Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Endpoint

11/4/2016
02:30 PM
Ed Amoroso
Ed Amoroso
Commentary
Connect Directly
LinkedIn
RSS
E-Mail vvv
50%
50%

Election 2016 & WikiLeaks: Bad, But Not Your Worst Nightmare

John Podesta may be the poster child for poor user security practices but the real problem is rigid regulatory compliance frameworks that perpetuate ineffective perimeter defenses.

By now, like the rest of us, you’ve probably cringed at all the textbook cybersecurity mistakes committed by Clinton Campaign Chairman John Podesta. He requested, for example, that his iCloud password be sent to him via plaintext email. He selected weak passwords containing no special characters. He reused the same password across different publicly accessible accounts. It just goes on and on. Podesta is now being referred to by many in the security industry as the poster child for bad cybersecurity decisions, and I think he deserves it.

Clinton Campaign Chairman John Podesta Image Source: Joseph Sohm via Shutterstock
Clinton Campaign Chairman John Podesta
Image Source: Joseph Sohm via Shutterstock

But for cybersecurity professionals, there is a problem with the implicit messaging in this case. Yes, better selection and handling of passwords would have made Podesta’s email much more secure. But it’s been the practical and empirical experience of most leaders in the field of cybersecurity, that if a nation state really wants your sensitive data, then it will obtain it through a variety of means – the most common of which is the advanced persistent threat or APT. And while good password selection might slow down an APT, it won’t stop it.

Stated simply, as most security professions already know, an APT begins with the bad guys gaining access into an organizational network through email phishing or some other external means. Outsourced connections, for example, are popular for slipping past perimeter firewalls. Once in, the bad guys quietly install remote access tools, from which they browse, steal, and exfiltrate valuable data. The approach is effective because firewalls simply cannot properly arbitrate complex business processes with external groups, and such interaction is a requirement for every organization in the world. As a result, local security administrators are forced to leave ports open on the firewall, which is sort of like leaving your doors ajar or your windows unlocked.

Now, if you wonder why this dumb firewall approach continues to be used everywhere, against the advice of just about every expert, you will find an unexpected root cause: compliance. Yes, the stiff regulatory and compliance community still clings fearfully to the ineffective but familiar firewall concept like a victim dangling from a rope unwilling to let go and drop into the safety net below. They refuse to accept new security architectures, such as virtualized, distributed cloud networks scattered across hybrid infrastructure, citing such modern and superior technologies as too risky. Such belief comes from stubborn ignorance, and it is holding us all back.

So yes, it is fine, perhaps even recommended, to use the Podesta case to help improve local user decisions about cybersecurity. Go make your corporate awareness video and put his face in the first frame. But we must also recognize that the more serious cybersecurity problem comes from bad organizational security design spearheaded by regulatory and compliance auditors who perpetuate ineffective perimeter defenses through their rigid checklist frameworks. Until we fix this more complex problem, we will continue to see an onslaught ofcybersecurity threats, but with no obvious poster child to blame. 

Related Content:

 

Dr. Edward G. Amoroso is currently chief executive officer of TAG Cyber LLC, a global cyber security advisory, training, consulting, and media services company supporting hundreds of companies across the world. Ed recently retired from AT&T after thirty-one years of service, ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
ameliamartin
0%
100%
ameliamartin,
User Rank: Apprentice
11/5/2016 | 3:44:06 AM
RE: Election 2016 & WikiLeaks: Bad, But Not Your Worst Nightmare
Nice I agree with you
97% of Americans Can't Ace a Basic Security Test
Steve Zurier, Contributing Writer,  5/20/2019
TeamViewer Admits Breach from 2016
Dark Reading Staff 5/20/2019
How a Manufacturing Firm Recovered from a Devastating Ransomware Attack
Kelly Jackson Higgins, Executive Editor at Dark Reading,  5/20/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Building and Managing an IT Security Operations Program
As cyber threats grow, many organizations are building security operations centers (SOCs) to improve their defenses. In this Tech Digest you will learn tips on how to get the most out of a SOC in your organization - and what to do if you can't afford to build one.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-5798
PUBLISHED: 2019-05-23
Lack of correct bounds checking in Skia in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.
CVE-2019-5799
PUBLISHED: 2019-05-23
Incorrect inheritance of a new document's policy in Content Security Policy in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to bypass content security policy via a crafted HTML page.
CVE-2019-5800
PUBLISHED: 2019-05-23
Insufficient policy enforcement in Blink in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to bypass content security policy via a crafted HTML page.
CVE-2019-5801
PUBLISHED: 2019-05-23
Incorrect eliding of URLs in Omnibox in Google Chrome on iOS prior to 73.0.3683.75 allowed a remote attacker to perform domain spoofing via a crafted HTML page.
CVE-2019-5802
PUBLISHED: 2019-05-23
Incorrect handling of download origins in Navigation in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to perform domain spoofing via a crafted HTML page.