyer ... very soon it is not going to be thousands of robots as we use in our war today, it is going to be tens of thousands ...One of the things that you are familiar with, of course is Moore's Law: the idea that we have been able to pack far more computing power into our micro-chips, such so that they just about double in their power capacity just under every two years. Moore's Law, in action, is the reason that if you have ever gotten one of those Hallmark Greeting Cards that opened up and played a little song, you held in your hand more computing power than the entire U.S. Air Force had in 1960 ... Now if Moore's Law holds true, over the next twenty-five years, our systems, our computers and our robots will be over a billion times more powerful than today ... literally ... What if Moore's Law doesn't hold true? Yeah, it's hold true over the last forty years, but there is no guarantee that it is going to hold true over the next twenty-five. What if it only goes one one-hundreth as fast? Well, that would mean that our computers and our robotics mere million times more powerful than today ... The kind of things we only use to talk about at Science Fiction conventions, like Comic-Con, need to be talked about by people like us here, and at the Pentagon. We are living through a robots revolution.

Recent history offers some compelling evidence for the reliability of Moore' Law. Unfortunately, spanning the entire history of human consciousness, there is scant evidence that our collective common sense or our collective conscience will increase in sufficient depth to keep up with the demands that have already long since overwhelmed their existing capacities.

So, lost in the Clouds, shrouded in the Fog of War, how far ahead of your next step are you able to peer?

Here is a summary of CyBlog posts from RSA Conference 2010, in chronological order:

RSA 2010: Lifestyle Hacking -- Notes on "Social Networks & Gen Y Meet Security & Privacy"

RSA 2010: Hacking the Smart Grid -- Myths, Nightmares & Professionalism

RSA 2010: Merging Mind & Machine - Hacking the Neural Net

RSA 2010: Lost in the Cloud, & Shrounded in the Fog of War, How Far Beyond Your Next Step Are You Able to Peer into the Cyber Future?

See also RSA Conference 2009: Summary of Posts

RSA 2010: Merging Mind & Machine - Hacking the Neural Net

The Rosetta Stone Photo Credit: Hans Hillewaert CC-SA-BY-3.0 (Theme of RSA 2010)

We are developing encyclopedia of the brain, neuron by neuron ... Dr. John P. Donoghue, Brown University

RSA 2010: Merging Mind & Machine - Hacking the Neural Net

By Richard Power

On Monday, at the I.S.S.A. CISO Executive Forum, I delivered the current iteration of my Executive Intelligence Briefing. I update it quarterly, and have delivered it in forty countries, over the last 15 years. The 2009-2010 theme is "Starting Over After A Lost Decade: In Search of A Bold New Vision of Security." The CISO Executive Forum presentation was the fifth time I have delivered this version.

In the current iteration, I continue to track the evolution of the five areas of concern that I started with: i.e., E-Commerce Crime, Information Age Espionage, Infrastructure Attacks, Personal Cyber Insecurity. But, in addition, I articulate five new areas of concern: IT supply chain insecurity, virtualization and the Cloud, Corporate Governance, Climate Change, Sustainability and Cyber Security, and Being and Consciousness in Cyberspace.

The last of these, "Being and Consciousness in Cyberspace" is an exploration of some philosophical issues from what "the Wisdom of Insecurity" and the theory of the "Biocentric Universe" can offer us in terms of perspective, to the existential implications and security consequences of the merging of human and cyber, a radical transformation which is happening at a far more accelerated pace than most of us realize.

At the ISSA CISO Executive Forum, as elsewhere, the responses registered in attendees range from bewilderment to a deep grokking.

So I smiled when I saw that at the last keynote session, at the end of the day on the second day of the RSA, featured Dr. John P. Donoghue, Director of Brown Institute for Brain Science, Brown University and his work on "connecting the internet to the brain," i.e., "hacking the neural net."

Why would we want a sensing neural interface system? Well, the principle answer (at this point in time) is to transform the lives of people paralyzed by disease or injury.

Five paralyzed people were implanted with BrainGate in a pilot project.

In his powerful presentation, Dr. Donoghue answered these questions:

Can motor intention activate neurons after long-standing paralysis? Yes.

What area of the brain? "Primary Motor Cortex/Arm."

What signals are there to read? "FP and Spikes."

How are these signals decoded? "Neural patterns in the Spikes become control signals."

Donoghue showed how researchers could listen to one brain cell of a patient, as the patient imagined opening a hand (active) and then closing a hand (silent).

What technologies are involved (and evolved) in this research?

Donoghue showed a video of a paralysis patient using the brain to move a computer cursor to open e-mail, & then draw a circle. He also showed a video of a paralysis patient controlling robotic "assistants."

The Brown Institute team is working on a version of BrainGate with wireless, fully implanted sensors.

Such neural output, it is projected, will be used not only to assist paralysis patients, but to replace the limbs, and even to restore movement in limbs.

