Professional Documents
Culture Documents
If you’re interested in writing for us do get in touch, we’re always eager to publish fresh material from
talented security professionals and enthusiasts.
Mirko Zorz
Chief Editor
Distribution
(IN)SECURE Magazine can be freely distributed in the form of the original, non modified PDF document.
Distribution of modified versions of (IN)SECURE Magazine content is prohibited without the explicit
permission from the editor. For reprinting information please send an email to reprint@insecuremag.com
or send a fax to 1-866-420-2598.
www.insecuremag.com
4
GFI LANguard Network Security Scanner 8 launched
www.insecuremag.com
5
New version of AppScan web application security testing tool
EDGE Tech Corp announced the release of its DiskGO Secure Flash
Drive Enhanced for ReadyBoost. This flash drive is the first in its market
to offer secure, password-protected encryption software that is compati-
ble with Windows Vista. Couple this compatibility with the speed and re-
liability of EDGE flash drives, and you have an all-in-one, drive guaran-
teed to see you through your Windows Vista upgrade transition and be-
yond. The drive features Vista-compatible Cryptarchiver software, which
enables the user to choose between 448-bit Blowfish encryption and the
government standard AES 256-bit encryption. (www.edgetechcorp.com)
www.insecuremag.com
6
The global introduction of electronic passports is a large coordinated attempt
to increase passport security. Issuing countries can use the technology to
combat passport forgery and look-alike fraud. While addressing these secu-
rity problems other security aspects, e.g. privacy, should not be overlooked.
This article discusses the theoretical and practical issues, which impact
security for both citizens and issuing countries.
Existing legacy passports are paper based strong identification methods. Rather then us-
and use related security features. Despite of ing common practices from the security indus-
advanced optical security features paper try the MRTD standards aimed at a revolu-
based travel documents are sensitive to fraud. tionary combination of advanced technology,
Two forms of fraud are most notable: including contactless smartcards (RFID), pub-
• Passport forgery: a relatively complex ap- lic key cryptography, and biometrics.
proach where the fraudster uses a false
passport, or makes modifications to a pass- The MRTD specs support storage of a certifi-
port. cate proving authenticity of the document
• Look-alike fraud: a simple approach where data. The signed data includes all regular
the fraudster uses a (stolen) passport of passport data, including a bitmap of the
somebody with visual resemblance. holder’s picture. Further data that may be
stored in the e-passport include both static
The ICAO (International Civil Aviation Organi- and dynamic information:
zation) has been working on what they call
MRTD (Machine Readable Travel Document) • Custody Information
technology for quite a while. This technology • Travel Record Detail(s)
should help to reduce fraud and support im- • Endorsements/Observations
migration processes. The MRTD specifica- • Tax/Exit Requirements
tions became a globally coordinated attempt • Contact Details of Person(s) to Notify
to standardize advanced technology to deliver • Visa
www.insecuremag.com 7
Since 2005 several countries have started is- From 2007 onward immigration services will
suance of e-passports. The first generation of start using e-passports. Authorities promote e-
e-passports includes some, but not all, of the passports by issuing visa-waiver programs for
planned security features. Biometric verifica- travelers with e-passports. A passport that
tion is generally not supported by the first conforms to the MRTD standard can be rec-
generation. All 189 ICAO member states are ognized by the e-passport logo on the cover.
committed to issue e-passports by 2010.
Electronic Passport security mechanisms key cryptographic capabilities in the chip. The
public key, signed by the issuing country and
With the aim to reduce passport fraud the verified by passive authentication, can be
MRTD specs primarily addressed methods to given to the inspection system, which allows
prove the authenticity of passport and its data, verification of a dynamic challenge signed
and the passport holder. The technology used with the private key. While the private key is
for this includes PKI (Public Key Infrastruc- well protected by the chip it effectively pre-
ture), dynamic data signing and biometrics. vents cloning since the inspection system can
The latter (biometrics) however is still under establish the authenticity of the passport chip
discussion and not yet fully crystallized in the with the active authentication mechanism.
specifications.
RFID
Passive Authentication
For the incorporation of modern electronic
PKI (Public Key Infrastructure) technology technology in the existing paper documents it
was chosen to prove the authenticity of the was decided to use (contactless) RFID chips.
passport data. This technology is successfully These chips can be embedded in a page of
applied on the internet for e-commerce, and the document and put no additional require-
has gained high popularity. Certificate based ments on the physical appearance of the
authentication requires only reading the cer- passport. A question that arises here is
tificate by the inspection system, which can whether this is the only reason to apply RFIDs
then use a cryptographic computation to vali- instead of contact based cards. Other reasons
date the authenticity using the public key of could be related to the form factor of contact
the issuing country. This method is called smart cards which complicates embedding in
passive authentication and satisfies with RFID a passport booklet, or the fact that contacts
chips without public key cryptographic facili- may be disturbance sensitive due to travel
ties, since it involves only static data reading. conditions. With the choice for RFID the pri-
Although the authenticity of the data can be vacy issue arises. RFIDs can be accessed
verified, passive authentication does not from distances up to 30 cm, and the radio
guarantee the authenticity of the passport it- waves between a terminal and an RFID can
self: it could be a clone (electronically identi- be eavesdropped from a few meters distance.
cal copy). An adversary with dedicated radio equipment
can retrieve personal data without the pass-
Active Authentication port owner’s consent. This risk is particularly
notable in a hostile world where terrorists
The cloning problem is addressed with an op- want to select victims based upon their na-
tional signing mechanism called active tionality, or criminals commit identity theft for a
authentication. This method requires the variety of reasons.
presence of a asymmetric key-pair and public
www.insecuremag.com 8
Figure 2: Radio communication between inspection system and passport.
Basic Access Control strip (see figure Figure 3) of one of the pass-
port pages.
To protect passport holder privacy the optional
Basic Access Control (BAC) mechanism was In a normal access procedure the MRZ data
designed. This mechanism requires an in- is read first with an OCR scanner. The inspec-
spection system to use symmetric encryption tion system derives the access key from the
on the radio interface. The key for this encryp- MRZ data and can then set up an encrypted
tion is static and derived from three primary radio communication channel with the chip to
properties of the passport data: 1) date of read out all confidential data. Although this
birth of holder; 2) expiry date of the passport; procedure can be automated it sets high re-
3) the passport number. This data is printed in quirements to inspection systems and also
the Machine Readable Zone (MRZ) a bottom impacts inspection performance.
The BAC mechanism does provide some ad- holder may perceive this as a disadvantage
ditional privacy protection, but there are two considering the possibility that a passport
limitations that limit the strength of this contains dynamic data.
mechanism: • The BAC key is derived from data that may
• The BAC key is individual but static, and is lack sufficient entropy: the date of expiry is
computed and used for each access. An ad- always in a window of less than ten years, the
versary needs to get hold of this key only date of birth can often be estimated and the
once and will from then on always be able to document number may be related to the ex-
get access to a passport’s data. A passport piry date.
www.insecuremag.com 9
The author of this article discovered BAC se- • Number of certificates (additional PKI certifi-
curity issues in July 2005 and showed that the cates in the validation chain)
key entropy that could reach 66 bits may drop • Inclusion of dynamic data (for example visa).
below 35 bits due to internal data dependen-
cies. When passport numbers are for instance Future generations of the technology will also
allocated sequentially they have a strong cor- allow the following options:
relation with the expiry date, effectively reduc-
ing the key entropy. An eavesdropper would • Use of biometrics
then be able to compute the BAC key in a few • Choice of biometrics (e.g. finger prints, facial
hours and decode all confidential data ex- scan, iris patterns, etc)
changed with an inspection system. The • Biometric verification methods
Netherlands, and maybe other countries, • Extended Access Control (enhanced privacy
have changed their issuance procedures protection mechanism).
since this report to strengthen the BAC key.
In terms of cryptography a variety of algo-
An associated privacy problem comes with rithms and various key lengths are (or will be)
the UID (Unique Identification) number emit- involved:
ted by an RFID immediately after startup. This
number, if static, allows an easy way of track- • Triple DES
ing a passport holder. In the context of e- • RSA (PSS or PKCS1)
passports it is important that this number is • DSA
dynamically randomized and that it cannot be • ECDSA
used to identify or track the e-passport holder. • SHA-1, 224, 256, 384, 512.
The reader should note that these privacy is- The problem with all these options is that a
sues originate from the decision to use RFID passport can select a set of preferred options,
instead of contact card technology. Had this but an inspection system should support all of
decision been otherwise the privacy debate them!
would have been different as it would be the
passport holder who implicitly decides who An associated problem in the introduction of
can read his passport by inserting it into a the passport technology is that testing inspec-
terminal. tion systems becomes very cumbersome. To
be sure that false passports are rejected the
Inspection system security issues full range of options should be verified for in-
valid (combinations of) values.
The use of electronic passports requires in-
spection systems to verify the passport and Finally, a secure implementation of the vari-
the passport holder. These inspection sys- ous cryptographic schemes is not trivial. Only
tems are primarily intended for immigration recently a vulnerability was discovered by
authorities at border control. Obviously the Daniel Bleichenbacher that appeared to im-
inspection systems need to support the secu- pact several major PKCS-1 implementations.
rity mechanisms implemented in an e- PKCS-1 also happens to be one of the al-
passport. This appears to be a major chal- lowed signing schemes for passive authenti-
lenge due to the diversity of options that may cation in e-passports. This means that inspec-
be supported by individual passports. tion systems should accept passports using
this scheme. Passport forgery becomes a risk
In terms of security protocols and information for inspection systems that have this vulner-
retrieval the following basic options are al- ability.
lowed:
Immigration authorities can defend them-
• Use of Basic Access Control (including OCR selves against this attack, and other hidden
scanning of MRZ data) weaknesses, by proper evaluation of the in-
• Use of Active Authentication spection terminals to make sure that these
• Amount of personal data included weaknesses cannot be exploited.
www.insecuremag.com 10
Biometrics and Extended Access spection systems that know the MRZ data.
EAC goes further than that: it allows an e-
Control
passport to authenticate an inspection sys-
tem. Only authenticated inspection systems
Biometrics
get access to the sensitive (e.g. biometric)
data. Inspection system authentication is
The cornerstone of e-passport security is the
based upon certificate validation, (indirectly)
scheduled use of biometric passport holder
issued by the e-passport issuing country. An
verification. The chip will contain the signed
e-passport issuing country therefore decides
biometric data that could be verified by the
which countries, or actually: which Inspection
inspection system. It is only this feature that
System issuers, are granted access to the
would prohibit the look-alike fraud. All other
sensitive data. EAC requires a rather heavy
measures do address passport forgery, but
PKI. This is for two reasons:
the primary concern of look-alike fraud re-
quires a better verification that the person car-
• Each Inspection System must be equipped
rying the passport is indeed the person
with certificates for each country whose bio-
authenticated by the passport. Many countries
metric details may be verified.
have started issuance of e-passports, but the
• Certificates should have a short lifetime;
use of biometrics is delayed. There are two
otherwise a stolen Inspection System can be
main reasons:
used to illegally read sensitive data.
• Biometric verification only works if the soft-
The current EAC specification foresees a cer-
ware performs a better job than the conven-
tificate lifetime of several days. The two condi-
tional verification by immigration officers. The
tions above will result in an intensive traffic of
debate on the effectiveness of biometric veri-
certificate updates.
fication, and the suitability of various biometric
features, is still ongoing. Also there are some
A problem acknowledged by the EAC specifi-
secondary problems, like failure to enroll, that
cation is the fact that e-passports have no
need to be resolved.
concept of time. Since the RFID chips are not
• Biometric data are considered sensitive. The
powered in between sessions, they do not
threat of identity theft exists, and revocation of
have a reliable source of time. To solve this
biometric data is obviously not an option.
problem, an e-passport could remember the
Countries do not necessarily want to share
effective (starting) date of validated certifi-
the biometric data of their citizens with all
cates, and consider this as the current date.
other countries.
This could potentially lead to denial-of-service
problems: if an e-passport accepts an inspec-
The impact of first issue is decreasing in the
tion system’s certificate whose effective date
sense that the quality of biometric systems
has not yet arrived, it may reject a subsequent
gets better over time, although it may slow
inspection system certificate that is still valid.
down the introduction of biometrics in e-
To avoid this problem the specification pro-
passports. At least at this moment, there is
poses to use only certificates of trusted do-
still limited experience of representative pilot
mestic terminals for date synchronization.
projects.
Although date synchronization based on do-
The second issue is more fundamental, issu-
mestic certificate effective dates would give
ing countries will always consider who to
the e-passport a rough indication of the cur-
share sensitive data with. To alleviate these
rent date this mechanism leaves a risk for
concerns the ICAO standardization body has
some users. Infrequent users of e-passports
introduced the concept of Extended Access
and users being abroad for a long time will
Control.
experience that their e-passport date is lag-
ging behind significantly. For example, if an e-
Extended Access Control (EAC)
passport has validated a domestic EAC capa-
ble terminal 6 months ago, it will reveal sensi-
The earlier described Basic Access Control
tive data to any rogue terminal stolen over this
(BAC) mechanism restricts data access to in-
period.
www.insecuremag.com 11
The above problem could be alleviated by us- tise is needed for a secure implementation
ing a different date synchronization method. and configuration of both the e-passports and
Instead of using effective dates of inspection the inspection systems.
system certificates we would use a separate
source of time. For this ICAO, or another The technology got increasingly complex with
global Certification Authority, should issue the decision to use contactless RFID technol-
date certificates on a daily basis, and inspec- ogy. Additional security measures were intro-
tion systems should load and update their duced as a result of privacy concerns. But
date certificates frequently. these measures appear to offer limited privacy
protection at the cost of procedural and tech-
A passport could then use the date certificates nological complexity.
signed by a trusted party to get a reliable, and
more accurate, source of time. This approach The next generation e-passports will include
could be better since we can also synchronize biometrics and Extended Access Control
on foreign systems and we could use the cur- (EAC). The standardization of these features
rent date in stead of the inspection system is unfinished and could still be improved. Fu-
certificate effective date. ture e-passports, using all security features,
will offer strong fraud protection:
With respect to EAC and biometrics several
practical and standardization issues are yet to • Passport forgery is more difficult with an e-
be resolved. Although EAC, in its current passport that supports active authentication.
specification, offers strong benefits over the • Look-alike fraud is more difficult with an e-
simpler BAC it is certainly not a panacea, and passport that supports biometrics.
there is room for improvement. Nevertheless,
migration to biometrics in e-passports is This level of security can only be reached if all
needed to effectively combat look-alike fraud. passports implement these features; other-
wise fraudsters can fall back to less advanced
Conclusion or legacy passports.
The global introduction of electronic passports Therefore it is important for ICAO to finalize
delivered a first generation of e-passports that the EAC standardization, and for issuing
support digital signatures for document countries to continue the migration process
authentication. The system builds on the and enhance their passports with biometrics.
newest technology, and a high level of exper-
Marc Witteman has a long track record in the smart card security industry. He has been involved with security
and smart card projects for over a decade and worked on applications in mobile communications, payment
industry, identification, and pay television. In 2001 he founded Riscure (www.riscure.com), a security lab based
in the Netherlands. Riscure offers consulting and testing services to manufacturers and issuers of advanced
security technology. Today he is the Chief Technology Officer of Riscure.
www.insecuremag.com 12
In late March, security and messaging company GFI released version 8 of
their flagship product GFI LANguard Network Security Scanner. In this article
you can read about scanning and patching - product's main functionalities,
usage details and the overall experience I had with it.
