Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Endpoint

11/4/2016
02:30 PM
Ed Amoroso
Ed Amoroso
Commentary
Connect Directly
LinkedIn
RSS
E-Mail vvv
50%
50%

Election 2016 & WikiLeaks: Bad, But Not Your Worst Nightmare

John Podesta may be the poster child for poor user security practices but the real problem is rigid regulatory compliance frameworks that perpetuate ineffective perimeter defenses.

By now, like the rest of us, you’ve probably cringed at all the textbook cybersecurity mistakes committed by Clinton Campaign Chairman John Podesta. He requested, for example, that his iCloud password be sent to him via plaintext email. He selected weak passwords containing no special characters. He reused the same password across different publicly accessible accounts. It just goes on and on. Podesta is now being referred to by many in the security industry as the poster child for bad cybersecurity decisions, and I think he deserves it.

Clinton Campaign Chairman John Podesta Image Source: Joseph Sohm via Shutterstock
Clinton Campaign Chairman John Podesta
Image Source: Joseph Sohm via Shutterstock

But for cybersecurity professionals, there is a problem with the implicit messaging in this case. Yes, better selection and handling of passwords would have made Podesta’s email much more secure. But it’s been the practical and empirical experience of most leaders in the field of cybersecurity, that if a nation state really wants your sensitive data, then it will obtain it through a variety of means – the most common of which is the advanced persistent threat or APT. And while good password selection might slow down an APT, it won’t stop it.

Stated simply, as most security professions already know, an APT begins with the bad guys gaining access into an organizational network through email phishing or some other external means. Outsourced connections, for example, are popular for slipping past perimeter firewalls. Once in, the bad guys quietly install remote access tools, from which they browse, steal, and exfiltrate valuable data. The approach is effective because firewalls simply cannot properly arbitrate complex business processes with external groups, and such interaction is a requirement for every organization in the world. As a result, local security administrators are forced to leave ports open on the firewall, which is sort of like leaving your doors ajar or your windows unlocked.

Now, if you wonder why this dumb firewall approach continues to be used everywhere, against the advice of just about every expert, you will find an unexpected root cause: compliance. Yes, the stiff regulatory and compliance community still clings fearfully to the ineffective but familiar firewall concept like a victim dangling from a rope unwilling to let go and drop into the safety net below. They refuse to accept new security architectures, such as virtualized, distributed cloud networks scattered across hybrid infrastructure, citing such modern and superior technologies as too risky. Such belief comes from stubborn ignorance, and it is holding us all back.

So yes, it is fine, perhaps even recommended, to use the Podesta case to help improve local user decisions about cybersecurity. Go make your corporate awareness video and put his face in the first frame. But we must also recognize that the more serious cybersecurity problem comes from bad organizational security design spearheaded by regulatory and compliance auditors who perpetuate ineffective perimeter defenses through their rigid checklist frameworks. Until we fix this more complex problem, we will continue to see an onslaught ofcybersecurity threats, but with no obvious poster child to blame. 

Related Content:

 

Dr. Edward G. Amoroso is currently chief executive officer of TAG Cyber LLC, a global cyber security advisory, training, consulting, and media services company supporting hundreds of companies across the world. Ed recently retired from AT&T after thirty-one years of service, ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
ameliamartin
0%
100%
ameliamartin,
User Rank: Apprentice
11/5/2016 | 3:44:06 AM
RE: Election 2016 & WikiLeaks: Bad, But Not Your Worst Nightmare
Nice I agree with you
10 Ways to Keep a Rogue RasPi From Wrecking Your Network
Curtis Franklin Jr., Senior Editor at Dark Reading,  7/10/2019
The Security of Cloud Applications
Hillel Solow, CTO and Co-founder, Protego,  7/11/2019
Where Businesses Waste Endpoint Security Budgets
Kelly Sheridan, Staff Editor, Dark Reading,  7/15/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: "Jim, stop pretending you're drowning in tickets."
Current Issue
Building and Managing an IT Security Operations Program
As cyber threats grow, many organizations are building security operations centers (SOCs) to improve their defenses. In this Tech Digest you will learn tips on how to get the most out of a SOC in your organization - and what to do if you can't afford to build one.
Flash Poll
The State of IT Operations and Cybersecurity Operations
The State of IT Operations and Cybersecurity Operations
Your enterprise's cyber risk may depend upon the relationship between the IT team and the security team. Heres some insight on what's working and what isn't in the data center.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-3571
PUBLISHED: 2019-07-16
An input validation issue affected WhatsApp Desktop versions prior to 0.3.3793 which allows malicious clients to send files to users that would be displayed with a wrong extension.
CVE-2019-6160
PUBLISHED: 2019-07-16
A vulnerability in various versions of Iomega and LenovoEMC NAS products could allow an unauthenticated user to access files on NAS shares via the API.
CVE-2019-9700
PUBLISHED: 2019-07-16
Norton Password Manager, prior to 6.3.0.2082, may be susceptible to an address spoofing issue. This type of issue may allow an attacker to disguise their origin IP address in order to obfuscate the source of network traffic.
CVE-2019-12990
PUBLISHED: 2019-07-16
Citrix SD-WAN 10.2.x before 10.2.3 and NetScaler SD-WAN 10.0.x before 10.0.8 allow Directory Traversal.
CVE-2019-12991
PUBLISHED: 2019-07-16
Citrix SD-WAN 10.2.x before 10.2.3 and NetScaler SD-WAN 10.0.x before 10.0.8 have Improper Input Validation (issue 5 of 6).