Welcome to another issue of (IN)SECURE. This time around we bring you articles covering topics such as the future of encryption, data security, attacks on consumer embedded devices, PCI DSS, and much more. Our feature topic for this issue is wireless security and we managed to gather six experts from world- renowned companies that provide an overview of the current wireless security threats and offer predictions for the future. Given the focus of this issue, our giveaway focuses on wireless security and I!m sure you!re going to like it so check out page 104!

I!d like to thank all the potential authors and organizations that got in touch with us. We!re always pleased to hear that (IN)SECURE is distributed in several Intranets worldwide and that the readership is growing strong. Don!t forget to visit www.insecuremag.com and subscribe for free. We!re always interested in new authors and topics so if you!d like to get in front of a large audience drop me an e-mail.

Mirko Zorz Chief Editor

Visit the magazine website at www.insecuremag.com

(IN)SECURE Magazine contacts

Feedback and contributions: Mirko Zorz, Chief Editor - [email protected]

Marketing: Berislav Kucan, Director of Marketing - [email protected]

Distribution

(IN)SECURE Magazine can be freely distributed in the form of the original, non modified PDF document. Distribution of modified versions of (IN)SECURE Magazine content is prohibited without the explicit permission from the editor.

Copyright HNS Consulting Ltd. 2007. www.insecuremag.com DefensePro with an adaptive behavioral server-based IPS feature set

The latest version of DefensePro's flagship Intrusion Prevention System provides adaptive behavioral server-based IPS feature set, protecting against misuse of application authorization and preventing break-in at- tempts to enterprise critical application servers, with no need for human intervention. This allows the network to automatically respond to attacks targeted at revenue-generating applications. The new version complements Radware's Defense- Pro existing signature and behavioral network- based protections and reinforces the company's vision to provide business-smart networking solutions. (www.radware.com)

New security features in Google Apps Premier Edition

The new security, compliance, policy management, and message recovery services added to Google Apps Premier Edition give customers the ability to: • Set configurable spam and virus filtering that are customized for the nature of the business, comple- menting the spam and virus filters already included in Google Apps. • Centrally manage all outbound content policy, including adding footers to every message based on business policy rules, blocking messages with specific keywords or attachments, and prevent- ing emails with sensitive company information from being sent. • Create, manage, and report on policies that apply to user groups or individual users. • Give administrators the option of visibility into all email within their organization for the purposes of compliance. (www.google.com) www.insecuremag.com ! ! 5 New innovative ID verification system using grids

GrIDsure Limited has announced its revolutionary new approach to authenti- cation - designed to tackle many of the problems currently being suffered by consumers buying both online and on the high street. Users create a simple pattern by choosing a set number of squares on a grid, in a shape of their choice - such as an 'L' or a 'tick'. Because the grid is then filled with random numbers at authentication time, new 'PIN' or pass codes are created each time. Best of all, GrIDsure can work without the need for extra hardware such as tokens, generating one-time codes that are more secure and resilient to spyware threats. (www.gridsure.com)

Secure printing of sensitive documents with new HP appliance

HP introduced an automated, comprehensive solution that enables the se- cure printing of sensitive documents in corporate and government networks. HP Secure Print Advantage minimizes business risk by addressing printer security vulnerabilities across the disparate systems, servers and clients typical to most enterprise environments. HP Secure Print Advantage en- ables IT to automatically set and enforce policies across systems, applica- tions and the print network. To safeguard against malicious attacks, the so- lution integrates the highest level of federal and international security assur- ances available in the market today – both FIPS 140-2 Level 4 and Common Criteria EAL 4+ security technology – into print environments. (www.hp.com)

SEC's Anti-Spam Initiative causes reduction in financial spam

The Securities and Exchange Commission continued its assault on stock market e-mail spam by suspending trading in the securities of three companies that haven't provided adequate and accurate in- formation about themselves to the investing public. The trading sus- pensions are part of the Commission's Anti-Spam Initiative an- nounced earlier this year that cuts the profit potential for stock- touting spam and is credited for a significant worldwide reduction of financial spam. A recent private-sector Internet security report stated that a 30 percent decrease in stock market spam "was triggered by actions taken by the U.S. Securities and Exchange Commission, which limited the profitability of this type of spam." (www.sec.gov)

SDK for building fingerprint biometric applications for Linux systems

DigitalPersona announced the DigitalPersona One Touch for Linux SDK, their new software development kit that enables developers to create fingerprint en- abled applications for the Linux operating system. The new SDK is the first Linux product for DigitalPersona, which is expanding into the quickly evolving open-source space to enable fingerprint support for multiple Linux distributions. (www.digitalpersona.com) www.insecuremag.com ! ! 6 Secure USB flash drive with a self-destruct sequence

IronKey recently launched Enterprise Special Edition of their secure flash drive designed for use on sensitive government, military and enter- prise networks. The IronKey: Enterprise Special Edition has been de- signed to be the world's most secure USB flash drive, using onboard hardware encryption to protect the gigabytes of files that can be stored on the device. No software or drivers need to be installed on your com- puter to use an IronKey. A password is used to unlock your IronKey, and this is verified in hard- ware. If an IronKey is lost or stolen, attempts to unlock or tamper with the IronKey will trigger a self-destruct sequence, ensuring data is kept confidential. (www.ironkey.com)

New advanced quality and security WLAN testing solution

Codenomicon introduced DEFENSICS for WLAN, an advanced quality and security testing solution that gives developers of wireless consumer devices, public broad- band infrastructure vendors and network service provid- ers the means to identify previously unknown product flaws and security vulnerabilities early in the production process - before any business or consumer information is compromised or service maliciously interrupted. It can be used to extend quality assurance and security-readiness processes of vendors, service providers, enterprises and municipalities de- ploying Wi-Fi and WiMax networks. (www.codenomicon.com)

Secure file transfer solution for IBM mainframes

SSH Communications Security announced the general availability of SSH Tectia Server 5.5 for IBM z/OS which allows enterprises to secure file trans- fers and other data in transit with little or no changes to scripts, applications or infrastructure. SSH Tectia Server for IBM z/OS is an advanced, cost-effective file transfer solution for the IBM environment supporting key mainframe features such as: direct MVS file system access, hard- ware encryption acceleration, SMF logging, automatic character set conversion, strong authenti- cation through RACF, ACF and TopSecret, X.509 certificate support as well as fast data streaming technology. (www.ssh.com)

IBM DB2 gets database encryption capabilities

Vormetric partnered with IBM to deliver database encryption capabilities for DB2 on Windows, Linux and Unix. IBM will offer Vormetric's highly ac- claimed data security solution as part of its data server portfolio, addressing customer demand for increased protection of sensitive data. This new ca- pability is delivered in IBM Database Encryption Expert, initially available for the new DB2 9.5 "Vi- per 2" data server. (www.vormetric.com)

www.insecuremag.com ! ! 7 Strong user authentication via leading enterprise smartphones

RSA announced the availability of the RSA SecurID Software Token 2.2 for Sym- bian OS and UIQ. Symbian develops and licenses Symbian OS, the market lead- ing operating system for smartphones. Symbian OS is licensed by leading mobile phone manufacturers; to date, more than 145 million Symbian smartphones have shipped worldwide to more than 250 major network operators. Businesspeople who use smartphones based on UIQ and Symbian OS can now leverage their devices to access protected corporate information securely, eliminating the need to carry a separate, stand-alone authenticator. (www.rsa.com)

New Oracle security product: Oracle Adaptive Access Manager 10g

Oracle announced general availability of Oracle Adaptive Access Manager 10g, a comprehensive solution designed to prevent online identity theft and fraud, Oracle Adaptive Access Manager 10g fea- tures a number of enhancements including: turnkey Knowledge- Based Authentication and system monitoring dashboard features, in- creased support for financial and retail compliance requirements, a hot-pluggable architecture and tight integration with Oracle Access Manager. (www.oracle.com)

Forensics edition of password recovery bundle

Elcomsoft released Password Recovery Bundle - Forensics Edition. Using innovative technology, ElcomSoft's package of password re- covery products lets authorities unlock more than one hundred file formats and programs. The bundle includes programs and technolo- gies that are not available from other software companies: Elcomsoft System Recovery, a boot-disk application that makes it easy to ac- cess your computer's Windows password settings, Proactive Pass- word Auditor, a password audit and security test tool that makes it easy for Windows systems administrators to identify and close security holes in their networks and Elcomsoft Distributed Password Recovery, an innovative way to harness the power of multi- ple computers to recover lost passwords. (www.elcomsoft.com)

Good Mobile Messaging Secure Multipurpose Internet Mail Extensions

Motorola recently introduced Good Mobile Messaging Secure Multipurpose Internet Mail Extensions (Good S/MIME). Designed specifically to meet federal government security policy requirements, it supports the Motorola Q family of smartphones and gives the Department of Defense and associated government agencies a mobile messaging solution that is more personalized and easier to manage and administrate than other alternatives. Good S/MIME works with the Motorola Q family of smartphones, Bluetooth CAC-readers and standard DoD- issued common access cards to seamlessly secure CAC communication, sign and encrypt emails and attachments, and deliver a superior user experience. (www.motorola.com) www.insecuremag.com ! ! 8 When attacking a network you must look at the “network” as the holistic sys- tem that allows the organization to share, create, and maintain information.

When you are deciding on which targets to rity professionals are spent trying to protect attack on the network, I like to remind people that data. of my favorite movie quote which comes from the 1992 film called “Sneakers”. In it the bad When looking at the network holistically, would guy named “Cosmo”, played by Ben Kingsley, you choose a target that contains some of the is explaining his strategy and motives for organization!s data or a target that all of the world domination (a popular goal by bad guys data flows through transiently? Let's think in the movies). In the final breath taking about that for a moment. If you compromise a scenes Cosmo proclaims, “…it's not about server or workstation that contains some Word whose got the most bullets. It's about who documents, is that most likely the latest ver- controls the information. What we see and sion of that data or the entire company!s hear, how we work, what we think... it's all document collection? Or, is it better to gain about the information!” There are so many control of a printer or network switch that is parallels between this quote and information sending or printing the latest version of that security that it could warrant an article all on document? By attacking, and subsequently its own. However, lets take just the line that “owning”, the individual devices that make up states “its all about the information”, which the network, we can own the information. This couldn!t be more true today. is better from an attacker perspective than gaining access to a single server or desktop As an attacker, “whitehat” or “blackhat”, what for several reasons. First, there is typically not is your goal? Why, to get the information of a monitor, mouse, keyboard, or end-user as- course! When you evaluate risk for your or- sociated with a network device. Console con- ganization the most important variable in any nections are the closet thing, however typically risk calculation is the importance of the data, they are used only when performing mainte- and much of our careers as information secu- nance or to recover a device from a failure. www.insecuremag.com 9 The absence of a user interface makes it could send and receive packets on the net- much easier to hide our presence. Embedded work through the management interface devices also have a stealthy characteristic as- [tinyurl.com/ytbrod]. sociated with them because administrators or end users do not pay attention to them unless Manipulate settings they are broken. I worked for several years in the networking department of a fairly large or- If an attacker cannot easily replace firmware ganization who lived by the words “if it ain!t on devices, they will most likely resort to broke, don!t fix it”. I have also spoken with changing the settings in the existing firmware. countless end users who will say such things This idea has been explored on devices such as, “Don!t touch that, it works just fine!” as printers, where everything from the display to the number of pages printed can be modi- The remainder of this article will focus on ex- fied [tinyurl.com/2fudev]. However, network ploring vulnerabilities, and associated risk, settings are a target too. If an attacker can with wireless access points, routers, printers, modify the DNS settings on a wireless home and some other common devices on the net- gateway, they can redirect the user to phishing work. The methods of vulnerability discovery sites with ease. Also, a printer!s routing table and defense against attacks can be applied to can be manipulated such that all network traf- many different types of embedded devices in fic goes through a specific workstation, allow- different environments. ing an attacker to view all of the print jobs go- ing through it. Goals of exploitation Other settings manipulations include enabling Replacing the firmware remote administration, or disabling wireless security. The idea of doing evil things with Being able to modify the device!s firmware, or home routers by changing the settings was even replacing it, is one of the most powerful explored in a paper from Symantec titled attacks against embedded devices. Unlike “Drive-By Pharming”, which details using workstations and servers, it is quite easy and Javascript and Java tricks on the client to take feasible to replace the entire operating system advantage of a default password and manipu- on an embedded device. Attackers can even late a router!s configuration go to the extent of creating a firmware that [tinyurl.com/2vpb8r]. looks exactly like the firmware running on the device, for example imitating the look and feel Denial Of Service of the Linksys web management interface. The new operating system could not only du- Denial of service conditions on embedded de- plicate the functionality of the original, but also vices can often happen by accident. However, add “special features”. In the context of a some devices may become intentionally tar- home cable modem/router/firewall, the new geted for denial of service. Examples include functionality could intercept usernames, web cameras used to provide security moni- passwords, credit card numbers, or other per- toring, or SCADA devices that are used to sonal information. monitor and run energy sources that may be under attack from cyber terrorists. Unfortu- These attacks are not out of the realm of pos- nately for the defenders, triggering a denial of sibility; many different firmware distributions service on an embedded device is far to easy, exist for several common home routers and sometimes is not easy to recover from. A [toh.openwrt.org]. Even if an attacker does not good example is the HP printer FTP denial of have replacement firmware to work with al- service exploit [5], which when sent to a de- ready, it is possible to take any device using vice corrupts the firmware. Once the firmware firmware and write custom code for it. For ex- is corrupted, you will need to perform some ample, Stephen Lewis presented at the 21st form of recovery, which may entail a JTAG de- Chaos Communication Congress and re- vice that needs to be interfaced with the hard- leased proof-of-concept code that could insert ware directly. In the case of the HP printer, it custom code into an embedded device run- has to be sent back to the factory for recovery. ning the Motorola 68EC020 processor that www.insecuremag.com 10 Example attacks against embedded into the web interface, which is now a com- devices mon target for attackers on all embedded plat- forms. By browsing to the web management As a society we hope that if we learn from his- interface a user was able to enter an IP ad- tory, we will not be doomed to repeat it. Lets dress, click the “Ping” button, and test connec- start by taking a look at a vulnerability in an tivity. Fortunately for the hacking community, embedded device that was responsible for the developers did not do a very good job im- sparking the router hacking revolution (with a plementing input validation checks, making it little help from the GPL [tinyurl.com/c56wz]), possible to run arbitrary commands on the de- the infamous “Ping Hack”. In the firmware that vice. For example, consider the following shipped with Linksys WRT54G series routers commands that could be entered into the there was a bug in the Ping functionality built “ping” dialog box:

;cp${IFS}*/*/nvram${IFS}/tmp/n ;*/n${IFS}set${IFS}boot_wait=on ;*/n${IFS}commit

The above commands will enable the exist on the end-users computer, but only on boot_wait parameter on a WRT54G, allowing the router where it can remain undetected. It's you to TFTP new firmware to the device when amazing how we really do not learn from his- it boots up. This helps us accomplish our goal tory as a very similar vulnerability exists in the of installing our own firmware on the device La Fonera FON routers, which contain a re- and/or installing our own end-user software. mote command execution vulnerability that Installing a tool such as dnsiff on a router allows us to install custom firmware. For ex- gives the attacker a very powerful tool ena- ample, to manipulate the firewall on a La Fon- bling credentials to be sniffed via many differ- era router, consider the following POST re- ent protocols. This program does not need to quest:

iptables -I INPUT 1 -p tcp --dport 22 -j ACCEPT)" size="68" >

Whoops, looks like the connection.sh script Linksys and La Fonera are not alone. There forgot to do input validation on the username are many embedded devices that are vulner- field. This, of course, opened up the La Fon- able to a wide range of attacks. Take the era to firmware hacking and allows us to in- 2wire 2071 Wireless/Ethernet/ADSL router, stall OpenWrt, an open-source firmware for which is thought to be one of the most popular embedded devices. Installing software within home DSL router in Mexico OpenWrt is easy, with one command we can [tinyurl.com/2ahy38]. It contains a default con- have the dsniff suite of tools available to us: figuration that has no password. This allows for a really easy CSRF (Cross Site Request # ipkg install dsniff Forgery Attack) to occur. Consider the follow- ing attack URL:

http://192.168.1.254/xslt?PAGE=J38_SET&THISPAGE=J38&NEXTPAGE=J38_SET& NAME=www.bank.com&ADDR=2.2.2.2

The above command will add a static DNS en- alone; many ISPs are now shipping DSL/ try for www.bank.com and resolve it to 2.2.2.2. Router/Wireless Access point combined de- All the end user would need to do is click on vices with default passwords and vulnerabili- this URL, and a new DNS server would be ties. A good example involves a router in added. This easily allows an attacker to per- widespread use in the United Kingdom from form phishing attacks, as now they can control British Telecom (BT). where your web traffic goes. Mexico is not www.insecuremag.com 11 The “BT Home router” is one of the most tacks that will manipulate the configurations popular DSL/Cable routers in Britain, claiming on their routers in some way. Authentication 2+ million installations [tinyurl.com/2fpbtf]. It bypass vulnerabilities present in home routers too suffers from CSRF vulnerabilities that al- are not new, nor are they limited to the ones low an attacker to manipulate the configura- distributed by the ISP. A researcher by the tion without the need for a password. While name of Ginsu Rabbit discovers that WRT54G the group responsible for finding the vulner- version 5 routers running firmware version abilities has not released all of the details, 1.00.9 are vulnerable as well they can manipulate the router due to an [tinyurl.com/2ejhc9]. The danger of this vul- authentication bypass vulnerability. Who nerability is that to fix it a user must update needs to rely on the default password when firmware, which so many users simply do not we can just bypass authentication altogether! do.