Referencing TV Sci-Fi, Donoghue illustrated how BrainGate was now somewhere between technology imaged in Star Trek and technology imagined in Star Wars.

"Neurotechnology," Donoghue remarked, "is already here." He cited some examples: electronic stimulation used to "turn off" Parkinson's Disease, as well as bionic ears to restore hearing, and bionic eye to transmit some imagery to the brain.

BTW, I was inspired when Donoghue showed a slide juxtaposing an image of the human brain and with a mapping image of the internet, because my briefing starts with a slide juxtaposing images of the earth from space with a mapping image of the internet. Yes, I will soon be juxtaposing all three images in the next iteration of my briefing.

Now, we are getting somewhere ...

After Donoghue's dazzling presentation, he sat with Ari Juels of RSA Laboratories to answer some compelling questions.

Here is just a brief excerpt:

Ari Juels: BrainGate restores lost capabilities to patients who are suffering from a dysfunction, but as you have shown it is possible to control more than just artificial limbs, you showed, for instance, the ability to control a cursor. Can you envision a day when healthy patients have implants of this sort, to supplement their functionality in the world, implants that help people stick to their diets, or control devices for a third arm, or something along those lines?

Dr. John Donoghue: There are many people who think about these things, and who want to be able to extend their capabilities. This is a medical device. We are trying to develop something for individuals who have disabilities, to make their lives better. The biggest barrier is that this does require brain surgery. We don't take that lightly. It is something that always raises a concern. Where we go with this, and how we use it will require serious debate and discussion. But, as I said, I think the barrier will always be the surgical one. We will not in any cavalier way, implant able-bodied people to have frivolous functions. On the other hand, we have many things already available to us that are aids, we have smart phones that we carry around with us that are substitutes for our memories, we have many, many devices; so it would have to be clear that at some point we would outstrip all of the available external technology before we begin to think about enhancing ourselves by implanting something in the brain.

Juels: Have you in fact been approached by industries, or companies, or government agencies that are hoping to exploit BrainGate for purposes other than the strictly medical ones?

Donoghue: I would say "exploit." I mentioned this EEG-like signal that is available from outside your head. There are a lot of people interested in how much control can you get from that. It is, in fact, a very noisy and hard to manage signal. And it is not very reliable. There are a lot of people who are interested in seeing that signal be as good as the one that you can from inside your head ... One place where there is a lot of interest is in the toy industry ...

Well, I am going to leave it there.

There are profound implications for security and privacy.

First, the network perimeter vanished, as the internet popped up inside the enterprise, and vice-versa; and now, both the network and the internet are vanishing into the Cloud. What's next? Will Being and Consciousness vanish into the Cloud, or will the Cloud vanish into Being and Consciousness? The answer to that either/or question is, of course, a very Zen "Yes."

Stay tuned ...

RSA 2010: Hacking the Smart Grid -- Myths, Nightmares & Professionalism

The Rosetta Stone Photo Credit: Hans Hillewaert CC-SA-BY-3.0 (Theme of RSA 2010)

NOTE: What do we mean by smart grid? Speaking on "Investing in Our Energy Future" at a Gridweek event on 9-21-09, Secretary of Energy (and Nobel prize winning physicist) Steven Chu offered a worthy definition: “Dynamic optimization of grid operations and resources. Incorporation of demand response and consumer participation.” (For your convenience, I have embedded Secretary Chu's full presentation at the end of this post.) Ah, but what about it's security?

RSA 2010: Hacking the Smart Grid -- Myths, Nightmares & Professionalism

By Richard Power

The implementation of Smart Grid is in the vital national interest of the U.S., and all other industrial (and post-industrial) nations; it is vital both in terms of energy security and climate security, which, of course, means Smart Grid is also vital to economic security.

Any nation that wants to compete in the 21st Century needs Smart Grid. Indeed, any nation that wants to survive in the 21st Century needs Smart Grid.

In framing the issue for this RSA 2010 session on "Hacking the Smart Grid," Gib Sorebo of SAIC (one of CyLab corporate partner, BTW), cited several Smart Grid drivers, most notably, resiliency and reliability and reduction in carbon emissions, as well as several Smart Grid challenges, including the integration and distribution of renewables, the complexity of transmission networks, how to eventually provide infrastructure for electric vehicles (hopefully much sooner than later), and yes, what to do in regard to cyber security.

A smart grid, after all, is not necessarily a secure grid.

Smart grid is full of innovation, and it is being designed and implemented swiftly (or certainly should be), and innovation and urgency only tend to exacerbate security issues.

Furthermore, the issues swirling around the cyber security of power grids, whether legacy, smart or in transition, have shifted from the theoretical to the down and dirty. A decade or so ago, talking about attacks on the power grid were mostly speculative, but a decade ago, well, that was a century ago.

