Endpoint

11/4/2016
02:30 PM
Ed Amoroso
Ed Amoroso
Commentary
Connect Directly
LinkedIn
RSS
E-Mail vvv
50%
50%

Election 2016 & WikiLeaks: Bad, But Not Your Worst Nightmare

John Podesta may be the poster child for poor user security practices but the real problem is rigid regulatory compliance frameworks that perpetuate ineffective perimeter defenses.

By now, like the rest of us, you’ve probably cringed at all the textbook cybersecurity mistakes committed by Clinton Campaign Chairman John Podesta. He requested, for example, that his iCloud password be sent to him via plaintext email. He selected weak passwords containing no special characters. He reused the same password across different publicly accessible accounts. It just goes on and on. Podesta is now being referred to by many in the security industry as the poster child for bad cybersecurity decisions, and I think he deserves it.

Clinton Campaign Chairman John Podesta Image Source: Joseph Sohm via Shutterstock
Clinton Campaign Chairman John Podesta
Image Source: Joseph Sohm via Shutterstock

But for cybersecurity professionals, there is a problem with the implicit messaging in this case. Yes, better selection and handling of passwords would have made Podesta’s email much more secure. But it’s been the practical and empirical experience of most leaders in the field of cybersecurity, that if a nation state really wants your sensitive data, then it will obtain it through a variety of means – the most common of which is the advanced persistent threat or APT. And while good password selection might slow down an APT, it won’t stop it.

Stated simply, as most security professions already know, an APT begins with the bad guys gaining access into an organizational network through email phishing or some other external means. Outsourced connections, for example, are popular for slipping past perimeter firewalls. Once in, the bad guys quietly install remote access tools, from which they browse, steal, and exfiltrate valuable data. The approach is effective because firewalls simply cannot properly arbitrate complex business processes with external groups, and such interaction is a requirement for every organization in the world. As a result, local security administrators are forced to leave ports open on the firewall, which is sort of like leaving your doors ajar or your windows unlocked.

Now, if you wonder why this dumb firewall approach continues to be used everywhere, against the advice of just about every expert, you will find an unexpected root cause: compliance. Yes, the stiff regulatory and compliance community still clings fearfully to the ineffective but familiar firewall concept like a victim dangling from a rope unwilling to let go and drop into the safety net below. They refuse to accept new security architectures, such as virtualized, distributed cloud networks scattered across hybrid infrastructure, citing such modern and superior technologies as too risky. Such belief comes from stubborn ignorance, and it is holding us all back.

So yes, it is fine, perhaps even recommended, to use the Podesta case to help improve local user decisions about cybersecurity. Go make your corporate awareness video and put his face in the first frame. But we must also recognize that the more serious cybersecurity problem comes from bad organizational security design spearheaded by regulatory and compliance auditors who perpetuate ineffective perimeter defenses through their rigid checklist frameworks. Until we fix this more complex problem, we will continue to see an onslaught ofcybersecurity threats, but with no obvious poster child to blame. 

Related Content:

 

Dr. Edward G. Amoroso is currently chief executive officer of TAG Cyber LLC, a global cyber security advisory, training, consulting, and media services company supporting hundreds of companies across the world. Ed recently retired from AT&T after thirty-one years of service, ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
ameliamartin
0%
100%
ameliamartin,
User Rank: Apprentice
11/5/2016 | 3:44:06 AM
RE: Election 2016 & WikiLeaks: Bad, But Not Your Worst Nightmare
Nice I agree with you
Crowdsourced vs. Traditional Pen Testing
Alex Haynes, Chief Information Security Officer, CDL,  3/19/2019
BEC Scammer Pleads Guilty
Dark Reading Staff 3/20/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
5 Emerging Cyber Threats to Watch for in 2019
Online attackers are constantly developing new, innovative ways to break into the enterprise. This Dark Reading Tech Digest gives an in-depth look at five emerging attack trends and exploits your security team should look out for, along with helpful recommendations on how you can prevent your organization from falling victim.
Flash Poll
The State of Cyber Security Incident Response
The State of Cyber Security Incident Response
Organizations are responding to new threats with new processes for detecting and mitigating them. Here's a look at how the discipline of incident response is evolving.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-18913
PUBLISHED: 2019-03-21
Opera before 57.0.3098.106 is vulnerable to a DLL Search Order hijacking attack where an attacker can send a ZIP archive composed of an HTML page along with a malicious DLL to the target. Once the document is opened, it may allow the attacker to take full control of the system from any location with...
CVE-2018-20031
PUBLISHED: 2019-03-21
A Denial of Service vulnerability related to preemptive item deletion in lmgrd and vendor daemon components of FlexNet Publisher version 11.16.1.0 and earlier allows a remote attacker to send a combination of messages to lmgrd or the vendor daemon, causing the heartbeat between lmgrd and the vendor ...
CVE-2018-20032
PUBLISHED: 2019-03-21
A Denial of Service vulnerability related to message decoding in lmgrd and vendor daemon components of FlexNet Publisher version 11.16.1.0 and earlier allows a remote attacker to send a combination of messages to lmgrd or the vendor daemon, causing the heartbeat between lmgrd and the vendor daemon t...
CVE-2018-20034
PUBLISHED: 2019-03-21
A Denial of Service vulnerability related to adding an item to a list in lmgrd and vendor daemon components of FlexNet Publisher version 11.16.1.0 and earlier allows a remote attacker to send a combination of messages to lmgrd or the vendor daemon, causing the heartbeat between lmgrd and the vendor ...
CVE-2019-3855
PUBLISHED: 2019-03-21
An integer overflow flaw which could lead to an out of bounds write was discovered in libssh2 before 1.8.1 in the way packets are read from the server. A remote attacker who compromises a SSH server may be able to execute code on the client system when a user connects to the server.