There are also US based providers shipping Unfortunately many people leave the default insecure default configurations as well (i.e. a username and password set to the default default password of “password”), and my fear even on devices that they purchase them- is that they may become targets of attack. If selves. For example on most Linksys an attacker knows that everyone from XYZ WRT54G routers it!s set to a username of ad- ISP has a router with a default password, they min and a password of admin. All it really can use data mining techniques to collect takes is to entice a client to go to the following those users email addresses (i.e. URL: [email protected]) and target them with at-

http://admin:[email protected]/apply.cgi?submit_button=index&change_action=&submit_typ e=&action=Apply&wan_dns0_0=192&wan_dns0_1=168&wan_dns0_2=1&wan_dns0_3=13&wan_dns1_0=0& wan_dns1_1=0&wan_dns1_2=0&wan_dns1_3=0&wan_dns2_0=0&wan_dns2_1=0&wan_dns2_2=0&wan_dns2 _3=0&wan_wins=4&wan_wins_0=0&wan_wins_1=0&wan_wins_2=0&wan_wins_3=0&time_zone=-08+1+1& _daylight_time=1

This works on a Linksys WRT54G with the de- Most recently while doing some work for a cli- fault username and password and allows us to ent on a penetration test I was testing the change the routers DNS servers as we did be- wireless network. This particular wireless net- fore. work was a managed system, meaning that the access points were “dump” and only pro- Vulnerability discovery methods vided the radio functionality, while all of the intelligence (encryption, captive portal, etc..) Nmap was provided by a central controller. During the test I associated to the open SSID and Nmap, the world famous portscanner, has tried to go to a web site. Working as adver- proven a useful tool to finding vulnerabilities in tised, the captive portal kicked in and re- embedded devices. A little known fact about directed my request to the login page sitting Nmap is that due to printers printing endless on the wireless controller!s web server. This pages, port 9100 is ignored when doing cer- means that any wireless client has access to tain scans. While this is not a vulnerability per at least one open port on the controller itself. I se, it will deplete the resources of a printer. I started my testing by launching an Nmap scan have personally crashed many printers doing against the controller to gain some insight into operating system fingerprinting with Nmap. its setup:

Nmap -0 –P0 –T4

The above command produced a message server crashed, and was no longer serving from Nmap that said it was scanning port 80, web requests. This caused a serious problem but during the scan port 80 appeared to be for the wireless network. If the web server was closed (i.e. it responded with reset packets). It down, the captive portal was still redirecting was then apparent that the captive port web users to the captive portal page, which www.insecuremag.com 12 displays a page not found error. This prevents Metasploit even legitimate users from entering their cre- dentials and using the wireless network. Even Metasploit is a fantastic tool for finding vulner- more interesting was that to solve this problem abilities in embedded devices, and as an the wireless controller had to be rebooted, added bonus is one of the best frameworks which means all clients lose wireless connec- available for exploit development when you tivity because the access points are “thin” and are ready to take it to the next step rely on the controller. This is now a very useful [tinyurl.com/2zqbzu]. Metasploit 3.0 has a took for attackers, as causing all users to dis- couple of modules that you can use to fuzz associated and re-associated to the wireless wireless (802.11) stacks. I like to use the network is a powerful action. The attacker can auxilery/dos/wireless/fuzz_proberesp module do this, and then capture WPA-PSK traffic for to find weaknesses in wireless access points. later brute forcing, pretend to be a wireless It is convenient to use the msfcli program, access point (aka. Evil twin), or spoof the SSL which lets you execute metasploit commands certificate of the captive portal and capture from the command line, to fuzz wireless driv- usernames and passwords. ers. For example:

./msfcli auxiliary/dos/wireless/fuzz_proberesp DRIVER=madwifing ADDR_DST=AA:BB:CC:DD:EE:FF PING_HOST=192.168.1.1 CHANNEL=6 E

The above command will send bogus probe wireless adapter on the same subnet as the response packets to the device at the listed access point you are testing. address. Probe response packets are typically sent by the wireless client to the access point For example, if you crash the wireless driver, in response to beacon frames and indicate but the access point is till running, you want that the client would like to associate to the the ping test to fail. If you!ve plugged into the access point. The ping host is the IP address Ethernet port on the access point, your ping to ping while doing testing to see if the host packets would only fail if you caused a system being tested is till alive. It is important that you wide crash. If you miss enough ping packets associate to the access point with a different Metasploit will spit something out like:

"P\000\000\000\000\032pu\265\375+\r\311xTM+\r\311xTM\000\366\215\364\314\325z%\3 14N\311g\e\345\000\336TkVGjC1mTEQRmNrulZNV8lqpoEa5WOxOqTZewkL2e6WBr0aQQgQFKLVkjw 8Wg5gRNTV3qEYXBHqKBWyHJc7s7puT6nFaI5sVRFOglbe98864GMLb0RSPEQ7nILpqM9kW6V8r8J47MR X03PDf69v9LgqPZPBdQd4kdA93nWClwTHOieDK4sWvq2uXwJhxaIdchxo12s8SOCoKZGc1cQnVW94SAI xC72\001\b\202\204\213\226\f\0300H\003\001\006\t#Mj\272\\\254\225\000\323\310\"\ 272X3J\364m\214\005\344\251tH\302w\362\330\351j\232R%*\376\317\221h\217\361\360\ 200i\340nw\326\243\216}\315:\225\226\n\025w\323\201\251\343\320\310\003v\325\017 \030\235\327\300\354\200\267\277!\207\233\326Z\325\344453Y\333\t9\266\260\235Z\2 11\260\235t\253\212\377\246\351\272\226\020\324e\254\233\nm\247-\254\251]{\375\2 05\2020\022\344f_07\275\210\326\246\023\372W\205\276\034w!\301:C\261T\316\206\25 3\365k<\233\222]\261\201K\335\266\255\377w\v\234\233\267\026\232u\243nV\330XM\34 6GM\016\eGU\a\230/\325z\331}s%\t:4\207\001\253y\203g\037\024\025\020L;\225Fw\t&J 0\036\230\2512H\357'z\30 1\313s\274\000"

The above is the raw packet information, to-date. It may seem like a daunting task to which can be interpreted by the ruby functions update the firmware on all of the printers in within Metasploit. your environment, however given the current threats and research trends it!s a task that Protecting your embedded devices must be completed on a regular basis. If you are a home user, updating firmware on your Keep your firmware up-to-date router will protect you from many of the cur- rent threats. With all embedded devices, even Just as it is important to keep your operating if it means scheduling regular maintenance system and associated software up-to-date, its time, it is critical to keep them up-to-date. equally as important to keep your firmware up- www.insecuremag.com 13 Default settings cannot be trusted nefarious activity that may occur on the vari- ous platforms that do not have the capability I!d say the number one downfall of embedded to log locally. devices with respects to security are default settings. Wireless routers come with default Separate and protect your embedded de- SSIDs and username password combinations vices that allow for easy attacks. The OpenWrt pro- ject has addressed this issue with its Kami- Put printers (and other embedded devices of kaze release, which disables the wireless similar security requirements) on their own network by default and prompts the user to subnet and firewall them from the rest of the enter a password rather than come with one network. Then, tailor the rules just like you by default. You have to harden your embed- would for your servers and only allow the ports ded devices just as you would your worksta- that are required. tions and servers. This means disabling serv- ices that are not in use, enabling firewalls and Conclusion filtering rules, and most importantly changing default passwords. As the information security field evolves, changes, and improves, so do the attackers Monitor embedded devices just like every and their techniques. Embedded devices are other host ripe for the pickings, and attackers will begin to target and compromise embedded devices Do you have intrusion detection on your man- to achieve their goals. agement networks? Would you detect an at- tack aimed at your printer, or even originating Embedded devices carry our sensitive infor- from your printer? Monitoring is a critical piece mation and allow for sophisticated attacks that of your overall security strategy, and it must can be used to control various aspects of our include all of your embedded devices. This network and compromise our security. Chang- could manifest itself as an intrusion detection ing the way we treat our embedded devices is sensor, and/or be a centralized logging facility the key to success. We need to recognize that includes routers, wireless access points, that embedded devices need to be locked printers, and web cameras. Having remote down and secured just as any other device in logs from these devices will help you to detect our organization.

Paul Asadoorian is the weekly host of PaulDotCom Security Weekly (www.pauldotcom.com), a security podcast focused on the latest security news and hacking. He is also the author of the new SANS course titled “Embedded Device Hacking”.

Paul would like to thank Raul Siles for his input and direction in the writing of this article.

www.insecuremag.com 14 Qualys is a key player in the on-demand vulnerability management and policy compliance market. The company's flagship service QualysGuard is used to conduct automated security audits without any need of software or hardware installation by its users. The service is provided through a very fast and sta- ble online application which does over 150 million IP audits per year.

The user interface is very adaptive and you Mapping will need just a couple of minutes to make yourself comfortable in it. The application is The first step of your network security scan divided into a couple of content frames, mak- starts with a mapping module. While you can ing it easy to work with. The left menu naviga- skip this part and target the specific IP ad- tion opens all the important QualysGuard dress or a network block, it is recommended modules, while the top drop down menus offer to use it because you will get a glimpse of all configuration and setup options for the cur- the computers that can be mapped from the rently active module. outside. Before you create a new map, you should add your target domains. Each domain Besides the technical options, you will also may include one or more netblocks (IPs and find a large collection of support documents, IP ranges). Before running the map, my sug- containing detailed information on every pos- gestion would be to fill QualysGuard with all sible aspect of the application usage. If this is the possible data on your network by creating not enough, you also get access to both e- asset groups. An asset group can include IPs, mail and phone support that will give you all domains/netblocks, and scanner appliances the answers you need. that exist in your account. Each of the groups can contain a specific set of computers and This article will cover main aspects of Qua- network devices and can be very useful in the lysGuard usage which I divided into five sec- scanning process where you want to target tions - mapping, scanning, reporting, remedia- particular assets. tion and risk analysis. www.insecuremag.com 15 QualysGuard user interface

Repository of mapping results

For launching the map you will need to manu- formats, as well as checking out the detailed ally select the domain or asset group you want report on the discovered hosts. The data is to work with and in just a couple of seconds very well presented, so with a click of a mouse the detailed map will be available within the you will be able to add hosts to new asset interface. You will have the possibility of down- groups, as well as start or schedule security loading the results in a number of different scans on them.

Example map of the Qualys test network

www.insecuremag.com 16 Scanning should very interesting to a large number of users. The user can chose one of those Starting the scan is also a no frills process. If scans, but can also customize them through you worked your way through the mapping an "Option profiles" selection in the tools stages you already have all of your hosts sit- menu. There you can chose the advanced ting comfortably in a line for scanning. By de- mode that will offer quite an extensive list of fault the system has some default scanning setting you can change. These options are profiles including the default one, Payment related to ports, performance, load balancers, Card Industry (PCI), Qualys Top 20 and brute forcing, vulnerability detection, as well SANS20 scan. The latter three are self de- as authentication. By setting up authentication scriptive, as they cover a specific set of credentials, the scanner can log into hosts at threats and the first one is a general scan that scan time to extend detection capabilities.

Option profiles for the vulnerability scan

After the scan is started, the process goes into successfully completed, you will immediately the background and you can watch its status be able to check the results. In the same type through the Scan interface. Depending on of user interface as with mapping, you can your network or scan complexity, this can take both download the report or view a full status some time (30-45 minutes per host). After it is that opens in a pop-up window.

Vulnerabilities found on one of the hosts www.insecuremag.com 17 Reporting lysGuard applications hosts quite a lot of dif- ferent templates focused on particular sub- The default report template provides a rather jects. You will find ways to satisfy your execu- comprehensive amount of information on the tives (Executive Remediation Report, Execu- found vulnerabilities. You will get a standard tive Report,Payment Card Industry Executive set of host information, followed by a vulner- Report), as well as your technical peers ability summary charts and images, as well as (Payment Card Industry Technical Report, a quite detailed list of the vulnerabilities sorted Technical Report, High Severity Report). Be- by its importance. Every detected vulnerability sides these vulnerability and compliance re- hosts detailed facts about the issue, contain- ports, there are also templates for the popular ing the threat description, impact, possible SANS and Qualys top 20 lists, as well as workaround solution and further links helping ticket reports that are related to the remedia- the user to remediate the problem. tion module discussed later in the article.

While the default report seems to be sufficient, For more advanced QualyGuard usage, there there are of course a number of people in the is a simple way of creating your own custom- organization you will need to present to. ized report templates. Therefore, the "Report" section of the Qua-

Report templates in QualysGuard

Snippet from a vulnerability report www.insecuremag.com 18 Choosing the "New map template" from the nerabilities by using recommended solutions menu opens a pop-up window with advanced (patches or workaround scenarios provided in settings containing host types, discovery the scanning reports). methods, operating systems and much more needed to create a totally new report template Each created ticket is connected to a specific focused on the needs of your organization. vulnerability that is accompanied with a unique Qualys ID (QID). If you are using the Remediation ticketing, it is recommended to create a cus- tomized policy that will push automatic crea- Within the application you will find a dedicated tion of tickets. ticketing service for prioritizing and fixing vul-

Creating a custom policy

Each policy rule contains details connected to assign tickets to different users, as well as the scanning hosts, type of vulnerabilities and create deadlines and ticket expiry dates. ticket actions. As regarding the vulnerabilities, the best way is to target higher levels of secu- The remediation module has its own report rity issues, but the application can also target templates including Executive Remediation just the particular vulnerabilities. The vulner- Report, Tickets per Vulnerability Report, Tick- ability database is regularly updated and you ets per User Report and Tickets per Asset can easily search it to find the QID you are Group Report. after. Under the ticket action menu you can www.insecuremag.com 19 Active ticket related to an SSL server

Risk analysis you'll get a report stating whether your hosts are affected by it. The service is also able to Risk analysis is a quite interesting option for determine whether hosts are likely to be at checking out your network security status for risk to potential vulnerability by comparing ex- specific vulnerability. Within just a couple of ploit data to known information from past seconds you hosts will be scanned for the par- scans. ticular security issue (based on a QID) and

Results of a risk analysis test for a sample vulnerability

Final thoughts With its powerful technology provided through a web browser user interface, QualysGuard is I tested QualysGuard for a couple of days and perfect solution that combines efficient auto- I can really say that it is a terrific security solu- mated security scans, powerful reporting and tion for both large organizations with dis- a must have ticketing procedure for tracking persed and complex networks, as well as the remediation status of active vulnerabilities. small businesses.

Mark Woodstone is a security consultant that works for a large Internet Presence Provider (IPP) that serves about 4000 clients from 30 countries worldwide.

www.insecuremag.com 20 CCTV technology is in a period of rapid evolution. A key component of this change is the emergence of network based or Internet Protocol (IP) cameras. The transition from analog to IP is a difficult one because it requires knowl- edge of two previously separate disciplines - traditional CCTV technology and networking technology. There is a huge learning curve for existing CCTV re- sellers and installers that must be overcome for IP technology to be applied productively. This article will answer some basic questions about the differ- ences between the analog and network-based approaches and where each is best employed.

Overview verts the analog signal to digital, compresses it, and then stores it on a hard drive for later The first diagram on the following page de- retrieval. picts the basic setup of an analog camera sys- tem and a network-based, or IP camera sys- Intelligence is built into the DVR to handle tem. In the traditional analog CCTV applica- such things as scheduling, motion detection, tion, security cameras capture an analog and digital zoom. Monitors for viewing the video signal and transfer that signal over coax video are connected to the DVR, or it can be cable to the Digital Video Recorder (DVR). set up to publish over an internal network for Each camera may be powered by plugging in viewing on PCs. The DVR can also be set up the power supply right at the camera or by us- to broadcast over the Internet and can add ing RG59 Siamese cable which bundles the password protection and other features. video and the power cables. The DVR con- www.insecuremag.com 21 When broadcasting over the Internet, the one stream (one IP address). Therefore, it is video for all of the cameras is transmitted as very efficient.

In the IP world, each network camera captures set up its IP address and other identifying at- an analog image but immediately converts it to tributes. digital inside the camera. Some digital proc- essing can happen right at the camera, such Software is required on each PC that you want as compression and motion detection. The to view the cameras or playback video. An- digital video stream is then broadcast over the other high powered PC is set up with the ap- IP network using Ethernet (CAT5) cable. The propriate software to record the cameras. power supply may be plugged in at the cam- Since communication standards are not con- era or can be run over the ethernet cable by sistently followed in this industry yet, the view- using Power-Over-Ethernet (POE) adapters. ing and recording software must be purchased The CAT5 cable for each camera is plugged from the same vendor that sells the IP cam- into a switch which feeds into the network hub. eras. This can make switching or mixing cam- As with all network devices, some set-up era vendors very expensive. needs to be done for each network camera to www.insecuremag.com 22 Typically that requires a high-powered PC with for most security applications. Later on, a considerable hard drive space. Often, that will couple of scenarios will be introduced cost as much as or more than a DVR. Even whereby an IP-based solution might be less more significant is the price of the recording expensive. software which tends to be expensive. Li- censes are typically based on number of cam- A typical medium quality analog dome camera eras, and per user. The IP camera signal is sells retail for about $100 to $200. A similar broadcast over the Internet in the same way quality IP camera sells for at least twice that that a DVR signal is. However, each camera is amount. Analog cameras are available with a separate stream and has its own IP address many different features: varifocal lenses, high or port. This can greatly affect bandwidth as resolutions, and long distance infrared, for ex- we!ll see below. When viewing remotely each ample. camera can be pulled up individually by its IP address. If you want to see all of the cameras Finding just the right combination of features side-by-side, additional software (again, from in a network camera for your application might the same camera vendor) must be installed. be difficult and very expensive. Sometimes you may have to buy an analog camera and Which approach is more cost-effective? add a separate video server to do the job. Single-channel network video servers cur- For now, installing analog cameras coupled rently start at about $300 retail. with DVRs is the most cost-effective approach www.insecuremag.com 23 IP advocates will point out that a digital video above would require approximately 67 Gigs of recorder is not required in an IP solution. That hard drive space to record one day!s worth of is true, but some device will still be needed to video. record the camera images. Typically that re- quires a high-powered PC with considerable It!s worth noting that DVRs will also use hard drive space. Often, that will cost as much bandwidth if viewed remotely over a network. as or more than a DVR. Even more significant However, the DVR will only use bandwidth if is the price of the recording software which people are currently viewing the cameras. tends to be expensive. Licenses are typically Otherwise, they will not. Furthermore, a DVR based on number of cameras, and per user. will combine several camera images into one video stream vs. a separate video stream for IP advocates may also point out that busi- each camera, as in IP. For example, a typical nesses often have IP networks in place and 16 camera DVR will combine its camera im- therefore no additional cabling or hardware is ages and throttle its output to a maximum needed. However, each camera requires a 360Kbps. To run 16 similar IP cameras on a port to plug into the switch, so more or bigger network would generate about 11Mbps. switches may need to be purchased. POE adapters might need to be added. If the exist- Which approach is better quality? ing network will not handle the load of the ad- ditional network devices, upgrades might need There are poor quality components and good to be made, thereby making the installation quality components no matter which type of more expensive. system is used. That being said, network cameras do offer some technological ad- Finally, bandwidth on the network needs to be vances in the areas of video quality and wire- considered. Video uses a lot of bandwidth. less installations. The bandwidth used by each camera varies by many factors including the resolution, the Analog cameras cannot provide resolution compression method, and even the amount of above TV standards, the maximum being movement in the field-of-view. about 0.4 megapixel. Resolution of IP cam- eras can be many times higher (currently up to As a general rule, a camera using full CIF 3 megapixel) and they can capture a clearer (352 x 288) resolution, 30 frames per second image when objects are moving. This could (30 fps), and MPEG4 compression will require make a difference in high risk applications about 720K bits per second (720Kbps). There- such as for casinos and law enforcement. fore, if we put 100 IP cameras on a network, Wireless communication over IP networks has we would use about 72Mbps more bandwidth. fewer problems with interference, and encryp- This number will double if audio is also trans- tion security is built into the technology. mitted. It should come as no surprise, then, that some companies have gone so far as to Which approach is easier to install and create an entirely separate IP network just to configure? run their camera system. If an IP network is already in place at the in- To make bandwidth matters worse for IP – stallation site, and it can handle the additional many of the newest IP cameras are coming load of the new cameras, then IP cameras will out with "megapixel! resolution. This is wonder- be easier to install. ful from the standpoint of how much clarity and field-of-view can be captured, but it If additional RJ-45 jacks are needed to plug in comes at a huge price to bandwidth. A single the network cameras, then the installer only 2-megapixel IP camera, running 30 fps with has to run a CAT-5 cable from the camera to MPEG4 compression will use a whopping the nearest switch. An inexpensive switch can 6.5Mbps of bandwidth. be installed right at the nearest wall jack. In contrast, each cable for analog cameras must These high-resolution IP cameras also require be run all the way back to the DVR. a great deal of hard drive space to store the video. The 2-megapixel camera described www.insecuremag.com 24 If upgrades need to be made to an existing IP width network installed – especially if the network to handle the additional load, obvi- cameras will be spread out over a wide area, ously the installation would be more difficult. or if wireless cameras will be used.