Some incidents have even ended up in the headlines:

In a rare public warning to the power and utility industry, a CIA analyst this week said cyber attackers have hacked into the computer systems of utility companies outside the United States and made demands, in at least one case causing a power outage that affected multiple cities. Washington Post, 1-19-08

A power failure has blacked out Brazil's two largest cities and other parts of Latin America's biggest country for more than two hours, leaving millions of people in the dark after a huge hydroelectric dam suddenly went offline. All of neighbouring Paraguay also lost power, but for only about 20 minutes ... The blackouts came three days after the CBS's 60 Minutes news programme in the US reported that several past Brazilian power outages were caused by hackers. Guardian, 11-11-09

So what is really happening in the space of Smart Grid cyber security?

The RSA 2010 panel Sorebo moderated consisted of Matthew Franz, Principle Security Consultant, SAIC, Matthew Carpenter, Senior Security Analyst, InGardians and Seth Bromberger, Information Systems Security Manager, PG&E.

For those of us who have firsthand knowledge of the decade-long struggle to promote critical infrastructure protection for existing systems, this few brief excerpt from their discussion offer a tantalizing, but humbling glimpse into this profoundly promising, yet clearly perilous undertaking glibly dubbed Smart Grid:

Seth Bromberger, PG&E: The research is being done on security in these components is not necessarily new. We are talking about encryption, key management, strong authentication. These are not new concepts. The devil is in the implementation. Where you have vendors, manufacturers and product developers taking short-cuts, or implementing poorly, that's where we are finding these vulnerabilities ...

Matthew Carpenter: We need pen-testing out of everybody. That doesn't mean everyone in the audience should go disassemble our firmware and look for buffer overflows. But there are so many different layers in this very complex system, and sometimes we just need critical thinking done about how we implement x, or whether this is a great feature to have. For instance, some utilities are thinking about having [an automated process by which] a person's credit report could impact whether or not that person can actually have power. This may not be the smartest choice to have automated throughout the system, without checks and balances in place. But it is actually something that has been pushed forward as a To-Do. So I can break into meters using this technology, but what about the guys who can influence credit reports? Or how about getting in between the communication of these credit reports? How can I manipulate the system? So we need everyone in the entire implementation of Smart Grid to be thinking critically about this could be abused. If I turn on this security protection, how could it be abused to cause more damage? How do I turn on anti-tampering technology in this device? OK, now what? So if I have anything higher than a 1.0 on some scale, I just shut down my entire neck of the woods? OK, maybe not the best bet. We need critical thinking done by everyone who has purview into the system, and good communication of "Well, maybe this isn't such a good idea." We need to open up that flow of communication.

Gib Sorebo, SAIC: For a long time, the [utility] industry has had a reputation of being tight-lipped about incidents, even about vulnerabilities that have been discovered (and, of course, it is not the only one). There have been a lot of bad feelings, recently, about some disclosures related to meters, people were branded not as terrorists, but it was almost that kind of thinking; in other words, "You guys are destroying the industry by revealing information about these vulnerabilities." And then we have the issue of everyone complaining that incidents are never reported to the regulators, or to the industry, or to whatever. Is there a middle ground? Obviously, we do not want to disclose vulnerabilities right away for an infrastructure that takes a long time to change, but where can we go with that?

Matthew Franz, SAIC: I am still kind of traumatized by my involvement with the disclosure of some SCADA vulnerabilities. Speaking of [being called] terrorists, I remember a utility software vendor that ... I gave a case study back in 2006 about some ... protocol vulnerabilities that I worked through the CERT process ... To paraphrase, what I was told was that by telling US CERT, i.e., giving them the details, and how to reproduce it, etc., and having US CERT release an advisory, we were arming the terrorists ... Just as a bell-weather of where we are I went to four or five of the leading meter AMI vendors this morning, and I looked for their /security site. The kind of site that Microsoft and Cisco and others have, in terms of how you go about reporting vulnerabilities, and only one of these meter vendors had the contact information, the GPG keys, etc., and that is the first step if that researcher wants to do the right thing, to get a hold of these vendors, and there is no way to do that ... The level of transparency you have is far less than Cisco or Microsoft ...

Matthew Carpenter, InGaurdians: We have to be more cautious than a Microsoft vulnerability disclosure. If you know me, you have probably heard me talk about responsible disclosure being a communication mechanism for vulnerabilities, but also a way to keep vendors in line. For IT, I think that makes a lot more sense. We have to be more cautious because of the impact in this arena. But we need to have fluid motion for our vulnerability research, we need to have a way to disclose to a vendor that there is an issue. We need to be able to have discourse throughout the utility space, so that effected customers have an early warning, "Hey, something's up, we've got a fix that's in the works, but just to give you some warning, when this comes out, you need to put it into test immediately, and in a certain amount of time, roll it out ... I remember hearing a vendor say, "Think about thirty days." I said, "That seems a little long, but if get a vulnerability notification, and within thirty days you have a fix out, well, you're better than Microsoft." But no, thirty days was actually the number to push out the patch from the time they clicked the button. "Whoa," I said, "we have some problems in our viewpoint into vulnerability handling." Disclosure needs mechanisms ...

