Endpoint

7/2/2015
11:00 AM
Jeff Schilling
Jeff Schilling
Commentary
Connect Directly
Facebook
Twitter
LinkedIn
RSS
E-Mail vvv
100%
0%

In The Cyber Realm, Lets Be Knights Not Blacksmiths

Why the Internet of Things is our chance to finally get information security right.

It happens every year. I attend the major security conferences and watch them devolve into rhetoric-filled conduits void of productivity and education. In fact, many decisions-makers no longer attend. And if they do, they don’t appear at many sessions and avoid venturing into the noise of the vendor exhibit floor.  

It’s the same monotonous commotion. Vendors and experts flooding the floor and claiming, “We are the only one doing this.” It’s been quite a while since I’ve seen new technology that makes me think, “Wow, that’s unique.” Each year, everyone has their spin on four components of the same mantra:

  • Artificial Intelligence/Machine-Learning 
  • Big Data Analytics
  • Anomaly Detection 
  • Finding the “Right Needle in the Stack of Needles”  

It continues to be the wrong mindset for security professionals. It’s a warehouse of weaponry without anyone skilled in using it properly or safely. To me, it’s akin to a blacksmith dropping off a cart full of swords and shields at a village and saying, "Stack these weapons on the road to your town. Don’t worry, it will protect you from evildoers."  

What is forgotten in the conversation is that it takes skilled professionals — or knights in this rudimentary analogy — to wield tools to protect themselves or organizations from malicious threat actors.

Everyone’s Doing It, And Doing it Wrong
Security vendors continually deploy a basic set of tools: a security information and event management (SIEM) tool; virtual machine inspection; “Layer 7” inspection; and finish with a variety of inline deep-packet inspection. I see limited innovation with vendors that have successfully integrated these capabilities in a unified threat management (UTM) platform.

The effectiveness of this approach will lean heavily on vendors’ ability in integrating and simplifying threat detection functions within UTMs. However, these UTM platforms are usually not strong in all functional capabilities.

An emerging trend that appears to be the new direction in security tools is application security capabilities, which proclaim to sit between the app server and the database. Are we simply building more swords and shields, but not making any real progress against true threats? Today’s security tools are overly complex and, in most cases, ineffective if not employed by highly trained security teams. In many scenarios, you may have to accept that while you have a great sword, it may be two feet shorter than your enemy’s simple but effective spear.

Embrace IOT Security Before It’s Too Late
So, what’s the core problem? As I see it, most security teams lack a true strategy. They continue to pile swords, spears and shields on the road to the village and hope threat actors will somehow be deterred or trip and fall on a sword. Unlikely.

In my opinion, 99 percent of the problem faced by professionals struggling to secure their networks boils down to one simple fact: their architecture cannot be defended. The traditional network-centric model — a framework that has evolved since the evolution of TCP/IP in the late ‘80s — has too much surface area to protect. We will never get the initiative back from the threat actors. I just stated a fact of the obvious. But is there a solution?

There is:  Embrace the Internet of Things (IOT) as a new security architecture. I may be in the minority. I still very much feel like the lone professional on every security panel I sit on who believes the IOT is our chance to get security right.

Four Key Steps for IOT
Essentially, we seek to transform our fundamental architecture from a network-centric model (where you pull data and applications into many endpoints) to a data-centric model (where applications and data don’t move). The ubiquitous user moves around on many different platforms, but for the most part they connect to the application and data, view it or interact with it, then drop the connection. Nothing of value to exploit is left on the end-user device.

In this framework, I recommend four key focus areas for security and technology vendors, some of which are already in flight.

  1. Develop a foolproof, role-based identity management system that is easy to scale and manage access to applications and data
  2. Provide an application/database encryption solution that denies an authorized user, who does not present the right token, from getting unencrypted data access  
  3. Build a sandbox environment in the application for interaction on the user host that is protected from any malware that exists on user devices
  4. Design infallible handshake and en route encryption capabilities so attacks like man-in-the-middle are not possible

If we’re able to move away from legacy network-centric thinking toward new IoT frameworks, we’ll have a great opportunity to improve security. This will help us clearly identify users; protect both data at rest and in transit; eliminate the ability of users to move data to their devices; and stop defending the endpoint.

I am ready for the Internet of Things to usher us into a new security era. The strategy of bolting on security technology to an un-defendable network-centric architecture is obsolete. It’s time.