The power for the cameras can be handled For large installations with many cameras, fairly easily with either technology. For IP net- some installers still prefer a multiple DVR so- works, use Power-Over-Ethernet (POE) lution to an IP solution. Software is bundled transmitters to send the power through the ex- with higher-end DVRs that allows you to view isting CAT-5 cable. and record cameras from multiple DVRs. Us- ing analog cameras and multiple DVRs can be For analog systems, use RG59 Siamese cable less costly than purchasing many IP cameras to combine the video and power cables into along with the required software licenses. one jacket. Either way, there is no additional cabling for power. POE can run 300 feet with- The multiple DVR solution also provides better out a repeater. RG59 can be run 1000 feet fail-over protection. If the network goes down without a repeater. in an IP based system, video is lost from all the cameras. If the network goes down in an Once the cabling is in place, configuring the analog system, the DVRs are still recording system is less difficult for analog systems. the cameras. If one DVR has a problem, only With analog, you plug the cameras into the the recorded video from the cameras on that DVR and you!ve got video. For IP cameras, particular DVR is lost. In contrast, if the re- you have to assign each camera a network cording PC goes down in an IP system, all address and open up ports on the router. It!s video recording is stopped. easier to set up cameras for internet viewing using a DVR because access is provided to all Conclusion cameras at once by using one external IP ad- dress to the DVR. Network-based camera security is not yet the most cost-effective solution for most applica- What about wireless? tions. The technology simply hasn!t matured enough. Furthermore, professional skills are Analog wireless systems do not work well. not widespread to effectively design and im- This is because the government regulates on plement these systems. which frequencies analog wireless devices can run and how strong the signal can be. In- Five years from now, the above questions will terference from other wireless devices such as be obsolete, and new issues will take their cell phones can cause the camera video to be place. Network CCTV technology will continue distorted. Interference is especially problem- to evolve. New standards will be implemented, atic in buildings with florescent lighting. allowing the components to communicate more effectively with each other. Better stan- Digital IP wireless is much better. The digital dards will also allow third-party development transmission does not get interference from of the software which will improve the software other analog wireless devices, and the quality and bring down the overall cost. 802.11x communication standard used has encryption built in. Consequently, there is no With new products such as next-generation problem with unauthorized access to the DVRs and network camera servers, the lines video. between these technologies will continue to dissipate. Hybrid solutions will be developed, For what applications should I consider which will employ both analog and digital IP? components seamlessly.

IP cameras should be considered for large in- stallation sites that already have a high band-

Dave Page is President of Discount Security Cameras, a US provider of professional security camera and sur- veillance equipment. See the website at www.discount-security-cameras.net. www.insecuremag.com 25 Ubuntu for Non-Geeks, 2nd Edition: A Pain-Free, Project-Based, Get-Things- Done Guidebook By Rickford Grant No Starch Press, ISBN: 1593271522

Tackling any operating system as a neophyte may be quite challenging. Thankfully, if you're thinking about giving Ubuntu Linux a spin, having this book on your desk will make life much easier. The book is divided into 18 chapters in which the author guides you through a myriad of tasks such as using the command line, installing applications, working with your iPod, updating software, and much more. The material is aimed at new users that want to get introduced to all that Linux has to offer. Read a complete review at: www.net-security.org/review.php?id=167

LAN Switch Security: What Hackers Know About Your Switches By Eric Vyncke, Christopher Paggen Cisco Press, ISBN: 1587052563

The majority of security books we review are focused on specific technologies, software platforms and hot security issues everyone is talking about. Cisco Press has a rather extensive line of books discussing their networking and security products and their publications often provide information on some lower level security issues. "LAN Switch Security" is a perfect sample of this kind of publications - authors Vyncke and Paggen are here to tell you why Ethernet switches are not inherently secure. Read a complete review at: www.net-security.org/review.php?id=168

www.insecuremag.com 26 Virtual Honeypots: From Botnet Tracking to Intrusion Detection By Niels Provos, Thorsten Holz Addison-Wesley Professional, ISBN: 0321336321

In order to stay one step ahead the attackers you have to learn what they know. Virtual honeypots enable security professionals to identify potential risks and improve their defensive techniques.

Written by two industry veterans, "Virtual Honeypots" promises to tackle this topic heads-on, with lots of technical details. Read a complete review at: www.net-security.org/review.php?id=164

Linux Firewalls: Attack Detection and Response with iptables, psad, and fwsnort By Michael Rash No Starch Press, ISBN: 1593271417

Linux Firewalls discusses the technical details of the iptables firewall and the Netfilter framework that are built into the Linux kernel, and it explains how they provide strong filtering, NAT, state tracking, and application layer inspection capabilities that rival many commercial tools. You'll learn how to deploy iptables as an IDS with psad and fwsnort and how to build a strong, passive authentication layer around iptables with fwknop. Read a complete review at: www.net-security.org/review.php?id=165

Security Data Visualization: Graphical Techniques for Network Analysis By Greg Conti No Starch Press, ISBN: 1593271433

The visualization of security data is useful to the modern security analyst, and it will certainly become essential in certain environments very soon. Never has there been more traffic, more threats and a variety of other reasons to learn more about it. One thing is certain, after going through this book you'll realize that going through an endless stream of raw logs is not the only way to keep an eye on your network and identify potential threats. Read a complete review at: www.net-security.org/review.php?id=169

Cisco NAC Appliance: Enforcing Host Security with Clean Access By Chad Sullivan, Jamey Heary, Alok Agrawal and Jerry Lin Cisco Press, ISBN: 1587053063

Cisco Network Admission Control (NAC) Appliance, formerly known as Cisco Clean Access, provides a powerful host security policy inspection, enforcement, and remediation solution that is designed to meet these new challenges. This Cisco Press publication provides you with all the information needed to understand, design, configure, deploy, and troubleshoot the Cisco NAC Appliance solution. You will learn about all aspects of the NAC Appliance solution including configuration and best practices for design, implementation, troubleshooting, and creating a host security policy.

www.insecuremag.com 27 Designing BSD Rootkits: An Introduction to Kernel Hacking By Joseph Kong No Starch Press, ISBN: 1593271425

Designing BSD Rootkits introduces the fundamentals of programming and developing rootkits under the FreeBSD operating system. In addition to explaining rootkits and rootkit writing, the book aims to inspire readers to explore the FreeBSD kernel and gain a better understanding of the kernel and the FreeBSD operating system itself. Written in a friendly, accessible style and sprinkled with geek humor and pop culture references, the author favors a "learn by example" approach that assumes no prior kernel hacking experience.

End-to-End Network Security: Defense-in-Depth By Omar Santos Cisco Press, ISBN: 1587053322

End-to-End Network Security is designed to counter the new generation of complex threats. Adopting this robust security strategy defends against highly sophisticated attacks that can occur at multiple locations in your network. The ultimate goal is to deploy a set of security capabilities that together create an intelligent, self-defending network that identifies attacks as they occur, generates alerts as appropriate, and then automatically responds. End-to-End Network Security provides you with a comprehensive look at the mechanisms to counter threats to each part of your network.

Practical Packet Analysis: Using Wireshark to Solve Real-World Network Problems By Chris Sanders No Starch Press, ISBN: 1593271492

Wireshark is the world's most powerful "packet sniffer", allowing its users to uncover valuable information about computer networks. Rather than simply take readers through Wireshark's tools Practical Packet Analysis shows how to use the software to monitor their own networks. The book is aimed at network engineers and system administrators, but it's clear enough even for Wireshark newbies. Includes a bonus CD with trace file examples as well as videos that show packet analysis in action.

Cisco ASA, PIX, and FWSM Firewall Handbook By David Hucaby Cisco Press, ISBN: 1587054574

This is a guide for the most commonly implemented features of the popular Cisco firewall security solutions. Fully updated to cover the latest firewall releases, this book helps you to quickly and easily configure, integrate, and manage the entire suite of Cisco firewall products, including ASA, PIX, and the Catalyst Firewall Services Module (FWSM). Organized by families of features, this book helps you get up to speed quickly and efficiently on topics such as file management, building connectivity, controlling access, firewall management, increasing availability with failover, load balancing, logging, and verifying operation. www.insecuremag.com 28 Robert ("RSnake") Hansen (CISSP) is the CEO of SecTheory, an internet secu- rity consulting firm. Mr. Hansen founded the web application security lab at http://ha.ckers.org. He has worked for eBay, Realtor.com and Cable & Wire- less. He has spoken at Blackhat, Microsoft's Bluehat, and he is a member of WASC, OWASP, and ISSA.

What is the proper way to manage web time about how to protect yourself, using li- application security? What are the the braries for each instance of insertion into a most important things to keep an eye on? database (a database access layer) really helps to nail things down. Ultimately though, One of the most important things to remember websites are pretty custom these days so it's is to log. I see a lot of people using things like a crap shoot on if you are doing a good job in Google Analytics or Omniture, but because your application if you don't know what you're they use tracking pixles and JavaScript they doing. A crap shoot with really bad odds, I miss almost all the interesting things that a might add. website sees. If you can't see your traffic how can you possibly know what's going on? Once When doing research, how do you you have that, focus on the primary approach a potential vulnerability? attack points. Typically on a site that has us- ers, those are the authentication pages, the I generally start with an assumption of vulner- registration pages, the change password, ability - I'm rarely proven wrong, unfortunately. change email address, change secret ques- Unlike binary exploit development you don't tions and inter-user communication pages. see things crash - a lot of times I have a lot less information to go on than your traditional Focus the majority of your security in those exploit author. However, one of the advan- places. Of course, I always like to use librar- tages of knowing how to program is I know ies to mitigate things like CSRF, XSS and what shortcuts and mistakes I'd probably SQL Injection. Instead of having to worry each make in an effort to ship something if I had www.insecuremag.com 29 written the software. One thing you'll hear me start seeing that there are a lot of vulnerabili- saying over and over to people I meet is that ties in almost everything we use on the web. the only difference between programmers and hackers is that programmers spend their en- In your opinion, how has the web security tire day trying to make something work, while scene evolved in the last few years? hackers spend their entire day trying to think of ways to make the same thing fail. Honestly, when I started in webappsec it was back in the mid 90's. The last few years To be more precise, there is almost always though have been the really interesting part. additional functionality you can add into a It's not due to AJAX, despite what a lot of program by understanding that most pro- people thing. It's due to SAAS (software as a grammers don't really understand regex, they service). People suddenly started thinking that fail to sanitize and even if they do know what everything they do needs to be on the web. they're doing they often don't think of all the Almost everything I want access to is now ac- use cases. People say that a thief has to get it cessible with a credential and a browser. That right every time while a police officer has the makes things a lot more exciting from a secu- luxury of being able to hit and miss. Unfortu- rity perspective. We basically eradicated one nately in the virtual world it's reversed in some of the original reasons we had a firewall - to ways - the attacker has a huge protect our sensitive data from the outside. advantage in that they only have to find one exploit, while the developer has to protect Two years ago I could count the interesting against everything. webappsec sites on one hand. Now there are dozens of them - too many to keep up with With that in mind, I spend a great deal of time actually. In fact I have trouble keeping up with thinking of how things can be used in slightly sla.ckers.org alone, and I run it! Now that different ways than they were intended and people are becoming more aware of the is- therefore abused. That's how I came up with sues, it's starting to manifest itself as more most of the Intranet hacking stuff with JavaS- interesting tools, and techniques. I feel pretty cript. By taking a step back and saying, "Wait, confident a determined group of hackers sure, my browser can contact anything on the could break into any website these days, and internet, but is that always a good thing?" you that's finally legitimized the niche of we- bappsec.

The only difference between programmers and hackers is that programmers spend their entire day trying to make something work, while hackers spend their entire day trying to think of ways to make the same thing fail.

What web application scanners do you proves. But to answer your question, my fa- use? vorite tools in my arsenal (including the man- ual ones) are: Burp Suite, THC Hydra, fierce, A better question would be which ones don't I Nessus, Nikto, nmap, NTOSpider (commeri- use! I change around quite a bit depending on cal), httprint, Cain, sn00per, Absynthe, the website, the circumstances, and the time I Sqlninja, a half dozen Firefox plugins like have to audit. Unfortunately, the more com- Webdeveloper, JSView, NoScript, Grease- prehensive scanners can take days to scan a monkey etc... and the entire suite of unix utils complex app (or more). A lot of times I don't out there, like wget, telnet, ncftp, etc. have that kind of time, so I end up doing the majority of my work by hand. It's kind of sad It's really sad that I don't need much more that I end up finding more issues than most than that do be pretty effective at breaking scanners, and more quickly - but I think that into the majority of sites out there, now that I will change with time as the technology im- think about it.

www.insecuremag.com 30 When it comes to security, what's your pull in the JavaScript - so using JSON can be take on the increasing use of Ajax in all dangerous if it contains sensitive information. sorts of web applications? The only new issue that I've seen it create is This is a tricky subject and depending on who that sometimes people will throw all the sensi- you talk to you'll get different answers. Here's tive information into the AJAX request and let my take. AJAX for the most part doesn't add the JavaScript parse it apart. All you need to any additional vulnerabilities. There are some do is watch the wire or look at the JS source caveats to that though. The first is that tradi- and suddenly you get all the information you tional applications only have to sanitize output were after. That's rare, but it does happen, once (at the server level). AJAX apps have to where it never happened before. Honestly do it twice, once at the server and once in the though, I think AJAX is a bit over hyped from JavaScript. So it doubles up the potential for a security perspective except for the fact that vulnerability, as you can send the information more websites are building more dynamic ap- directly to the server bypassing the JavaScript plications - which is always a dangerous protection. It also allows remote websites to proposition unless they know what they are doing.

I think AJAX is a bit over hyped from a security perspective except for the fact that more websites are building more dynamic applications - which is always a dangerous proposition unless they know what they are doing.

You are one of the authors of "Cross Site lic. It was never designed to be secure. It Scripting Attacks: XSS Exploits and De- used to suffer from lots of cross site scripting fense". How long did the writing process and cross site request forgery exploits. Some take? What was it like to cooperate with of that stuff has been closed down, some other authors? Any major difficulties? hasn't. But really the underlying problem that I believe it suffers from is that it has the ability The whole thing from start to finish was only a to write to disc, instead of being in the data- few months (which you may be able to tell base context. It can overwrite php files, .htac- from some of the editing). But honestly, the cess files and does so as the www user. If group really came together once PDP got on there is ever any server vulnerability, kiss your board. I think we all struggling to find the time website goodbye. If that's not scary enough, if to write our sections until he got there and you are running on a shared host, other users saved the day. of the system can take over your website since the files need to be writable by the web- As it stands, I think PDP wrote 1/3, I wrote 1/3 server user. and the rest wrote the remaining portions. We all contributed pretty heavily, and given how I'm just not a fan of that architecture - which is much material is in the book, I think it turned problematic since I run a WordPress powered out very well. The only major difficulties were blog. Over the last 6 months or so I've made getting the time necessary. I had no idea how heavy modifications, mostly involving remov- hard it would be to write that book, honestly. ing most of the functionality people like about administering WordPress. A lot of people have Recently you've pointed out serious prob- asked me for the source, but I haven't made it lems with WordPress security, can you open source. It's something I've considered, share some details with our readers? but there are lots of other more important pro- jects on my radar than supporting an open Fundamentally, WordPress suffers from all the source platform. So it's on the back burner for same problems as any home-brew application now. that was organically built for the general pub-

www.insecuremag.com 31 What should be done to increase web curity community, have done a miserable job application security awareness? in giving consumers the correct tools to se- cure themselves. I've never been a fan of consumer education for security - I've seen reports where compa- I like to quote Hamlet, "The fault, dear Brutus, nies have spent millions on user education is not in our stars, But in ourselves..." I don't and not seen any lift in their fraud ratios as a look to consumers to solve the security com- result. But I think there is hope in educating munity's problems. We as a security commu- security people of the issues. I know lots of nity have a very serious problem to fix, and I people think that stupid users are to blame for think it mostly comes down to educating the getting hacked, but I totally disagree with that people who can actually make the biggest dif- (I like to think I have a pretty modern view of ference - the browser and operating system security in this regard). community.

Let's take an example of a user who logs into I've spent the last three or four years working a Windows machine for the first time. It com- closely with Microsoft and Mozilla to make plains that there is no AV or Firewall. So they them aware of the problem, offering sugges- turn on Windows firewall or install another tions and helping them test their emerging one, and the AV of their choice. They patch up technologies. Demonstrating vulnerabilities because Windows yells at them. Does that and helping them fix their products is the only make them secure? They've followed every way to help consumers long term by coming piece of advice that we as the security com- up with best practices and better security munity have programatically offered them. technologies that fundamentally shift how we The answer, unfortunately is that we, as a se- do business online.

We, as a security community, have done a miserable job in giving consumers the correct tools to secure themselves.