Seth Bromberger, PG&E: You talked about making sure that the affected customers are made aware of the vulnerability. I am all for knowing ... The challenge that we have is that the lines dividing customers and non-customers are very blurry when it comes to things like critical infrastructure. I could see an argument that anyone who consumes power is a customer of the vendor whose control systems help deliver that power. From a utility perspective, I would say that the utilities are probably the customer base that the vendor would be beholden to. So when we talk about disclosing vulnerabilities ... to what end is the researcher disclosing, is it to feed ego? If so, that is probably not the most responsible way of doing it. Sending out on one of the public lists, information on a zero-day in a control system handling power or manufacturing is probably not the best way to people who are going to be impacted by it. And someone could argue that everyone is impacted by it, but I would challenge [by saying] that the average power consumer doesn't have any ability to effect the change and necessary remediation in those systems. So there are mechanisms the word to the right people, and again, I would say from my perspective, knowing about it is better than not knowing, so if the only way to get it out there is full disclosure, well, if it is actionable, I can take action, if I don't know about it, I can't do anything, and we can't pressure the vendors to fix it. But ultimately the utilities are in the position here of being the consumers of the product, and not necessarily the manufacturers of the product, and so the leverage we have is as a paying customer ... But it also puts us at a little bit of a disadvantage in that we need to be able to have the influence with our vendors to actually affect this change. We can't do it by ourselves.

Secretary Chu Grid Week

View more presentations from Glenn Klith Andersen.

RSA 2010: Lifestyle Hacking -- Notes on "Social Networks & Gen Y Meet Security & Privacy"

The Rosetta Stone Photo Credit: Hans Hillewaert CC-SA-BY-3.0 (Theme of RSA 2010)

When e-mail was just starting to be introduced in the workplace, I was a summer intern at IBM, before I went to graduate school, and you couldn't send anything outside of IBM, and there was a lot of struggle about whether or not to allow it. Now we are just seeing the exact same thing is repeating. -- Avi Rubin

People have been looking at social networks and crowds and how they reinforce productivity ... People who are on social networks are more productive, make better decisions, and have many advantages over those who are not. -- Kimberly De Vries

RSA 2010: Lifestyle Hacking -- Social Networks & Gen Y Meet Security & Privacy
By Richard Power

After a long morning of heavy hype and lofty notions at the RSA 2010 keynote sessions (see www.twitter.com/cylab for my 33 tweets from inside), I went looking for something to sink my teeth into. And therefore, not surprisingly, I drifted toward "Social Networks & Gen Y Meet Security & Privacy," a panel organized by the worthy IEEE Security and Privacy.

The panel was moderated by Gary McGraw, CTO, Cigital, and included Kimberly De Vries, Assistant Professor, CSU Stanislau, Avi Ruben, Professor, John Hopkins University, James Routh, Consultant, Archer Technologies and Gillian Hayes, UC Irvine.

Whatever Gary has his hand in is going to be refreshing, yet relevant, timely and yet ahead of the curve. This session was no exception.

He led off by having his panelists role-play in two little skits, both entitled "Pursuit of Productivity."

The first skit depicted a meeting between an H.R. Director, a CISO and a Chief Operating Office.

The COO remarked that there seemed to be some sort of generational gap, but that there was no way the enterprise could allow employees to fritter away time on social networking, declaring, "we need to focus on productivity."

The CISO showed the COO an analysis of recent security incidents, showing that they had increased dramatically, and that most were from the inside, because employees were seeking to by-pass the enterprise's controls to use social networking sites.

The COO responded, "Well, just tell me their names and we will fire them."

The HR Director then showed the COO results of studies that showed loosing up policy might make people more productivity, as well as the results of focus groups that showed in order to attract and hold on to the best candidates we have to update our current policy.

The COO remarked, "I never thought I would see the day when the security geek would propose loosening up policy, I will have to think about this ..."

In the second skit, the HR Director was depicted in a meeting with two employees who were both really outspoken about the need to access social networking, one from Sales and one from Technology.

The Sales person said, "I have over 600 contacts on LinkedIn."

The Technology person said, "On the product development team, if you don't keep up forget it, social networking is how I keep in touch with my peers and gurus."

The Sales person said, "I cannot be productive unless I clear my head with tunes on You Tube."

The H.R. Director asked for a percent of how much social networking was business as opposed to purely social.

The Sales person said, "It is very hard to compartmentalize between social and business."

The H.R. Director insisted, "I will need a percent for the form."

The Technology person answered, "LnkedIn: 100% business, 30% social."