The new features in the version 8 include over As the software is not just a typical security
2,000 new vulnerability checks, a performance scanner as someone could think from its title,
enhanced scanning engine and a highly intui- there are some interaction needed for com-
tive graphical threat level indicator. Besides pleting the initial setup procedure. Although it
this, the latest version has received a variety is possible to install LANguard N.S.S with just
of patch management improvements including hitting "Next" buttons, the product offers some
added support to rollback Microsoft patches good options that should be used.
as well as technology to automatically down-
load new Microsoft security patches when The Attendant Service is the first option to set
made available. It also supports scanning for and it offers a way of doing automated sched-
vulnerabilities on Windows Vista-based sys- uled scans. While you can enter any user
tems. name on the system, because of obvious rea-
sons you should run the software under do-
Installation main administrator account. LANguard N.S.S
stores scanning information into a database,
As you will see from the screenshots, I run the so you can chose between the default option
software on multiple computers in my network, of using Microsoft Access (never mind if you
both Microsoft Windows XP and Windows have it installed or not) or Microsoft SQL
Vista. The installation procedure took around Server version 2000 or higher. For more com-
4-5 minutes and passed by without any prob- plex networks the latter is recommended.
lems.
www.insecuremag.com 13
Windows XP computer scan results with emphasis on open ports.
One more thing you should think about are the lineup is aimed to users that don't have Eng-
e-mail settings alerts after successful scans. lish version of the Microsoft Windows. As
Besides the typical e-mail fields, the software LANguard N.S.S has patching functions, us-
supports both standard SMTP servers, as well ers need to select the operating system lan-
as those that have authorization turned on. guages used on the computers in the network.
The final step of the pre-usage configuration
www.insecuremag.com 14
Scanning Patching Status - When exploring the status of
Microsoft Windows patches in your network,
Every scan starts with a typical wizard. Be- you can chose between four profiles that will
cause of a quite large scope of scanning op- search for missing or critical patches, service
tions, wizard is divided into four different scan packs and the modest scan of the last month's
jobs: patches.
Vulnerability Scanning - This was the option I Network & Software Auditing - Through this
used the most. While its function is pretty option you will be able to scan all the network
much self explanatory, there is an extra step and software inventory. Scan profiles con-
in configuring this type of a scan which fo- nected with it provide a line of useful checks
cuses on the specific scenarios you want to for open ports, up time, connected USB de-
check out. Users that don't have a need to do vices and even a glimpse at disk space us-
a full vulnerability scan can chose from a cou- age.
ple of different scan profiles including Sans
Top 20, SNMP, high security vulnerabilities Complete/Combination Scans - Deep and
and even trojan ports. thorough scans that incorporate all the previ-
ously mentioned scan jobs.
While I found all the scan jobs perfectly fitted was disclosed and majority of the machines
for all the possible scenarios, it was really nice residing on my network were affected by it.
to see that the Configuration tab offers further
customization opportunities. At the same time I opened some specific attack signatures that
I was testing the software a new vulnerability were aimed to discovering a similar vulnerabil-
ity and mangled with them a bit.
www.insecuremag.com 15
Description of security issues found on a computer in the network.
As you all know, patch management is a tedi- The GFI LANguard N.S.S. ReportPack add-on
ous process, so automated scanning/patching is a full-fledged reporting companion to the
solutions like LANguard N.S.S. could prove to software. This reporting package can be
be a life saver. scheduled to automatically generate graphical
IT-level and management reports based on
After the scan is done, the results are pre- the data collected during your security scans.
sented in the main console. It is easy to find
out what computers are not up to date with the Although I have seen sample reports gener-
latest patches and with a click of a button ad- ated by the ReportPack (executive, statistical
ministrator can push the new patches over the and technical) I wasn't able to thoroughly test
network. As a bonus to applying Microsoft up- this because the add-on needs a newer ver-
dates, there is an interface that gives the op- sion of Microsoft .NET Framework which I
portunity of deploying custom software on re- don't have on my computers (company
mote computers. policy).
www.insecuremag.com 16
Patch deployment on a sample out of the box testing computer.
Nevertheless, reports are nicely done and the product that would surely be a great addition
management people will surely like how the to any network and system administrators that
information is presented. work with Microsoft Windows computers.
Mark Woodstone is a security consultant that works for a large Internet Presence Provider (IPP) that serves
about 4000 clients from 30 countries worldwide.
www.insecuremag.com 17
Hacking Web Services
By Shreeraj Shah
Charles River Media, ISBN: 1584504803
Endpoint Security
By Mark Kadrich
Addison Wesley Professional, ISBN: 0321436954
www.insecuremag.com 18
The Official Ubuntu Book
By Benjamin Mako Hill, Jono Bacon, Corey Burger, Jonathan Jesse, Ivan Krstic
Prentice Hall, ISBN: 0132435942
In recent years, the Ubuntu operating system has taken the Open Source and
IT world by storm. Written by leading Ubuntu community members, the book
should teach you how to seamlessly install and customize Ubuntu for your
home or small businesses. It covers every standard desktop application all the
way to software development, databases, and other server applications. “The
Official Ubuntu Book” comes with a version of Ubuntu that can run right off the
DVD, as well as the complete set of supported packages for Ubuntu, including
Kubuntu.
www.insecuremag.com 19
Virtualization is one of the hottest technologies in the data center today, and
with good reason. The benefits are clear. Virtualization can help reduce the
physical space of the data center, lower hardware, software support and fa-
cilities costs, increase speed to deploy new servers and applications and en-
hance disaster recovery and business continuity.
As is the case when introducing any new 1) Ensure your software vendors provide full
technology it is important to have a strong support for applications running within a virtu-
understanding of how virtualization will impact alized environment - It’s best to figure this out
your environment and all of the applications before you move an application to a virtual-
you are running. It is important to understand ized environment, instead of when you need
how virtualization may change your level or help troubleshooting an issue, especially if the
risk. application in question is mission-critical. Talk
with your vendors about support options, be-
For example, if the virtual server running a fore making the switch.
web site were compromised, could the at-
tacker continue to compromise other virtual 2) Update your written security policies and
servers on the same host undetected by net- procedures to account for virtualization - You
work intrusion detection? There are certainly will now have multiple virtual systems running
ways to leverage virtualization without in- on the same physical server using the same
creasing risk, but it’s important to recognize physical data storage, memory and peripheral
these potential challenges and safeguard hardware such as network interface control-
against them. lers.
Below are a few security concerns and best You need to update your security require-
practices to keep in mind as you virtualize ments and policies to allow these resources to
your IT environment. be shared in such a manner.
www.insecuremag.com 20
3) Always secure the host virtual machine - 6) Make network intrusion detection and pre-
It's very important that the virtual server host vention changes - If multiple virtual machines
operating system be locked down following are using the same network interface cards,
the appropriate guidance for that operating keep in mind the extra bandwidth that will be
system. For VMWare Infrastructure, for ex- traversing that card. Before you may have
ample, the guest Operating System is based had separate servers, each with Gig inter-
on Linux, so it should be locked down in ac- faces, peaking at 80 MB/sec of traffic. Now
cordance with best practices and your corpo- you will have a Gig interface peaking at 480
rate standards and requirements. MB/sec if you run 6 virtual machines. Your
network intrusion protection system may need
4) Institute appropriate access control - Since to be re-architected slightly to keep up with
virtualization provides the opportunity to com- the new demands of this single port.
pletely control a machine remotely, appropri-
ate access control measures must be imple- 7) Understand the impact to incident response
mented to limit the risk of inadvertently shut- and forensics plans - When introducing virtual
ting down, rebooting or deleting a machine. systems into an environment, things like inci-
Filesystem permissions for virtual machine dent response need to be handled a little dif-
images also need to be stringent and consis- ferently. Your incident response plan must
tently monitored and audited. Virtual server now account for other systems running on the
configuration settings such as network con- same virtual host. Immediately separate the
figuration settings should also be restricted. suspect virtual machine from the others to en-
sure proper containment. Your system image
5) Build Virtual DMZ’s - For systems deemed acquisition process will also need to take into
to be safe for virtualization, the virtual servers account the differences between nonvirtual
that run together on the same hardware plat- and virtual systems.
form should share similar security require-
ments. Think of these systems as being to- 8) Host intrusion detection and prevention -
gether on a virtual DMZ network. The virtual Host intrusion protection should continue to
machines will likely exist on the same subnet be in place as it would with a stand-alone
and may communicate with each other to server. Be sure to test your intrusion detection
handle transactions. It is preferable to config- and prevention software within the virtual en-
ure hosts in this manner so that they do not vironment. Check with your vendor to be sure
need to traverse an external firewall (separate it is officially supported when running in a vir-
physical system) to communicate with each tual environment.
other.
Critical network and security infrastructure systems should remain on dedicated servers.
Does it always make sense to virtualize? exceptions to this, especially with regards to
disaster recovery initiatives.
Critical network and security infrastructure
systems should remain on dedicated servers. Although some firewall vendors are beginning
to provide virtualization-ready solutions, it is
It is important to keep critical authentication best to hold off on virtualizing your firewall
and directory services on dedicated systems. servers for now. While the idea of hosting
In most cases Active Directory domain con- multiple firewalls as virtual servers on a single
trollers, RSA authentication manager servers, host is appealing, you are likely running multi-
and RADIUS servers should not be run in a ple firewalls that serve very different needs—
virtualized environment. However, there are with different security policies and rules. Keep
these systems on their own servers for now.
www.insecuremag.com 21
Howard Schmidt has had a long distinguished career in defense, law en-
forcement and corporate security spanning almost 40 years. He has served
as Vice President and Chief Information Security Officer and Chief Security
Strategist for eBay.
At the moment you work as a consultant 1) Criminals in their nations who are commit-
for governments of several countries. ting crimes online that give the country an un-
What do you see them most worried about fair reputation of being a haven for cyber
in general? criminals.
www.insecuremag.com 23
In the past you served as the CSO for gi- 3) Lack of end point security and lack of
ants such as Microsoft and eBay and you automated access controls that do not protect
also worked for President Bush. What against "zero day" exploits.
have been your biggest challenges while 4) Lack of widespread use of encryption
in such important positions? which still leaves data vulnerable.
5) Attacks on mobile and wireless devices.
The biggest challenges have been: 6) "Out of band" attacks to steal personal in-
formation.
1) Convincing owners and operators of ICT/
Critical Infrastructure that they are a part of a Where do you see the current security
biggest "eco-systems" and while they may be threats 5 years from now? What kind of
willing to accept certain risks around security, evolution do you expect?
their risks may affect others as the interde-
pendencies are not always very pronounced. While is always difficult to predict the future, I
2) Getting people to realize that data is the see many of today's threats being mitigated
"new currency" of the online world and pro- by building many of the technologies and
tecting the data should be one of the highest processes into day to day IT functions both at
priorities of any enterprise. the enterprise and the consumer level. The
3) Having people understand that cyber secu- evolution of threats will still be directed at the
rity is NOT someone else's problem that we end user based on the premise that the weak
all have a role in securing cyber space. link in security is the human interaction.
Based on your experiences, is there more What is, in your opinion, the biggest chal-
security in the private or government sec- lenge in protecting sensitive information at
tor? the government level?
This varies from government to government Much of the data that has been accumulated
as much as it does from private sector com- over decades has been dispersed to so many
panies to each other. What I see today is both different systems that locating and securing
sectors are looking for ways to improve secu- the data is the biggest challenge.
rity in a cost effective way that does not re-
duce privacy and have negative affect on their What do you expect from the future? Is it
"businesses". As far as investment goes, likely for a high-profile "cyber-terrorism"
there seems to be a greater investment by event to take place in the next 12 months
private sector as a percentage of IT spend. or do you see it as media hype?
Are compliance laws taking the enterprise While the potential for a significant cyber se-
to a positive security level? curity event to occur, I do not use the term
"cyber-terrorism" to talk about high profile se-
As much as many of us to not care for addi- curity events.
tional regulation, we are seeing a positive im-
pact on security as compliance is linked di- We have made cyber security a global priority
rectly to good governance and risk manage- which reduces the chance that an event that
ment which now have moved the discussion has a negative impact on ICT less likely. That
into the boardroom and the "C" suite. is not to say we will not continue to deal with
worms, Trojans and other malware that might
What do you see as the biggest security be "high profile" but of limited impact overall.
threats today in general?
I do not see discussions about this as "media-
1) Insufficient application security through de- hype" as the media is not the only group that
velopment shortfalls talks about the potential. It is a valid debate to
2) Not sufficiently protecting data and data have as long as people don't loose track of
leakage through lack of content protections the hard work that has been done the past 5
years to make this less likely.
www.insecuremag.com 24
Since 2004 Matta has been running a project to test the technical competence
of security consultants. With probably the largest collection of data on the
methodology's and technical approach taken by some of the worlds best
known security companies, some interesting conclusions can be drawn. The
tests started as a result of a client asking for our assistance in running an
RFP. The programme grew from there as other companies became interested
in doing the same thing. In 2006, Matta provided Royal Holloway University
with a version of Sentinel to make the country's first Penetration Testing
vulnerable network for its students.
As there is a lot of data, the conclusions you peers. It just so happened that it was Matta
reach will really depend on what you are look- that was asked to do it. Typically, the clients
ing for in the first place. I've documented in who have run Sentinel programs, are either
this article some of the things which I feel may looking for a global Penetration Testing sup-
be of general interest. plier - which Matta is not - or they are running
internal accreditation schemes. Our reports
I would like to preface this article by saying have always been considered objective, and if
that it is human nature to find the bad news we have something subjective to say, it goes
more interesting than the good news. In our on a separate page in the report, which is
tests, we saw many impressive consultants. marked as a subjective observation.
We tested companies which acted profes-
sionally and competently throughout, and Looking at some findings then, the first, and
there are consultancies who we admire and perhaps the most startling fact of all is that
respect as a result of working either directly or every consultant who has gone through the
indirectly with them. Many other companies test has always found vulnerabilities with their
could have set up the Sentinel program, and tools, which then failed to make it on to their
we don't place ourselves higher than our final report.
www.insecuremag.com 25
We sniff and log all the network traffic during though, we also feel that the consultants
the test, and are often required to demon- would probably have missed the vulnerabili-
strate to the vendor that they did indeed find ties regardless of the time limit. We believe
the issue, which was then absent on their that the output from some common tools is not
report. so easy to read for those with less experience.
Clearly, there is a real problem with time lim- Second, and for me the most baffling observa-
ited tests, and the work required to go through tion, is that some consultants - a small minor-
reams of unqualified data to sort out the real ity - but enough to be significant, don't seem
issues from the false positives. Things just get to read their briefing notes. This is really con-
missed. Importantly it seems, at least in our cerning. Each test we run has an engagement
tests, something gets left out on every occa- protocol. The vendor is given a set of briefing
sion. Our tests are intense, and time limited, notes, with key information, including perhaps
so perhaps a fair conclusion to reach is that if some login credentials to a web application, or
the consultant is similarly under pressure, ei- a request to treat a database exactly as if it
ther internally, or from the client, then expect were a production system.
to get incomplete results. In some cases
So whilst most consultants had no trouble Most consultants of course, actually do read
executing the tests with these instructions, the briefing notes, and follow the instructions
one consultant repeatedly crashed the data- as you would expect, but if you're engaging
base to get debug information. Not something with a new vendor, it certainly pays to make
you would want do on a production database! no assumptions.