What are your future plans? Any exciting maybe one of these days I'll hire a full time new projects? technical research assistant to finally build all my crazy ideas for me! Well, I'm getting my company up and off the ground - helping companies realize their ex- As a parting thought, I'm pretty overwhelmed posure, and fixing the holes. So I've been by the support of the community. A few years pretty swamped with that. But I always have ago there was almost no one doing any note- 50 projects in the wings. Most recently I've worthy research and suddenly over the last been doing a lot of work on understanding the two years everyone has started paying atten- costs of bots on a web application. There are tion. I get a lot of credit for raising webappsec lots of hidden costs, and most people don't awareness, but I'm only one person. get that the application is getting hurt in more than just a few ways by a single malicious ro- Ha.ckers.org has been marked as a phishing bot. I'll write up some results once I get some site, a malware site, it's been taken offline, time to sort through the data we've compiled. suffered countless attacks and it's been under scrutiny by just about every agency on earth. Another project I've been working on for quite It's one of the hardest websites on earth to a while is the Fierce domain scanner (which is maintain. But the good news is the readers really helpful in finding non-contiguous IP have taken the message home to their com- blocks as a pre-cursor to an Nmap type scan). panies. None of this would have been possi- I've actually recently gotten a few volunteer ble without them and the other often unsung requests to help out with future revisions so researchers in the space. I'm hoping we'll see something interesting come of that. Really though, you never know,

www.insecuremag.com 32 In today!s world the protection of sensitive data is one of the most critical concerns for organizations and their customers. This, coupled with growing regulatory pressures, is forcing businesses to protect the integrity, privacy and security of critical information. As a result cryptography is emerging as the foundation for enterprise data security and compliance, and quickly becoming the foundation of security best practice. Cryptography, once seen as a specialized, esoteric discipline of information security, is coming of age.

No one would argue that cryptography and Last line of defense for personal data encryption are new technologies. It was true decades ago and it is still true today – encryp- As many merchants and retailers take action tion is the most reliable way to secure data. in order to meet the stringent Payment Card Industry Data Security Standard (PCI DSS), National security agencies and major financial the need to protect sensitive credit card data institutions have long protected their sensitive is first and foremost on their minds. This is data using cryptography and encryption. To- highlighted in the recent finding by the Cana- day the use of encryption is growing rapidly, dian government that the lack of proper en- being deployed in a much wider set of industry cryption was to blame for the TJX breach that sectors and across an increasing range of ap- exposed at least 45 million customers' credit plications and platforms. Put simply, cryptog- and debit card records. But looking more raphy and encryption have become one of the broadly the issue isn!t limited to just credit hottest technologies in the IT security industry card data. In September, more than 800,000 – the challenge now is to ensure that IT or- people who applied for jobs at clothing retailer ganizations are equipped to handle this shift the Gap Inc. were alerted to the fact that a lap- and are laying the groundwork today to satisfy top containing personal information such as their future needs. social security numbers was stolen, exposing the applicants to potential identity theft. www.insecuremag.com 33 It is clear that the protection of personal or pri- lated topics. The survey concludes that these vate data is critical to the well being of any pioneering organizations have already bene- company that stores or processes this infor- fited by lowering the instances of actual or po- mation. Encryption has become a last line of tential exposure while simultaneously reducing defense for data protection because, once actual key management costs by an average data is encrypted, if stolen or even simply of 34 percent. misplaced, it is rendered unreadable without the keys to decrypt that data. Cryptography - embedded security by default Survey says As Aberdeen and other independent analysts A recent independent survey conducted by have discussed, access to encryption technol- industry analyst firm Aberdeen Group shows ogy is getting easier and easier, with it often an increasing use of encryption and a growing coming along for free, and has already made need for centralized and automated key man- its way into a host of devices we use every agement. The survey, ”Encryption and Key day. Laptop computers, wireless access Management” found that Best-in-Class or- points, and even devices we don!t think of as ganizations (a category that Aberdeen defined being part of a typical IT infrastructure such as as including organizations that have seen the vending machines, parking meters, gaming most improvement in their IT security effec- machines and electronic voting terminals, tiveness over the past 12 months) demon- have encryption embedded. The same is true strated a tremendous increase in the number for business applications and data center of applications and locations deploying cryp- hardware such as back-up tape devices and tography in order to protect sensitive data database software. This is steadily resolving compared with one year ago and, conse- one of the big challenges with encryption, how quently, an increase in the number of encryp- to upgrade existing systems to support en- tion keys they have to manage. cryption without penalizing performance or costing a fortune in custom developments or Eighty-one percent of respondents had in- "bolt-on! encryption products. creased the number of applications using en- cryption, 50 percent had increased the num- Don!t forget the keys ber of locations implementing encryption and 71 percent had increased the number of en- The widespread availability of encryption is cryption keys under management compared good news but without a clear way of manag- with one year ago. ing its deployment a number of pitfalls remain. Organizations of all sizes and in all industries How is the growth of encryption and the need need to look seriously at the management of to manage the keys changing organizations' the cryptographic keys, the secret codes that behaviors? In order to address the challenges lock and unlock the data. Unless organizations brought about by the increased deployment of begin laying the groundwork today this new cryptography, Best-in-Class companies have age of encryption will present serious man- shifted their thinking and were 60 percent agement challenges. Encryption is a powerful more likely than the industry average group to tool, but getting it wrong either from a technol- take a more strategic, enterprise-wide ap- ogy or operational perspective can at best re- proach to encryption and key management sult in a false sense of security and, at worst, than the traditional more tactical approach of leave your data scrambled forever. addressing particular and isolated points of risk within their infrastructure such as the theft Protecting data is important, but if a key is of laptops or back-up tapes. To further quantify lost, access to all of the data originally en- this shift, the Aberdeen Group survey de- crypted by that key is also lost. To put it scribes the significantly higher priorities and bluntly, encryption without competent key corresponding investments by the same Best- management is effectively electronic data in-Class companies in specific encryption and shredding. Just as with house keys, office key management technologies to complement keys or car keys, great care must be taken to other organizational structure and process re- www.insecuremag.com 34 keep back-ups and special thought needs to chines and removing keys as machines and be given to who has access to keys. Estab- storage media are retired, fail or redeployed. lishing a key management policy and creating This frequently results in escalating costs par- an infrastructure to enforce it is therefore an ticularly in situations where security and audit important component of a successful enter- ability are high priorities. prise security deployment. In many situations the only way to adequately Key management brings encryption under deal with these challenges is through the use control of a dedicated, general purpose key manage- ment system. Such a system can act as a Key management can!t just be an after centralized repository for storing keys on be- thought, it is the process by which encryption half of multiple applications or "end-points!, and cryptography become effective security distributing keys on demand. This provides a and business tools. Key management is about simple mechanism to unify key management bringing encryption processes under control, policies and automate key life-cycle manage- both from a security and a cost perspective. ment tasks, greatly reducing costs and easing Keys must be created according to the correct time critical tasks such as key recovery, key process, backed up in case of disaster, deliv- revocation and auditing. Important product se- ered to the systems that need them, on time lection criteria include scalability and the and ideally automatically, under the control of range of end-points that can be managed both the appropriate people and, finally, deleted at in terms of target application and type of host the end of their life-span. In addition to the lo- platform and operating system. Finally due to gistics of handling keys securely, which are the unique security characteristics of key secrets after all, it is also critical to set and en- management tasks, the absolute security force policies that define the use of keys – the properties of the key management system be- who, when, where and why of data access. come important additional selection criteria. Archiving, recovery and delivery of keys are all This includes the security of the key reposi- crucial parts of the equation. For instance, if a tory, tamper controls surrounding audit capa- laptop breaks down or a back-up tape is sto- bilities and the fundamental integrity of the key len the issue is not just one of security, but management software. also business continuity. Information recovery takes on a whole new dimension, particularly Conclusion in an emergency situation when the recovery process is performed in a different location, by At the end of the day we need to protect our a different team, governed by different policies data. Increasingly, encryption is being seen as and on protected data that is years or even the best way to ensure that data is protected, decades old. What used to be a data man- but the ever growing use of encryption creates agement problem is now also a serious key a management challenge. The challenge, management problem. however, doesn!t need to be daunting. Imple- menting a flexible and extensible solution that Enterprise key management automates many of the time-consuming and recommendations error-prone key management tasks in an automated enterprise-wide manner is rapidly Traditionally key management has been tied becoming a priority for many organizations. In to the specific applications in use and there- order for enterprise-wide encryption to be de- fore quickly becomes fragmented and ad hoc ployed correctly, organizations need to deploy as the number of applications increases. the correct tool to manage the keys. In the Scalability quickly becomes an issue as a re- same way that data protection has moved sult of relying on manual processes for renew- from an IT challenge to a C-level issue, key ing certificates, rolling-over keys or moving management has become a high-level busi- and replicating keys across multiple host ma- ness imperative.

Richard Moulds is VP of product management at nCipher. He leads the company!s product strategy including that of keyAuthority, nCipher!s key management solution. Richard has more than 20 years of technology mar- keting and business development experience. Richard holds a bachelor's degree in electrical engineering from Birmingham University and an MBA from Warwick University, UK. www.insecuremag.com 35 In spite of greater awareness of the risks and security threats facing compa- nies and professional firms around the world today, security breaches are on the rise and seriously threatening the health of businesses and the privacy of their clients.

Even though IT administrators have at their cause data leaks are almost certainly under- disposal an extensive arsenal of security solu- detected and under-reported. tions, cyber criminals are still successfully at- tacking systems and stealing valuable data • A 2007 survey conducted by Forrester Con- which they can use for credit card fraud, iden- sulting among 151 enterprises entitled Data tity theft and other malicious activity – activity Loss Prevention and Endpoint Security: Sur- which is only limited to the imagination of the vey Findings shows that 52% have lost confi- cyber criminal himself. Companies in every dential data through removable media such as sector are continuing to report security USB drives in the past two years. The survey breaches and yet still allow their most sensi- also found that intellectual property, customer tive and confidential information to be ex- data and company financials are the top three posed. concerns for data loss at the endpoint while data loss via USB drives and other removable And the statistics confirm an unhealthy situa- media is the top concern (72%) for endpoint tion: security, followed by Trojans, spyware and other threats. • According to the Privacy Rights Clearing- house, between January 2005 and October • The third annual Higher Education IT Secu- 2007, more than 167 million records contain- rity Report Card released by CDW Govern- ing sensitive personal information have been ment, Inc. in October found that despite in- involved in security breaches in the US alone. creased attention to better IT security in The actual figure is probably even higher be- higher education, there has been little pro- gress and concludes that less than half of www.insecuremag.com 36 • campus networks are safe from attack, with • A former Boeing employee, accused of steal- 58% reporting at least one security breach in ing 320,000 files and leaking them to a news- the last year. Data loss or theft has increased paper, copied the sensitive information to a 10% in the last year, up to 43%. That includes portable drive during a period from 2004 to loss or theft of staff and student personal in- 2006, breaching Boeing!s security policies. formation. The firm calculated that the potential damage could cost between $5 and $15 billion. • Research carried out by GFI Software in Q2 found that 65% of companies were needlessly • A Japanese policeman from the Metropolitan putting themselves at risk because they un- Police Department in Tokyo was sacked after derestimated the threat posed to their net- the personal information of thousands of peo- work!s security by USB sticks, flash drives, ple relating to criminal investigations was iPods and PDAs. Although 49% of 370 UK leaked on to the internet from his computer. companies surveyed said they were con- Personal details of 12,000 people related to cerned about data theft, 65% did not consider criminal investigations were spread across the the use of these devices on their network to web and around 6,600 police documents were be a security threat and 83% admitted to giv- compromised. ing their employees USB sticks or PDAs to enabled mobile working (76%) and make data • A huge German manufacturing company suf- sharing easier (61%). fered an intellectual property breach in Q3, when it discovered that a competitor had cop- • A recent Information Security survey in the ied one of their products. A foreman had sent European Union demonstrated the vulnerabil- detailed information about a component to an ity of corporate information when it found that external design department without telling his 45% of employees take data with them when IT department or encrypting this information, they change jobs. Employees have taken any- thus allowing the competitor to get hold of it. thing from documents and lists to sales pro- posals and contracts. The weakest link

The statistics are backed up by numerous in- The adoption of the internet as a core busi- cidents that have hit companies around the ness requirement coupled with the massive globe. The following examples are just the tip uptake of consumer technologies – such as of the iceberg but serve to highlight the grow- plug & play, USB devices, Wireless devices, ing number of security breaches and data loss mobile phones and so on – have led to an in- cases over the past 10 months and the ease crease in the number of ways that can be with which data is being lost, stolen and used used by cyber criminals to achieve their target maliciously. and, in a way, they have made it easier for data to be leaked, copied and used fraudu- • Undoubtedly, the largest breach ever! TJX, lently. parent company to the TJ Maxx brand, re- vealed that at least 45.7 million credit and Most companies today deploy some form of debit card numbers were stolen by hackers security measure on their network. The most who accessed their computer systems at the basic of approaches to network security fo- TJX headquarters in Framingham, United cuses on the perimeter and the majority have Kingdom, over a period of several years. That a firewall, IDS, anti-virus and anti-spam soft- figure has now shot up to over 90 million. ware protecting them from outsiders. Larger enterprises which have a proper IT depart- • A US citizen stumbled across a computer ment in place are in a better position to dedi- memory stick at a filling station in Azle, Texas, cate more time and resources to the deploy- a town of about 10,000 northwest of Fort ment of vulnerability management solutions Worth, which contained information about the and other security measures to close as many Joint Strike Fighter, the US!s most expensive backdoors as possible and to narrow the weapons program. hacker!s window of opportunity.

www.insecuremag.com 37 But does this mean that their networks are se- Social engineering is another method how cure? Have they considered every attack vec- data can be coaxed out of people. The "at- tor? The answer, unfortunately, is no. tackers! do not need to be security experts but creative people who charm their way into Every network is as strong as its weakest link people!s lives and then use the knowledge and it only takes one small kink in a com- they obtain (such as passwords or access pany!s armour for a cyber criminal to enter, codes) to steal important information. An IT exploit the network and make off with precious administrator can control employee activity on commercially sensitive data and confidential the network, but there is little he can do to details belonging to hundreds if not thousands prevent employees from unwittingly giving out of clients who have put their trust in that entity. security information to outsiders. The proliferation of consumer devices and the increase in usage of social websites like The popularity and scale of growth of social Facebook and MySpace, have opened new networking sites is very worrying. Apart from avenues through which data can be obtained the obvious loss in productivity because em- and these are not managed by "traditional! se- ployees are wasting time seeing who has curity measures, because more often than posted what to their profile, there is a great not, the weakest link in a network!s security is risk that work details could be shared and not technology in itself, but the people who passed on to third parties, maliciously or oth- use it. erwise. Companies often believe that all em- ployees will follow all regulations and policies The human element in network security to the letter, they will comply with every re- quest and willingly not make use of any device Computer users can be considered as the or visit any unauthorized sites. Wishful think- least predictable and controlled security vul- ing! nerability. In the majority of cases, a lack of education and an understanding of basic se- Another issue to deal with is the volume of curity principles and procedures are the main data that can be stored on portable devices. causes of security breaches rather than mali- When floppy disks surfaced in the 1970s they cious activity (although the latter can never be could store a mere 320KB going up to 1.44MB ignored). However, the end-result is usually by the early 1980s. But since then portable the same: priceless data is lost, the company storage devices have so much capacity – up loses credibility and so on. to 8GB on a USB stick and 80GB on an iPod – that it is extremely easy for individuals to It takes so little for a security breach to occur. store personal information, software products Huge amounts of data are lost because em- and games on a memory stick that can be ployees put their passwords on sticky notes very easily concealed. The ease with which on their monitors, forget laptops or handheld data can be copied to and from a network has devices in airports, gyms and restaurants or in increased the risk of data disclosure incidents. their car, keep computers unlocked or It has also facilitated the upload of malicious switched on during lunch-breaks, overnight or code (e.g. a virus) that can expose networks over the weekend, leave USB sticks with sen- to trojans or rootkits which, in turn, may hijack sitive company information unattended or surf services and open ports that a hacker can the internet from home while connected to then use to compromise the network. their company!s networks. A recent study in the British Medical Journal found that the ma- Portable storage devices also expose net- jority of house doctors interviewed stored pa- works to other vulnerabilities: employees can tient details on a UBS stick and shared this download unlicensed or objectionable third with other doctors during changes in their party data such as peer-to-peer software, shift. To add to the risk of a data leakage, very games or pornography for which the corpora- few bothered to encrypt the data. In an emer- tion can become legally liable through vicari- gency situation it is extremely easy to drop or ous liability. This not only raises legal issues leave the USB stick somewhere only to be but it compromises networks because it can picked up by a passerby; and there is no disrupt business continuity. guarantee that this person will return the stick. www.insecuremag.com 38 And in spite of all this, companies are still not law firms found that 6% had lost clients or suf- taking the necessary action to plug these vul- fered damaged relationships as a result of se- nerabilities. The statistics and examples given curity breaches in the previous past 12 above as well as new research that GFI Soft- months. Data entrusted to a company is valu- ware is carrying out in the United States con- able property, and it is not surprising that the firm this rather sorry state of affairs and pro- "owners! of this data rapidly lose patience with vide the answer to "why are security breaches any entity that treats these rights lightly, or and data loss on the increase?! gives the appearance of doing so.