The Sales person said, "Here's a percent, if LinkedIn and Facebook are banned, it is 100% certain I am going to quit; well, let's say 90%, yes, I have 600 contacts, and there's a 90% that one of them will hire me."

These two little skits really do capture the essence of a great upheaval going on inside the enterprise, in regard to how best to tap into the power of social media, without it turning into a well of woe.

Here are some of the insightful commentary from the panel discussion that followed.

Gary McGraw: Do controls encourage breaking rules? Is hacking around controls a gateway drug?

James Routh: It is not a gateway drug; it is more of a manifestation of a convenience factor. The generation that is coming out of school, and into corporate America, there are certain expectations coming to work, so to them, hacking around policy is trivial, it is not like crossing the line in their minds.

Gary McGraw: How do you define productivity? How do you balance maximum productivity against tools that do genuinely cause productivity loss?

Gillian Hayes: I am doing a lot of work with public schools, and what we see is this emphasis on 21st Century skills; what that means is solving problems creatively, and often that involves using technology, and it involves a sort of mash-up culture that kids have, i.e., grabbing bits and pieces of information, grabbing different services, bringing this all together, using your social network, etc. This is explicitly how we are teaching kids to solve problems when they are in school. It is probably a really good way to teach kids to solve problems, but we then put them into a very different environment. We take all those tools away, and say work inside this little sandbox. This is not a generation of people that is prepared for that. At the same time, what we are teaching them about information is "keep all your data private all the time." This is the abstinence-only model of teaching kids about security and privacy. So we have a real tension in which we are not teaching kids to make these decisions intelligently. Kids are taught very early: "Hide all the crazy things you're doing, but do them so that you can solve the problem."

Gary McGraw: Is there a parallel to the history of phones in the workplace?

Kimberly De Vries:Actually, there is a parallel to almost every new technology. Even if you go back and look at the introduction of writing, it was felt that if people learned to write, their memories would suffer, they wouldn't be able to focus. Plato complained about. People use to memorize everything, they use to be able to listen, people could remember; but if you can write things down and have that crutch, your brain is going to turn to oatmeal.

Avi Rubin: I have three elementary aged school children. I look at social networking and all the cool things you can do on-line, and say, "How cool is that, I can google this, and my GPS can tell me where I am ..." But my kids know no other world. If we go somewhere my son will tell me to pause the TV because he has to go to the bathroom. And I have to tell him, "we can't pause this TV, it's not one of those TVs." They use this stuff all the time. They live it, they breathe it. My son was using some video game that they play on-line, he knows how to get there, I don't ... He's seven years old. he created a user account. I overheard the conversation between my eleven year old and my seven year old. "Well, I need a user account and a password." And my daughter says, "Wel, don't use the same password that you use for other things, like your e-mail." "Well, how am I going to remember it?" "Here's what I do, have a good password, and then find something from that site and then combine it together, and if you go to another site, do the same thing with something from that site ..." I can't believe I a hearing my kids talk like this, they live in a completely different world.

Yes, I have been doing a lot of thinking, writing and speaking about the state of security and privacy, and where we are going in the future. And I have come to the conviction that the very nature of security and privacy must change radically to prevail, and that our best hope for this is the next generation, and the generation just beyond them. It was good to hear a similar sentiment echoed in the remarks of the panelists, particularly Hayes and Rubin.

Cyber Shock, Virtualization, Cloud Computing & the State of the Web -- Not for the Faint of Heart ...

Partial map of the Internet based on the January 15, 2005 data found on opte.org. Each line is drawn between two nodes, representing two IP addresses. The length of the lines are indicative of the delay between those two nodes. This graph represents less than 30% of the Class C networks reachable by the data collection program in early 2005. Lines are color-coded according to their corresponding RFC 1918 allocation as follows:
* Dark blue: net, ca, us
* Green: com, org
* Red: mil, gov, edu
* Yellow: jp, cn, tw, au, de
* Magenta: uk, it, pl, fr
* Gold: br, kr, nl
* White: unknown
Matt Britt, Internet Map, 12-1-2005

Cyber Shock, Virtualization, Cloud Computing & the State of the Web -- Not for the Faint of Heart ...

Richard Power

Three stories have intrigued me over the past few days, and I will share them with you here. Woven together they deliver a message that needs to be heard (over and over again apparently). And that message? From the corridors of the highest power, through IT networks across the planet, down to each and every end user -- there is a tremendous amount of yet as yet undone, and much of it is attitudinal and cultural.

Cyber Shock

First, there is the Cyber Shock story.