On a similar note, we did hear a real life story
from a client, in which a penetration tester had Third, every vendor has a methodology
tried to drop a database to prove he had ef- statement, and clearly some follow it, but ac-
fected a compromise. Fortunately, due to miti- tually we find many do not. This is one area, I
gating factors, he was unable to drop it, but believe we as an industry can do much better.
the client was less than happy, and I don't be- The old UK government CHECK approach is
lieve they required his services again. a good one, and anyone can follow it regard-
less of whether you have CHECK accredita-
Another consultant on our test, ran the pass- tion or not. I believe that many vendors are
word cracking tool, John the Ripper, on a sys- not active enough in ensuring their adopted
tem he was required to treat as production. He methodology is followed. Typically, some of
used 100% of the CPU for 24 hours on our the issues we have seen include:
'production' server trying to crack the pass-
word. The sad thing was that the password • missing issues, because the consultant has
was blank, and he never cracked it. His report not stepped through it in a logical and pro-
stated that our password policy was very ro- gressive manner
bust. • going in too 'deep' because the consultant
gets excited about some vulnerability they've
A further example with passwords was some- found, but then forgets, or runs out of time to
one who spent hours trying to crack a pass- do some of the basics
word on an application, when the objective • running exploits, changing passwords, etc,
was privilege escalation, and the username and failing to clean up afterwards. In the real
and password were given to him in the brief- world we have been on incident response
ing document. If only he had read it! calls where the 'hacked host' was just the re-
sult of a previous security consultant failing to
clean up after an assessment.
www.insecuremag.com 26
As I mentioned before, there are companies difference. More often nowadays we see
out there who we admire and respect. We companies choosing their Penetration Testing
have worked with companies who were ping- vendors based on incorrect metrics, such as
ing our network, waiting for us to open the accreditations of varying value, and of course
firewall to them and start the test. They on price. My hope is that an independent body
worked round the clock, were courteous, of technically competent people with experi-
communicated with us when necessary, and ence in Penetration Testing, but who are not
didn't stop until we closed the connection at vendors, set up a program which works in a
the end of the test. Then there were those that way similar to how we have run Sentinel, and
started late, and finished at 5 p.m. on the dot, to award technical accreditations to individual
even though they still had much more to do. consultants, not companies, in a range of
There were those that read the briefing notes, technical security assessment areas. Until
and those that didn't. Those which scanned all then, as a vendor, we'll continue to be put un-
65k+ ports, and those which did a quick scan der pressure to 'buy' every new PCI, CIS-
only. SP,CREST, CEH, et all accreditation to be
competitive in the market, and most compa-
All consultants and vendors are not equal. nies will continue to operate in the dark with-
Some of the less competent vendors are nev- out a set of good, industry standard, technical
ertheless good at selling their services to cli- metrics to guide them.
ents who may not be aware how to judge the
Nick Baskett is Managing Director of Matta (www.trustmatta.com), a security consultancy and software com-
pany based in Richmond on Thames, London.
www.insecuremag.com 27
WINDOWS - LockNote
http://www.net-security.org/software.php?id=649
LockNote will change the way you work with confidential notes. Application and document in one:
the mechanism to encrypt and decrypt a note is part of it. Secure, simple, independent. No instal-
lation required.
LINUX - MailScanner
http://www.net-security.org/software.php?id=144
MailScanner is a virus and spam scanner for e-mail designed for use on e-mail gateways. Not
only can it scan for known viruses, but it can also protect against unknown viruses hidden inside
e-mail attachments by refusing entry to attachments whose filenames match any given pattern.
A suite of Unix command-line tools and a server designed to remotely administer the file systems
of multiple Unix machines. For Mac OS X, there's also a graphical interface.
Reliable and user-friendly encryption software for Pocket PCs. It encrypts all sensitive information
keeping it secure and protected, even in such catastrophic cases when the Pocket PC is lost or
stolen. Protects information with NIST-approved AES 256-bit encryption.
www.insecuremag.com 28
It is a well-known fact in computer security that security problems are very
often a direct result of software bugs. That leads security researches to pay
lots of attention to software engineering. The hope is to avoid the ever pre-
sent penetrate-and-patch approach to security by developing more secure
code in the first place. - McGraw and Felton, 1999.
It’s no wonder that including security early in • Build (develop) and document
the development process will usually result in • Acceptance
less expensive, less complex and more effec- • Transition to production (installation)
tive security than adding it during the life- • Operations and maintenance support (post-
cycle. installation)
• System replacement (disposal).
Given that ISO 17799 is the international code
of reference for information security, we will Therefore, to successfully include security into
focus on how to integrate key controls se- the SDLC process, the following requirements
lected from such standard into all phases of must be met:
the SDLC process, from initiation to disposal.
• It must be based on security principles ad-
SDLC is a framework for developing software hering to a recognized standard and informa-
successfully that has evolved with method- tion privacy.
ologies over time. Discussions over different • It must be focused on risk and compliance
models are out of the scope of this article but • It must include activities designed to ensure
regardless of which software development compliance to ISO 17799:2005
model is used, there are typical phases that • It must require security-related steps in
need to be included. The basic phases are: SDLC procedures
• It must be supported by management as
• Project initiation and functional requirements well by information and business process
definition owners.
• System design specifications
www.insecuremag.com 29
Before going further, we can think in ISO Most of information classification schemes
17799 like ‘the security control supermarket’; define three levels (low, moderate or high) of
hence, you go there and pick what you fancy! potential impact for organizations or individu-
However, this is a peculiar supermarket in the als should there be a breach of security (a
way that you need to justify all the decisions loss of confidentiality, integrity or availability).
you make on what controls you choose and This standard will assist you in making the
what controls you don’t. This justification will appropriate selection of security controls for
be based in periodic risk assessments. This is your application.
what we call a risk based approach.
On the other hand, a preliminary risk assess-
So based on these typical phases, the next ment will result in a brief initial description of
section provides a correlation of where secu- the basic security needs of the system, ex-
rity tasks and ISO 17799 based controls pressed again in terms of the need for integ-
should be included during the activities com- rity, availability and confidentiality. This as-
pleted at each of these SDLC basic phases. sessment will establish the threat environment
in which the application will operate, followed
Security Activities within the SDLC by an initial identification of required security
controls that must be met to protect it in the
Project initiation and functional require- intended operational environment. The tech-
ments definition nical, operational and economical feasibility of
these controls and any other security alterna-
At the beginning phase, business needs are tives must be analyzed at this point. A cost /
identified along with the proposed technical benefit analysis should be undertaken for
solution. The identified solution must be each control, resulting in a preliminary risk
aligned to business strategy as well as to IT treatment plan. To assess the effectiveness of
strategy and security strategy. those controls, a security test and evaluation
plan will be developed in order to provide im-
At this stage, ISO 17799:2005 section 6 (Or- portant feedback to the application developers
ganization of Information Security) highlights and integrators at later stages.
the importance of a well established security
management framework where security re- This risk-based approach, as stated on sec-
lated decisions are supported by the busi- tion 4 from the standard, is the basis for any
ness, responsibilities are clearly allocated and successful security initiative; hence risk as-
activities coordinated across the organization. sessments must be repeated periodically dur-
During this early phase of development, the ing the application lifecycle to address any
organization will determine its information se- changes that might influence the risk assess-
curity requirements, often developed by suc- ment results, until consistency is achieved.
cessive refinement, starting from a high level
of abstraction that may include the information Although you can choose among many differ-
security policy and the enterprise architecture, ent risk analysis methods, the risk assess-
and then adding additional specifications dur- ment will not necessarily be a large and com-
ing consecutive phases. plex document. It is extremely easy to get lost
in a complex risk analysis, so bear in mind
However, the definition of the security re- that the risk assessment is a mean to achieve
quirements must always include security your goal but not the goal itself, so keep it
categorization and a preliminary risk assess- simple.
ment.
In addition, the application context should be
According to section 7 (Asset management considered, as it might affect other applica-
and information classification), to ensure that tions or systems to which it will be directly or
the information handled by your application indirectly connected. If the context is not con-
receives the appropriate level of protection, sidered, there is a possibility that the applica-
you will have to identify information assets tion being developed could compromise other
and categorize each according to regulatory organization systems.
impact, business criticality and sensitivity.
www.insecuremag.com 30
Additionally, the security functional require- (Developing and implementing continuity
ments analysis should include not only a se- plans including information security) of the
curity policy and enterprise architecture standard.
analysis, but also an analysis of applicable
laws and regulations, such as the Privacy Act, Typically, a service level agreement (SLA) is
HIPAA, SOX, ISO 27001, and others, which also required to define the technical support
define baseline security requirements. As sec- or business parameters that an application
tion 15.1 (Compliance with legal require- service provider will provide to its clients, as
ments) states, all relevant legal and contrac- well as the measures for performance and
tual requirements as long as functional and any consequences for failure. These kinds of
other IT security requirements should be ex- agreements together with a typical list of
plicitly defined, documented, and kept up to terms are covered on section 6.2.3 (Address-
date for each information system in the or- ing security in third party agreements) of the
ganization. standard.
A preliminary business continuity plan focused This section finalizes with the security frame-
on the required business objectives is also work documentation, resulting in a high-level
produced at this point, e.g. restoring of spe- description of the security issues, risks and
cific communication services to customers in controls in the proposed application and the
an acceptable amount of time, etc. Producing assurance requirements. This material will be
this plan requires full involvement from appli- used to support the derivation of a cost esti-
cation and business processes owners, and mate that addresses the entire life-cycle. It is
again, is based on a business continuity risk usually the case that there is a balance such
assessment. A list of items that must be con- that increased expenditures during early de-
sidered within the business continuity plan- velopment stages may result in savings dur-
ning process is included in section 14.1.3 ing application operation.
System design specifications list of issues that should be taken into account
before granting access to any external party
This phase includes all activities related to ac- are listed in section 6.2.1 (Identification of
tually designing the application. In this phase, risks related to external parties) of the stan-
the application architecture, system outputs, dard.
and system interfaces are designed while
data input, data flow and output requirements At this point, access control rules must be de-
are established. Detailed security specifica- fined to ensure that access to information and
tions are included into the formal baseline information processing facilities are controlled
documentation and the security test plan will on the basis of business and security re-
be updated, including specific procedures on quirements previously defined. In addition, a
how to validate system components through policy should be in place to maintain the secu-
development and deployment stages. rity of information that may be exchanged
through the application with any external en-
Prior the approval of design specifications, a tity. Section 10.8.1 (Information exchange
comprehensive security risk assessment policies and procedures) contains a compre-
should have been conducted, including those hensive list of security issues that should be
risks related to third parties that may require considered when using electronic communi-
access to the organization’s information and cation facilities for information exchange, i.e.
information processing facilities. This as- using cryptographic techniques to protect the
sessment will result in the identification of ap- confidentiality, integrity and authenticity of in-
propriate security controls that will be agreed formation.
and included into a contract or into a SLA. A
www.insecuremag.com 31
Capacity management is also a key area that so special care should be taken to avoid ex-
must be formally considered when it comes to posure of sensitive data within them. It is
application development. At this stage, sec- highly recommended to avoid the use of op-
tion 10.3.1 (Capacity management) states erational databases containing personal data
that any projections of future capacity re- or any other sensitive information for testing
quirements should take account of new busi- purposes, as this could result in a breach of
ness and system requirements and current data protection laws, and access to program
and projected trends in the organization’s in- source code and associated items (such as
formation processing capabilities. This is par- designs, specifications, verification plans and
ticularly important in case your application re- validation plans) should be strictly controlled
quires any resources with long procurement in order to prevent the introduction of unau-
lead times or high costs. thorized functionality and to avoid uninten-
tional changes. Section 12.4.3 gives particular
At the end of this phase, all appropriate secu- recommendations to control access to pro-
rity controls must be defined and included into gram source libraries in order to reduce the
the application design specifications. potential for corruption of computer programs.
During this phase, the source code is gener- In the acceptance phase, an independent
ated, test scenarios and test cases are devel- group develops test data and tests the code
oped, unit and integration testing is con- to ensure that it will function within the organi-
ducted, and the program and system are zation’s environment and that it meets all the
documented for maintenance and for turnover functional and security requirements. Prior to
to acceptance testing and production. this stage, managers should ensure that the
requirements and criteria for acceptance of
At this stage, the parallel security activities new applications are clearly defined, agreed,
must ensure that any security-related code is documented and tested. It is essential that an
actually written (or procured) and evaluated, independent group test the code during all
security tests are performed and that all ap- applicable stages of development to prevent a
proved security components in formal base- separation of duties issue, as recommended
line are included. by section 10.1.3 (Segregation of duties) of
the standard.
Most of security controls that will be imple-
mented during this phase are found on sec- As recommended in the previous section, any
tion 12 (Information systems acquisition, de- test must be carried out with previously sani-
velopment and maintenance) of the standard, tized data to ensure that sensitive production
i.e.: data is not exposed through the test process.
A list of items that should be considered prior
• Input and Output data validation to ensure to formal application acceptance being pro-
that data is correct and appropriate and to vided is found on section 10.3.2 (System ac-
prevent standard attacks including buffer ceptance).
overflow and code injection.
• Validation checks to detect any corruption of Good practice, as stated in section 10.1.4
information through processing errors or de- (Separation of development, test and opera-
liberate acts. tional facilities), includes the testing of soft-
• Cryptographic techniques to ensure authen- ware in an environment segregated from both
ticity and protecting message confidentiality the production and development environ-
and integrity in applications. ments, as this provides a means of having
control over new software and allowing addi-
Additionally, section 12.4 (Security of system tional protection of operational information
files) gives some guidelines on securing ac- that is used for testing purposes. This should
cess to system files and program source include patches, service packs, and other up-
code. Test environments are usually compli- dates.
cated and difficult to manage environments,
www.insecuremag.com 32
The security testing should uncover all design integrated application component tests and
and implementation flaws that would allow a identifies several steps that should be fol-
user to violate the software security policy and lowed to establish an effective management
requirements, and to ensure test validity, it process for technical vulnerabilities, including
should be tested in an environment that simu- vulnerability monitoring, vulnerability risk as-
lates the intended production environment. As sessment, patching, asset tracking, etc.
a result of such tests, security code may be
installed and necessary modifications under- This will be the last chance to detect security
taken. weaknesses or vulnerabilities as, once the
application security has been verified and the
Section 12.6.1 (Control of technical vulner- system has been accepted, it will moved into
abilities) provides guidance on how to perform production.
www.insecuremag.com 33
Therefore, to ensure the correct and secure and access to audit tools should be protected
operation of information processing facilities, to prevent any possible misuse or compro-
any changes to systems and application soft- mise. Further information on this topic can be
ware should be subject to strict change man- found on section 15.3 (Information systems
agement control, as recommended by section audit considerations).
