This is the second installment of a two-part discussion of the threats and challenges involved with cybersecurity. The first part of the discussion explored cyber threats and challenges using the Stuxnet attack as a lens. This post picks up with an allegorical analysis of the cyber threat posed by nation-state attacks as well as ideas about how information systems can be built so that they are less tempting targets.
For me, and others such as Ruth Bader Ginsberg, Donald Douglas and Alan Dershowitz, growing up in Brooklyn was an education in itself. In addition to practical matters such as what constituted an ideal slice of pizza, how to parallel park and how to tell which blocks to avoid as a pedestrian after dark, there were more philosophical lessons to be learned. Take, for example, the case of Anthony Gianelli. (Note: Names have been changed to protect the innocent.)
Anthony, or Tony as he was called, was a hard working guy. He had that common Brooklyn fondness for sitting on his stoop in the evenings and pontificating on weighty issues about the state of the world. One week, as always, Tony played the lottery. Only this week was different. Tony won, and won big. I won’t say just how much money Tony went home with after taxes, but it was bordering on life changing. So what, you may ask, did Tony do with his winnings?
For those readers hailing from that storied borough, the answer is both obvious and easy. For everyone else… I’ll tell you. Tony bought a car. And not just any car. Tony bought a pristine, brand-spanking-new Ferrari GTSi. However, his trip home from the dealership was only the beginning. Knowing that he had about a month before the car was delivered, Tony set about fortifying his garage.
Fortifying might have been a bit of an understatement. Tony broke up the garage’s concrete floor and poured a new one - about eight feet deep. Sunk deeply into the wet concrete were four hardened steel eye bolts. The garage door was replaced with a high security model and a state of the art, sensor-based alarm system added. During the construction process, Tony spent many an evening on his stoop declaiming enthusiastically about the high degree of security being engineered into his garage.
The big day came and the Ferrari arrived. Tony drove it in a manner that was almost, well, reverent. At the end of the day, the ritual began. Tony lovingly parked the car in the garage, ran hardened steel chains through the undercarriage and secured each chain to an eye bolt with a high security padlock. The door was shut and hermetically sealed. The alarm was set, Tony wished the car good night, and then took to the stoop, passionately discussing the Ferrari’s security.
One day, several months after taking delivery, Tony went down to the garage to greet the Ferrari. To his horror and shock, the car was gone. Not only was it gone, but there was no evidence of any burglary. The door hadn’t been forced. The alarm hadn’t been tripped. The chains were neatly coiled around the eye bolts, the locks opened, ready for use. Tony, predictably, went into mourning.
After several months and stages of grief, Tony became somewhat philosophical about the loss. It was, he mused, a case of “easy come, easy go.” And so, you can only imagine Tony’s surprise when he walked into his dark garage on the way to retrieve the newspaper one morning only to bump into something with delightful, albeit hard, curves. Turning on the light, Tony stared and crossed himself. The Ferrari was back. In fact, it was all back. The chains were looped through the undercarriage. The alarm, which was now going off, had been set, and the door was still sealed. It was as if the car had never left. Except for one small detail.
Taped to the windshield was a note. There were all of eight words:
If we really want it, we’ll take it.
Tony took his Ferrari and moved to New Jersey.
Tales of braggadocio and grand theft auto notwithstanding, the story about Tony’s Ferrari has an important nugget of advice for cyber defenders. Tony ran into a certain kind of reality. Specifically, he discovered what happens when an individual of significant but finite resources is at odds with an organization that has almost limitless time and resources. This reality, deriving from the axiom that “given enough time and money, all things are possible,” also applies when cybersecurity intersects with geopolitics. That is to say, when a nation-state puts your information system in the crosshairs of its cyber capabilities, there’s generally little that can be done about it.
That doesn’t mean that organizations should give up on cyber defense. Dedicated, specific, targeted attacks by nation-states using Advanced Persistent Threats (e.g., “Stuxnet”) are rare. The real cyber threats faced by commercial, government and military organizations – probes and penetration by external actors and data loss due to insider threats – are almost mundane in their ubiquity. Moreover, these threats are so common that many security professionals simply assume that losses due to cyberattacks are just another terrain feature in cyberspace.
