Raesene's Ramblings

Re-reading my previous post on data-centric security Hoff made the correct comment that I'd gone to the extreme end and it didn't quite flow from his post.
Fair point, I jumped a couple of hurdles a bit too quickly and it probably didn't make where I'm coming from clear, so I'll try and cover things a bit better now.
ok first basic point, I'm not a fan of *some* of the Jericho forums ideas (I like most of the others just fine, in principle anyway). Specifically the DRM/acces to data bit. In principle it sounds great, but I don't think that it's practible to implement in most organisations with their masses of un-organised data an ever increasing requirements for easier connectivity and data flow.
Now Rob makes the point very forcefully that models like Bell LaPudala have described the kind of Mandatory Access Control world that DRM implements for quite some time. Yep they have, but outside of miltiary or police environments I've never seen these implemented. My feeling is that the reason for this is that in these systems users need to be actively involved in data security, they need to classify information as it's created and they need to understand the requirements on them to maintain the classification of data.
I don't think that most corporates will buy into systems that work in that way. I think that the overhead of training and maintaining systems that implement MAC is beyond what most companies want.
So .. am I anti-security? Nope I'm extremely pro-security. My feeling is however that the best way to implement security is in ways which it's invisable to users. Every time you make ordinary business people think about security (eg, usernames/passwords) they try their darndest to bypass those requirements.
Personally I'm a great fan of network segregation and defence in depth at the network layer. I think that devices like the ones crossbeam produce are very useful in coming up with risk profiles, on a network by network basis rather than a data basis and managing traffic in that way. The reason for this is that then the segregation and protections can be applied without the intervention of end-users and without them (hopefully) having to know about what security is in place.
So to use the phrase that I've seen in other blogs on this subject, I think that the "zones of trust" are a great idea, but the zone's shouldn't be based on the data that flows over them, but the user/machine that are used. It's the idea of tagging all that data with the right tags and controlling it's flow that bugs me.
So that's where my points in the previous post came from, and I still reckon their correct. Data tagging and parsing relies on the existance of standards and their uptake in the first instance and then users *actually using them* and personally I think that's not going to happen in general companies and therefore is not the best place to be focusing security effort...

The Security Development Lifecycle : Oil Change or Culture Change?
Really interesting point here on the Microsoft SDL blog about executive buy-in being critical to getting focus on security. I think that it actually applies to pretty much all security spending.
The thing that came home to me reading this is. It's not that company executives don't want their organisations to be secure, I'm sure they do. It's that when it comes down to the detail of "where will I not spend money and effort so I can do this piece of security work" that the problems start.
It's a really difficult sell to say " well Mr CIO we suggest spending X on security which will mean that one (or more) of your other projects won't happen this year due to the resource cost of doing the security work" unless that CIO realises how important security is and also trusts the people who are giving him that message.
Using the example of implementing a SDL. It's not just the cost of the tools and consultancy to implement it, it's the developer time that's not writing new features or fixing customer bugs while they learn about SDL and get the appropriate training.
So how do you do this magic convincing act... not sure (probably why I'm not a CSO at the moment!) . With Microsoft it happened 'cause they had a very large number of high profile security problems which led their CEO to ensure that the improvements occurred. I'm not sure I've heard many other stories of companies that have really changed their attitude to security in the same way without that kind of problem, but I'd hate to think that incidents are the only way to get a good security stance!

Rational Security: For Data to Survive, It Must ADAPT...
EDIT: I've had a couple of comments on this posting that I was bad mouthing Hoff with this post. Not my intention and I apologise if it came across like that. I actually agree with most of what he says, just not the bit about data centric security/information classification
All this data-centric security stuff sounds really good in principle, but to be honest I'm not buying it, for a couple of reasons.
One: there's no widely agreed on DRM open standard that companies are applying now. For data-centric security to work all systems which process the data have to be able to understand the security meta-data that's applied to it and be able (if permitted) to process it. To be honest I just don't see that happening even in the medium-long term. And without that the idea won't fly. Imagine telling a senior exec that he can't get his board report on his handheld device 'cause it doesn't support [standard X] yet so can't read the DRM-encrypted file.
Two: More importantly the idea of assigning security levels to individual data items or collections of data items seems really un-manageable to me. Take Office/E-mail security at the moment. Ultimately for most corporations the majority of their data will at some time reside in a (MS) Office and/or email format at some time. Now at the moment most companies manage access to that in an incredibly coarse-grained fashion with whole data shared getting assigned to large groups of users and even that is seen as not being flexible enough by a lot of end users...
Three: Data-centric security has been trialled recently in a large multi-company multi-system environment that everyone's heard of and it's been a complete disaster, which is DRM on music files. Users absolutely hate it and have spent large amount of effort bypassing it, it's created a monopoly because of the lack of industry standards and even the record companies seem to be backing off from it...

Looks like the slides are up for most of the OWASP conference presentations over here
A couple that I thought were particularly interesting were
Alex Lucas on the Microsoft SDL which gave some good insight on all the work that Microsoft are putting into improving the security of Vista. I've never been a huge Microsoft fan but they're definately moving in the right direction on the security issue.
Also Brian Chess on static source code review. This one gives some good insight into what static source code analysis can and can't do for a security review. It looks to me like Fortify and Ounce will be moving into the same kind of space that SPI, Cenzic and Watchfire are in for web application testers. No-one thinks you can just run those tools and call it a day, but they're pretty valuable in improving the coverage of the test and catching certain classes of vulnerability, leaving the tester to focus on things like business logic flaws that automated tools can't find.