10.1.2 (Change management). • Documenting operating procedures as con-
sidered on section 10.1.1 (Documented oper-
In general, changes to operational systems ating procedures), to ensure the correct and
should only be made when there is a valid secure operation of information processing
business reason to do so, and must be al- facilities. This control also helps to ensure that
ways preceded by an assessment of the po- system activities associated with the applica-
tential impacts, including security impacts, of tion (backups, maintenance, media handling,
such changes. Hence, periodic risk analysis etc…) are always made available and up-
are required whenever significant changes dated to all users who need them.
occur, including a change in data sensitivity or • Control of operational software to minimize
criticality, relocation or major change to the the risk of corruption to operational systems
physical environment, new equipment, new by implementing a rollback strategy, activating
external interfaces, new operating system auditing logs, archiving old versions of soft-
software (as considered on section 12.5.3 – ware and other guidelines found on section
Technical review of applications after operat- 12.4.1 (Control of operational software).
ing system changes -), or new application • Protection against malicious and mobile
software. It is recommended that a specific code to protect the integrity of software and
group or individual is given responsibility for applications. Section 10.4 (Protection against
monitoring vulnerabilities and vendors’ re- malicious and mobile code) provides guid-
leases of patches and fixes. Also, someone ance on the detection, prevention and recov-
should be assigned the task of verifying com- ery controls that should be implemented
pliance with applicable service level agree- across the organization.
ments according to the initial operational and
security baselines. Nevertheless, when it comes to access con-
trol, the standard allocates a whole section to
Other parallel security activities considered this pillar of security. Controlling the allocation
during this stage include: of access rights to information systems, privi-
lege management, password management
• System monitoring to detect any unauthor- and the review user access rights are a day-
ized information processing activities, to to-day challenge. You’ll find particularly useful
check the effectiveness of controls adopted, to follow the guidelines found on section 11
and to verify conformity to an access policy (Access control) and to implement those spe-
model, as stated on section 10.10 (Monitor- cific controls that will be selected as a result
ing). This section also addresses audit logging of the previous risk assessments.
activities, the protection of log information and
logging facilities and supporting activities like System replacement - disposal
clock synchronization.
• Network security management to ensure the Disposition, the final phase in the SDLC, pro-
protection of the application information and vides for disposal of the application in place.
the protection of the supporting infrastructure Information security issues associated with
as stated on section 10.6 (Network security disposal should be addressed explicitly. In
management). general, when information systems are trans-
• Technical compliance checking to ensure ferred, obsolete, or no longer usable, it is im-
that hardware and software controls have portant to ensure that organization resources
been correctly implemented and usually in- and assets are protected. Generally, an appli-
volving penetration tests or vulnerability as- cation owner should archive critical informa-
sessments as considered on section 15.2.2 tion, sanitize the media that stored the infor-
(Technical compliance checking). Special care mation and then dispose of the hardware/
should be taken when auditing to minimize software.
the risk of disruption to business processes
www.insecuremag.com 34
ISO 17799:2005 gives particular emphasis to Finally, as stated on section 9.2.7 (Removal of
secure disposal or re-use of equipment (sec- property) you must remember that any
tion 9.2.6) when it recommends that all de- equipment, storage media, information or
vices containing sensitive data should be software should not be taken off-site without
physically destroyed or the information should prior authorization and, where necessary and
be destroyed, deleted or overwritten using appropriate, it should be recorded as being
techniques to make the original information removed off-site.
non-retrievable rather than using the standard
delete or format function.
Project Initiation and • Identify business needs • Determine security re- 5.1.1 – Security Policy
Functional Require- • Identify areas affected and quirements 7.x – Asset management
ments Definition responsibilities • Classification and criticality and information classifica-
• Develop functional require- of information/applications tion
ments • Identify legal, statutory and 6.1.1, 6.1.2, 6.1.3 – Organi-
• Propose technical solution contractual requirements zation of Information Secu-
• Evaluate alternatives • Initial Risk Analysis rity
• Document project’s objec- Cost / benefit analysis 12.1 – Security require-
tives, scope, strategies, costs • Preliminary contingency ments of information sys-
and schedule. planning tems
• Select / approve approach • Prepare a security evalua- 6.2.3 – Addressing security
• Prepare project plan tion plan in third party agreements
• Prepare preliminary test plan • Include security require- 15.1 – Compliance with
• Select acquisition strategy ments in the security base- legal requirements
• Establish formal functional line as well as in request for 14.1.3 – Business Continu-
baseline proposal and contracts ity Management
• Determine SLAs
• Document security frame-
work
System Design Speci- • Develop detailed design • Identification of Risks re- 11.1 – Business require-
fications (system architecture, system lated to external parties. ment for access Control
outputs and system inter- • Define access control strat- 6.2.1 – Identification of risks
faces). egy related to external parties
• Detail the solution’s interac- • Define security specifica- 10.8.1 – Information ex-
tions with external systems. tions (program, database, change policies and proce-
• Update testing goals and hardware, firmware and net- dures
plans. Establish data input, work) 10.3.1 – Capacity man-
data flow and output require- • Develop security test pro- agement
ments. cedure
• Establish formal baseline/ • Include security area in
quality controls and require- formal baseline documenta-
ments. tion and quality assurances
Build/Development and • Construct source code from • Write or procure and install 12.2.x –Correct processing
Documentation detailed design specifications. security-related code. in Applications
• Perform and evaluate unit • Control access to code. 12.3.x – Cryptographic con-
tests. • Evaluate security-related trols
• Implement detailed design code. 12.4.x – Security of System
into final system. • Ensure approved security Files
components in formal base-
line are included.
www.insecuremag.com 35
SDLC Phases Project Activities Parallel Security ISO 17799:2005
Activities mapping
Acceptance • Test system components. • Sanitize test data. 10.3.2 – System accep-
• Validate system perform- • Independent security tests. tance
ance. • Install security code with 12.6.1 – Technical vulner-
• Install system. necessary modifications. ability management
• Prepare project manuals. • Document security controls. 10.1.4 – Separation of de-
• Perform acceptance test. velopment, test and opera-
• Accept system. tional facilities
Transition to Produc- • Train new users according to • Control data conversion 12.5.1 – Change control
tion (implementation) implementation. and data entry. procedures
• Implement the system (in- • Reconcile and validate data 10.1.3 – Segregation of
stallation, data conversions...). integrity. duties
• Enforce segregation of du- 10.1.4 – Separation of de-
ties and segregation of envi- velopment, test and opera-
ronments. tional facilities
Operations and Main- • Monitoring performance. • Periodic risk analysis. 10.10. x – Monitoring
tenance Support (post- • Ensuring continuity of opera- • Change management. 12.5.2 – Technical review of
installation) tions. • Verify compliance with ap- applications after operating
• Detect weaknesses or de- plicable SLAs and security system changes
fects. baselines. 10.6.x – Network security
• Manage and prevent system • Maintain release integrity management
problems. with secure and controlled 11.x – Access control
• Recover from system prob- environments. 15.2.2 – Technical compli-
lems. ance checking
• Implement system changes. 15.3.x – Information sys-
tems audit considerations
10.1.1 – Documented oper-
ating procedures
12.4.1 – Control of opera-
tional software
10.4.x - Protection against
malicious and mobile code
System Replacement - • Hardware and Software dis- • Information preservation. 9.2.6 – Secure disposal or
Disposal posal. • Media sanitization. re-use of equipment
9.2.7 – Removal of property
Ismael is working as an Information Security Specialist at iSOFT plc. He is involved in security governance
and compliance, implementing ISO 27001, providing risk assessment and security consulting and strategy. He
has also participated as a senior consultant for many big security projects in Spain, as well as an instructor,
writing articles and promoting security business. Ismael holds a Bachelor in Computer Science, is certified in
Business Administration, ITIL, CISM and CISSP and was recently accredited as IRCA ISO 27001 Lead Auditor
by Bureau Veritas UK. Ismael can be reached at ismael.valenzuela@gmail.com and
www.linkedin.com/in/ivalenzuela.
www.insecuremag.com 36
A public key infrastructure (PKI) can provide a set of security building blocks
that other infrastructure components can use to provide stronger security
services. For quite some time there is discussion around PKI. After more
than a decade there is still a feeling of doubt among organizations whether
they should implement a PKI and how certificates and related cryptosystems
can play a role within their businesses. PKI is definitely not new and it is a
fact that it never really became a huge success. Is this changing? Let's dis-
cuss this in more detail and then draw your own conclusions.
A Public Key Infrastructure (PKI) provides a a struggle with the question whether it is
set of security building blocks that other infra- needed to adopt PKI and how certificates in
structure components can use to provide the organization must be introduced.
strong security services to their users. In this
perception these services are highly important Possible questions with which we are con-
in todays IT infrastructures and the questions fronted are:
around it are really hot topics. It’s beyond the
scope of this article to explain PKI entirely. - do we have to set up an internal PKI service
This article discusses and focuses on the im- on our own or can we buy certificates exter-
portant considerations concerning PKI and nally?
what it can do for your business. - how is the integration with other parties,
software, compatibility?
The pros and cons of PKI - and what about the basis of faith and the
factor trust?
If you start searching for information about - what is the position of externally bought cer-
PKI and implementations within larger organi- tificates?
zations you generally see a huge discussion - what is the third party liability and what are
about it. After more than a decade there is still the possible consequences of this?
www.insecuremag.com 37
- do we have some legal regulations that the answer to all of the commonly known se-
makes PKI necessary? curity challenges. Sorry but it isn’t that simple
- are there no other technical solutions to ac- as it seems to be.
complish the same goals?
PKI as infrastructural basis
Furthermore are the high implementation
costs, complexity and time consuming pro- It’s really important to stress the last character
jects that we can hear as critics. Although of the PKI acronym: PKI is an infrastructural
there are many examples in which the imple- component, which means that by itself it has
mentation of PKI failed, we must be aware of no direct value. Added value comes at the
the projects that ended up successfully and moment other services and infrastructure
had a large added value to business in those components can build on it to provide
cases. strong(er) security.
Among the security building blocks that a PKI A PKI provides services and processes to
can offer are identification, authentication, manage these keys and the entire lifecycle of
confidentiality, integrity, and nonrepudiation. it. Among these services are certification, user
Identification gives an entity a way to check registration, key generation, key update, key
another entity’s identity. In order to be sure archival, certificate publishing, certificate re-
that John is indeed John. Second, authentica- newal, and certificate revocation.
tion ensures that, for example, the sender of a
message is the one from whom it originates. Use of a PKI
Next, confidentiality is a service that protects
against unauthorized disclosure of informa- A way PKI can be used is that a certificate
tion. Then integrity protects against unde- can be linked to a person or identity and the
tected modification of a message. Nonrepu- Certificate Authority (CA) supplies on request
diation gives protection against denial, by the the certificate of that specific person. You can
entities involved in a communication process. then log on to a workstation using a certificate
that is stored on a smart card. At that time do
The previous issues are all important for most have the so called “two factor authentication”.
of us IT professionals and certainly those of Something you own or what is in your pos-
us familiar with security. We know that these session (the smart card with certificate stored
topics are most of the times part of the basic on it) and something you know which is in
ingredients of the “CIA triad”: Confidentiality, most cases a pin-code that is handed out in
Integrity and Availability. We would say: PKI is combination with the smart card.
www.insecuremag.com 38
A PKI can also be used as a framework for and validates the server’s digital certificate, it
secure WLAN. The certificates can be used in creates a master key, encrypts it with the
the WLAN components and to certify your server’s public key, and sends it to the
Windows clients. The 802.11i standard does authentication server. Now the wireless de-
not deal with the full protocol stack but ad- vice and authentication server have both a
dresses only what is taking place at the data master key, which they can use to generate
link layer of the OSI model. The use of EAP, individual symmetric session keys. These
however, allows for different protocols to be session keys are being used for encryption
used to fill in the gap and deal with authenti- and decryption purposes, a secure channel
cation. EAP and Transport Layer Security between the two devices. As you can see a
(EAP-TLS), carry out this authentication complex process where PKI can really play a
through digital certificates. part in. However, you can implement secure
WLAN without PKI - the use of PEAP in com-
If EAP-TLS is being used, the authentication bination with MSChap v2 for example.
server and wireless device exchange digital
certificates for authentication purposes. When There are several applications of PKI. It can
using EAP-TLS, the steps the server takes to be used to certify hardware components, to
authenticate to the wireless device are basi- uniquely bind a certificate to a person, for digi-
cally the same as when an SSL connection is tally signing documents or encrypting data.
being set up between a web server and web
browser. Once the wireless device receives
www.insecuremag.com 39
PKI and e-commerce this whole process. How much more secure
will this be, and against what costs? They ac-
In the digital outside world it is clear that there cept the risks that comes with this and the
is a bigger challenge to retrieve and be sure loss of profits. The most important point is that
about an identity as within an organization. it creates more complex processes and a bar-
For some time it really seemed that PKI would rier for potential buyers or customers. The
play an important role on the internet and conclusion can be drawn that freedom, sim-
within e-commerce. However, in an e- plicity and doing business more easily have a
commerce application it is most of the times higher priority compared with rock solid and
only necessary for an end-user to ask the maximum security. This is a fact and reality.
question if a website can be trusted such as
www.amazon.com. Digital signatures
To get this type of trust we mostly see imple- There was for some time no clarity concerning
mentations with SSL. The tiny litte lock pre- the legality of a digital signature and the
sented in your browser. This does not go with minimum requirements for use. To solve these
user certificates, although it is possible within problems, and to stimulate e-commerce, in
SSL to also authenticate a client party (or in the end of the year 1999 an European direc-
real: the web browser) to a server, it is not a tive appeared with no. 99/93/EG concerning
common practice to do so. This because so- electronic signatures. In the US the same
called mutual authentication is more complex. thing happened. This directive states that the
Member States of the European Union must
The offered service on the web portals will be adopt laws to make digital signatures valid.
to present a server certificate to an end-user.
SSL makes use of this and establishes two Law articles say that an electronic signature is
things: present the identity of that server to considered reliable enough when the signa-
the user and second to get a secure commu- ture is linked to a person that signed a mes-
nication channel before you hand over your sage in a unique way and that the signatory
personal matter such as delivery address and always can be identified.
credit card data. Such certificates can be
bought for SSL externally by contacting Besides that, each modification afterwards
Thawte or Verisign. can be traced. With all this precautions a "so-
phisticated" electronic signature becomes
Most commercial parties are not confident valid. Conclusion is that a reliable signature is
that PKI can play an more important role in possible by using digital certificates.
www.insecuremag.com 40
I’ll give you an example of this. With PKI you’ll dures. As you can see, within the whole secu-
know that a specific electronic document is rity chain of PKI there are the same weak
digitally signed with a private key. A key that is spots like in other security solutions. Nothing
used by one identity or person. However, more and nothing less. Within a closed PKI
there are still some questions left: (or internal PKI) of an organization it is better
possible to implement strict procedures to en-
- Did indeed that person sign the document? sure that a person really represents the cor-
- What is the underlying process of digitally rect identity. After that it is possible to link that
signing? person to a specific certificate or private key
- Did that person really read the document or by handing it out personally.
is it a computer system or application that car-
ried out the actual signing without approval? In other words, the physical determination of
- How did this person came into possession of the identity can be accomplished. After hand-
the private key? ing out a certificate on, for example, a smart
- Is the identity really true and correct that is card, there is no guarantee anymore that the
linked to the private key? person is who he or she claims to be. We as-
sume it is but are we sure about that? If we
All these highly important processes are not talk about the digital outside world, then this
filled in automatically at the mathematical side determination is nearly impossible. We have
of PKI. Cryptography is really strong within in no way sufficient control about processes at
PKI but the weakest link is still the human fac- all.
tor and the implementation of strict proce-
Justification for PKI Therefore not only have a look at the position
of PKI for the short term and quick wins but
A couple of years ago we could see that there also for problems (or challenges) over a
was no solid case we could found in most or- longer period in time. Do not bring PKI for-
ganizations having PKI implemented all the ward as the ultimate solution for all problems
way. A first warning sign of operational and within the company: the three character magic
financial inefficiency as Gartner laid down in a word. Once PKI has been introduced it is
2006 report. And nothing has changed in really difficult to say it farewell.
respect to PKI solutions in my respect. The
method of: "implement it and the services Considerations for implementing PKI
which makes use of PKI will come within time"
is not a sufficient argument and a justifiable It isn’t that easy to have it all clear from the
point of view for the introduction of PKI. beginning. There are a lot of arguments you
have to consider before the decision can be
There are enough technical solutions possible made implementing a PKI or not. Although
to have valuable alternatives to implement hard to give some advise in general, I’ll try to
VPN, protected Wi-Fi, mail signing and so on. give you some ammunition.