That assumption is premised on the ideas that cyber defense is inherently reactive and that that architecture of distributed systems (and, for that matter, the internet) must remain inherently static.
That premise is inherently flawed.
Technical standards and capabilities don’t remain static. They continuously advance. Many of the advances made over the last decade or so present engineers, architects, designers and developers with new options and choices when crafting responses to operational requirements. Taken as a whole, this technical progress offers an ability to proactively design and integrally implement security in a manner that could alter much of the cybersecurity calculus.
This isn’t to say that there is a single silver bullet. Rather, there are a number of technologies that, operating in concert, offer designers and defenders significant advantages. An exhaustive discussion of all these technologies could fill volumes (and has) and is beyond the scope of this post. However, highlighting just a few provides a useful overview of the way things could, and should, be.
1. Software is broken. It’s created broken, it’s delivered broken and what’s worse, users become (unwitting) beta testers. These flaws in the delivered product result in vulnerabilities which are exploited by hackers and malware authors. In a disturbingly large proportion of cases, the delivery of flawed products can be traced to the nature of the software development life cycle itself. In these cases, security verification and validation is the penultimate step prior to release. As a result, it’s often rushed, resulting in flaws not being discovered. Worse, it’s often too late or too expensive to fix a significant number of the flaws that are found.
But what if security verification and validation could be pushed back to the beginning of the development lifecycle? If we could ensure that the only code modules that entered the trunk were those that had passed the complete battery of functional and non-functional (e.g., performance, scalability, interoperability and security) tests, the ensuing increase in the quality of software products would be accompanied by a significant decrease in delivered vulnerabilities.
The good news is that this is exactly what the DevOps PaaS delivers. By leveraging a shared, Cloud-based integrated development environment (IDE), environmental variances between Dev, Test and Operations that inject vulnerabilities can be eliminated. Next, by automating DevOps practices such as Continuous Build, Continuous Integration, Continuous Test and Continuous Design, the onus is shifted to the developer, who must deliver flawless code, from the tester who had previously been (unrealistically) expected to find all the flaws in the code.
2. Many, if not most, critical systems are protected by access control systems that focus on authentication, or ensuring that the entity requesting access to the system is who it claims to be. Authentication can be a powerful gate guard, sometimes requiring multiple concurrent methodologies (e.g., something you know, something you have, something you are, etc.). The problem is that once a user is authenticated, these systems provide few, if any, controls or protections to system resources. This vulnerability was exploited by both Bradley Manning and Edward Snowden.
The answer is to add a layer that enforces fine-grained authorization and managing which resources can be accessed by authenticated users with a given set of attributes. This mechanism, called attribute-based access control, or ABAC, is implemented through an OASIS open standard known as the eXtensible Access Control Markup Language (XACML). XACML was first published in September 2003, and there are a significant number of commercial software packages (both proprietary and open source) that use it to bring ABAC’s powerful security to the enterprise.
3. When vulnerabilities are discovered in an enterprise’s key software components, it can take a significant amount of time to disseminate countervailing security measures. During this time, the enterprise remains vulnerable. The challenge is to rapidly close the security gap while ensuring that the enterprise’s operations suffer as little disruption as possible.
The answer is to apply access control security at the operating system level, enabling an access control regime that is dynamic and centrally controlled. In principle, this is similar to what ABAC implements for enterprise resources. In this case, however, the control takes place at the inter-process communication (IPC) level. In practice, this means that the organization can, upon learning about a vulnerability or compromise, push out a new access control policy to all hosts. The policy can both enable and disable specific IPC types. The net result is that the compromised software is prevented from executing while replacement software is seamlessly enabled.
None of these things are a panacea to the cyber-vulnerability epidemic. However, they all represent very real, tangible steps that engineers, designers and defenders can take to mitigate the risks faced while operating in an increasingly hostile environment. They don’t solve everything. But, taken in concert with other measures, they create a much more agile, resilient infrastructure.
And that beats moving to New Jersey.