Event: A massive cyber attack has turned the cellphones and computers of tens of millions of Americans into weapons to shut down the Internet. A cascading series of events then knocks out power for most of the East Coast amid hurricanes and a heat wave.
Is the assault on cellphones an armed attack? In a crisis, what power does the government have to order phone and Internet carriers to allow monitoring of their networks? What level of privacy can Americans expect?
A war game, sponsored by a nonprofit group and attended by former top-ranking national security officials, laid bare Tuesday that the U.S. government lacks answers to such key questions.
Half an hour into an emergency meeting of a mock National Security Council, the attorney general declared: "We don't have the authority in this nation as a government to quarantine people's cellphones."
The White House cyber coordinator was "shocked" and asserted: "If we don't have the authority, the attorney general ought to find it." Ellen Nakashima, War game reveals U.S. lacks cyber-crisis skills, Washington Post, 2-17-10

If you google Cyber Shock, you will find hundreds of news items, and blog posts, about it.

When I heard it, I started hearing the theme music from the hilarious filmGroundhog Day, starring Bill Murray and co-written and directed by Harold Ramis again.

Do you remember The Day After (1996)? Do you remember Eligible Receiver (1997)? There have been many other such cyber war games over the past 15 years. I have been involved in a few, and studied the results of many.

So when I read the WashPo's headline,"War game reveals U.S. lacks cyber-crisis skills," I tweeted, "Shouldn't this read STILL lacks?"

As a reality check, I asked a few friends and colleagues who have been at and beyond the front-line for all the years of this long struggle. I received three responses. None thought it was anything new, of course. One dismissed it as a "bad joke." One said hopefully it would "embarrass" some officials on high to "addressing the issue" at long last. One said that it never hurts to try to get the attention of people who are just tuning in."

From my perspective, I encourage and commend such exercises, but I think everyone would learn more if we framed them in proper historical context, and I certainly would have hoped that we would be much farther along, here at the start of the second decade of the 21st Century, than discovering that we STILL LACK cyber crisis skills.

As it quite often, the press (both mainstream and IT) missed the real story.

Head in the Clouds

Meanwhile, two new studies perked my interest, and not surprisingly they also reinforce the sense that we are spinning our wheels in the the digital Thunderdome.

The first of them was conducted for Symantec by Applied Research. It queried "2,100 top IT and security managers in 27 countries."

Is moving to virtualization and cloud computing making network security easier or harder? The "2010 State of Enterprise Security Survey - Global Data" report shows that about one-third believe virtualization and cloud computing make security "harder," while one-third said it was "more or less the same," and the remainder said it was "easier." The telephone survey was done by Applied Research last month on behalf of Symantec, and it covered 120 questions about technology use -- organizations remain overwhelmingly Microsoft Windows-based -- and cyberattacks on organizations. Ellen Messmer, Security of Virtualization, Cloud Computing Divides IT and Security, Network World, 2-22-10

Harder? About the same? Easier? Well, of course, the most insightful answer would be "All of the Above." (There are numerous security concerns, not the least of which is that we still do not know most of them.) But I doubt the "All of the Above" was available option to the respondents.

Certainly, it should be of concern to us all that most of these "top IT and security managers" are under the impression that virtualization and cloud computing have either made the challenge of cyber security easier to deal with or had no impact on it at all. This data point suggests that a majority of "top IT and security managers" don't really understand security in any depth.

Leading SaaS Vendor Offers Evidence of Enterprise Exposure

The second study is hot of the digital press.

Zscaler Lab's State of the Web - Q4 2009, A View of the Web from an End User's Perspective." Zscaler is a Security-as-a-Service (SaaS) vendor, so its "network of web gateways continually inspects traffic for millions of end users around the globe."

"With the emergence of Advanced Persistent Threats (APT) as evidenced with the Operation Aurora attacks, it is obvious that large enterprise are vulnerable to such targeted attacks that exploit employee behavior," the Zscaler study concludes; and furthermore, it also offers corroboration that "vulnerable desktops and browsers are extremely common in corporate environment making them easier targets than previously believed."

It is an interesting report, with lots of data points to ponder, but two in particular jumped out at me.

First, Internet Explorer continues to dominate among browsers, with over 70% of market share, while Firefox Mozilla its nearest competitor, with only 15% of market share in December 2009. I was not surprised that IE still held sway, but I was surprised that the margin was so significant. But what is even more striking to me was that 48% were still using 6.0, while only 46% had moved on to 7.0, and only 5% have moved on to 8.0. Yes, although 6.0 is still being updated by Microsoft, it lacks several important security features available in later releases. We are talking about IE here? How can this be so?

Another intriguing tidbit, concerning "Top Ten Malware IP Addresses," was that "more and more," Zscaler reports seeing "otherwise legitimate sites hosting malware without being aware of it."

I asked Mike Geide, a senior security researcher for Zscaler, for some insight into the study's findings.

CyBlog: On pg. 17 and pg. 18, you share some numbers on browsers that were eye opening to me, specifically breakdowns of market share and IE versions. I expected to see IE still holding the lion's share, but I confess I was surprised to see by it to be dominating by such a wide margin. Why? Is this a failure on corporate network managers to push upgrades out, or insist on them, or are the 6.x number inflated by home use (of course, either way it represents an unnecessary risk)?