Is a PKI then worth looking at? Yes it certainly
is but it is really important to overlook the field First you must consider if there is any clear
of possible solutions on a strategic term. De- (business) case that justifies the implementa-
limit the scope clearly and at an early stage in tion of PKI and second if there is only one
such projects. This will mean that there is a challenge where PKI did came into the pic-
big need to have a clear answer on how to ture. Think about it again if the case is not
implement it and for what kind of services. In clear and ask yourself the question if you can
other words - implementation strategy. find another solution without using PKI.
www.insecuremag.com 41
However, if there is are two or more cases After all it is most of the times not a “must
from business perspective where PKI is in the have” to implement PKI. Some measures like
picture, you might want to know if there are a more solid process around identities (Iden-
other scenarios is the future where there is tity Management or IDM) and the use of strict
the possibility to position PKI as an infrastruc- Role Based Access (RBAC) gain more suc-
tural component and solution within your envi- cess.
ronment. If so there can be a point in time that
it is more wise to implement PKI instead of In an organization like I’m working for this cer-
half a dozen of point solutions. This stand tainly is a consideration. Designate the Hu-
alone solution at that time can be more of a man Resource department for issuing identi-
challenge in management and costs. ties and make them full responsible for the
Pre-employment Screening and the issuing of
Generally speaking you have to take into ac- accounts. These accounts can be provisioned
count that a full implementation of PKI in a to certain important platform like the Active
larger organization without experience will Directory and give access to the Windows in-
take between 9-12 months. It’s not the techni- frastructure and workstation.
cal side of it all that will take time and effort
but the biggest challenge is to get all the nec- If an employee leaves the company the sys-
essary procedures in place in a secure and tem will take care of withdrawing all possible
controlled way. I think this is 80 percent of the accounts and rights. The return on investment
time versus 20 percent for technical issues. (ROI) in such circumstances can be much
better.
Rob P. Faber, CISSP, MCSE, is an infrastructure architect and senior engineer. He is currently working for an
insurance company in The Netherlands with 22.000 clients. His main working area is (Windows Platform) Se-
curity, Active Directory and Identity Management. You can reach him at rob.faber@icranium.com.
www.insecuremag.com 42
Strategic Information Security Singapore
23 May-25 May 2007 – Singapore
http://www.uninetintelligence.com/events.htm
www.insecuremag.com 44
Christen Krogh is responsible for all software development at Opera. Krogh
received his bachelor's degree in computer science from Glasgow University
and his Ph.D from the University of Oslo. In this interview he provides insight
into Opera security.
What is Opera's market share? How many selves "Evil Knights" working at finding holes
users do you have? and issues prior to launch.
Market share is a difficult number to measure Second, we try to develop our product in such
and different companies use different methods a way that it helps the end users to browse
and track different websites, so a true and ac- safely. Our advanced Fraud Protection is one
curate representation is almost impossible. example of such a feature. Thirdly, whenever
Our numbers though are more interesting: we something comes up as a security issue after
have between 10 and 15 million users of the we have launched a product it takes first prior-
desktop browser, more than 10 million cumu- ity. We aim to never let a security issue stay
lative Opera Mini users, come pre-installed on unpatched.
more than 40 million mobile phones and are
available to anyone using Nintendo Wii or Does Opera use technology that makes it
Nintendo DS. stand out from other browsers?
In your opinion, what are Opera's For us, security is largely about architecture,
strengths when it comes to security? process, and user interface. Architecturally,
we might be less prone to certain issues, due
Our strenght is that we take it really really se- to the fact that we have a self-contained
rious. We have an excellent Q&A team that browser application with few necessary de-
tests the browser versions priort to release, pendencies to the underlying platform.
both manually, and automatically. We even Process-wise, we might test more diversly
have a group of skilled experts who call them- than the competition, due to the fact that we
www.insecuremag.com 45
release our products on the largest amount of What has been your average response
different platforms. Regarding user interfaces, time to a reported critical vulnerability?
it has always been a design goal never to mis-
lead the user that they are in a safe environ- If reported correctly with sufficient details in
ment when they aren't. the report, it is usually less than 24 hours.
Do you believe that you are more secure Do you believe that your level of security
than other available browsers? would drop if you managed to get a quite
larger portion of the market?
Security can be classified in several ways.
Principled security is a function of architec- No. I don’t think so. Recall the distinction be-
ture, process (including Q&A), and design tween principled security and the lay persons
(including user interface). For the lay person, perception. Our principled security will be at
however, security is measured largely by least as good with higher market share. The
statistics: amount of attacks directed at Opera only
1) how many issues might increase, but it is important to remem-
2) how long (on average) did it take to release ber that almost all attacks are tried out on all
a Q&A'ed version with a patch (as opposed to the main browsers. Thus the net result of even
how long did it take to have a suggested code more attacks will most likely not be significant.
change which is not Q&A'ed) What *will* be significant, however, is that the
3) how many issues are unpatched (at any overall security level of end users browsing
one time) will be better if Opera gets a larger market
4) the severity of an issue. share - due to the facts discussed above.
The only way of evaluating this is to consult What's your take on the full disclosure of
with an independent advisory organization vulnerabilities?
such as secunia.org. According to their inde-
pendent analysis, we have a superior track We prefer that reporters contact vendors prior
record, of which we are very proud and work to disclosing a vulnerability in order to ensure
hard to maintain. that the impact on innocent bystanders (i.e.
end users) is as minimal as possible. When
How many security issues have you there is a patch available from a vendor, we
patched in 2006? understand and respect that some reporters
want to disclose their findings to the commu-
According to secunia.org, Opera 9 had two nity. Out public security policy can be found at
known security vulnerabilities in 2006, both www.opera.com/security/policy/
were patched. In 2006, Opera 8 had two re-
ported vulnerabilities, both were patched.
www.insecuremag.com 46
If I keep my documents on Google Docs, my mail on Yahoo Mail, my book-
marks on del.icio.us, and my address book on .Mac, is there any point in talk-
ing about the privacy of my data any more? Should I just accept that using
web-hosted applications means that privacy doesn't exist?
Many new applications do a great job of mak- user of these applications think about these
ing it easy and free for you to post your infor- risks?
mation online. In a lot of cases, your data is
combined with other people's data, to pull Right now, most application providers either
helpful or interesting relationships out of ag- don't talk about these risks or simply ask us-
gregate data ("People who bought this book ers to trust that they have their best interests
also bought...."). Your photos on your hard in mind; and as far as we know, the compa-
drive are not as useful as your photos on nies providing these applications do in fact
Flickr, where others can comment on them, make great efforts to respect the privacy of
find them via tags, share them, and make their users. As users, though, the "trust us"
them into photo-related products. proposition does not offer much in the way of
reliability of certainty. We essentially must rely
Obviously, though, this shift has many implica- on the harm that a large-scale privacy breach
tions for privacy, and it is worth wondering would cause the provider as counter-incentive
what the future of privacy is for web applica- against allowing one to occur.
tion users. A security breach on one of the
most popular hosted web applications could As developers of Wesabe, and online per-
easily reveal private information about thou- sonal finance community, we think about
sands or even millions of the site's users. An these questions a great deal. We believe that
employee of one of the largest providers there is a significant benefit to consumers in
could access information about the site's us- anonymously combining their financial data
ers without anyone knowing. How should a online, since this allows us to produce an ag-
gregate view of where consumers find the
www.insecuremag.com 47
best values (sort of like a reverse FICO score user's data is not to have that data at all. Of
-- a value rating for businesses). However, course, it's hard to develop a useful applica-
this project asks our users for a lot of trust. tion without any data, but it is worth asking, is
We decided from the outset that, as a startup there any information you don't absolutely
without the name recognition of a Google or need, which you could make sure not to have
Yahoo, and simply as people interested in at all?
providing privacy and security to our users,
that we should come up with as many ap- In designing Wesabe, we decided that the
proaches as possible that would help us pro- most sensitive information in our system
tect Wesabe users' privacy. would be the bank and credit card website
usernames and passwords for our users.
Many of these techniques are generally appli-
cable. While there is a fair amount of informa- These credentials uniquely identify a person
tion online for individuals who want to protect to the site, allow them to make security-critical
their own privacy, we found little for web ap- actions such as bill payments and bank trans-
plication developers interested in protecting fers, and enable access to other information,
their users' privacy; so, we want to document such as account numbers, that can be used
what we've learned in hope of making these for identity theft. In interviewing people about
techniques more common, and developing the Wesabe idea, we heard loud and clear
better critiques and improvements of the ap- that consumers were, quite rightly, extremely
proaches we've taken so far. sensitive about their bank passwords, having
been inundated by news reports and bank
Below, we outline four techniques we use warnings about phishing.
which we think any web application developer
should consider using themselves, and de- Our solution was to make sure our users did
scribe the benefits and drawbacks to each. not have to give us their bank and credit card
credentials. Instead, we provide an optional,
1. Keep critical data local downloadable application, the Wesabe Up-
loader, which keeps their credentials on their
As a web application developer, the best way own computer.
to ensure that you protect the privacy of a
www.insecuremag.com 48
The Uploader contacts the bank and credit Overall, we believe that a local client is a
card sites directly, and uses the user's cre- good privacy tool for new companies, and for
dentials to log in and download their data. It applications where some data should abso-
then strips sensitive information out of the lutely never be placed on a server. Wesabe
data file (such as the user's account number), will continue to provide a local client for all
and uploads just the transaction data to users, but we will also move to providing other
Wesabe. The Uploader acts as a privacy data syncing tools that do not require a client
agent for the user. We also provide a way for download, since we believe that over time
the user to manually upload a data file they've people will be more comfortable with those
downloaded from their bank or credit card approaches and will want the convenience of
web site, though this requires more effort on not running the Uploader.
their part.
For now, though, a local client has been a
The advantages of the client model are that great approach for us, and should be consid-
the user need not invest as much trust in the ered whenever an application involves data
web application as they would otherwise, and the user legitimately would hesitate to ever
that we do not have a central database of upload.
thousands of users' bank credentials (a very
tempting target for an attacker). 2. Use a privacy wall to separate public
and private data
As a small startup, not having to ask our us-
ers for as much trust is great - we can grow The first people we asked to upload data to
without needing people to be willing to give us Wesabe were some of our closest friends.
their bank credentials from the start. Likewise, Many of them replied, "Um, will you be able to
as a user of the site, you can try it out without see all my bank data, then?" Even people
having to surrender these credentials just to who trusted us were, understandably, very re-
experiment. luctant to participate. We devised a method,
the "privacy wall," for protecting their informa-
The Uploader approach has been extremely tion even from us as developers of the site.
successful for us - our users have (as of early We believe this model is a good approach to
April 2007) uploaded nearly half a billion dol- ensuring that employees of a company have
lars in transaction data, with over 80% of that the least possible access to users' data, and
information coming through the Uploader. to minimizing the harm that would come from
a security breach on the site.
The most significant disadvantage of the Up-
loader model is that it places a significant se- The idea of a privacy wall is simple: don't
curity burden on the user. If the user's ma- have any direct links in your database be-
chine is vulnerable, storing bank passwords tween your users' "public" data and their pri-
on their machine does not protect them. vate data. Instead of linking tables directly via
(Note, however, that if the user's machine is a foreign key, use a cryptographic hash that is
vulnerable, an attacker can go after those based on at least one piece of data that only
same credentials via the web browser, so in the user knows-such as their password. The
some sense the burden on the user is the user's private data can be looked up when the
same.) user logs in, but otherwise it is completely
anonymous. Let's go through a simple exam-
Asking a user to download a client application ple.
is also a usability burden, since it requires
greater commitment and trust that the client Let's say we're designing an application that
application does what it says it does and does lets members keep a list of their deepest,
not contain spyware or trojans. Finally, if we darkest secrets. We need a database with at
were to become very successful, the Up- least two tables: 'users' and 'secrets'. The first
loader application could itself become a spe- pass database model is show on the following
cific target for trojans, degrading its benefit. page.
www.insecuremag.com 49
The problem with this schema is that anyone small change, however, we can make this ex-
with access to the database can easily find tremely difficult, if not impossible:
out all the secrets of a given user. With one
The special sauce is the 'secret_key', which is The privacy wall technique has a number of
nothing more than a cryptographic hash of the possible weaknesses. As mentioned earlier,
user's username and their password (plus a we store the secret key in the user's session.
salt). When the user logs in, we can generate If you're storing your session data in the data-
the hash and store it in the session. When- base and your database is hacked, any users
ever we need to query the user's secrets, we that are logged in (or whose sessions haven't
use that key to look them up instead of the yet be deleted) can be compromised. The
user id. Now, if some attacker gets ahold of same is true if sessions are stored on the file-
the database, they will still be able to read system. Keeping session data in memory is
everyone's secrets, but they won't know which better, although it is still hackable (the swap-
secret belongs to which user, and there's no file is one obvious target). However you're
way to look up the secrets of a given user. storing your session data, keeping your ses-
sions reasonably short and deleting them
So what you do if the user forgets their pass- when they expire is wise. You could also store
word? The recovery method we came up with the secret key separately in a cookie
was to store a copy of their secret key, en- on the user's computer, although then you'd
crypted with the answers to their security better make damn sure you don't have any
questions (which aren't stored anywhere in cross-site scripting (XSS) vulnerabilities that
our database, of course). Assuming that the would allow a hacker to harvest your user's
user hasn't forgotten those as well, you can cookies. Other holes can be found if your sys-
easily find their account data and "move it tem is sufficiently complex and an attacker
over" when they reset their password (don't can find a path from User to Secret through
forget to update the encrypted secret key); if other tables in the database, so it's important
they do forget them, well, there's a problem. to trace out those paths and make sure that
the secret key is used somewhere in each
chain.
www.insecuremag.com 50
A harder problem to solve is when the secrets tion, *including* the developer's login pass-
themselves may contain enough information word (since that was one of the POST pa-
to identify the user, and with the above rameters to the request that failed). After that
scheme, if one secret is traced back to a user, developer changed his password, we went
all of that user's secrets are compromised. It about making sure that any sensitive informa-
might not be possible or practical to scrub or tion would not be logged in exception reports.
encrypt the data, but you can limit the dam- Good thing, too -- the next day, one of our
age of a secret being compromised. early testers hit another login bug, and her
action caused an exception report, fortunately
We later came up with the following as an ex- containing "'password'=>'[FILTERED]'" rather
tra layer of security: add a counter to the data than her real password. Setting up exception
being hashed to generate the secret key: reports to omit a list of named parameters
in exception reports is necessary precaution
secret key 1 = Hash(salt + password + '1') to prevent errors from causing privacy leaks.
secret key 2 = Hash(salt + password + '2') ... (In Ruby on Rails, which we use at Wesabe,
secret key n = Hash(salt + password + '<n>') there is a filter_parameter_logging class
method in ActionController::Base that exists
Getting a list of all the secrets for a given user for just this purpose.)
when they log in is going to be a lot less effi-
cient, of course; you have to keep generating Another good datum to filter is IP address.
hashes and doing queries until no secret with Tracking IP addresses is useful for security
that hash is found, and deleting secrets may auditing and reporting on usage for an appli-
require special handling. But it may be a small cation. However, there is usually no need for
price to pay for the extra privacy. every log in the application to record the full
IP address at every point. We recommend
3. Data fuzzing & log scrubbing zeroing-out that last two quads of the IP --
changing 10.37.129.2 to 10.37.0.0 -- when-
While this is the most basic and best-known ever possible. Most of the time, this informa-
of the techniques we describe, it's also proba- tion is completely sufficient for application-
bly the most important. Application developers level debugging, and prevents identifying a
naturally want to keep as much information specific user on a network by correlating with
about the operation of the application as pos- other network logs.
sible, in order to properly debug problems.