Windows Server 2008 Features Address Linux Rivalry
Interesting article which talks about the modular nature of Windows server 2008. From the content of this article I think it's fair to say that Microsoft will have addressed the last big architectural problems with their software security that I can think of, once server 2008 is available.
Previous versions of Windows server have had items like Internet Explorer and Windows Media player installed by default with no easy way to remove them, which led to additional patching and security requirements for the operating system and an increased attack surface, even with the lock down on some of the functionality they provided that happened in server 2003.
Now from this article it appears that Windows server 2008 will reduce the attack surface of the OS by allowing it to be much more modular. And for the first time you can have a windows server without a GUI!!
In the past I've always doubted that Microsoft would do this as from a marketing perspective bundling has always been a strong point for them.
When you combine this with the very strong story that Microsoft has on secure development techniques I'd say that the latest generation of their products are likely to be the best in their fields for security...

Top 15 free SQL Injection Scanners - Security-Hacks.com
Interesting looking list of SQL injection scanners although Justin notes here that at least one of them, sqlbrute, isn't really a scanner.
Anyway I'm planning to run some tests on them to see how they handle some basic SQL injection flaws, so it'll be interesting to see how they go.

Well the OWASP conference in Milan was really great. There was a large number of good presentations and lots of interesting chat. Also got to meet quite a few people I only know from their blogs.
First day was the SOA and Web services Security training from Gunnar Peterson. Whilst there was a lot of information to absorb in one day, it was very good and left me with some key things to take away like the importance of using XML Security gateways in enterprise web services, some risks which apply to webservices that are different to those faced by usual web apps. like XDOS and that MQ only provides authorization not authentication !
On the first evening we got free food and drink courtesy of the nice people at Breach Security and I had some interesting chats with Alex Lucas on cool home computing setups amongst others.
The second day was the first of the conference proper ( agenda) . Hopefully all the slide decks will be up and linked from that page fairly soon... There was lots of interesting stuff, probably the most interesting (or perhaps scary) of the day for me was PDP Architects presentation on advanced web hacking (slides from this one are here) . It was a really interesting look at what some of the new services that are available on the 'net like Yahoo Pipes and tinyURL can be used for by malicious parties. Unfortunately the dark angel of demos was around and Yahoo Pipes was down during the presentation but I imagine it'll be up again soon....
Dinner on the second day was the conference one at Ristorante Why Not and again loads of interesting chat was had. I was sat next to Simon Roses Femerling, lead on the Pantera Project and had some interesting chats about what's next for that project. It actually cleared up for me what the goals of the project are. Pantera (at the moment) seems primarily geared at gathering information on the site under analysis rather than automatically handling XSS testing or the like.
Unfortunately I was pretty tired by the end of the meal (they have quite leisurely dining in Italy) and missed the first appearance by the OWASP band! However there's pictures here
Day Three had some more great talks and more stuff that I really should look at when I get the task. There was information on the newly revamped OWASP testing guide which sounds like a really good basis for web testing methodologies now.
There was also a madcap spin through the expanded OWASP project list from Dinis Cruz where we got a flavour for the variety of projects now undertaken by OWASP. One thing that sprang to mind while I was listening to this was that perhaps OWASP need to enforce some kind of naming convention on their projects as at the moment some of the names aren't really very descriptive of what the project does which can lead to some confusion
Day Three ended up with the panel discussing "What is needed to fix web app sec vulnerabilities once and for all?" . The main suggestions surrounded re-vamping the underlying protocols and technologies (eg, HTTP 2.0) to embed security and also encouraging development framework usage so that individual developers find it easier to write secure applications. Ultimately though it seems that the conclusion was that the current crop of web application vulnerabilities will be with us for some time and there are no easy fixes...
All in all a great conference, I'll definitely hope to get back next year. The talks were all pretty good and also there were loads of interesting people to meet and put faces to blogs...

Well that's the blog back online after more than a week, just before I was off to the OWASP Conference (Of which more later), the power supply in my server blew! after some frustration with moving disks and volume groups in Linux I decided to wait until I got back and re-build on a Virtual machine...

I've been having some fun sorting out some cool new tech. for my house. I've been looking for something to replace the large tower box I've got running my file/print & website for a while. Mainly so I can separate them and not be hosting any extneral services on the same machine as I'm hosting internal services.
So I've been looking for small, quiet, cheap Linux boxes to use for a webserver and I came across the Buffalo Linkstation Pro. It only costs 99 pounds in the UK and is designed as a NAS device, however in common with most of these kinds of devices, it's really a small ARM-based computer running Linux. So following a quick trip to the excellent Linkstation wiki some downloading and following of instructions to re-flash the device, I've now got a debian Linux server with 128MB RAM and a 250GB hard drive all for under a hundred quid!!
The other thing I set-up for the first time the other night was tor, mainly to see how easy or difficult it would be. the answer is (on Fedora Core 6 at least) pretty easy, two package installs and a couple of edits to config files and I'm surfing anonymously. It's a bit slow but apart from that seems to do what it says on the tin. Very handy to test source IP address restrictions if you're using them.

TJX finds self at bottom of 300-bank pig pile | The Register
I'm not usually a great fan of the sue someone every time something goes wrong mentality that some people and companies seem to have but this one could actually be good for security...
300 Banks suing TJX for the breach... If they win then I'd expect retailers to start taking security a fair bit more seriously as then there'll be some really serious consequences to losing control of your customers data...