Mike Geide: In short, yes this a failure of corporate network managers. This could be because corporate managers are unfamiliar with the security risks of IE 6 / benefits of IE 8. Because MS is still supporting / releasing patches for IE 6, managers may feel that they are sufficiently secure because their IE 6 is patched. Additionally, while IE 8 is pushed as a High-Priority update from Automatic Updates, it will not automatically install on machines. Users must opt-in to install IE 8 or organizations may deploy via SMS / WSUS. (Ref: http://blogs.msdn.com/ie/archive/2009/04/10/prepare-for-automatic-update-distribution-of-ie8.aspx)

What could corporate IT security people be doing to improve on these numbers?

Mike Geide: Corporate IT should have a centralized method for managing software and patch installation. It is not enough to just patch the underlying OS, web browsers and other client software (e.g., Adobe Acrobat, MS Office, etc.) need to be included in this management.

CyBlog: Is there anything that Microsoft could be doing (or not doing) that could help these numbers?

Mike Geide: If Microsoft announced an end-of-life for IE 6, this may force organizations to conduct an audit of their systems and upgrade to IE 8. However, from MS's point-of-view they may feel that there is still too much of a user base to end-of-life the product, and should continue to maintain/provide patches for any newly discovered vulnerabilities that would impact this user base. The responsibility is really on the corporations and end users to sufficiently patch and upgrade.

CyBlog: On pg. 22, you talk about Top 10 Malware IP Addresses, and note that "more and more legitimate sites are hosting malware without being aware of it." I see you have listed the IP addresses, could you share some more information here? Of the Top 10, how many are "legitimate sites," and could you characterize them in any way? Types of businesses, types of applications, types of traffic?

Mike Geide: For this report we did not specifically break out stats for "legitimate sites" versus "illegitimate sites" for malware- perhaps we will do this for the next report. I would need to pull the logs to properly answer this question, however based on Google results, the majority of the top 10 appeared to be illegitimate sites identified in other resources (e.g., ThreatExpert).

CyBlog: Of the Top 10, how do you define this?

Mike Geide: I would define an illegitimate site as a site that is setup by the attacker explicitly for malicious purposes. Whereas a malicious legitimate site provides or had provided benign content, but has been compromised and is serving some malicious content (e.g., embedded malicious iframe or JS drive-by-download).

CyBlog:Is there any accountability for either "legitimate sites" or "illegitimate sites" that show up in such a ranking?

Mike Geide: Depends. Some hosting providers will terminate legitimate site accounts if they are repeatedly compromised, while other hosting companies care very little about malicious content being hosting. Depending on the severity of the incident and jurisdiction, law enforcement (LE) could enforce accountability- but LE resources do not scale to the Internet. In short, the Internet doesn't have an overall policing body to ensure accountability. If a site continues to be an offending site, block it from being visited. If the site provides a legitimate service they will either fix their security problem or go out of business.

CyBlog: What are key measures that "legitimate sites" should be taking to avoid ending up as a part of the problem instead of being part of the solution?

Mike Geide: Legitimate sites are frequently leveraged to host malicious content through vulnerabilities in 3rd party web applications (e.g., Wordpress, Joomla, etc.). The most common vulnerabilities in these and other web applications are SQL Injection and Cross Site Scripting (XSS). Legitimate sites should only install 3rd party web applications that they absolutely need, and then follow the patch cycle of the application to ensure that known vulnerabilities are fixed.

CyLab Seminar Series Notes: Lujo Bauer Shares Glimpse into CyLab Research on Usable Privacy & Security in the Digital Home

[NOTE: CyLab's weekly seminar series provides a powerful platform for highlighting vital research. The physical audience in the auditorium is composed of Carnegie Mellon University faculty and graduate students, but CyLab's corporate partners also have access to both the live stream and the archived content via the World Wide Web. From time to time, CyBlog wets your appetite by offering brief glimpses into these talks. Here are some of my notes on a talk delivered by CyLab researcher Lujo Bauer on 2-1-10. At the end of this post you will find links to other issues of CyLab Seminar Series Notes as well as two editions of CyLab Chronicles that highlight Bauer's work. -- Richard Power

CyLab Seminar Series Notes: Lujo Bauer Shares Glimpse into CyLab Research on Usable Privacy & Security in Home Computing