Google recently announced their intention to
They also want to have that information be as mask the last quad of IP address information
accurate as possible, so that disparate events after 18-24 months, in order to better protect
can be correlated easily. Unfortunately, both their users' privacy and comply with EU pri-
of those desires often fly right in the face of vacy laws.
protecting your users' privacy.
Likewise, dropping precision on dates -- or
Techniques such as the Privacy Wall are dropping dates altogether -- can significantly
pretty much useless if your log files allow protect a user. One of our advisors suggested
someone to pinpoint exact information about this practice to us after an experience with an
a user's actions. To prevent logs and other anonymous source inside a company, sending
records from violating users' privacy, those him email with information. He noticed that
records should purposefully omit or obscure date information, which is often logged with
information that would uniquely identify a user date and hour/minute/second precision, could
or a user's data. uniquely identify a sender even if no other in-
formation is present.
Early in the development of Wesabe, we hit
this problem when one of the developers Obviously some logs will need date informa-
found an exception on our login page. Since tion to be useful for debugging, but if possible,
exceptions are reported into our bug system dropping whatever precision you can from a
and also emailed to all of the developers, the date log is good protection.
exception sent around a full record of the ac-
www.insecuremag.com 51
For our application, tracking personal fi- service a target of forced data recovery (either
nances, a similar approach could be taken criminal, such as a coordinated attack, or
with transaction amounts. A record of all fi- governmental, such as a subpoena). How-
nancial transactions, with payee, date, and ever, covering all of the types of data men-
amount, could be used to identify a particular tioned above in all parts of your application is
person even without any additional informa- difficult, and requires care from all developers
tion. By rounding dollar amounts to the near- on the project. Likewise, none of these tech-
est dollar, or randomly selecting a cents niques would prevent a trace and tap (wire-
amount for each transaction, the application tap) order from mandating a change to the
would allow a user to have a good-enough application specifically to target a user. None-
estimate of their spending without penny-level theless, we believe all of the filters mentioned
precision. (The privacy threat here would be a above are both good practice and substantial
request for "all transactions at Amazon on privacy protections.
May 13th for $23.45" -- a fairly limited result
set, especially since not all Amazon buyers 4. Use voting algorithms to determine pub-
are Wesabe users.) lic information
With all of these filters, you lose a certain One of the purposes of Wesabe is to aggre-
amount of precision in your ability to debug a gate our users' transaction histories around
problem when one does occur. One work- merchants. This allows us to provide pricing
around for this is to retain precision and sensi- information (what is the average price for this
tive data where needed, but to write that data plumber's services?) and other useful data (if
to a separate, well-secured file store, and to all the Wesabe members who try this restau-
send a reference to the captured data to the rant never go back, it's probably not very
developers. In this way, needed information is good). We faced a problem, though, in devel-
centralized and protected under stricter poli- oping this feature -- how should we determine
cies, while the email broadcast or bug report which payees are really "merchants" for which
announcing the problem is sanitized. we should aggregate and publish data, versus
private transactions (such as a check from a
All of these techniques are beneficial when wife to her husband), which we definitely
faced with accidental privacy leaks or a desire should not publish? We decided to use a vot-
to avoid having data that would make your ing algorithm to help sort this out.
www.insecuremag.com 52
The idea for using a voting algorithm came same merchant name to describe one of their
from an interesting online application called transactions, we aggregate the transactions
the "ESP Game" (see www.espgame.org). with that payee name and release a page on
The purpose of the ESP Game was to im- "Safeway" that contains the data we've col-
prove image search engines by getting two lected.
people to collaborate on labeling a random
image from the web. People who register with This approach offers several benefits. First,
the site may start a labeling game at any time, this method works on completely opaque in-
and they are randomly matched based on formation -- ESP Game does not need image
when the request a game. Presumably, the analysis algorithms, and we do not need a
two participants do not know each other and battery of regular expressions to comprehend
have no way of communicating except the bank's payee representation. Second, we
through the game. They are both shown an are essentially defining a merchant based on
image at the same time, and asked to enter the amount of transaction activity in which that
words that describe the image. If they both merchant participates. This allows us to cap-
enter the same word, they get points in the ture a far broader range of merchant informa-
game and are shown another image (and so tion -- for instance, eBay and Craig's List sell-
on, until a timer runs out). This approach ers -- than would be available if we simply
helps improve image searching since two bought a database of merchant names. Third,
people are agreeing on one term that de- users do not need to manually identify each
scribes the image, and that image can then transaction as public or private -- we simply
be returned for searches on that term. The draw the line based on a consensus among
image is described by people who understand our users that a merchant should be public.
it, rather than having to be analyzed by a Finally, no developer or Wesabe employee
computational process that can extract very needs to make the public/private distinction,
limited information from it. either (that is, the system is fully automated).
When people agree on a merchant name, that
Wesabe uses the same approach to deter- name is common knowledge; if enough peo-
mine when we should start publishing aggre- ple agree, it is probably public knowledge.
gate information about a merchant. We wait
until a "quorum" of users has identified a There are a few drawbacks, of course. We
transaction as being at a particular merchant understate the full extent of our database in
name before publishing any information about our public pages, simply because some real
that merchant. As an example, say that User merchants have not yet reached a quorum
A downloads their transactions from their and thus are not published in our index. Like-
bank and uploads them to Wesabe. Each wise, a private individual who collects checks
transaction has a description of the payee from many Wesabean friends for a group ac-
provided by the bank. These descriptions are tivity may find themselves listed in our index
often quite obscure, such as: when they should not be. That said, we be-
DEB/14673 SAFEWA 37 19 OAKLS G lieve the automation and scope benefits out-
weigh these drawbacks.
User A can then edit the payee to a form
they'll more easily recognize, such as: More Information
Safeway
While we've written above about software
This benefits User A, since their subsequent techniques for protecting users' privacy, there
transactions at Safeway will be automatically are also policy techniques for the same ends.
converted for them. User B then uploads their We have published a "Data Bill of Rights" to
own data, and edits one of their transactions specify the promises we make to our users
to the payee name "Safeway," too. This re- about the treatment of their data, which any
peats for Users C, D, E, and so on. When a organization is free to copy -
certain threshold of users have all used the www.tinyurl.com/2tujnl.
Marc Hedlund and Brad Greenlee are developers at Wesabe (www.wesabe.com), an online personal finance
community for consumers.
www.insecuremag.com 53
Information security has finally become mainstream. It is almost a recognized
profession, with its own areas of specialization: network security, audit,
incident response, forensics, and security management.
Salaries for IS practitioners have been rising defacements and Denial of Service (DoS)
constantly, the market for security products takedowns “the malicious hackers are com-
and services is much bigger than it was five or ing”. Now, sleek statistics from reputable firms
ten years ago, and more firms are entering it. or institutions are used, so the language has
also become more grown up: “organizations
The “security frontier” has moved from fire- should secure,”, “we must ensure that every
walls and anti-virus to IM and VoIP security. piece of critical information in a company is
appropriately secured”, etc.
However, convincing people and organiza-
tions to implement effective security measures The problem with these approaches is that
has not become easier, so we must ask our- the need for security is not personalized
selves: enough to trigger a buying decision.
www.insecuremag.com 55
The issue is quantification. You or your firm quick look at a typical large European country
may not care much that “virus attacks have as a “market” for example Germany or the
increased by X% in the last 12 months”, but UK. This reveals that there will be, on aver-
you may pay more heed if the warning was age, ten firms providing Managed Security
specific to your industry: “virus attacks against Services (MSS), with the biggest firm holding
XYZ systems running ABC applications have about a 20% market share. There will also be
increased against ACME-industry institutions”. around 30 firms providing various security
consulting services and we’ll perhaps find one
It is of course, easier to sell any type of insur- with the biggest market share of 10%. This
ance or advisory services in regulated indus- would mean HHI indexes of competitive in-
tries: housing or car insurance, financial serv- tensity of 526 and 135 respectively.
ices, health care, government. One only has
to look at laws like Data Protection Act, HIPAA Glancing back at our economics textbooks,
(US) and Sarbanes-Oxley to see how these we find that this is not an overly competitive
created new business opportunities for con- market to be selling security services in, even
sulting firms in may countries. if we accept that defining the actual ‘market’
may be the trickiest part of this type of analy-
However, for the security practitioner catering sis.
for a diverse clientele, another class of argu-
ments must be found, in order to successfully Security ROI
convince clients to buy security services and
products. Then there is another way: proving security
ROI. Of course, ROI is a valid financial tool. In
Fear vs. economics the security industry, however, every vendor
seems to have one, which is slightly different
The problem with using fear to sell security is from other vendors’ and which ‘proves’ that
that it is subject to the stroboscopic light ef- buying that vendor’s product or service makes
fect: you get used to it, you may not realize the best economic sense.
when it really is bad and you could collapse
under it not knowing why. Fear also works if For example, I’m sure we’ve all seen the sta-
you are naturally risk averse. But, it doesn’t tistics stating that having someone else to
work if you’ve never experienced the touted manage your company’s firewalls is a 400%
bad consequences or, if you are not risk ROI over one year, when compared to man-
averse. aging them in house.
Basic economics tells us that a free market for Whenever we are confronted with such fig-
one specific product or “good” (let’s leave it ures, there are several things we need to ask:
“good”, please, as this is the basic economics How many firewalls do these figures refer to?
terminology) will converge to an equilibrium How many different technologies? Were these
position, where supply equals demand, at a devices located in one company office, or dis-
certain price P per unit. However, security is a tributed on a country or continental level?
complex issue, where many remedies are re- What service levels do the costs refer to?
quired for different aspects, so such a simplis- How many clients participated in the survey,
tic view may not be enough to look at when how many vendors?
selling our security wares.
Many ROI calculations adopt a simplistic and/
Besides, in some cases it is difficult to deter- or simplified view of the underlying costs.
mine what “one unit” of that product or good They also tend to disregard ‘communications’
may be and company purchasing decisions costs, human and skills costs, dealing with
are not as simple as the theoretical academic process or operational exceptions, with net-
models may suggest. work upgrades.
Some industry participants complain about One must always seek to understand the as-
increased competition as a factor in depress- sumptions of any ROI model.
ing their security sales. However, let’s take a
www.insecuremag.com 56
As a final note, an IDC study in 2003 found Fear, Risk and Economics
that 83% of companies do not track ROI for
their security investments. Things are likely to So, where does this discussion leave us? Are
have changed, but caution and scrutiny we any wiser about how to make security
should still be applied to ROI models. more widely adopted -- and encouraging cli-
ents to spend more on their security budgets?
Buy or Build and the Individual Perspec-
tive The main idea we need to tell our clients is
that security can be a business enabler and
From a client perspective, a lot of energy is not just an “IT cost,” Let’s stop viewing infor-
usually spent debating whether security is mation security through the prism of fear and
best kept ‘in house’ and delivered by client’s start to quantify it and, more generally, tech-
own personnel (or built by internal efforts), or nology risks and threats in Economic terms.
is it better to outsource or buy ‘off the shelf’. At the end of the day, buying decisions are
made by business people and not necessarily
Because security is essentially a trust issue, by technologists, so security investment deci-
the natural inclination is to keep it in house, sions must make business sense in order to
shrouded in secrecy. We know that, from a be adopted.
technical perspective, ‘security through ob-
scurity’ is not good practice. The encryption We need to articulate the economics angle
algorithms that become standards are sub- whenever we buy or sell security. This should
jected to scrutiny for years before being enable us to make rational (economics-based,
widely adopted. rather than fear-based) decisions when it
comes to security.
From an economic perspective, there will be
security tasks which are more efficiently car- Let’s not allow fear or the latest technological
ried out by an outsourcer (e.g. managing fire- fad to cloud our judgement. We can and
walls or IDS), and some which are more should place economic value on security
suited for in house delivery (e.g. fraud and in- measures, be they technology, people or
cident investigations), if skills exist in-house. A processes.
good provider will remind the client that they
always retain the full responsibility for their If we adopt an economic approach, we can
organization’s security posture, even if some demystify Information Security and make it a
security tasks have been ‘delegated’ to hands friend of the organization. This should benefit
and brains outside the firm. both the ‘buy’ and the ‘sell’ side of the market.
Ionut Ionescu is the Director of Security Services for EMEA at Nortel. He has over 14 years of ICT industry ex-
perience and specializes in systems and network security. His work involves designing, implementing and
auditing enterprise, carrier and e-business infrastructures.
www.insecuremag.com 57
Hacking the Cisco NAC - NACATTACK
http://www.net-security.org/article.php?id=1001
At Black Hat Europe we met Dror-John Roecher and Michael Thumann who were able to hack
the Cisco NAC solution by exploiting a fundamental design flaw. In this video they illustrate how
they worked towards this discovery and give us some exploit details. It is not their intention to
simply release a tool, they want the audience to understand how Cisco NAC works and why it is
not as secure as Cisco wants us to believe.
Jeremiah Grossman is the CTO of WhiteHat Security. In this video he talks about the differences
between web application security and network security, the assessment process in general, logi-
cal vunerabilties as well as Web 2.0 security developments.
Markellos Diorinos from the IE team at Microsoft introduces the new security features in IE 7 and
speaks about extended validation SSL certificates. He also covers the Certification Authority
Browser Forum whose members apart from Microsoft include also the Mozilla Foundation, Opera
Software and KDE.
Reliable and user-friendly encryption software for Pocket PCs. It encrypts all sensitive information
keeping it secure and protected, even in such catastrophic cases when the Pocket PC is lost or
stolen. Protects information with NIST-approved AES 256-bit encryption.
www.insecuremag.com 58
A firewall is a software which is used to control the movement of network
traffic according to a set of rules. Linux ships with an excellent GPLed
firewall called iptables.
As you can see in the diagram on the follow- lazy (like me) to plod through over 130 pages
ing page, iptables works in the kernel space. of the tutorial, then read on.