Jeff Schilling, a retired U.S. Army colonel, is Armor's chief security officer. He is responsible for the cyber and physical security programs for the corporate environment and customer-focused capabilities. His areas of responsibilities include security operation, governance ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Jeff.schilling
50%
50%
Jeff.schilling,
User Rank: Author
7/6/2015 | 5:50:22 PM
Re: Kights with weak swords
Gary,

Thank you for your response to the article.  Great points all around.  Flawed Software is the crux of the issue.  I tell people everyday that threat actors are not doing much different from when I ran the DOD Security Ops centers from 2007-2012.  Their operational processes have gotten much more organized and their ability to leverage Zero day exploits much quicker.  

I am hopeful we will get it right when we move to IOT, which really a cloud-based, data centric model vice a network centric model we live in for the most part today.

Jeff   
Blog Voyage
100%
0%
Blog Voyage,
User Rank: Strategist
7/3/2015 | 9:06:21 AM
Re: Kights with weak swords
Very nice analysis.
GaryS166
100%
0%
GaryS166,
User Rank: Apprentice
7/2/2015 | 3:47:33 PM
Kights with weak swords
I suggest that the issue is more than not being knights (a good and important point).  Rather the idea of having swords 2-feet shorter starts to highlight the pragmatic reality.  Attackers have a large attack surface to attack, a surface that to the defender is much like an iceberg - the part we see (known vulnerabilities) is only a small part of the overall.  And we face adversaries conducting 'undersea' operations.  Moreover, the 4 IOT actions could be quite effective if (BIG IF) they are implemented such that they are correct, always invoked when needed, not bypassed, and not tampered with.  Yet if we could do that for these IOT actions, we could do it for non-IOT means as well.  And the reasons we are not would apply to the IOT actions as well.

A first principle is that a problem due to flawed software cannot be corrected by adding more flawed software.  The trustworthiness of SW is NOT determined by what it does, but by how it came to be.  And the software for the 4-IOT actions will be implemented with SW of the same low assurance as the SW it is trying to protect; unless doing differently is an explicit part of the actions to be performed.

My suggestion is - sure, absolutely pursue ideas such as your 4-IOT actions.  Yet more importantly and as mandatory for mission/business success FIRST:

a. See the reality of large low assurance IT for what it is - highly susceptible to attack and a situation that cannot, on first principles, be meaningfully changed by the addition of more low-assurance SW;

b. Use the IT we have according to what it is, not what we wish it was, making 'wise use' decisions as to what and how much to automate and having alternative mission/business processes for contingency operations;

c. Measure our cybersecurity capability against the adversary, not against our previous capability (to avoid measuring degrees of ineffectiveness and start measuring how effective we really are); and

d. Make changes to the above as the reality of the IT we use changes in a meaningful manner.

Gary Stoneburner, Senior Professional Staff, Johns Hopkins University/Applied Physics Laboratory and major contributor to NIST information security guidance (Expressing personnal judgement and not an position of my employer)
Government Shutdown Brings Certificate Lapse Woes
Curtis Franklin Jr., Senior Editor at Dark Reading,  1/11/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
The Year in Security 2018
This Dark Reading Tech Digest explores the biggest news stories of 2018 that shaped the cybersecurity landscape.
Flash Poll
How Enterprises Are Attacking the Cybersecurity Problem
How Enterprises Are Attacking the Cybersecurity Problem
Data breach fears and the need to comply with regulations such as GDPR are two major drivers increased spending on security products and technologies. But other factors are contributing to the trend as well. Find out more about how enterprises are attacking the cybersecurity problem by reading our report today.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-6443
PUBLISHED: 2019-01-16
An issue was discovered in NTPsec before 1.1.3. Because of a bug in ctl_getitem, there is a stack-based buffer over-read in read_sysvars in ntp_control.c in ntpd.
CVE-2019-6444
PUBLISHED: 2019-01-16
An issue was discovered in NTPsec before 1.1.3. process_control() in ntp_control.c has a stack-based buffer over-read because attacker-controlled data is dereferenced by ntohl() in ntpd.
CVE-2019-6445
PUBLISHED: 2019-01-16
An issue was discovered in NTPsec before 1.1.3. An authenticated attacker can cause a NULL pointer dereference and ntpd crash in ntp_control.c, related to ctl_getitem.
CVE-2019-6446
PUBLISHED: 2019-01-16
An issue was discovered in NumPy 1.16.0 and earlier. It uses the pickle Python module unsafely, which allows remote attackers to execute arbitrary code via a crafted serialized object, as demonstrated by a numpy.load call.
CVE-2019-6442
PUBLISHED: 2019-01-16
An issue was discovered in NTPsec before 1.1.3. An authenticated attacker can write one byte out of bounds in ntpd via a malformed config request, related to config_remotely in ntp_config.c, yyparse in ntp_parser.tab.c, and yyerror in ntp_parser.y.