Making the Tradeoff: Be Secure or Get Work Done

SEC 203 Making the Tradeoff:Be Secure orGet Work Done Steve Riley Sr. Security Strategist Microsoft Trustworthy Computing Group steve.riley@microsoft.com http://blogs.technet.com/steriley

Old vs. new • Traditional approaches vs. contemporary attacks • How have bad-guy methods changed? • What motivates them now?

What’s changing? Largeglobalevents Massiveworms Makingheadlines Identity theft,financial fraud Spyware Exploitenterprises Makingmoney

Meta-trend Identitytheft Spamming Phishing Extortion

Increasingly sophisticated Poly- and metamorphic Evading anti-virus software Act as vulnerability assessment tools Use search engines for reconnaissance Better targeting Don’t advertise presence So what’s going on? Malware becomesmore sophisticated Attacks are usefulfor longer times Vulnerabilitieshave street value Common to modify existing proven attack code More variants of successful worms Might result in new and hidden entry points Criminals hire attackers Criminals reuse their code Huge market in unknown vulnerabilities Capitalizing on shrinking window of exposure

How bad is it? Direct losses $13,000 grows with frequency, extent, severity (FBI 2005 Computer Crime Survey) $83,000 small company, modest infection (Counterpane Internet Security) $millions Indirect losses $? reputation, customer trust Counterpane Internet Security and MessageLabs

Trojan attacksTop 5 by industry Counterpane Internet Security and MessageLabs

Probes and enumerationsTop 5 by industry Counterpane Internet Security and MessageLabs

SpywareTop 5 by industry Counterpane Internet Security and MessageLabs

Direct attacksTop 5 by industry Counterpane Internet Security and MessageLabs

Security's link to economics • An economic opportunity lurks inside every security problem • Learn how to express security issues in economic terms • Look for ways to shift the balance in your favor

Spyware is costing you big Network World Magazine

A law firm Network World Magazine

Is email even useful anymore? Postini

“Our first program pays you $0.50 for every validated free-trial registrant your website sends to [bleep]. Commissions are quick and easy because we pay you when people sign up for our three-day free-trial. Since [bleep] doesn't require a credit card number or outside verification service to use the free trial, generating revenue is a snap.The second program we offer is our pay per sign-up plan. This program allows you to earn a percentage on every converted (paying) member who joins [bleep]. You could make up to 60% of each membership fee from people you direct to join the site.Lastly, [bleep] offers a two tier program in addition to our other plans. If you successfully refer another webmaster to our site and they open an affiliate account, you begin earning money from their traffic as well! The second tier pays$0.02 per free-trial registrant or up to 3% of their sign-ups.” An affiliates program

Let’s do the math SoBig spammed 100,000,000 mailboxes. What if… Would you do it???

Postmarks—change the economics http://research.microsoft.com/research/sv/PennyBlack/

Spam and spyware lead to bots Consider a 10,000-member botnet

How to become a bot Low interest rates! Gimme credit cards! Extend your penis! Get abetter job! Cheap movie tickets!

Edwin Pena: pioneering VoIP attacks

Edwin’s stats

The tradeoff • Security vs. usability • Security vs. usability vs. cost • Is the security worth the cost?

Secure You get to pick any two! Usable Cheap

Examples • Personal security • Event/city security • National security • Aviation security • Information security

Personal security: bullet-proof vests • Claim: protects you from gunshot death • Costs • Weight • Comfort • Convenience • Lack of style • Risk + likelihood: very low • Analysis • Risk not worth the cost

Personal security:children and strangers • Claim: talking to strangers is dangerous • Costs • Fear of asking for help • Default stance of distrust • Reduction in civil society • Risk + likelihood: quite low • Analysis • More children will suffer

Event/city security:cameras and face recognition • Claim: watch crowds everywhere, find criminals • Costs • Money • Privacy • High error rate • Risk + likelihood: questionable • Analysis • Did the costs actually help find criminals? • Tampa: no

National security: war on terror • Claim: protect United States from terrorists • Costs • Money • Lives • American reputation • Personal freedoms and liberties • Risk + likelihood: extremely low • Analysis • Did we get the most security possible, given the costs? • Is there any return in exchange for liberties?

Speaking of war…

Aviation security: how much screening? • Claim: identity + inspection = intent • Costs • Privacy (plus embarrassment) • Time (plus convenience) • Restrictions (liquids, pointy things) • Liberties (guilty first, massive profiling databases) • Money • Risk + likelihood: low • Analysis • Does any of it actually make airplanes more secure? • Can you pick bad guys out of a crowd?

Aviation security: too much? • Transmission x-ray

Aviation security: too much? • Backscatter x-ray

Aviation security: too much? • Passive-millimeter wave scanner

Information security Will you exchange these? • Performance • Freedom and location of access • Ease or frequency of use • Portability • Time • Cost • Privacy

Tradeoff: complete security

Information security • Passwords: remembering vs. writing down • RFID: inventory tracking vs. monitoring locations • System config: locked down vs. wild and free • Access control: strict vs. loose • Encryption: privacy vs. loss • Email: availability vs. integrity • Security admin vs. network admin • Security staff vs. executive management 

Virtual keyboards • Seems to be effective… • Screen recorders • Steal session after logon • Capture credentials from HTTP stream before SSL encryption • Hassle factor: forces user to select a short password • So maybe it’s less secure! • Not worth the tradeoff—slow and clunky • Addresses symptom (stolen credential) vs. root cause (malware) • Threat scenario is too specific

Privacy tradeoffs • Have a private face-to-face conversation? • Drive from A to B without anyone knowing? • Fly? • Be totally invisible in a crowd? • But still leave your cell phone turned on? • Make purchases without revealing your identity? • Online? • Embed tracking devices in pets? • In people? • Surf the Internet anonymously? • Send email anonymously?

Are we designed to make tradeoffs? • Yes • When threats are visible, obvious, immediate, recent • But common threats we forget about • No • When threats are invisible, nonobvious, delayed, historical • But rare threats we tend to hype

Applying the tradeoff • Don’t spend more on mitigation than the asset is worth! • Don’t destroy the asset in the process • Some risks you have to tolerate • Make the loss cost less • Transfer risk to someone else • Or simply ignore

Everything we do is risk management • Should you apply the patch? • Did you make that setting? • Did you get rid of Wintendo? • How did you configure the firewall? • What’s the ACL? • Risk management deals with threats

Not risk management • “We have to enable NTLMv2” • “Another patch? Let’s switch platforms” • “Another patch? OK, deploy it” • “All systems should be secure by default”

One size does not fit all • Every environment is unique • The risks differ for each environment • Risk tolerance differs • Products are designed based on assumptions • No product provides optimal security Lemma: You cannot design an optimal security strategy without a thorough understanding of the usage and risks

Risk assessment High Yes!We worry! Risk Risk tolerance What?Me worry? High Low Asset Value

It’s got to cover all layers People, policies, and process Physical security Data Application Host Internal network Perimeter

Sample classification schemes

Making the Tradeoff: Be Secure or Get Work Done