Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Endpoint

11/4/2016
02:30 PM
Ed Amoroso
Ed Amoroso
Commentary
Connect Directly
LinkedIn
RSS
E-Mail vvv
50%
50%

Election 2016 & WikiLeaks: Bad, But Not Your Worst Nightmare

John Podesta may be the poster child for poor user security practices but the real problem is rigid regulatory compliance frameworks that perpetuate ineffective perimeter defenses.

By now, like the rest of us, you’ve probably cringed at all the textbook cybersecurity mistakes committed by Clinton Campaign Chairman John Podesta. He requested, for example, that his iCloud password be sent to him via plaintext email. He selected weak passwords containing no special characters. He reused the same password across different publicly accessible accounts. It just goes on and on. Podesta is now being referred to by many in the security industry as the poster child for bad cybersecurity decisions, and I think he deserves it.

Clinton Campaign Chairman John Podesta Image Source: Joseph Sohm via Shutterstock
Clinton Campaign Chairman John Podesta
Image Source: Joseph Sohm via Shutterstock

But for cybersecurity professionals, there is a problem with the implicit messaging in this case. Yes, better selection and handling of passwords would have made Podesta’s email much more secure. But it’s been the practical and empirical experience of most leaders in the field of cybersecurity, that if a nation state really wants your sensitive data, then it will obtain it through a variety of means – the most common of which is the advanced persistent threat or APT. And while good password selection might slow down an APT, it won’t stop it.

Stated simply, as most security professions already know, an APT begins with the bad guys gaining access into an organizational network through email phishing or some other external means. Outsourced connections, for example, are popular for slipping past perimeter firewalls. Once in, the bad guys quietly install remote access tools, from which they browse, steal, and exfiltrate valuable data. The approach is effective because firewalls simply cannot properly arbitrate complex business processes with external groups, and such interaction is a requirement for every organization in the world. As a result, local security administrators are forced to leave ports open on the firewall, which is sort of like leaving your doors ajar or your windows unlocked.

Now, if you wonder why this dumb firewall approach continues to be used everywhere, against the advice of just about every expert, you will find an unexpected root cause: compliance. Yes, the stiff regulatory and compliance community still clings fearfully to the ineffective but familiar firewall concept like a victim dangling from a rope unwilling to let go and drop into the safety net below. They refuse to accept new security architectures, such as virtualized, distributed cloud networks scattered across hybrid infrastructure, citing such modern and superior technologies as too risky. Such belief comes from stubborn ignorance, and it is holding us all back.

So yes, it is fine, perhaps even recommended, to use the Podesta case to help improve local user decisions about cybersecurity. Go make your corporate awareness video and put his face in the first frame. But we must also recognize that the more serious cybersecurity problem comes from bad organizational security design spearheaded by regulatory and compliance auditors who perpetuate ineffective perimeter defenses through their rigid checklist frameworks. Until we fix this more complex problem, we will continue to see an onslaught ofcybersecurity threats, but with no obvious poster child to blame. 

Related Content:

 

Dr. Edward G. Amoroso is currently chief executive officer of TAG Cyber LLC, a global cyber security advisory, training, consulting, and media services company supporting hundreds of companies across the world. Ed recently retired from AT&T after thirty-one years of service, ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
ameliamartin
0%
100%
ameliamartin,
User Rank: Apprentice
11/5/2016 | 3:44:06 AM
RE: Election 2016 & WikiLeaks: Bad, But Not Your Worst Nightmare
Nice I agree with you
Edge-DRsplash-10-edge-articles
7 Old IT Things Every New InfoSec Pro Should Know
Joan Goodchild, Staff Editor,  4/20/2021
News
Cloud-Native Businesses Struggle With Security
Robert Lemos, Contributing Writer,  5/6/2021
Commentary
Defending Against Web Scraping Attacks
Rob Simon, Principal Security Consultant at TrustedSec,  5/7/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-27734
PUBLISHED: 2021-05-17
Hirschmann HiOS 07.1.01, 07.1.02, and 08.1.00 through 08.5.xx and HiSecOS 03.3.00 through 03.5.01 allow remote attackers to change the credentials of existing users.
CVE-2021-27342
PUBLISHED: 2021-05-17
An authentication brute-force protection mechanism bypass in telnetd in D-Link Router model DIR-842 firmware version 3.0.2 allows a remote attacker to circumvent the anti-brute-force cool-down delay period via a timing-based side-channel attack
CVE-2021-31727
PUBLISHED: 2021-05-17
Incorrect access control in zam64.sys, zam32.sys in MalwareFox AntiMalware 2.74.0.150 where IOCTL's 0x80002014, 0x80002018 expose unrestricted disk read/write capabilities respectively. A non-privileged process can open a handle to \.\ZemanaAntiMalware, register with the driver using IOCTL 0x8000201...
CVE-2021-31728
PUBLISHED: 2021-05-17
Incorrect access control in zam64.sys, zam32.sys in MalwareFox AntiMalware 2.74.0.150 allows a non-privileged process to open a handle to \.\ZemanaAntiMalware, register itself with the driver by sending IOCTL 0x80002010, allocate executable memory using a flaw in IOCTL 0x80002040, install a hook wit...
CVE-2021-32402
PUBLISHED: 2021-05-17
Intelbras Router RF 301K Firmware 1.1.2 is vulnerable to Cross Site Request Forgery (CSRF) due to lack of validation and insecure configurations in inputs and modules.