Companies are underestimating the threat. Clients are the lifeblood of any professional Unfortunately, even faced with such hard services company and mitigating the risk of proof, many businesses still believe that "it damage to company reputation should be the won!t happen to me! and this could be a very top priority of managing partners and senior costly way of brushing aside the argument. executives. Moreover, IT administrators are so concerned with traditional security issues that endpoint Addressing the problem problems are too far down the list to raise any concern or merit further study. Endpoint secu- Companies need to take pre-emptive security rity has featured regularly in the media this measures to prevent these things from hap- year and because of this, in part, companies! pening through education and technology bar- have started to ask whether the problem is as riers which enforce company policy. They bad as security experts are saying. need to make better use of the tools that are available to them and their IT teams and to The facts speak for themselves: endpoint se- start looking at security as an investment in- curity is a real threat… and getting worse. stead of an overhead. In a good number of Companies have two options: they can either cases, companies need to revisit their ap- do something about it or simply bury their proach to network security. The enforcement head in the sand and face the music. of the Payment Card Industry Data Security Standard (PCI DSS) has proved to be a wake The repercussions up call for many companies that thought their networks were adequately protected. The low Companies hit by security breaches can ex- level of compliance achieved over the past pect to pay a hefty price and suffer on many two years has revealed that many businesses fronts through eroded trust, brand, loss of don!t even follow security best practices. This, business, and in some cases, civil and even in part, also explains why security breaches criminal penalties. Privacy compliance stan- and data leakage remain a major problem. dards and regulations – SOX, PCI DSS, CA 1386, HIPAA, Basel II, and PDPSA, for exam- Achieving network security is all about manag- ple – often present their own consequences in ing risks and this is a continuous process that the form of penalties ranging from contract includes: termination to fines to jail terms. • A thorough and continuous assessment of where risks lie A study by Forrester Research among 28 • Putting up barriers to mitigate the risks companies that had some type of data breach • Taking a proactive approach to security in found that the average breach can cost any- general. thing between $90 and $305 per lost record. Although every company puts a different value Malicious individuals will go to great lengths to to its data, the loss of sensitive data can have gain malicious access to networks, using all a crippling impact on an organization's bottom forms of subversion and attacks. Companies line. To this direct cost you also have to factor have to make sure that all loopholes are cov- in the indirect losses to individuals, institutions ered, all systems are patched, all not utilized and society at large when business people, system accounts are disabled and last but not lawmakers, and ordinary citizens lose faith in least, make sure that corporate insiders are the institutions entrusted with data. A survey aware of the threats and are trained to counter conducted earlier this year among 14,000 UK these threats. www.insecuremag.com 39 Every company should have an effective cor- 2. Take control of compliance efforts. Do not porate security policy set up and made known depend on end-user compliance for your se- to all corporate insiders – and subsequently curity needs. they do not rely on the goodwill of insiders to 3. Implement your company!s security policy. abide with this policy. More importantly, this Define the responsibilities of each user, ad- policy should cover and enforce concepts that ministrator or manager. should already be in force on all corporate 4. Upgrade security. Test and implement the networks. latest stable versions of the OS and applica- tions on computers, switches, routers, fire- 10 steps to protect networks against hu- walls and intrusion detection systems. man vulnerabilities 5. Patch systems. Keep the operating systems and the applications up-to-date by installing 1. Start at the top with senior management. the latest security updates. When management understands and acts 6. Know your network. Create and maintain a tough on security, then the battle is half won. list of all hardware devices and installed soft- 2. Implement a clearly defined, and not com- ware. plicated, security policy. Back it up with clear 7. Customize your security. Use custom set- communication. tings and passwords rather than relying on the 3. Educate employees to be careful not to defaults that come with out-of-the-box soft- leave mobile devices running around. Make ware applications. them understand what is at stake 8. Scan the network regularly. Shut down un- 4. Instruct all staff on the basics of computer necessary servers and services and turn off security such as good practices for password functional areas which are seldom used but use, etc. Education is key in securing your potentially have vulnerabilities. network. 9. Follow the principle of least privilege. Keep 5. Introduce non-standard security measures the number of administrative accounts to a such as biometric scans for top security areas. minimum and use administrator credentials at It is usually cheaper than a data theft incident. little as possible. 6. Restrict remote network access strictly to 10. Partition your network according to its se- those who need it. This also applies to internet curity level and enforce strong permissions/ access through the company!s gateway. rights on folders and data. This eases admini- 7. Track employees! use of their computer re- stration and allows stronger security policies. sources. Establish control over your corporate network. Conclusion 8. Limit user changes to a computer!s settings and installed applications. Limit browsing, in- Security breaches and data theft can occur at stant messaging, use of peer-to-peer applica- any time. It is not a matter of "if!, it!s a matter tions and file-sharing. of "when!. No business can every claim to be 9. Restrict the use of portable storage de- 100% secure and so long as humans and vices. Use only solutions enable you to pro- technology work together there will always be vide read/write access or block access to room for errors, new vulnerabilities and secu- those who do not need to use these devices rity threats. However, there are effective ways 10. Implement a strong password policy. and means to limit the chances that someone Regularly change passwords/access codes to somewhere is waiting patiently to inflict seri- limit damage caused by leaks through social ous harm on your network and steal your engineering. data. By looking at the bigger picture, compa- nies can successfully protect their businesses 10 steps to protect your network from from financial, legal and reputation damage. In technology vulnerabilities an ever-growing networked environment where risk is becoming a major concern, you 1. Install vulnerability management software. have to be ahead of threats and not passively This enables you to centralize control of your reacting to incidents. Remember: a single network!s security. breach could have irreversible repercussions.

Simon Reed is Vice President of Engineering at GFI Software (www.gfi.com). www.insecuremag.com 40 Black Hat DC 2008 18 February-21 February 2008 http://blackhat.com

Black Hat Europe 2008 25 March-28 March 2008 http://blackhat.com

Kiwicon 2k7 17 November-18 November 2007 https://kiwicon.org

Net&System Security '07 27 November 2007 http://www.atsystemgroup.org/en/conventions/nss07

PacSec 2007 29 November-30 November 2007 http://pacsec.jp

24th Chaos Communication Congress 2007 27 December-30 December 2007 http://events.ccc.de/congress/2007

ARES 2008 4 March-7 March 2007 http://www.ares-conference.eu www.insecuremag.com 41 Our computers used to be loaded with different computer virus protection products, personal firewalls, various adware and malware removers, anti spam tools - you name it. The only logical way was to combine all these func- tionalities into one product and that was the birth of Internet security bundles. This article covers the in-depth usage of one of them - Kaspersky Internet Security version 7.0.

Kaspersky Internet Security user interface www.insecuremag.com 42 Installation functionality before the program installation and I suggest you use it. The software installation is rather straight- forward and hosts about five different steps of The next step is to setup the level of Interac- program customization. For starters, the usual tive protection. The default option, suitable for difference in the express and custom installa- most of the users, makes the software notify tion types is the scope of the installed mod- you of any dangerous activity. If you want a ules. As you bought the whole security bundle, higher level of interaction, chose the Interac- I don't see why would you remove firewall or tive mode where you can also give your say- anti-virus from the installation, but this can be ing on the activities the program finds suspi- done. The software has one user interface cious. I will later cover some of the options and if you remove some modules, they will that come with this level of protection - espe- just be blocked out from the menu. cially the training modes for the personal fire- wall, as well as the extended proactive de- Kaspersky Internet Security 7.0 includes a fense. The last step focuses on an important self-defense mechanism for the anti-virus pro- function of updating the signatures database. gram. There is a number of malicious applica- The database can be refreshed automatically tions that attempt to block the anti-virus solu- (I presume on an hourly basis), every 24 tion or even remove it from the computer. The hours or manually. After the initial database self-defense mechanism blocks such at- update, you are ready to use the software in tempts. You are given an option to enable this its full power.

The settings screen after the software setup www.insecuremag.com 43 Proactive defense Sometimes the threats can attack your com- puter before the proper signatures are created The Proactive Defense module!s interface and deployed, so heuristics come in to the deals with the application activity analysis and play. To cut things short, the proactive defense system registry monitoring. Dangerous activity analyzes active applications and, for instance, is identified based on all of a program!s activ- if their payload contains suspicious activities ity rather than its individual actions. Kaspersky such as copying to network resources, adding Internet Security 7.0 empowers a powerful its roots into registry and startup folder it flags heuristic analyzer that is a perfect addition to the program as a potential threat. the usual virus scanning based on signatures.

Setting up parts of the Proactive Defense

The good thing about this analyzer is that it your computer security. After dangerous activ- uses a sandbox technique so Kaspersky soft- ity is detected on the system, the module can ware starts the application in an emulated en- roll back any changes to the uninfected state. vironment which doesn't endanger the state of

Proactive defense alert window www.insecuremag.com 44 Local antivirus are not any ingenious new things I can men- tion. The scanning of my test computer with Antivirus is the most typical component of around 45,000 files took about 30 minutes. personal computer security bundles, so there

Scanning for viruses on a local computer

When malicious files are discovered the soft- to a local backup, so if in any case you want ware will try to disinfect them. If this cannot be some of them restored, you can do it with a done, you can either move them to quarantine click of a mouse. or delete them. All deleted files are also added

Quarantined infected files www.insecuremag.com 45 Web antivirus way to go. Kaspersky Internet Security inte- grates into your web browser (in my case Majority of new threats are Internet-borne, so Internet Explorer) and it sits there waiting for virus scanning interaction with browsing is a malicious files.

Alert saying the active download contains a VBS worm

If your browsing brings you to an infected web download - the system will alert you with a site - of course infected meaning that a mali- pop-up accompanying a rather noisy squeak- cious file is either available or pushed for ing sound.

Blocked access to the file containing Javascript malware

Besides the alert pop-up, the browser won't giving you more details on the infected file. open the real file, but a changed HTML file

www.insecuremag.com 46 Trojan found in a Halloween dancing skeleton screensaver

Firewall tributed denial of service attacks, snooping software that reports to someone, as well as From my experience, looking from the home different type of malware that has its own user or even SOHO point of view, firewalling secret agenda. the inbound connections is a thing from the past. Ten years ago personal firewalls were a This module's functionality isn't of extreme valuable help from different type of attacks, importance, but when you combine it with dif- but now days the biggest problem is to pre- ferent personal security modules, it provides vent things generating from your own comput- an integrated solution that is a must have for ers. These problems include zombified dis- home/SOHO users.

Security zones related to network connections www.insecuremag.com 47 When configuring the built in firewall, the soft- timal for the average computer user. More ex- ware automatically detects your network set- perienced users can edit the predefined rule- tings and sets up different security zones for set, as well as add new rules. From the appli- the local network, as well as the Internet. cation point of view, the software detects all running applications and creates a rule for The basic configuration contains a specific set them. of packet filtering rules, that provide to be op-

Setting up applications and packet filtering rules

Kaspersky Internet Security has an adaptive future it will be easier to detect new threats firewall that will ask you a number of things generating around your computer. when you actually start using your computer. Every software you manually open, or it is If you are not to keen in using command opened in the background will cause a pop-up prompt for checking the status of your active alert where you can either allow or deny the connections, the software offers a Network connection. monitor that will provide real time information on them. Besides this, with a click on a sys- The best thing is to dedicate 10 minutes of tem tray icon, you can block all the network your time and start all the applications you connections going from or coming to your regularly use. On this way the ruleset will be computer. created specifically by your demand and in the

www.insecuremag.com 48 User can act on every outbound TCP connection

Kaspersky Net monitor showing the active connections

Anti spam mail. The technique used is based on Bayes- ian algorithms and works quite efficient. Spam is one of the key annoyances of the every day Internet use, so no security combo One of the things I often find useful with anti product of this kind shouldn't come without spam products is the training mode, which is dedicated anti spam protection. This module nicely incorporated into this product. You can works with a couple of popular Windows manually chose a folder location of your e- based mail solutions including Microsoft Office mail (if you are Outlook/The Bat user) and the Outlook, Microsoft Outlook Express and The software will process all e-mails and start an Bat!. Besides the plugins for the mentioned interactive procedure where its "artificial intel- products, Kaspersky Internet Security can in- ligence" is pumped with details about the tercept and process all POP3/IMAP/SMTP spam status of your received e-mails. traffic and therefore take care of unwanted e- www.insecuremag.com 49 Anti spam module configuration zone

Spam filters can be configured as according to this doesn't seem like an option someone a couple of security levels provided with the would use, but nevertheless it is here. software by default. Besides the usual Allow all and Block all options that work with your Anti phishing predefined whitelist, you can select High and Low levels which are sure to generate either Kaspersky' security suite features a privacy too many false positives, or let the spam to control center that features anti dialer, anti enter your inbox. Recommended option is the phishing and confidential data protection. In one set up by default, as it proved to be most the past, dialers proved to be a quite big prob- efficient. lem for the average dial-up Internet user. As majority of us doesn't use dial-ups any more If in any case you have some time on your and we don't have (at least in the wild) dialers hand, you can always use built-in Mail Dis- that use our computer's VoIP services I didn't patcher which gives your the possibility of play with this option at all. I was more inter- manually checking the mail headers on your ested in mangling the phishing threats by us- remote POP3 accounts. With the level of e- ing the inbuilt protector. mail (both valid and spam) people are getting,

Blocked phishing URL www.insecuremag.com 50 The software hosts a database with fake them. Phishing sites don't have a long "time to URLs commonly found in phishing links. live", so I was testing the sites detected by Therefor when a user mistakenly opens a fake another security company in real time. Most PayPal or bank web site, the software will probably the detection rate was connected automatically pop-up an alert window saying with the constant evolution of phishing sites, that a phishing site was accessed. Besides but I had better expectations from this module. the list, the program can also detect some common phishing "signatures". I should also note that the anti spam function of Kaspersky Internet Security also uses the I tested more than 20 different phishing web same phishing database to automatically in- sites and the product detected just half of tercept phishing e-mails.

Inspecting encrypted transfer on the phishing site

Conclusion fectly. By using this application, you can really Kaspersky Internet Security 7.0 proves to be a make sure that your computer has a full force robust security applications with a line of qual- defence system against a variety of harmful ity modules that complement each other per- security attacks and online annoyances such as spam and phishing.

Mark Woodstone is a security consultant that works for a large Internet Presence Provider (IPP) that serves about 4000 clients from 30 countries worldwide.

www.insecuremag.com 51 Amol Sarwate heads Qualys' team of security researchers and engineers who manage vulnerability research. His team tracks emerging threats and develop new vulnerability signatures for Qualys' vulnerability management service.

Amol is a veteran of the security industry and has devoted his career to pro- tecting, securing and educating the community from security threats. He pre- sented his research at numerous security conferences, including RSA 2007, InfoSec Europe 2007 Press Conference, Homeland security Network HSNI 2006 and FS/ISAC 2006. He regularly contributes to the SANS Top 20 expert consensus identifying the most critical security vulnerabilities.

What do you see as the biggest online se- Web application vulnerabilities also pose a big curity threats today? risk as they can lead to consequences ranging from identity theft to fraudulent credit-card For the past year or so we!ve observed a charges. These are all very big threats with trend of increased client-side attacks that potent consequences. make use of social engineering techniques to compromise victim computers. Malformed im- What do you see your clients most worried ages, videos, and music files land-up on cor- about? porate desktops that can then take complete control of unsuspecting users. I can!t point to a single concern among clients, but issues that are often raised are in the ar- Social engineering techniques such as phish- eas of perimeter security, patch management, ing are the preferred attack method which can asset management and complying with PCI lead to viruses, Trojans, spyware and other and other compliance frameworks like SOX type of malware. and HIPAA.

www.insecuremag.com 52 Many larger organizations that acquire or Currently Qualys! vulnerability management grow operations rapidly in different parts of the solutions can detect all remote and local vul- world have trouble managing their assets, nerabilities. Additionally, we have limited sup- meeting the various requirements, as well as port for web application scanning. In the fu- enforcing security standards without breaking ture, with advancements in newer protocols their established business model. and applications we expect these types of threats to become more sophisticated. There- What do you think about the full disclosure fore, new web application threats are almost of vulnerabilities? guaranteed to come and Qualys is developing a comprehensive web application scanner that I fully support responsible disclosure of secu- would scan remotely and optionally with web rity issues. I do not believe in putting custom- authentication. ers at risk by releasing a PoC (proof-of- concept) or publishing exploit code that has In the future we will see vulnerabilities in the detailed instructions on compromising a vul- implementation of newer protocols like IPv6 nerable product – especially when this is done as well as older, less targeted protocols like before a patch or a workaround is made avail- SIP. Control protocols like SCADA will also be able. I believe that the person who discovers a targeted. vulnerability should get full credit for his/her hard work. This can all be accomplished very What are the future plans to extend your easily via responsible disclosure. product offerings and capabilities?

In your opinion, what is the biggest chal- To help customers comply with security lenge in protecting sensitive information at frameworks like SOX, HIPAA, GLBA or inter- the enterprise level? nal policies, Qualys is developing a compli- ance platform that will leverage our existing I believe that enforcing enterprise wide secu- scanning infrastructure to run compliance rity policies is the number one challenge in scans. protecting sensitive data. Part of the difficulty is due to large enterprises having diverse We!re developing the next release of our PCI technologies and being scattered in different offering that will enable partners and custom- countries. This often happens when enter- ers to create their own certification program to prises merge or buy other companies. audit vendors or external parties. As men- tioned previously, we!re also developing a How do you see the current security specialized web application scanner for help- threats your products guard against evolv- ing customers to identify and fix related ing in 3-5 years? threats.

www.insecuremag.com 53 The business work place has evolved significantly over the last ten years. Back then, networks were far more simplistic; the internet was not a critical business tool, there was far less legislation, and there were no applications for employees to launch in the workplace, except for a sly game of Solitaire. Now, a company's IT network is its central hub, an increasingly complex envi- ronment that offers dramatically enhanced efficiency, but also brings with it a convoluted set of problems for increasingly over-stretched IT departments.

Modern technologies have opened a Pan- in corporate defenses, these new technolo- dora's box of issues for companies trying to gies are like candy to a baby for cybercrimi- keep control of their networks. It is not un- nals, who are exploiting these vulnerabilities usual for a typical employee to launch instant to infect networks with malware, spyware and messaging, log onto Facebook and start shar- Trojan horses for their financial gain. ing videos with friends and colleagues. Not only might members of staff log on to the net- Organizations' ongoing drive for more flexible work from their desks, they might also log on working practices also has a major impact on from home, or from their laptop at a WiFi hot- the overall security of corporate networks. spot in a coffee shop or at the airport. Now, networks need to be opened up to third parties, such as contractors, customers and While the ubiquity of the new internet is pre- consultants, but these guests may not use the dominantly positive for businesses, boosting same security applications as the host net- employee up-time and therefore productivity, it work and may not have applied the most re- has opened up a can of worms in terms of se- cent software upgrades or patches. Moreover, curity, and adhering to an ever-escalating full-time employees are frequently granted number of compliance regulations is becom- administration rights that enable them to use ing an increasingly difficult challenge for or- their computers from outside the office, but ganizations. By their ability to puncture holes this can compromise security, as it requires www.insecuremag.com 54 that some critical security services are dis- Some forward thinking businesses are how- abled. ever cottoning on to the risks and have there- fore begun to implement security policies Despite the risks involved in not keeping a which try to control employee use of corporate tight rein on the comings and goings of net- resources and the internet whilst at work. work users, a surprising number of organiza- While such frameworks can go some way to- tions have no enforcement mechanism in wards ensuring that employees toe the line, place to drive compliance or to report on re- they can be difficult to implement and enforce. sults. This gap in corporate policy exposes the enterprise to a range of threats; not simply Furthermore, policies alone do not present a from malware and hack attacks, but also the watertight solution and they cannot stop all loss or theft of intellectual property, and pun- security breaches that are outside user con- ishment from inadvertently flouting regulatory trol. requirements.

Policies alone do not present a watertight solution and they cannot stop all security breaches that are outside user control.

