Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Endpoint

11/4/2016
02:30 PM
Ed Amoroso
Ed Amoroso
Commentary
Connect Directly
LinkedIn
RSS
E-Mail vvv
50%
50%

Election 2016 & WikiLeaks: Bad, But Not Your Worst Nightmare

John Podesta may be the poster child for poor user security practices but the real problem is rigid regulatory compliance frameworks that perpetuate ineffective perimeter defenses.

By now, like the rest of us, you’ve probably cringed at all the textbook cybersecurity mistakes committed by Clinton Campaign Chairman John Podesta. He requested, for example, that his iCloud password be sent to him via plaintext email. He selected weak passwords containing no special characters. He reused the same password across different publicly accessible accounts. It just goes on and on. Podesta is now being referred to by many in the security industry as the poster child for bad cybersecurity decisions, and I think he deserves it.

Clinton Campaign Chairman John Podesta Image Source: Joseph Sohm via Shutterstock
Clinton Campaign Chairman John Podesta
Image Source: Joseph Sohm via Shutterstock

But for cybersecurity professionals, there is a problem with the implicit messaging in this case. Yes, better selection and handling of passwords would have made Podesta’s email much more secure. But it’s been the practical and empirical experience of most leaders in the field of cybersecurity, that if a nation state really wants your sensitive data, then it will obtain it through a variety of means – the most common of which is the advanced persistent threat or APT. And while good password selection might slow down an APT, it won’t stop it.

Stated simply, as most security professions already know, an APT begins with the bad guys gaining access into an organizational network through email phishing or some other external means. Outsourced connections, for example, are popular for slipping past perimeter firewalls. Once in, the bad guys quietly install remote access tools, from which they browse, steal, and exfiltrate valuable data. The approach is effective because firewalls simply cannot properly arbitrate complex business processes with external groups, and such interaction is a requirement for every organization in the world. As a result, local security administrators are forced to leave ports open on the firewall, which is sort of like leaving your doors ajar or your windows unlocked.

Now, if you wonder why this dumb firewall approach continues to be used everywhere, against the advice of just about every expert, you will find an unexpected root cause: compliance. Yes, the stiff regulatory and compliance community still clings fearfully to the ineffective but familiar firewall concept like a victim dangling from a rope unwilling to let go and drop into the safety net below. They refuse to accept new security architectures, such as virtualized, distributed cloud networks scattered across hybrid infrastructure, citing such modern and superior technologies as too risky. Such belief comes from stubborn ignorance, and it is holding us all back.

So yes, it is fine, perhaps even recommended, to use the Podesta case to help improve local user decisions about cybersecurity. Go make your corporate awareness video and put his face in the first frame. But we must also recognize that the more serious cybersecurity problem comes from bad organizational security design spearheaded by regulatory and compliance auditors who perpetuate ineffective perimeter defenses through their rigid checklist frameworks. Until we fix this more complex problem, we will continue to see an onslaught ofcybersecurity threats, but with no obvious poster child to blame. 

Related Content:

 

Dr. Edward G. Amoroso is currently chief executive officer of TAG Cyber LLC, a global cyber security advisory, training, consulting, and media services company supporting hundreds of companies across the world. Ed recently retired from AT&T after thirty-one years of service, ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
ameliamartin
0%
100%
ameliamartin,
User Rank: Apprentice
11/5/2016 | 3:44:06 AM
RE: Election 2016 & WikiLeaks: Bad, But Not Your Worst Nightmare
Nice I agree with you
AI Is Everywhere, but Don't Ignore the Basics
Howie Xu, Vice President of AI and Machine Learning at Zscaler,  9/10/2019
Fed Kaspersky Ban Made Permanent by New Rules
Dark Reading Staff 9/11/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
7 Threats & Disruptive Forces Changing the Face of Cybersecurity
This Dark Reading Tech Digest gives an in-depth look at the biggest emerging threats and disruptive forces that are changing the face of cybersecurity today.
Flash Poll
The State of IT Operations and Cybersecurity Operations
The State of IT Operations and Cybersecurity Operations
Your enterprise's cyber risk may depend upon the relationship between the IT team and the security team. Heres some insight on what's working and what isn't in the data center.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-14540
PUBLISHED: 2019-09-15
A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10. It is related to com.zaxxer.hikari.HikariConfig.
CVE-2019-16332
PUBLISHED: 2019-09-15
In the api-bearer-auth plugin before 20190907 for WordPress, the server parameter is not correctly filtered in the swagger-config.yaml.php file, and it is possible to inject JavaScript code, aka XSS.
CVE-2019-16333
PUBLISHED: 2019-09-15
GetSimple CMS v3.3.15 has Persistent Cross-Site Scripting (XSS) in admin/theme-edit.php.
CVE-2019-16334
PUBLISHED: 2019-09-15
In Bludit v3.9.2, there is a persistent XSS vulnerability in the Categories -> Add New Category -> Name field. NOTE: this may overlap CVE-2017-16636.
CVE-2019-16335
PUBLISHED: 2019-09-15
A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10. It is related to com.zaxxer.hikari.HikariDataSource. This is a different vulnerability than CVE-2019-14540.