Here I will give a simple introduction to this
very useful and powerful but cryptic form of Netfilter is divided into tables which in turn are
securing a network. If you are using kernel 2.4 divided into chains and each can have differ-
and above, you will be using iptables. Its func- ent targets.
tionality is directly compiled into the Linux ker-
nel as a module (netfilter). The policies are Netfilter tables
checked at the layers 2, 3 and 4 of the OSI
Reference Model. That is 'Datalink', 'Network' There are three inbuilt tables. They are as
and 'Transport' layer. It is very fast because follows:
only the packet headers are inspected. There 1. Filter - This is the default table if no table
is a wonderful tutorial on configuring firewalls name is specified in the rule. The main packet
using iptables at Netfilter.org. But if you are filtering is performed in this table.
www.insecuremag.com 59
+-----------+
| Incoming |
| packet |
+-----------+
|
|
v
+-----------+
| Iptables | --> Block
+-----------+
| Pass
|-------> Forward to another system
|
| Kernel Space
----------------------------------------
| User Space
|
v
+--------------+
| TCP Wrappers | --> Block
+--------------+
| Pass
|
v
+--------------------+
| xinetd based rules | --> Block
+--------------------+
| Pass
|
v
Onward journey of the packet
2. NAT - This is where Network Address 2. PREROUTING - This is the entry point of
Translation is performed. For example, if you packets on their arrival. All packets first pass
are using your machine as a router or sharing through this chain before even passing
your internet connection with other machines through the routing decision.
on your network, you might use the NAT table 3. POSTROUTING - If PREROUTING is the
in your rule. first chain that a packet encounters, POS-
3. Mangle - This is where a limited number of TROUTING is the final point of contact for any
'special effects' can happen. This table is packet before it leaves the system.
rarely used.
For the mangle table
Netfilter chains The mangle table contains a union of all the
chains in the filter and NAT tables. Over and
Each table has a number of inbuilt chains and above the built-in chains, you can also have
these are as follows: custom user defined chains too. Usually you
use a custom chain to group a series of ac-
For filter table tions together before passing it to one of the
1. INPUT - Handles packets destined for the built-in chains.
local system, after the routing decision.
2. OUTPUT - This chain handles packets after Rule targets
they have left their sending process and be-
fore being processed by POSTROUTING (ap- Each chain can have different targets. They
plicable to nat and mangle) chain. are broadly classified into builtin and exten-
3. FORWARD - This chain handles packets sion targets. The target names must be pre-
routed through the system but which are actu- ceded by the option -j (as in jump).
ally destined for another system on your LAN.
The targets are outlined on the following page.
For the NAT table
1. OUTPUT - see explanation above.
www.insecuremag.com 60
Built-in targets • REJECT - If this target is used, a notice is
• DROP - As the name indicates, discards the sent back to the sender. Like for example "you
packet. No message is relayed back to the are denied access to this service" message.
sender of the packet. • DNAT - Used for destination NAT ie rewriting
• ACCEPT - Allows the packet to pass through the destination IP address of the packet.
the firewall. • SNAT - Used for rewriting the source IP ad-
• RETURN - This is a built in target which is dress of the packet.
created for convenience. Because most tar- • MASQUERADE - This is used to do either
gets do not return. That is if a packet matches SNAT or DNAT. Basically this target is used to
a rule, the checking of that packet ceases and set up internet connection sharing in your
the chain is exited. network.
ipt_limit 1792 8
iptable_mangle 2048 0
ipt_LOG 4992 8
ipt_MASQUERADE 2560 0
iptable_nat 17452 1 ipt_MASQUERADE
ipt_TOS 1920 0
ipt_REJECT 4736 1
ipt_state 1536 6
ip_conntrack 24968 5
ipt_MASQUERADE,iptable_nat,ip_conntrack_irc,ip_conntrack_ftp,ipt_state
iptable_filter 2048 1
ip_tables 13440 9
ipt_limit,iptable_mangle,ipt_LOG,ipt_MASQUERADE,iptable_nat,ipt_TOS,ipt
_REJECT,ipt_state,iptable_filter
These are the modules that are loaded on my with IP address 192.168.0.5 should be
system. As you can see, all modules that start dropped (-j DROP).
with the name 'ipt_' are extension modules.
So in the above listing, iptable_nat module # iptables -A FORWARD -s 0/0 -p TCP -i
eth0 -d 192.168.5.5 -o eth1 -- sport
uses a extension module called ipt_MAS- 1024:65535 --dport 80 -j ACCEPT
QUERADE. And to use the LOG extension
target, you should have loaded the ipt_LOG This rule reads as follows: Append (-A) to the
extension module. FORWARD chain, the rule that all packets
coming from anywhere (-s 0/0) using the pro-
What follows is a few examples. tocol (-p) TCP and using unreserved ports
(--sport 1024:65535), incoming (-i) through the
# iptables -t filter -A INPUT -p tcp -s
192.168.0.5 -j DROP interface eth0 , and destined (--dport) for port
80 on address (-d) 192.168.5.5 and outgoing
This rule can be read as follows. In the filter (-o) through the interface eth1 should be ac-
table (-t), append (-A) to the INPUT chain the cepted.
rule that, all packets using the protocol (-p) tcp
and originating (-s) from the remote machine
www.insecuremag.com 61
# iptables -L Usually the commands that you executed
above will reside in memory but will not persist
List (-L) all the rules in the iptables. across rebooting. Which means, once you re-
boot, all your rules are lost and you have to
# iptables -F start all over. In order to avoid this, you save
your rules into a file which is read by the OS
Flush (-F) all the rules from iptables. Now you when you reboot your machine. In RedHat/
can start afresh. Fedora, the iptables rules are saved in the file
/etc/sysconfig/iptables. You save it using
# iptables -A OUTPUT -j LOG
# iptables -A INPUT -j LOG the programs iptables-save as follows:
Log all incoming and outgoing rules in the fil- # iptables-save > /etc/sysconfig/iptables
ter table to the file /var/log/messages.
or do the following:
Iptables is a very powerful and flexible tool # service iptables save
and can be used to block anything or every-
thing that comes into or goes out of your com-
There is another script called iptables-restore
puter.
which can be used to load the rules from a file
into memory.
Ravi Kumar is a Linux enthusiast who maintains a blog related to Linux, open source and free software at
linuxhelp.blogspot.com.
www.insecuremag.com 62
An impressive crowd of security professionals, high profile speakers, hack-
ers as well as incognito individuals going only by their first name, gathered
at the Moevenpick Hotel Amsterdam City Centre in the Netherlands to attend
one of the most important security events in the world - Black Hat Briefings &
Training Europe.
The most intensive part of Black Hat is cer- • GS and ASLR in Windows Vista by Ollie
tainly the training and new for this year were Whitehouse.
Metasploit 3.0 Internals (by Matt Miller, aka • Attacking the Giants: Exploiting SAP
skape), Web Application (In)security (by NGS •Internals by Mariano Nuñez Di Croce.
Software) and Live Digital Investigation -In- • Making Windows Exploits More Reliable by
vestigating the Enterprise (by WetStone Kostya Kortchinsky.
Technologies).
A variety of IT companies watch closely the
The Briefings were filled with fascinating materials presented at Black Hat as they are
presentations covering a variety of topics, always very cutting-edge and sometimes
here are some of them: present holes in very popular software and
operating systems.
• RFIDIOts!!! - Practical RFID hacking (with-
out soldering irons) by Adam Laurie. This year, a plethora of attention was focued
• SCTPscan - Finding Entry Points to SS7 towards Nitin Kumar and Vipin Kumar that
Networks & Telecommunication Backbones presented "Vboot Kit: Compromising Win-
by Philippe Langlois. dows Vista Security". They got an invitation to
• Data Seepage: How to Give Attackers a dinner from Microsoft and we could see they
Roadmap to Your Network by David Maynor & were very excited about it. After all, they came
Robert Graham. from India to get a job in the industry.
• Software Virtualization Based Rootkits by
Sun Bing.
www.insecuremag.com 64
Under the microscope were Dror-John available to everyone that attends. The large
Roecher and Michael Thumann since they growth in the number attendees (from 300 to
spoke about Cisco in their "NACATTACK" around 450 this year) and the high quality of
presentation. Cisco wasn't tearing up confer- the presented material, Black Hat Europe is
ence material and we learned that they just proving to be the best event of its kind in this
had a pleasant conversation with the authors. part of the world. If that's not enough, the
Some change from the 2005 incident with Mi- Google folks with the "Hiring Squad" T-shirts
chael Lynn from ISS where Cisco acted like a should be enough for anyone having the skills
bully. Lessons learned! and looking for a high-profile job offer.
If you need credits towards a certification, Photos are a courtesy of Gohsuke Takama.
you'd be glad to know that ISC2 credits are
www.insecuremag.com 65
This is a friendly guide to computer certificates and their practical usage for
VPN and secure Web access, using open source software.
www.insecuremag.com 66
computers will be smart enough to process • certificate authority statement
operations with long numbers fast enough.
See RSA topic on Wikipedia for greater level Today, the most common certificates are so
of detail. called X509 certificates but watch XML based
methods, like XKMS.
Digital signature - a cryptographic function
where a private key of the signing subject is Certificates are the tool to implement trusts. At
used to encrypt cryptographic hash of the ob- To most, certificates are used to prove that a
ject (usually message, certificate request, file web site you are purchasing goods from actu-
or packet). ally belongs to the company that owns the
domain name. This trust is facilitated by the
Certificate chain - concatenated certificates so called "Certificate Authority" that your web
starting from the issuing certificate authority browser or computer trusts. The list of such
up to the root certificate authority. Certificate certificate authorities has been pre-populated
chain is rather necessity as the validity of a by operating system or web browser produc-
certificate depends on complete path from the ers.
certificate to the root certificate authority. usu-
ally, only root certificate authority certificate is Such certificate authorities make actually
trusted by a computer and it would be imprac- make a very good business out of these cer-
tical to import all sub certificate authorities tificates and that is not going to change for
leading to the root one. Certificate chain is some time. On the following page is such list
used when a client tries to connect to a from my Mac.
server, the client trusts root CA but the server
has got a certificate issued by a sub CA of the Similarly, this list can be viewed in other oper-
root CA. The server then sends it own certifi- ating systems and browsers. In Internet Ex-
cate plus the chain file for the client to estab- plorer, go to Tools, Internet Options, Privacy,
lish the certificate path and trust the server's Certificates and select Trusted Root Certifi-
certificate. cate Authorities tab.
Certificate Revocation List (CRL) - List of re- So how does your web browser know when to
voked certificates signed by private key of is- trust a certificate presented by a web site? It
suing CA. This is used to check whether a simply looks up whether an issuing certificate
certificate, while still within its validity period, authority is listed in the trusted root certificate
still holds its trust given by CA. authorities list, whether the current time falls
within the certificate validity boundaries and
1.2 Theory whether the website fully qualified domain
name (FQDN) is the same as stored within
A digital certificate is a certificate that attests the server's certificate. Finally it looks at
that the public key belongs to the specific sub- whether the certificate has been issued by a
ject, like a person, computer or web site. The certificate authority that is on the list of trusted
certificate contains a signature issued by an ones. Commercial certificate authorities,
issuer, which can be either Certificate author- those which certificates have been pre-
ity, another subject, or self signature. populated in operating systems, take great
care when issuing certificates to companies.
The certificate should include: As you can imagine verifying the identity of a
• subject name subject is the most important think to retain
• issuer subject name the trust that users have in these CAs
• validity (start and end)
• purpose (like client, server, encryption only, X509 certificates are widely used and there
signature only, CA, S/MIME) are various forms these can be stored. The
• public key to be signed most used formats are PEM and DER. You
• digital signature can also see PKCS standards, which is RSA
developed suite of formats for various crypto-
Optionally it can include: graphic functions. The most used are
• revocation list locations PKCS1,7,10,11 and 12.
www.insecuremag.com 67
Let's have a look at a typical X509 certificate RAW format, PEM encoded (Base64) certifi-
for a WEB server. cate:
-----BEGIN CERTIFICATE-----
MIIGfTCCBGWgAwIBAgIBATANBgkqhkiG9w0BAQUFADBiMQswCQYDVQQGEwJVSzEPMA0GA1UEBxMGTG9uZG9uMR
EwDwYDVQQKEwhBY21lIEx0ZDEUMBIGA1UECxMLSVQgU2VjdXJpdHkxGTAXBgNVBAMTEEFjbWUgRXh0cmFuZXQg
Q0EwHhcNMDcwMzA4MjAyNDEwWhcNMTAwMzA3MjAyNDEwWjBlMQswCQYDVQQGEwJVSzEPMA0GA1UEBxMGTG9uZG
9uMREwDwYDVQQKEwhBY21lIEx0ZDEUMBIGA1UECxMLSVQgU2VjdXJpdHkxHDAaBgNVBAMTE2V4dHJhbmV0LmFj
bWUuY28udWswggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQCbXC0SCIUj5o+zIyR/aZyBxX550wF6k2
Rf1byRQ/wSoqGdwVNKbnFI/9nn0jXwXSUAOQ+jQiLzC1OJd8VzgPlRt/Jr8Ac/Mxs0lNancv9DatQMMjxpfykt
FimYEbEbAIT+XyIv6c9qO8uesbHzvfmfNsxVslN8gs2qymsv98jtJAahx3jHlDYnK8ZLEre+Xo01jUi+8ibHNj
ZGVWZrglZSmPTQRpp/4p4AerwyzMZZkCAdyxF08TLGg9NTEDAuV5tASBLwZbAqKIQMEeTdu2CVuiYnqrAWnfnF
A1RjOMiOkMiV5PQL6iJCw81MGpuqtOD+d0sOYnaKHtk6hfcaEaqE4CXRKFfvMTNNLz7Bkyp6pD/7SDB2BD2UrG
hFP8onORlTs8lbWLMbfY+K6BEmWdmxRnWuls6Qva8kicujCd5azbJA6XMtHr15Cvzgw5PEZ9lziuPM/dBrpjKi
YDpAEZYOLkOHVTxKFZPVvuHM05us0pAcXRMoMz4HTJhXVpFqHPHQ7dHfx6I37NXPlGcybhg8iWfiirW39OksSV
NPblo8b+31cDfaguBDkLycLn2nqKfG3Ty1FKLWCbolNbXB6ZoySKvwTNX+UHLa9il7YxFEyG1zLgZ2SDqO5u5f
C5PLmaJUGikjtAhKQLnZhRDzjHF+RTE8HgzJz4O1s9FvogvyqQIDAQABo4IBOTCCATUwCQYDVR0TBAIwADARBg
lghkgBhvhCAQEEBAMCBkAwKwYJYIZIAYb4QgENBB4WHFRpbnlDQSBHZW5lcmF0ZWQgQ2VydGlmaWNhdGUwHQYD
VR0OBBYEFBgLKxchYfg2UimLMoJaF3WUvdGZMIGyBgNVHSMEgaowgaeAFKLDdUD2kD8jjC84WIgF9OfyARwSoY
GLpIGIMIGFMQswCQYDVQQGEwJVSzEPMA0GA1UEBxMGTG9uZG9uMREwDwYDVQQKEwhBY21lIEx0ZDEUMBIGA1UE
CxMLSVQgU2VjdXJpdHkxFTATBgNVBAMTDEFjbWUgUm9vdCBDQTElMCMGCSqGSIb3DQEJARYWaXQuc2VjdXJpdH
lAYWNtZS5jby51a4IBAjAJBgNVHRIEAjAAMAkGA1UdEQQCMAAwDQYJKoZIhvcNAQEFBQADggIBAI20uQyEFfQP
p7u2I+Hbz2IRcZWvuH4rpeLLJ+MA3ig3CCk/27dDUy39JecS+sB+oD5dXH2HeNP/giwvxST2lk75Acy7KOFeyn
YaMvpYFNpuW0mZ+KqmTmfmU1MDkB/18WXe07Ce2Q7auHpAB10b8EXx4va1odWnWi3/rDnxU4zTelDUXsEe+RZB
CjGR5OQjZ0aKN71G2g0QMDVnFZ0jmE6BZpG6paa07n2T9YBzrIaCQ52oUjxegqvNTZX4zTHm488zfbQvZCRO3k
Ay7zfORBxUKe5ru0CnlOoLaK5lB8sLuZdrSHP1J+m5iMfDdw119gpN7HOk51JcRaNIpotQNHfsYB/I0RYg5yAh
TBM6Zhqj4n8XNiLOc3JXCxrUM8kvbkcmCdKWjixVn/sY5A5j7Jqu9P0nlHzkHXznItL7k8lgBUDRlPh7VJAWXx
VhMhHVUBWoFw/STSMDhYreafZbE4p1jyRsKVisFjTh4kBuJGdUwoHqg0vhtnXr4BtZ046Am04Z4B/F6H1M4aY0
4+NJXR5iFbJcHu08hHV/NRXYzfO/YAgr6Tf0Nat5PqcCeRJ4gUsgXb+OkueqrdBSB2WAi5uB2xzlKU5/V8MPp3
mRf93gtjVJaFEkVm8B2TyszxKoslBInuHcZbZIfV86Agwy+p2sQQw0gHhdcqmfWMFyGpAc
-----END CERTIFICATE-----
www.insecuremag.com 68
Let's see the same certificate in more readable form.
www.insecuremag.com 69
X509v3 Subject Key Identifier:
18:0B:2B:17:21:61:F8:36:52:29:8B:32:82:5A:17:75:94:BD:D1:99
X509v3 Authority Key Identifier: #what namespace this certificate
belongs to. leads to Root CA and show which Sub CA (serial 2) was used
keyid:A2:C3:75:40:F6:90:3F:23:8C:2F:38:58:88:05:F4:E7:F2:01:1C:12
DirName:/C=UK/L=London/O=Acme Ltd/OU=IT Security/CN=Acme Root
CA/emailAddress=it.security@acme.co.uk
serial:02
2. Applying theory in real world - Security policy of Acme company reflects the
business requirement for teleworking or
Company Acme
homeworking and the criticality of Acme' as-
sets - information.