What are security companies doing to permission to access the network, but on an support customers? on-going basis once these users have been allowed to log on. In this way, companies can The complexity of managing modern security rest assured that if a user acts out of line with applications, combined with a lack of control the security policy, they will be banned from over employee and visitor computers attach- the network until the matter has been dealt ing to the network, has driven many security with. Furthermore, systems administrators can vendors to incorporate compliance and en- grant individual employees or guests specific forcement capabilities as extensions to exist- levels of network access, which dictate which ing products. Indeed, some vendors have resources they can use. These levels are set gone as far as to shift their position from pro- by looking at a combination of factors, includ- moting single endpoint security products to ing the user's department, internal role and creating and endorsing entire suite of endpoint their level within the company, as well as the security solutions to give IT departments back status of their endpoint's security solutions. the control they need to quash the growing threats to their networks. It has become Replicating physical security measures starkly apparent that companies need support online in managing all the various users and end- points accessing their networks to ensure that The need to secure sensitive data on busi- security and compliance breaches do not take ness networks, and the NAC method of place. achieving this, can be compared to the con- straints many businesses put in place to en- Network Access Control (NAC) - helping sure the physical security of their buildings. companies to take control back Let's take the example of a pharmaceutical company, which needs high levels of security Organizations of all sizes are now considering in order to protect drugs patents worth billions NAC as part of a holistic security strategy. of pounds, and to ensure compliance with NAC not only gives businesses the power to strict legislative standards. In this kind of envi- simply and swiftly create and enforce security ronment, a receptionist would meet all em- policies, it can also block or quarantine non- ployees and visitors at the front desk. Once compliant or unauthorized computers that are their reason for wanting to move forward has seeking to gain network access. An effective been established and the receptionist has ac- solution can also determine whether all end- cepted that it is in line with the company's se- points are compliant with the organization's curity policies, they will then be either author- security policies; not only prior to granting ized or refused entry. www.insecuremag.com 55 Those employees and visitors that have been tunately solutions do vary, and it is crucial to approved, will be granted further access to find the best system for the job. specific areas of the building, depending on their requirements and position within the Making NAC work for your company company. For example, while the managing director may have 'access all areas' clear- There are a number of different ways to im- ance, a temp may only be able to access the plement NAC; solutions can be hardware or parts of the office that they will directly be software based, standalone or integrated into working in. By giving physical access to the the internal network infrastructure. How do right people in this way, the company has businesses decide what is right for them? dramatically reduced the associated security risks. You would not let a masked man The appropriate solution for an organization is through business doors, but it's a bit more primarily dependent on its current network en- complicated to prevent them gaining access to vironment and it is therefore crucial to assess the business network - without the right solu- this fully before taking the plunge. Critical fac- tion in place. tors include, how homogenous the network is, what the main network access methods are, The risk of intelligent users and of course, the budget available. For ex- ample, for small to mid-sized businesses, the A common trap that many businesses fall into most effective NAC solution is one that can is only considering to implement NAC if they assess the security level regardless of the have remote and mobile workers and frequent specific solution in place as well as work visitors, but while these casual users certainly seamlessly within existing IT infrastructures. pose a significant threat to company networks, When making their choices, enterprises it is equally critical to protect their infrastruc- should focus expenditure on the solutions and tures from users within the corporate walls. services that solve their biggest problems, Indeed, in a recent Sophos poll, which asked choosing solutions that protect against vulner- more than 200 companies who they thought abilities and provide a full security process in- exposed their networks to the greatest IT stead of merely providing products. As a rule, threats, 44 percent believe standard employ- the best option for organizations looking to in- ees to be the most dangerous. Now that tech- troduce NAC to their security suite, is to find a nology is so integral to so many people's lives, solution that works with the existing network there are a growing number of expert users infrastructure and user management systems who have a potentially dangerous level of IT - and one that is truly vendor neutral. This will knowledge, enabling them to evade enforce- be least disruptive to implement and will pro- ment when accessing network resources, duce the best return on investment. even if there is only the narrowest of gaps to slip through. Such a gap may arise from a It is also imperative that a NAC solution pro- number of scenarios, including the use of vides comprehensive support for the organiza- DHCP networks - enabling a device to have a tion's security strategies, as well as having the different IP address every time it connects to ability to create and manage new policies in the network - or where the rogue computer is the future. It should also be flexible enough to using local, statically assigned IP addresses meet new business strategies as they inevita- for network access. bly arise. A final critical factor is that the solu- tion offers capabilities beyond standard Problems may also occur if a quarantine network-based enforcement, identifying and agent is not installed on the user's computer. providing protection against all classes of us- Whilst many of these employees will simply be ers trying to gain access to the network - both trying to play the system without malicious in- known and unknown. tent, they still pose a threat to networks be- cause they are opening holes, giving cyberci- The complete NAC solution minals a backdoor entrance into company in- frastructures. This is one example of why An all-encompassing NAC solution will alert companies should not rush headlong into pur- network administrators of MAC and IP ad- chasing the first NAC solution they find; unfor- dresses, enabling them to take immediate www.insecuremag.com 56 action when an unauthorized endpoint com- gives systems administrators the optimum de- puter connects to the network. Its reporting gree of flexibility and control. Because user capabilities should extend to include multiple groups in organizations are closely interwoven reports for rogue endpoints, exempt comput- with the associated policies, determining ers and any new information that may prove which users are assessed for compliance critical - as events occur, in real time. The against which policies, is a crucial step in rein- alerts should identify the rogue computer with ing in control. Groups can be defined accord- pinpoint precision so that network administra- ing to department, function, individual hire tors can simply and swiftly identify its network dates, or a combination of these factors. location and subsequently take the appropri- ate actions. The best NAC solutions allow multiple policies to be created for various user groups, and for It is crucial that this constant monitoring does these to be shared between groups as neces- not interfere with normal network communica- sary. tions; for this reason, passive monitoring will provide the best results. The monitoring of The crux of a truly flexible solution is ensuring low-level ARP (Address Resolution Protocol) a that these policy-to-group relationships can be network layer protocol used to convert an IP changed at the drop of a hat - including the address into a physical address, allows all IP addition of new users to existing groups - in communications to be detected, without ex- line with the very real requirements of a con- ception. This means that even if a canny user stantly evolving workforce. This is particularly evades DHCP network-based enforcement, critical if administrators want to mandate spe- their computer will not be able to communi- cific security applications for new users. This cate and spread infections throughout the degree of control is essential when mergers network because ARP has to be used in order and acquisitions take place for example, when to slip through. By monitoring ARP, identifying companies face the daunting task of imposing which computers are attempting to make IP their corporate security policies on large num- connections, and comparing the computer bers of new users. with the list of approved, compliant, and regis- tered computers, systems administrators have Without an effective NAC solution in place, a watertight way of spotting a rogue computer successful migration for new employees can making advances on the network, enabling be a logistical nightmare. them to act fast and effectively. Conclusion This solution, while providing comprehensive reporting on users attempting to access the Controlling employee and visitor access to in- network, and the actions of those already creasingly complicated business networks logged on to the systems, should make sys- should not be seen as an expendable add-on tems administrators' lives easier, and that to security suites, but as an integral part of means that reporting should be simply deci- ensuring compliance in an ever-more regula- pherable and easy to action. tory world, and fending off cyber attack in an ever-more dangerous network environment. Maximizing flexibility and control for sys- tems administrators By implementing a flexible and comprehen- sive NAC solution, organizations are able to Implementing NAC solutions is all about giving effectively combat today's threats, while being companies control back over their networks. It fully equipped to mitigate against tomorrow's. is therefore crucial that the chosen solution

Graham Cluley is one of the world's leading experts in IT security and control, and works as senior technology consultant and head of corporate communications at Sophos. He has given talks around the world at events such as EICAR, ICSA, Virus Bulletin and the European Internet Security Forum on the virus threat.

www.insecuremag.com 57 F-Secure Antivirus Research Weblog (www.f-secure.com/weblog/)

When you think about a company blog, you may expect boring marketing material. F-Secure decided to go the other route and offer visitors up-to-date malware information with informative videos, trend analysis and predictions.

Windows Incident Response (windowsir.blogspot.com)

The author of "Windows Forensics and Incident Recovery" writes about incident response and forensics on Windows systems and covers a very technical topic that will certainly find its audience.

SecuriTeam (blogs.securiteam.com)

SecuriTeam focuses on a variety of security-related issues and offers insight into current news and vulnerability research.

A Day in the Life of an Information Security Investigator (blogs.ittoolbox.com/security/investigator)

An anonymous security professional writes about everything related to his field. The blog is rich with real-world examples and answers to diverse reader questions. www.insecuremag.com 58 To the casual observer of the Payment Card Industry (PCI) standard, it might seem that the standard deals exclusively with the servers and point-of-sale terminals that house cardholder data. This is an understandable assumption, given the origin and subject matter of the PCI requirements. However, a care- ful read of the PCI Data Security Standards (DSS) reveals that almost half of the specifications are aimed at the network infrastructure that transmits the cardholder data.

Managers responsible for IT compliance need curity in mind, they were designed to add con- to understand that credit card companies hold venience to consumers! shopping experi- merchants accountable for not only protecting ences. However, hackers have caught on to stored consumer data, but also securing the this oversight and are finding new ways to ex- network transport layer and on-going proc- ploit the weakest network links for their profit- esses to validate compliance. Due to the ability — and they are getting really good at it. never-ending amount of network device change and configurations, it is nearly impos- Consider several well-published network data sible to determine exactly when a device ac- breaches over the last few years: tually becomes non-complaint. PCI auditors • February 15, 2005 - ChoicePoint - ID thieves are not only on the lookout for non-compliant accessed 145,000 accounts. devices, but also for a well thought-out secu- • April 12, 2005 - LexisNexis - 280,000 pass- rity process that is currently implemented, words compromised. tracked and well documented. This is where • November 2006 - UCLA – 800,000 current an automated change and configuration man- and former student Social Security Numbers agement system can really assist. stolen by computer hacker. • July 2005 through January 2007 – TJX – The PCI DSS requirements pertain not just to 45.7 million credit and debit card numbers sto- retailers, but to any credit card accepting or- len. ganization from university book stores to pay- • July 3, 2007 Fidelity National Information at-the-pump gas stations. Let!s face it, retail Services (Jacksonville, FL) 8.5 Million Re- payment systems were not designed with se- cords lost due to data breach. www.insecuremag.com 59 To illustrate the depth of this situation, Privacy The PCI DSS specifies security requirements Rights Clearinghouse has chronicled data se- across many domains, from documentation curity breaches since January 10, 2005, and and physical security to network encryption has estimated that 167,493,672 records con- and software design, all designed to ensure taining personal data have been stolen. the safe storage, transmission, and use of sensitive cardholder information. Further underscoring the gravity of the situa- tion, notice the amount of records stolen is As defined by the PCI Data Security Standard rapidly increasing every year. Not only does V1.1, “These security requirements apply to this equate to bad publicity, but it also lends all ʻsystem components.ʼ System components itself to increasing consumer costs. Hence, are defined as any network component, the quagmire merchants find themselves in: server, or application that is included in or Do I assume status quo will repel hackers – connected to the cardholder data environ- and PCI auditors or, do I make an investment ment. The cardholder data environment is that to help ensure a secure network? In the end, part of the network that processes cardholder protecting consumer data is less costly than data or sensitive authentication data.” dealing with a security breach and precisely why the PCI Council was formed.

THE PCI DSS SPECIFIES SECURITY REQUIREMENTS ACROSS MANY DOMAINS.

This definition has indeed caused some Requirement 3.4 deals with the Primary Ac- heartburn among merchants, as they refer to count Number (PAN), or the payment card these standards as too broad in scope — or number that identifies the issuer and the par- too narrow in some instances — to actually ticular cardholder account. The compensating comply with. In essence, there are 12 re- controls may consist of either a device or quirements and approximately 178 sub re- combination of devices, applications and con- quirements to deal with. trols that meet all of the following conditions:

Furthermore, organizations are required by 1. Provide additional segmentation credit card companies to comply with all these 2. Provide ability to restrict access to card- security requirements or face stiff penalties. holder data based on: Case-in-point: Under the new penalties issued " a. IP/MAC Address by VISA last year, acquirers will be fined be- " b. Application Service tween $5,000 and $25,000 a month for each " c. User Accounts/Groups Level 1 or Level 2 merchant that is not vali- " d. Data Type dated PCI compliant by September 30, 2007, 3. Restrict logical access to the database and December. 31, 2007, respectively. 4. Prevent/detect common application or da- tabase attacks. However to add a twist, there is also an inter- esting caveat to the all-or-nothing approach Given all the routine daily tasks that must be PCI mandate, found in Appendix B of the PCI performed by the IT personnel, no wonder it!s Data Security Standard v1.1 requirements a seemingly impossible task to interrupt and called Compensating Controls. According to implement PCI DSS. It stands to reason why PCI Security Council!s Glossary, “Compensat- VISA recently reported that only 40% of Level ing controls may be considered when an entity 1 and one-third of Level 2 merchants have cannot meet a requirement as explicitly validated PCI compliance. stated, due to legitimate technical or docu- mented business constraints, but has suffi- With so much riding on PCI compliance, net- ciently mitigated the risk associated with the work managers are increasingly turning to requirement [3.4] through implementation of software to automate specific steps in the other controls.” compliance process.

www.insecuremag.com 60 Automation, if done correctly, helps facilitate manager by providing a structured approach the planning, management, review and docu- to implementation of the DSS. It should offer mentation processes as well as assist with advice and best practices documentation in creation, implementation and enforcement of the context of the individual DSS require- a PCI compliant security policy across the en- ments, making it easy for managers to deter- tire network infrastructure. mine which steps need to be taken to ensure compliance with the standard. Network change and control helps demonstrate PCI DSS requirements Change control processes should be docu- mented and stored so that engineers and The PCI Security Council recognizes that managers can access the process documen- network security is not a destination but a tation on a daily basis. An automated, change process, and that the ability to reliably control control solution can facilitate this, providing the security of the network is dependent upon the network manager with the ability to include the establishment of solid change control the company!s established policies alongside processes. Network change policies should be the individual PCI requirements and vendor clearly documented, easily accessible to users best practice documentation. responsible for daily management of the net- work, and regularly reviewed and approved by For example, qualified personal should have management. the means to easily access the current – not static – status, and supporting documentation, Change processes should include validity of PCI DSS requirements in one consolidated checks and management approval for all out- view. This view should contain: going changes, and change verification and compliance checks after a change has been • PCI DSS Requirement Definition made. It!s not enough for an auditor to see " o 2.1 - Always change vendor supply de- that a device has been configured correctly, or faults before installing a system on the net- even that a set of written procedures exists. work. To verify that an appropriate change control • Reports and Links process is in place, the auditor will want to see " o Credential and Usage Reports evidence that the documented process has " o Communication Mechanism Reports been followed on a daily basis. • Each Compliance Item and Status: " o Default Password Beyond describing the change control proc- " • Cisco Routers esses that must be in place, PCI also requires " • 3,772 compliant the existence of specific network device con- " • 43 non compliant figurations such as access-lists and strong • Review Comments encryption. Border routers and firewalls " o 05/30/07 – Matt Clark, Updated default should be configured with explicit access-lists passwords policy to include PWs from latest allowing communication only across standard IOS. ports which serve a valid business purpose. With easy access to this content, network en- Network managers must employ regular gineers looking for direction or confirmation password rotation and ensure that no device will find it easy to access and review the is ever deployed on the network with vendor- documentation, ensuring higher adherence to supplied default passwords in place. Any net- the established processes. Network engineers work path that facilitates the transmission of will be more likely to follow the process when cardholder information must be secured with it is widely published than if it is stored in a strong encryption or start to face those afore- binder on the shelf of the compliance man- mentioned $5,000 to $25,000 fines. ager. Auditors will request network managers With 12 chapters and more than 170 individ- to demonstrate how the processes are distrib- ual requirements, planning for compliance uted to engineers, and the central repository with the DSS requirements is a challenge. in the PCI compliance solution will meet the Automating the change control and configura- requirement. tion process eases the burden of the network www.insecuremag.com 61 One of the largest cost savings provided by association between the PCI-compliant proc- having a PCI solution based on automated esses and the in-scope devices to the auditor. change and compliance control is the assis- In order to keep up with the changing de- tance in reducing the scope of the audit. mands of the business, enterprise networks Qualified security assessors (QSAs) are re- can absorb multiple changes per day. Engi- quired to set the scope of the audit to the de- neers were once able to accomplish change vices that protect, hold, or transmit cardholder management with a battery of scripts and FTP data. While it!s incumbent upon network engi- servers, but with today!s heterogeneous net- neers to design the network so that it is prop- works and heavier audit requirements, this erly segmented, a PCI solution can assist in method does not scale to meet current chal- proving this segmentation to the auditor. lenges. Full change and compliance control cannot be achieved without a high degree of The solution should provide logical containers automation, which is perhaps the largest to manage each network domain, and change benefit of a PCI compliance solution. and compliance reporting should highlight the

ONE OF THE LARGEST COST SAVINGS PROVIDED BY HAVING A PCI SOLUTION BASED ON AUTOMATED CHANGE AND COMPLIANCE CONTROL IS THE ASSISTANCE IN REDUCING THE SCOPE OF THE AUDIT.

Automated change control will ensure that must have flexible reporting and dashboard every change going into the network, whether capabilities available to them, and any PCI through the change control application or not, compliance solution must provide this in order is detected and stored. The PCI compliance to be of significant use. solution must not only be aware of every change on the network, but must provide an PCI DSS requirement 1.3.1 requires that fire- auditable history (who, what, when, and why wall policies are established that restrict “…in- for each change) so that auditors can review bound Internet traffic to internet protocol (IP) the history. For example, PCI DSS Require- addresses within the DMZ (ingress filters).” In ment #6, Develop and Maintain Secure Sys- essence, block access between publicly ac- tems and Applications, specifically 6.4, Follow cessible servers and any system component change control procedures for all system and storing cardholder data. Using compliance software configuration changes. The proce- tests and policies within the automated dures must include the following: change control solution, network managers can ensure that the specific access-list lines • Documentation of Impact needed are in place at all times. • Management Sign-off by Appropriate Parties • Testing of Operational Functionality Using automated software, network engineers • Back-Out Procedures. can assemble a dashboard that shows all pending changes, a list of changes in the past The granular access controls and documenta- 24 hours, any changes flagged as non- tion that are inherent to an automated change compliant by the compliance engine, and a control solution can enforce this. graph illustrating the overall compliance per- centage across the network. If compliance vio- Another PCI DSS requirement states that lations do appear on the dashboard, the net- network managers must be able to build struc- work engineer can immediately drill into de- ture compliance tests detailed enough to vali- tails as to which devices failed compliance, date individual configuration lines, but can what the offending configuration lines are, and also be aggregated to form comprehensive who made the change. With automated compliance policies automatically enforced change control in place, the network engineer upon change detection. In order to ensure that can then rollback the access-list on the device any lapses in compliance are immediately and re-run compliance, resting once the identified and remediated, network engineers dashboard shows “0” compliance failures.

www.insecuremag.com 62 PCI requires that security policies be reviewed When selecting a PCI compliance solution, no less than on a quarterly basis, and annu- network managers should keep the following ally auditors will want proof that these reviews criteria in mind: have taken place. A PCI compliant change configuration solution provides network man- • Automation – The solution must provide a agers with the ability to review current proce- high degree of automation, especially as it dures and compliance policies in the context pertains to change control and compliance of the DSS requirements. Updates to the poli- verification. cies should be recorded in an auditable his- tory, so that auditors can easily verify the on- • Embedded PCI Knowledge – Look for evi- going management of the policies and proce- dence that the vendor has analyzed the PCI dures. specification, and understands what is re- quired to demonstrate to an auditor, showing The PCI compliant change configuration solu- compliance has been achieved. tion should provide both current state and trending information on compliance to the es- • Change Control - The solution must work in tablished policies, so that network managers a heterogeneous (multi-vendor) environment, can make informed decisions about the direc- must facilitate a structured approval process, tion they give the engineering resources. In and must contain strong audit capabilities. addition, both sets of reports are useful to the auditor, since they demonstrate that a high • Compliance Enforcement – Structured com- level of compliance has been maintained all pliance policies must be detailed enough to year, including the time of the audit. validate individual configuration attributes, and must provide automated compliance checking Preparing for a PCI audit can be a costly en- of all detected changes. Extra cost-savings deavor, with tier 3 and 4 merchants spending can be achieved when the compliance engine $250,000-$300,000 on audit preparation. Most supports automated remediation, staging of this cost is spent trying to analyze PCI re- changes for managers who must only review quirements and construct meaningful reports and approve the remediations. for the auditor. • Reporting and Dashboards – Dashboards Costs can skyrocket when an auditor spends should be flexible enough for an engineer to billable time either wading through network monitor change and compliance information details which haven!t properly been summa- from a single screen. The product should fa- rized, or when prepared reports were deemed cilitate the audit preparation by providing a inadequate by the auditor, forcing a scramble structured and well thought-out list of reports to locate new information for a wide variety of for the auditor. resources. Achieving PCI compliance is not about where Any PCI compliant change configuration solu- your network is today, but about how you can tion needs to provide a well thought-out and ensure where it will be tomorrow. An auto- easily accessible hierarchy of reports that can mated, PCI compliant change configuration be printed out for any auditor to clearly ac- solution can assist in all phases of preparation knowledge adherence to PCI DSS require- for PCI, and carries the additional benefit of ments. cost savings through automation.