According to Lujo Bauer, “Usability” is often seen as the last phase in system design.
“One of the problems in the way we build systems is that first we build the system, and then perhaps we start thinking about how to best design the interfaces that we dress the system up in ...”
The thesis for Bauer’s seminar: “Creating usable systems often requires not just the help of usability experts, but that the system architects are usability experts.”
“Usability is something that we should pay attention to, and start building into our systems from the design phase onward; and not something that can just be always tacked on at the end.”
Bauer supported his thesis with three examples from his personal experience in research. Two of the examples were based on user studies, from which was learned something important to the very initial phases of system design. The third example was from an instance where the research team tried to make a system more usable after it was deployed, and learned something about features needed.
One of these examples involved the Expandable Grid, a robust interface that shows effective policy instead of policy rules, as well as both user and file hierarchies (groups), and also displays the entire policy on the screen; another involved Grey, a smartphone-based, end-user-driven access control system for physical and virtual resources deployed in Carnegie Mellon’s Collaborative Innovation Center (CIC); and the third example, the one we will focus on here, involved the “Future Digital Home,” and highlights not only the CyLab research thrust into “Usable Privacy and Security” but also the CyLab research thrust into “Securing the Digital Home.”
“Most of us already have a bunch of gadgets at home: digital cameras, maybe a network drive, a TV that can stream Netflix, things like that. In the near future, this will become much more extreme. We will have dozens of devices in our home, which will either gather information or store information that we put on them, or will be used for viewing information. Think of this information as being media, whether its music, or video, or home surveillance; you can also think of it as being files, e.g., tax records, or homework, or papers; you can think of it as your current shopping list, or the content of your refrigerator. Your refrigerator is going to have a little computer built into it and it is going to keep track of how much milk is left, and you are going to want to use your phone every once in awhile to ask your refrigerator how much milk there is because you are going to be walking by a grocery store, and wondering if you should pick up milk.”

“So there are exciting new capabilities from the user perspective, but on the other hand, there are also big questions, and one of the big questions is who handles security and reliability? In this environment, with many devices in my home that all somehow talk to each other and share data, I want to make it the case that I can always access all the information, confidential or otherwise, and I can also let any of my friends, or specific friends, to gain access to some of this information, but at the same time I might have really confidential data in the system, and it could be terrible if the wrong person got access.”
“We’re also dealing with people who are not professional system administrators. They only people in the home are the people that love there. They don’t take classes in system administration; so the interfaces that they use to configure the system correctly, or tell the system what they want it to do, have to be somehow specifically tailored to them. These interfaces can’t require much expertise.”
The goal of the research that the CyLab team working in this area is to provide usable security for digital home storage, e.g., enable users to effectively specify and understand policies, and to use and trust mechanisms.
“Having learned something from previous projects that we had done, we decided to start out with some user studies. Technical researchers are notoriously bad judges of what end users do … “
The first study done was based on in-situ, semi-structured interviews of subjects recruited via Craigslist and the distribution of fliers. The study subjects were limited to non-programmer households. There were thirty-three users (from eight to fifty-nine years of age) in fifteen households, these households ranged from families to couples to roommates.
“We also covered a wide range of expertise: even though there were no programmer households, we had people whose households had as many as twenty-something digital devices for two people, or as few as four or five digital devices for a family of three or four.”
House maps were used as reference points in the interviews.
“We had the participants draw maps of their households, and on these maps indicate where various digital devices might live. And we used these maps later to make sure that when we talked about the various digital devices and types of data, we could actually cover all the devices that they had."

The study yielded some insightful findings:
Current methods are not working: Although almost all of the people worry about sensitive data, access control mechanisms varied and were often ad-hoc.
Policy needs are complex: Fine-grained divisions of people and files are needed (e.g., distinguishing between “public” and “private” aren’t enough), dimensions beyond “person” are needed (e.g., “presence” proved important to most and “location” proved important to many), and of course, there was wide variation across participants (e.g., in definitions of what most private and who is most trusted).
A-priori policy isn’t enough: People want to be asked permission (even if they have assigned it), they want to know not only who is accessing files but why, and they want the capability to review access and revise policy.
Mental models do not equal system realities: Mismatches between current systems and users’ mental models may lead those users astray.
From these findings, Bauer and his fellow researchers distilled a set of useful guidelines for anybody building such a system:
Allow fine-grained control
Plan for lending devices
Include reactive policy creation and usable logs
Reduce or eliminate up-front complexity
Acknowledge social conventions
Support iterative policy specification
Account for users’ mental models

Related CyLab Chronicles

CyLab Chronicles: Q&A with Lujo Bauer (2009)

CyLab Chronicles: Q&A with Lujo Bauer (2008)

Other CyLab Seminar Notes

CyLab Seminar Series Notes: The Evolution of A Hacking Tool, Moxie Marlinspike on SSLstrip

CyLab Seminar Series Notes: User-Controllable Security and Privacy -- Norman Sadeh asks, "Are Expectations Realistic?"

CyLab Seminar Series: Of Frogs, Herds, Behavioral Economics, Malleable Privacy Valuations, and Context-Dependent Willingness to Divulge Personal Info

CyLab Seminar Series Notes: Why do people and corporations not invest more in security?

CyLab Research Update: Basic Instincts in the Virtual World?

For information on the benefits of partnering with CyLab, contact Gene Hambrick, CyLab Director of Corporate Relations: hambrick at andrew.cmu.edu