This company is an ordinary small business
selling products online. Salesmen travel
2.1 Extract from Acme Network Security
around the country and sell the company's
policy
services to manufacturers. Obviously they
need the access to company's resources
• Remote access - remote access to the com-
whilst traveling. They are equipped with lap-
pany network is allowed from authorised
tops and an HSDPA/WLAN network cards.
computers only.
And most importantly they do not understand
• Users accessing Extranet applications must
technology and I think some IT guys could call
be properly authenticated using two-factor
them "dummy" users. Well, they just need
authentication.
technology to work and they rely on IT guys to
• Client certificates must have a validity time
make it happen in an easy and secure way.
set to maximum of 1 year.
www.insecuremag.com 70
• Root Certificate Authority must only issue lished connection. No outgoing connections
certificates to subordinate certificate authori- from the firewall to the Internet are allowed.
ties. Firewall operates in stealth mode, silently
• All external connections to the Acme's inter- dropping all bad packets.
nal network must be terminated on a firewall 2. Extranet - allowed protocols from the Inter-
or in the Extranet zone. net zone: HTTPS, DNS, Email. Outgoing con-
• Direct connections originating from internal nections to the Internet: HTTP(s), DNS,
network to the Internet are not allowed. Email.
3. Intranet - No connections to the Internet
2.2 Security architecture allowed, incoming connections from Extranet:
SMTP, outgoing connections to Extranet:
Translating the security policy into an archi- proxy (3128), SMTP (only from Internal SMTP
tecture can be sometimes be rather difficult. server).
That is why the security policy should always
be supported by top management and actu- In addition, Internal DNS servers cannot re-
ally be enforceable by processes or technical solve anything on the Internet which is actu-
measures. In my example, the latter can be ally not actually needed as they must use Ex-
achieved by segregating internal network into tranet zone for all services anyway.
2 zones:
• Internal zone - all mail servers, Intranet Salesmen connect with their laptops to the
servers, client computers. Internet using WLAN or HSDPA cards and
• Extranet zone - servers in this zone termi- use OpenVPN software to connect back. This
nate connection between the Internet and the connection is terminated on the firewall and
Internal zone thus act like proxies. This en- the firewall rules give them the same privi-
forces security policy requirements number 5 leges as if they were connected to the Intranet
and 6. zone. Alternatively, they can use a web
browser to connect to sales application. Both
The firewall has 3 interfaces and this the fol- the OpenVPN and the sales application re-
lowing policy applied: quires a certificate issued by one of an
1. Internet - red or 0 in Cisco PIX terminology. Acme's CA.
Incoming packets are matched against estab-
www.insecuremag.com 71
2.3 Certificate Authorities • Linux server to act as a OpenVPN server -
architecture obviously this function could run on a Extranet
server, if budget is an issue. In my example I
2.3.1 Tools assign this function to a Linux firewall.
www.insecuremag.com 72
This structure has some weaknesses though. However to makes things simple I have de-
Due to the way OpenVPN verifies certificates cided to create separate Root CA just for VPN
(uses openssl verify call) user's certificate is- server. I am fully aware that this does not sat-
sued by Extranet CA can be used to gain ac- isfy security policy of Acme. Well, the risk as-
cess to the VPN server. This is due to the sessment of this gap shows that the risk to
chaining of certificates leading to one root cer- Acme organisation has not increased.
tificate and the implementation of OpenVPN.
Access to Extranet server does not have this
To disable this undesirable functionality tsl- weakness as Apache server, respectively
verify parameter could be used in openvpn to mod_ssl module, can do extensive checks of
specify an external script, in bash or perl for client's certificate and its issuer.
example, to return 1 (false) if a certificate pre-
sented by a client is not issued by VPN CA. So the final structure of CA is going to be:
www.insecuremag.com 73
In the following screenshot, the CA can CA are Certificate Signing and CRL Sign-
add some X509 extensions to the certifi- ing.
cate. • Netscape certificate type - specific exten-
• Key usage: This defines what the certifi- sion for Netscape browsers and server.
cate should be used for. Ultimate differen-
tiator is whether the certificate is going to Next step is to generate a key, in my ex-
be used by a sub CA or end entity, like cli- ample RSA key.
ent or server. Functions performed by a
www.insecuremag.com 74
This can take some time. On my test ma- However in our case we will also generate
chine with 600 MHz Via processor this ac- keys and, certificate requests in addition to
tivity took good the best part of 5 minutes actually issuing certificates. TinyCA soft-
to finish. ware makes it really easy to do these
steps in comfort.
This step should be repeated for VPN Root
CA and after this is done we should have It is important to understand the process of
two independent Certificate authorities: issuing certificates. The golden rule is that
• Acme Root CA the private key should be kept secret by
• Acme VPN CA the subject that is going to use it. This
would be in our example VPN server and
3. Configuration for VPN Access each laptop. This would mean installing
openssl on each computer and generating
After we have created VPN Root CA we key pair and certificate request as per this
will use it to issue certificates for VPN schematic:
server and couple of client computers.
The important bit to understand is that pri- However in my example it would be im-
vate key NEVER leaves the client. CA ac- practical to use this process so the opera-
tually does not need to see private key at tor of the CA is going to do all the tasks
all. On the other hand, whoever controls a and send users and server issued certifi-
CA is capable of issuing ANY kind of cer- cate and corresponding private keys.
tificate.
TinyCA actually makes it really easy and it
In other words, if the access to the network does not require you to generate a key first
or information system is secured only by but you can go straight to certificate re-
certificates, there is a substantial risk if the quest step:
CA is compromised.
www.insecuremag.com 75
Then click on newly created certificate re- dialogue enter number of days this new
quest and select Sign (server). In the new certificate should be valid for.
And repeat this whole process for all client PKCS12 format is kind of a vault that holds
certificates. all the above files above in one place and
can protect them using a passphrase. For
Now we have everything we need to con- OpenVPN server I do not specify any
figure OpenVPN. OpenVPN has two op- passphrase to pen PKCS12 file as it would
tions of configuring certificates: have to be entered when OpenVPN starts.
• specify ca certificate, key and server cer- On the other hand PKCS12 for clients
tificate must have passphrase set to enforce dual
• specify PKCS12 file. factor authentication (know & have princi-
ple).
I personally find it easier to use latter as it
is just one file to store on the file system. Export OpenVPN server PKCS12:
www.insecuremag.com 76
In the next step enter private key passphrase and leave Export password empty.
Export a client PKCS12 - This is the same password must be specified. Ideally we
as export for server except the Export want this to be different for each laptop.
www.insecuremag.com 77
In the end we should have 2 PCKS12 files, In this example I have installed openvpn
one for VPN server and one for one laptop, from a Debian package:
the former without passphrase. #apt-get install openvpn
# openvpn --show-ciphers
DES-CBC 64 bit default key (fixed)
RC2-CBC 128 bit default key (variable)
DES-EDE-CBC 128 bit default key (fixed)
DES-EDE3-CBC 192 bit default key (fixed)
DESX-CBC 192 bit default key (fixed)
BF-CBC 128 bit default key (variable)
RC2-40-CBC 40 bit default key (variable)
CAST5-CBC 128 bit default key (variable)
RC2-64-CBC 64 bit default key (variable)
AES-128-CBC 128 bit default key (fixed)
AES-192-CBC 192 bit default key (fixed)
AES-256-CBC 256 bit default key (fixed) #this is what we are going to use as
fixed cipher
/etc/openvpn/openvpn.conf
port 1194
proto udp #use UDP protocol - generally better as it is stateless and we leave
the control of traffic on encapsulated protocols
dev tun
pkcs12 openvpnsrv.p12 #server key and certificate - this is not pro-
tected by passphrase so the process does not need manual input
crl-verify crl.pem #CRL file generated by CA to verify validity of certificates
dh keys/dh1024.pem #used for generating symmetric keys for encryption
server 172.20.22.0 255.255.255.0 #use server mode - many clients at the same
time. specify IP pool for clients
push "redirect-gateway" #change default gateway rout on clients
push "dhcp-option DNS 172.20.20.4" #use internal DNS server, essentially the
same one as for clients connected via LAN
keepalive 10 120 #keep the link open using ping commands
cipher AES-256-CBC #use the strongest cipher available. this has to match the
client config
comp-lzo #compress
max-clients 20
user nobody
group nobody
persist-key
persist-tun
status openvpn-status.log
log-append /var/log/openvpn.log
verb 3
At this point openvpn should start and you can easily check it by showing the proc-
ess:
# ps ax | grep openvpn
12391 ? Ss 0:00 /usr/sbin/openvpn --writepid /var/run/openvpn.openvpn.pid
--daemon ovpn-openvpn --cd /etc/openvpn --config /etc/openvpn/openvpn.conf
www.insecuremag.com 78
Client config • GUI for configuring and managing
OpenVPN.
The client config is also rather straightfor-
ward. What is needed on a client is: Install the client and configure the .ovpn
• OpenVPN package - this exists for Linux, file openvpn directory. On Windows, users
Windows and Mac OS X. must be local administrators to be able to
use the software.
ACME.opvn:
client
dev tun
proto udp
remote <your server DNS name> 1194
resolv-retry infinite
nobind
persist-key
persist-tun
pkcs12 Laptop1-cert.p12 #certificate and key file protected by a passphrase (i.e.
encrypted). Different passphrase per laptop
ns-cert-type server #make sure the server certificate has X509 extension SSL
server
tls-remote Acme VPN Server #make sure we only connect to our VPN server by checking
server certificate DN (distinguished name)
cipher AES-256-CBC #use the most secure and available cipher
comp-lzo #compress traffic
verb 3
3.2 Testing all together The user should be able, subject to firewall
rules, to ping an internal IP address.
Finally we need to test whether a laptop
can connect. Laptop users should be In the server log you should be able to
asked for the passphrase to decrypt the see, apart from other messages, which
private key. laptop tried to connect and if the certificate
presented was successfully verified.
www.insecuremag.com 79
On the client these messages can bee seen in OpenVPN GUI window:
www.insecuremag.com 80
4. Access to Extranet applications comes down to how web browsers store
certificates and do not allow, if set, export-
In first part of this article I have shown how ing of these certificates.
to enable full IP access to internal network.
Sometimes it is just enough to enable ac- 4.1 Extranet Sub CA
cess to Web based applications. In that
case we do not really need VPN access The first step is to create Sub CA that
but can easily use certificates to securely would issue certificates to users and Ex-
access web applications. tranet servers. Sub CA certificate is noth-
ing more than a certificate with CA X509
Surprisingly, the number 1 risk that we extension set to true. Therefore it is trusted
identified and could not solve with to issue certificates on its own.
OpenVPN is actually mitigated by using
certificates for web applications. It all To create new sub CA open the Root CA
and click Sub CA button:
In the first dialogue on the following page, When generating certificates for users I
set Sub CA parameters, usually same as advise you to set Common Name to actual
for the Root CA. login name of the user in the network.
Next step is to issue a certificate for the The reason is that Apache server can fake
Extranet server and certificates for users. authentication and extranet DN and use it
These steps are identical as for openvpn in basic authentication, giving users pass-
server and laptop computers. word less access to applications.
www.insecuremag.com 81
As for the certificate for the Extranet server when trying to accessing the site even
make sure that Common Name equals to though the certificate is valid and trusted
the DNS name that users will use to ac- by the web browser.
cess the site. IIf not, user would get errors
www.insecuremag.com 82
< ~$openssl x509 -in ExtranetCA-cacert.pem -noout -subject > subject= /C=UK/
L=London/O=Acme Ltd/OU=IT Security/CN=Acme Extranet CA
extranet.conf
SSLEngine on
SSLVerifyClient optional
SSLVerifyDepth 2
SSLCertificateKeyFile /etc/apache2/ssl/extranet.acme.co.uk.key.pem
SSLCertificateChainFile /etc/apache2/ssl/web-ca-chain.chain #concatenated CA certifi-
cates
SSLCertificateFile /etc/apache2/ssl/extranet.acme.co.uk.pem
SSLCARevocationFile /etc/apache2/ssl/extranet-ca-crl.pem #Certificate revocation file
of Extranet CA
SSLCACertificateFile /etc/apache2/ssl/extranet-ca.pem
<Location /Extranet>
Allow from all
SetEnv force-proxy-request-1.0 1
SetEnvIf User-Agent ".*MSIE.*" \
nokeepalive ssl-unclean-shutdown \
downgrade-1.0 force-response-1.0
SetEnv proxy-nokeepalive 1
SSLVerifyClient optional
SSLVerifyDepth 2
SSLOptions +OptRenegotiate +FakeBasicAuth
#test whether the client's certificte has been issued by particular CA
SSLRequire %{SSL_CLIENT_I_DN} eq "/C=UK/L=London/O=Acme Ltd/OU=IT Security/
CN=Acme Extranet CA"
#Require 128 and more bits
SSLRequire %{SSL_CIPHER_USEKEYSIZE} >= 128
</Location>
www.insecuremag.com 83
Timeout : 300 (sec)
Verify return code: 0 (ok)
----
< GET / HTTP/1.0
[double enter]
>HTTP output
Vladimir Jirasek is an experienced security professional currently working as the Head of system security at
T-Mobile UK. Recently migrated to Apple's Mac OS X operating system and is loving it. He holds CISSP, CISM
and MCSE certifications. He can be reached at vladimir.jirasek@googlemail.com
www.insecuremag.com 84