Matt Clark is the Director of Compliance Reporting at Voyence (www.voyence.com), where his responsibility is developing Voyence's automated compliance engine. Matt has held several roles during his six-year career at Voyence, from software development and quality assurance to project management for the implementation of Voyence!s flagship offering - VoyenceControl - for major service providers. He welcomes your comments at [email protected].

www.insecuremag.com 63

Notwithstanding personal choices based on preferences for feature sets, usability, performance or interface design, all Web browsers share the same basic architectural building blocks among which, it is fair to say, data and identity security is not one of the cornerstones.

The reasons for this apparent lack of concern It is interesting to note that participants in fo- for security in the browsers! blueprints are in cus groups on Internet usage often find such part historical (security threats have greatly requirements too strong or even unnecessary evolved and expanded since the first appear- until they are presented with the list of Web ance of the Internet), in part technical (security pages, form entries and passwords gathered features require careful and more expensive a during their previous navigation session. priori design) and in part legal/political (em- bedding strong encryption and privacy tools When the harsh reality of privacy infringement may first require social acceptance and proper hits the soft spot of one!s own personal legal framing). Be that as it may, the reality for sphere, people tend to think again about the today!s Internet users is still that of an uphill need for an adequate protection of their Inter- battle against a multitude of threats to the pri- net activity. vacy of their surfing data and of their online identities. Where is my Internet surfing data?

At the risk of oversimplifying such a multifac- Navigating with any of the five mainstream eted issue, let us first focus on two of the main Internet browsers mentioned above leaves a security concerns for Internet users: local trail of data behind, stored in clear format in- storage and network identity. The main as- side well-known folders, readable by anyone sumption is that no information on Internet ac- who has access to the PC and by malicious tivity and/or online identity should be disclosed codes (e.g. Trojans) silently executing in the without the user!s prior authorization and background. knowledge. www.insecuremag.com 65 Sensitive data—browsing history, visited links, data that one may need at a later time. On the bookmarks, site cookies and, in some cases, other hand, access to the browsing applica- digital certificates, Web form entries and tions is generally not controlled and no form of passwords—are constantly in danger of being authentication is required to launch them. This copied, captured or disclosed to others with- implies that gaining access to someone!s PC out the user!s knowledge. log-in account also grants the freebee of un- restricted access to the user!s Internet envi- Most Internet browsers do provide some ronment. All these facts are well known to se- means for clearing navigation data, or cache, curity professionals and to a growing segment by periodically erasing the application files of the user population—typically those who where such data are stored. This resembles have learned the hard way about the standard more of a Catch-22 situation rather than true browsers! vulnerabilities. protection, however. In fact, one is really never sure of the right time to perform the de- There is no doubt that current technologies, letion (before, during or after browsing?) and both at the hardware and at the software lev- will always be tempted to postpone it, since els, can provide a much stronger level of se- the operation also erases useful links and curity to the average Internet user. www.insecuremag.com 66 Therefore, it should be possible to implement coupling of its software to the PC operating user authentication and strong encryption of system and to the application environment all browsing data and thereby mitigate or even and its components, which still suffer from remove the majority of the security threats equally damaging security vulnerabilities. On mentioned above. the other hand, the general availability of en- cryption tools for protecting Internet surfing There is still limited activity in this direction, data may fuel fears of misuse and hinder the however, compared to the dimension of the work of law enforcement officials against issue and the size of the affected population criminals and terrorists. A recent initiative from of end users. The few known initiatives for se- Germany's Interior Minister Wolfgang curing Internet browsers are not sponsored by Schäuble may help shed some light on the global software multinationals, but by smaller potential relevance of this concern. The minis- companies with focused expertise aimed at try is advocating for the development of occupying a specialized niche in the security means to secretly install government Trojans market. Part of the reason for Microsoft!s dis- (loaded with so-called "Remote Forensic inclination to include local security measures Software") onto the computers of crime sus- into Internet Explorer 7.0 may lie in the strong pects. www.insecuremag.com 67 Needless to say, privacy advocates are con- the monitoring party is also the Web content cerned about such measures, pointing to the provider, interested in profiling visitors! geo- blurriness of the boundary separating a priori graphical location, browsing activity, subject a crime suspect from an innocent citizen. The preferences and social status. German supreme court recently determined that such "legal hacking" techniques cannot The data collected can be later used and sold be used because no legal framework exists at to allow targeted advertising or to enforce present. This ruling, however, leaves room for price and even service level discrimination. In further debate as Mr. Schäuble will reportedly other cases, traffic analysis can allow foreign push for the constitutional changes needed to government authorities to scan Internet visi- allow the police to perform activities defined tors based on their countries of origin, thereby as "online house searches.” This case should facilitating subtle forms of censorship using not be considered an exception but rather an preferential routing and keyword filtering. Pro- indication of a global reality that has been in tecting network anonymity can also safeguard constant development during the past decade, against prejudice during socially sensitive albeit subject to the general public!s low communications, such as those occurring in awareness and scrutiny. chat rooms and Web forums for political dissi- dents, rape and abuse survivors or people According to The Economist, “These days, with severe and disabling illnesses. data about people's whereabouts, purchases, behavior and personal lives are gathered, Companies are also systematically gathering stored and shared on a scale that no dictator data about their employees and online cus- of the old school ever thought possible. Most tomers, who typically are totally unaware of of the time, there is nothing obviously malign the information they are handing over during about this. Governments say they need to their transactions and of the subsequent use gather data to ward off terrorism or protect made of such information. public health; corporations say they do it to deliver goods and services more efficiently. On the other hand, security concerns have But the ubiquity of electronic data-gathering resulted in legislation concerning the surveil- and processing —and above all, its accep- lance and monitoring of Internet use in several tance by the public— is still astonishing, even countries. Although distinct from filtering, compared with a decade ago. Nor is it con- these have many parallels in their potential fined to one region or political system. impact upon online freedom of expression and access to information. Recent and controver- Who cares about My IP address? sial EU legislation is aimed at regulating the surveillance of traffic data and its retention. The second dimension of Internet users! pri- The European Data Retention Directive, which vacy is that of anonymity and online identity will become effective for Internet traffic by management. It is a well-known fact that sim- March 2009, requires ISPs in the various na- ple analysis of the data header packets gen- tions to retain data pertaining to Internet ac- erated by Internet traffic can disclose the cess, e-mail and telephony for a minimum pe- source (IP address), destination, size, timing riod of six months but not exceeding two and possibly even the content of the surfing years. Through the formal establishment of activity. Similar to the issue of securing the common procedures for data retention, this local surfing data, no integrated solution is directive should facilitate the tracing of illegal currently offered for protecting Internet users content and to identify those who use the against traffic analysis, and thus their traffic electronic communications networks for terror- privacy is de facto left totally exposed. How- ist activities and organized crime. Privacy ever, the question often asked is: why should groups across all the member states, how- the average user care about disclosing his ever, are voicing their concerns about the source IP when browsing over the Internet? rights of ISPs, search engines and Web com- panies to retain data and monitor people!s on- Knowing the origin and destination of Internet line habits for up to twenty-four months, which traffic allows any third party to track a user!s seems like an unjustifiable length of time. online behavior and interests. Most frequently, www.insecuremag.com 68 These examples help us better understand over a computer network, developed by David the growing demand for tools to counteract Goldschlag, Michael Reed and Paul Syver- traffic analysis and to allow end users to son. The basic idea behind Onion routing is to choose if and when to disclose their Internet distribute the connections randomly over sev- identities. A popular resource is the Electronic eral Internet nodes, so that no single node can Frontier Foundation!s Tor toolset, which em- recover the complete path (including the origin ploys Onion routing, a technique for pseu- and destination) that a data packet has fol- donymous (or anonymous) communication lowed.

Before each hop along the circuit, the end speed with respect to clear direct connections. user!s client negotiates a separate set of en- Onion routing, however, is also implemented cryption keys to ensure that a node cannot in private networks owned by companies sell- trace the connections passing through it. Be- ing anonymity services to customers who are cause of the distributed and encrypted nature willing to pay a premium for a large bandwidth of Tor paths, using this technology for anony- guarantee. In such cases, the service provid- mous surfing may (and in most cases will) ers look at their private Onion network of vir- substantially degrade the Web browsing tual tunnels both as the technical means for www.insecuremag.com 69 ensuring anonymity and as the legal means worth mentioning that the Onion routing ap- for avoiding legal liabilities for the end users! proach provides better anonymity protection online activity. In fact, the nature of Onion than the “anonymizing proxy” approach shown routing complicates noticeably the task of in the picture below, where all communica- packet tracing even when all network nodes tions appear to come from a proxy server and are controlled by the same entity. It is also not from the true originator:

This technique has the advantage of a simpler trust on one single entity. This “trusted entity” architecture, focusing traffic through one is de facto a single point of failure, where a server that screens the identities of all the compromise or successful attack is enough to originating locations. A more careful analysis, reveal the identities of all the users. The Tor however, also reveals that the “anonymizing public service, on the other hand, suffers from proxy” approach suffers from the main disad- a known vulnerability that can be easily spot- vantage of requiring the users to place all their ted by looking at the routing diagram: the www.insecuremag.com 70 last node through which traffic passes in the of Internet-based applications and services. network has to decrypt the communication be- The rise in the variety and sophistication of fore delivering it to its final destination. In cyber fraud and identity theft points to the other words, the entity operating that node strong need to provide protection well beyond sees the communication passing through it in the simple perimeter level. the clear. This vulnerability points to the differ- ence between protecting anonymity and as- Here we wish to report on the slow but steady suring confidentiality or integrity, something emergence in the industry of ultra-secure that, unfortunately, Tor users don!t yet seem to products for Web transactions. These prod- fully appreciate. ucts offer the combined features of a smart- card-enabled hardware token, a mass storage Recently, Dan Egerstad, a Swedish computer device for data encryption and a secure appli- security consultant, posted online the user cation platform. As shown in the figure below, names and passwords for 100 e-mail ac- this new family of products exploits standard counts intercepted by hosting five Tor exit smart-card technology to deliver PKI- nodes placed in different locations on the compliant two-factor authentication, on-the-fly Internet as a research project. This was a hardware encryption and digital signatures of dramatic demonstration of how an opportunis- both data and transactions. The on-board SSL tic attacker could exploit a Tor exit node to engine allows seamless enforcement of mu- view and manipulate the traffic of a large tual client-server authentication as definitive numbers of users—which in this case also in- protection against phishing or man-in-the- cluded people from embassies belonging to middle attacks. Australia, Japan, Iran, India and Rus- sia—without the need to compromise key At the same time, a second, read-only layer parts of the Internet infrastructure. Naturally, holds embedded zero-footprint applications the use of end-to-end encryption (e.g. via SSL such as anti-keystroke-loggers, anti-virus, connectivity) would force the traffic to leave biometric sensors and Web transaction en- the Tor exit node still encrypted, thereby pre- gines that enable users to be identified and to serving the integrity and confidentiality of the securely access and operate online without communication. the need to rely on PC resources.

The lack of ubiquitous cryptography in net- A final, third security layer is dedicated to the work communication protocols, however, safe storage of personal and financial data, leaves the unaware Tor end-user often ex- which can be kept permanently encrypted and posed to this form of attack to the privacy of managed without fear of exposure to the PC his anonymous Web sessions. operating system and its vulnerabilities.

Platforms for ultra-secure Web The usability advantages of this new genera- transactions tion of products for end users are obvious, es- pecially when presented as an easy-to-use Some of the points touched on above also device such as a familiar USB stick and with apply to enterprises wishing to provide their no major learning curve to master. Further- employees and/or customers with strong se- more, the flexible on-board flash memory al- curity means for accessing the corporate do- lows remote updating of the applications! da- main or for transacting over the Web. The tabases and security components in order to slow penetration of online banking compared oppose new threats without having to physi- to other Internet activities is a clear indication cally replace the units. that both the financial institutions and the end users are aware of the high vulnerability of the The possibility of loading such devices with a current Internet browsing platforms when it variety of pre-installed and pre-configured se- comes to carrying out sensitive transactions. curity applications opens the road to targeted offerings and functionalities specifically de- Recent FFIEC regulations requiring two-factor signed for the online needs of vertical mar- authentication in financial business are aimed kets. at mitigating the risks associated with the use www.insecuremag.com 71 Finally lifting the security concerns of financial the number of online bankers, e-commerce institutions and corporations without overbur- and Web transaction clients, ultimately trans- dening the end users with complex and un- forming them from passive users to active friendly procedures will undoubtedly increase customers.

Corrado Ronchi (CISSP) is the co-founder and CEO of EISST Ltd., a multinational company focusing on soft- ware architecture, applied cryptography and mobile storage technologies. Corrado has conducted academic and applied industrial research for 20+ years, consulting with major European and USA corporations on stra- tegic issues concerning information security technologies applied to Internet-based business models, regula- tory compliance and business-critical applications. Originally from Brazil, Corrado holds a Master's degree in theoretical astrophysics from "La Sapienza" University of Rome and a Ph.D. in applied physics from Cornell University. Prior to his current occupation, he worked for leading global corporations, including Telecom Italia, AT&T and Cisco Systems. The author can be reached by email: [email protected].

www.insecuremag.com 72 Newton!s first law of motion states that a moving body will want to keep mov- ing. The same law also seems to apply to business data, and the problem is trying to stop that mobile data moving further than you want it to.

It!s an issue that has caught out a number of PDAs, mobile phones and USB devices. Sec- very high-profile organizations, from the UK ond is the requirement to audit and control financial institution, the Nationwide Building data transfer and access to removable media, Society, to MI5, the British security service. for example USB keys or iPods. The final is- Both have suffered embarrassing losses of sue is control of the security policy running on laptops, with the potential for damaging data the user!s endpoint device – irrespective of leaks from those devices. type of device.

What!s more, the problem is growing. In the Let!s now look at each of these issues sepa- 2006 FBI security survey in America, theft of rately – and how security administrators can laptops and mobile devices was second only best control the use of mobile technologies to to viruses as the most common type of attack give the widest access to corporate resources detected over the previous year. Nearly 50% while maintaining control to the organization's of those responding to the survey had suf- security policy. fered, with an average loss per respondent of over $30,000 USD – up from under $20,000 Disk Encryption: full-disk or file? the previous year. Once you have decided it is necessary to pro- So how should mobile data security be ad- tect your mobile devices then you will need to dressed? Broadly, this means looking at three decide on whether to implement full-disk en- key issues. The first issue is hard disk encryp- cryption (FDE) or file-based encryption. tion of laptops, and smart devices such as www.insecuremag.com 73 The latter is tempting, because Windows XP File encryption is only as good as your end- comes with file-based encryption built in – in users! level of interest or knowledge. Simply common with Linux, and the Macintosh oper- put would you leave updating the corporate ating system. While these methods mean that AV software, or software patching to your us- anything stored in specific folders or directo- ers? ries is encrypted automatically, there is a sig- nificant security flaw. They rely on users put- The key advantage of full disk encryption is ting files in the encrypted folders themselves. that it automates the process and secures the entire disk, so mobile users don!t have to That!s fine in theory, but as an IT professional worry about it – and also cannot interfere with do you want to rely on users to know what is it. sensitive information and two to place it into the appropriate folder. Even for the sharpest Enterprise data encryption solutions also offer end-users the issue is further complicated by central management with tools for resetting popular applications such as Outlook and passwords when the user forgets or leaves so Web browsers, which scatter attachments the corporate data remains a corporate asset. across file systems, often in obscure places. Let!s look at some of the factors it is worth Folder-level encryption helps only if the IT de- considering with a full disc encryption product. partment can tightly control all files and appli- cations.

The key advantage of full disk encryption is that it automates the process and secures the entire disk, so mobile users don!t have to worry about it – and also cannot interfere with it.

Performance and standards It!s essential that the FDE solution you choose is operative during these wake-up and shut Increasingly, compliance emphasis is being down periods, to avoid security vulnerabilities. placed on encryption that meets the Federal Information Processing Standard (FIPS) de- Busy users often don't shut down their laptops veloped by the United States Federal gov- at the end of a session: they put them into ernment. This entails the use of either Triple sleep or hibernate mode, so they can start DES (Data Encryption Standard) or 256-bit again quickly. It is vital to ensure the FDE so- AES (Advanced Encryption Standard) as the lution you choose can encrypt the contents of encryption algorithm. the laptop!s memory during the process of it being written to the drive. If the solution does Encryption performance is also a factor to not do this, a thief can remove the disk drive consider. A common criticism leveled at FDE from a stolen laptop that!s in sleep mode, techniques is that they slow down the PC!s mount it in another machine, and recall and performance, with the user experiencing de- read the data written from the memory. Sup- lays while data is encrypted and decrypted on port for laptops! sleep and hibernation modes the fly. is critical.

To a certain extent this is true, but misleading. For similar reasons, it!s important to choose A typical business-oriented machine from a an FDE solution that encrypts data before the corporate fleet of laptops, built in the last 2 to laptop operating system loads, on boot. The 3 years, will have the processing power and FDE solution should take control while the memory capacity to make any difference in computer!s BIOS looks for a master boot re- running performance barely noticeable. cord to load, to prompt for the users for their login credentials. This ensures that only In fact, the only times that FDE truly impacts authenticated users boot the OS, and mini- on performance is on boot-up or going into mizes the opportunities for manipulating data. hibernation – but this is a very modest trade- off for security.

www.insecuremag.com 74 Security in hand tion chosen should encrypt data automatically with no user intervention, giving ease of use While the examples given so far relate to lap- with control and enforceability. top PCs, the same concerns are just as valid for PDAs and smart phones which are also In terms of encryption strength for handheld platforms for corporate data. Because these devices, this is typically not as strong as for a devices vary in operating system – from Sym- fully specified laptop, but look for 128-bit AES bian, Pocket PC and Windows Mobile to Palm for data stored on the devices as a minimum. – and architecture, an easy security solution is harder to define than for an Intel PC platform. However, this is only the first part of the secu- rity picture. Full-disk encryption is not a magi- Key concerns for handheld security include a cal shield against all types of security threat to rigorous audit of all the devices being used portable devices. While it will protect data on within the enterprise, and then a single en- the hard drive from compromise if the device cryption solution to cover as many of the plat- is stolen or lost, the hard drive is only one forms as possible. If the handheld device is storage medium in use on a typical laptop. not authorized, the default approach should This brings us to the second area for endpoint be to not allow connection to the corporate security: the management and control of data network or storage of sensitive data. And as leakage. with full disk encryption on laptops, the solu-

Key concerns for handheld security include a rigorous audit of all the devices being used within the enterprise, and then a single encryption solution to cover as many of the platforms as possible.

Data leakage: audit and control of quirement to the Security Department as in a removable media large environment it would not be unusual to have 1000s of USB devices. Once the data is Endpoint security should ensure that the or- encrypted on an authorized device it must be ganization is able to avoid data leaks onto pe- accessible to the organization if required ripheral devices such as USB drives and port- through central administration of the system. able storage media – such as MP3 players and digital cameras. At the end(point)

The starting point for protection against leaks This leads us to the third area of endpoint se- via these USB devices is to include them in curity. How do we protect the data on the ma- the business acceptable usage policy (AUP) chine from software threats such as and to educate users on the importance of fol- application-level attacks or malicious code? lowing policy – which will include the business risks of breaching policies. The starting point for an effective endpoint se- curity strategy is for every machine to run a However, policies alone are not enough. How firewall and antivirus protection with up-to- should they be backed up and enforced? This date signatures before it is granted a connec- is the role of port control solutions, which can tion to the corporate network. This client automatically block a USB device that does should also ensure that the laptop is running not comply with the corporate security policy the appropriate software patches and include or prevent the transfer of certain files or file a VPN client for secure transfer of corporate types. information back to the corporate infrastruc- ture. As with all endpoint security it is impor- An example of a corporate security policy tant that this is managed centrally. could include allowing encrypted USB devices – but not an iPod or mobile phone – from an Other key points that should form part of the authorized user. Again the ability to manage endpoint security plan are: the security policy centrally will be a key re- www.insecuremag.com 75 • Client lockdown, to prevent mobile users and • Preventing unauthorized applications and attackers from disabling endpoint security or malicious code from capturing and sending enforcement of network access policy. The enterprise data outbound to hackers. ability to deliver comprehensive, assured end- point security and policy compliance across • Email protection: this includes quarantining the enterprise enables threats to be defeated. suspicious email attachments and inappropri- ate email – whether by network-based soft- • Inbound threats: laptop PC ports should only ware or an in-the-cloud service – to help pre- be opened for authorized network traffic and vent address book hijacking. should block network intrusion attempts; port stealthing hides endpoint PCs from port scans.

With endpoint security, each time we touch the remote device it is a cost to the organization so the ability to centrally manage the security policy of the remote security solution will be a key factor in deciding on a solution.

Management matters ability to exclude users or allocate specific user permissions; to create user groups; With endpoint security, each time we touch automatically push updates; integrate with ex- the remote device it is a cost to the organiza- isting LDAP or Active Directory infrastructures; tion so the ability to centrally manage the se- and set configuration essentials such as user curity policy of the remote security solution will passwords, password lengths and strengths, be a key factor in deciding on a solution. Se- retry attempts, lockout times and user recov- curity without easy, central control by IT ad- ery options. ministrators leads to holes in defenses – holes which will eventually be exploited. Don!t un- The other essential management issue is derestimate the importance of management. quick access to comprehensive audit and event logs, which give an audit trail on user Looking specifically at the management is- and network events such as when users are sues around full disk encryption, ensure the changing passwords, if there were failed at- solution you choose to deploy lets IT staff eas- tempts to log in, or errors occurring. This visi- ily perform day-to-day functions, such as re- bility is essential from both a management setting users' and administrators' passwords and compliance standpoint. and PINs. Load and lock Make no mistake, many users will forget or lose their authentication details, so re- In conclusion, some industry observers ques- allocating these needs to be simple and se- tion the need to have any sensitive data on cure. Furthermore, IT staff will regularly need mobile computing devices. It!s an interesting access to users! machines for routine upkeep point – but the data is already out there, and tasks such as software patches and updates – now that it has started to move, it!s going to so administrator access similarly needs to be keep on moving. secure and easy to manage. Therefore, the only effective solution is to en- For broader management of all endpoints, de- sure that data loaded onto mobile devices is sirable management capabilities include the kept locked up.

Caroline Ikomi (CISSP) has worked in IT for 15 years, and has specialised in IT security since 1997 when she was security engineer for the utility company, London Electricity. She joined Check Point in 2000, and is now UK technical manager.

www.insecuremag.com 76 Historically the goal of security for most companies was nice and simple - keep the bad guys out. And it was easy to classify who the bad guys were. The bad guys were everyone outside the company on untrusted external networks.

This approach worked pretty well until a num- increased awareness of the value of data and ber of reports emerged starting that internal the failure of the existing security approaches threats accounted for around 50 to 60 percent to secure the data. of the total security threats to a company. Now the bad guys were more difficult to classify. Companies now more than ever are realizing This revelation required a new approach to that their confidential data is in many cases security that revolved around keeping the bad the lifeblood of their business and loss or theft guys out, even if they were inside the network. of the data could be critical Companies ensured they had all their systems patched and “hardened” so that no attacker A simple example would be the prior approach would be able to break in. This approach too to dealing with lost laptops. Previously a lap- has lasted a number of years and been very top left in the back of a taxi would have been successful. written off as just the replacement cost of the laptop. The total cost to the business would be Recently, however there!s been a marked "500 maybe. Now however companies real- move towards a new security approach. This ize that the data stored on the laptop may be approach revolves around securing the data worth a whole lot more. How much would that itself as opposed to just the systems and net- laptop be worth if it currently held all your cus- works that hold the data. tomer records? While it!s hard to determine you can guarantee it!s a lot more than "500, Why the somewhat radical shift in focus and especially if you hadn!t backups of the data! need for a new approach? There are a multi- tude of reasons but the primary drivers are the www.insecuremag.com 77 Of course this is just one example of how for- ing to prioritize and assign greater levels of mer security controls don!t adequately secure controls to? When stated like that it seems the data. Another major source of new risks to obvious but how many people really know data is the fact that companies now want to what!s stored on their file servers? And if you share and integrate more with their customers don!t know what!s there, you!re either going to and suppliers than ever before. Integration is end up over-spending on protecting data that no longer a competitive advantage, it!s a re- isn!t sensitive or you!ll under spend and leave quirement. This often involves giving external sensitive data exposed. users access to internal systems and applica- tions, many of which were previously hidden Data encryption is a rapidly growing area of from public view by layers of firewalls. This security. While security managers have been increased requirement to expose internal ap- very familiar with the use of encryption for se- plications to the public has emerged in con- curing data in transit over public network such junction with the explosion in web application as the Internet, encrypting data at rest on file security research. The problem here is that servers or in databases is a relatively new many of the vulnerabilities within web applica- concept. tions are exploited through the normal func- tionality of the application of which firewalls If data encryption is a new concept for many and traditional security measures have no data integrity is an even stranger concept visibility. again. Data integrity boils down to a simple question, but one that often is unanswerable, So what does this shift in approach actually how do you know the data hasn!t been entail for the average security manager? One changed since you entered it? There are of the most significant shifts is that the secu- many examples where data integrity is even rity manager must now interact more with the more important than data encryption. For ex- data owners. Previously if a new financial ap- ample, if your company produced medicine, plication was being introduced the security would you know if someone altered the for- team would harden the server and then re- mula just prior to a new batch being pro- strict access to it using a firewall. At that point duced? their job was often done. The finance team would administer the application and that Data access control may seem like an area would be the end of it. Under the new data that!s already addressed by existing access security approach however, the security team control controls but can you restrict access to would also have to speak with the finance the data throughout it!s life? You may only al- team to determine what kind of data will be low the finance department access the budget stored in the new system, how sensitive that files, how do you restrict access to the budget data will be, who will require access and file once it!s been copied to a USB key or where will the data flow both within and out- emails to an anonymous email account? side of the application. Technologies such as DRM allow you to en- sure that only the members of your finance Essentially the main elements of data security department can open the file so that if the file revolve around data classification, data en- is sent outside the organization is will be use- cryption, data integrity and data access con- less to anyone else. trol. # Each of the new controls bring with them Data classification is a key element in the data many obstacles to overcome such as locating security model because unless you know how data, educating employees on classification, sensitive the data is you can!t assign ade- key management and supporting mobile quate security controls to its protection. For workers. This are the challenges of the future. example, if you have two file servers on your The next time you think about security, don!t network; one which stores all your companies just think about how to keep the bad guys out, intellectual property, and one which stores think about how to keep the data secure. employee personal photos, which are you go-

Mairtin O'Sullivan is a Senior Security Consultant at Espion (www.espion.ie) www.insecuremag.com 78

One of the things that we take pride in as intelligent human-beings is our abil- ity to learn from our mistakes. And for the most part, we do. But this ability to adjust our actions when things go wrong seems to fly in the face of the data insecurity problem that!s been dogging corporations for quite some time.

Since 2005, according to Privacy Rights measures than organizations that haven!t suf- Clearinghouse, 155,233,309 records contain- fered a breach. ing personal information have been compro- mised. A recent Ponemon Research Study What makes the data breach problem so (The Business Impact of Data Breach, 2007) hard to solve? points out that the question isn!t if a company will suffer a data breach but rather when. The Security has always been a game of cat and same study reveals that the overwhelming mouse. The good guys lock up the valuables, majority of the US companies surveyed have then the bad guys figure out how to pick the experienced a data breach, and half of those lock, and the good guys add a new obstacle to respondents have no incident response plan keep the bad guys away. But before the cat in place. Scratch head and read on. and mouse cycle begins, an object has to be worth stealing. This is what is happening to Data breaches are (obviously) an enormous electronic data. problem. The fallout from mass data breaches includes: fines, law suits, loss of customer and Companies have used sensitive electronic partner trust, brand damage, loss of business data for quite some time; only in the last few and dropping share prices. What could possi- years has data become such a valuable bly cause companies to ignore the data risk commodity that it!s being targeted by a vast problem? The answer is that they!re not ignor- and growing community of data thieves. Only ing it. According to the same Ponemon study, in the last decade has the nature of business organizations that suffer data breaches actu- called for electronic data, especially sensitive ally employ substantially more data security data, to be accessible to so many different www.insecuremag.com 80 users. As the need for industries to provide data but unfortunately many companies read data access to more stockholders grew, indus- this as “encryption is the silver bullet for PCI tries and governments imposed dozens upon compliance”—which it is not. dozens of regulatory requirements--including thirty five state and numerous federal Adding to the data protection challenge is the regulations--on the care and handling of sen- fact that most organizations store data in mul- sitive data. The state regulations bring with tiple locations and in many different types of them the added challenge of notification (they servers, and that data is accessible to thou- mandate that any individual who resides in sands of computers on corporate networks that state who is at risk from a breach be noti- and even larger numbers of people (maybe fied). Compliance with these regulatory re- tens of thousands or millions) via the Internet. quirements, although inspired by the need to Data is portable and easier to hide than most protect and/or guarantee the integrity of data, valuables and harder to track. So, to sum it became the primary focus of many compa- up, in order for businesses to achieve and/or nies. maintain competitive advantage, many, many people must have access to data; data is at In some respects, the regulations helped to greater risk than ever before, but you can!t clarify and in others they have complicated the lock data away or you will hurt your business; data protection issue. The Payment Card In- and, your company is likely to fall under a dustry Data Security Standard (PCI DSS) has dozen or more regulations mandating that you done a better job than most regulations of lay- know what is happening to the data in your ing out the action needed to achieve compli- care and be able to prove that you know ance. The standard clearly calls for encryption what!s going on with it. This adds up to a very to be used for the protection of cardholder difficult problem to solve.

DESPITE THE FACT THAT COMPANIES ARE EMPLOYING MORE SECURITY THAN EVER BEFORE, THE SECURITY METHODS THAT THEY!RE USING APPEAR TO BE LESS EFFECTIVE THAN EVER BEFORE.

This difficulty of securing sensitive/regulated attitude (about data and anything else of criti- data is evidenced by the fact that data cal importance) is passed down from top breaches have become such a common oc- management. Data Governance is the term currence that we are no longer surprised that many companies have adopted to de- when data belonging to thousands of people scribe their company!s overarching plan for is compromised (outraged maybe, but not how data is to be handled by stake-holders. surprised). Despite the fact that companies The more strategic companies start with a are employing more security than ever before, Data Governance plan and build programs the security methods that they!re using appear from there. This is likely to be the way that to be less effective than ever before. Data se- many companies will formulate data protection curity is a moving target and we!re in a phase strategy in the future. where the bad guys seem to have momentar- ily pulled out in front—security needs to catch In the present, however, companies tend to up. But, as the old saying goes, “we have the start from the immediate problem and work technology.” from there. They may be under the gun to pass a compliance audit (where non- Where do you start? compliance will result in stiff penalties) or have suffered a data breach that forces them to to- Business practices are a good starting place tally rethink their data security policies and ac- when reformulating the way a company views tivities. The question is, “what should a com- their data assets and handles data security. pany consider when they!re looking to update There is another old saying that a fish rots or overhaul data protection/governance prac- from the head down. This is a colorful way of tices?” expressing the sentiment that a company!s www.insecuremag.com 81 Searching the internet you can find statistics database or file server containing large claiming that anywhere from 50% to 80% of amounts of valuable data assets. data threats come from insiders. Whether these statistics are accurate or somewhat ex- Companies using only this type of “perimeter” aggerated, this is still a good starting place security are subjected to data breaches that when it comes to rethinking data protection. go unnoticed for many months (or years). Insiders are not just a company!s employees, There are many recent examples of data outsourcers or partners, but they are any us- breaches that were detected long after the ers with credentials—this includes masquer- fact including a major retailer, a credit card aders pretending to be authorized users. processor and several well-respected univer- These users have the keys to the kingdom. In sities –just to name a few. These organiza- other words, traditional security will not work. tions did not have insight into what was hap- Catching insiders or outsiders masquerading pening with the data stored in their data cen- as insiders, requires a new way of looking at ters. They were not tracking user activity with things. If traditional security is “Outside In” sensitive data assets. Since no break-in thinking companies need to adopt “Inside Out” alarms were sounded, no firewall of IAM sys- thinking. What this means is that instead of tem breached, the breaches were impossible constructing obstacles from the perimeter in- to detect in time to mitigate damage. ward toward the data, companies need to start from the inside—at the core data servers Interestingly enough, at the core of almost all where data is stored. compliance regulations is the requirement that companies track who accessed which regu- What we!ve learned from recent breaches is lated data when and report on these actions in that enterprises employing only data security detail. These are essentially the same actions architectures, designed to slow or stop at- needed to prevent data theft from inside data tacks, cannot stop mass data breaches— centers. where someone with credentials accesses a

CATCHING INSIDERS OR OUTSIDERS MASQUERADING AS INSIDERS, REQUIRES A NEW WAY OF LOOKING AT THINGS.

Rethinking data security it (theft has to be differentiated from legitimate access - analytics are critical). The Inside Out data protection model ad- dresses insider data risk as well as compli- 4. Automated Risk Mitigation – Alerting ca- ance requirements. It also enables wide ac- pable of sending data to response centers cess to data because it is based on having immediately, as a breach/data compromise is insight into exactly what is happening with da- detected. This should be designed so that ac- ta—as it happens—without locking the data tions can fit the exact situation. away. To illustrate the way Inside-Out security think- The Inside Out model is based on four steps: ing works, it might be useful to visualize a se- curity camera in Fort Knox that is being moni- 1. Discovery – Knowing where high value tored by guards who know exactly who should data is located and classifying it. be in what part of the building and who is al- lowed access to the contents of the vaults-- 2. Monitoring – Capturing detailed informa- right down to which blocks of gold they can tion on the access to data as it is being ac- touch. If they make it past the locks and the cessed. badge readers, the guard can see what they!re up to, and if they overstep their bounds 3. Theft Alerting – Using analytics that can he can remediate based on the action they detect theft accurately in real-time and alert on take.

www.insecuremag.com 82 This is an oversimplified analogy but it identi- ered defenses that include user authentica- fies the hole in data security that has allowed tion, access control, encryption and content mass data breaches affecting databases to inspection for data in motion. These methods continue. are still extremely important for data security but they make up only part of the solution be- That hole is the inability to “see” what is going cause they can!t tell the difference between an on inside data centers. Traditional best prac- authorized user who is conducting legitimate tices have emphasized the integrity of server- business and a malicious insider who is steal- resident data assets. They have relied on lay- ing valuable data assets from a database.

What have we learned? Getting it right is not a simple checklist exer- cise. Enterprises are complicated entities with The current atmosphere of breach mania is a diverse policies, data access needs, technol- clear signal that beefing up existing methods ogy infrastructures and resources. That said, is not the answer. To stay on top of the latest the answer is relatively simple---make sure threats requires us to step back and rethink you know what is going on with sensitive/ what security looks like. Insider threats pose regulated data at all times and make sure that some of the greatest risk to data and it will you can prove that you know what is going on. take more than traditional layered defenses to mitigate it. This is particularly true when it Inside Out data security with monitoring and comes to privileged insiders who have direct behavioral analytics in an active role (to help access to systems and data and are capable companies know what is really going on with of covering their tracks. data and applications) is a necessary compo- nent of sound data governance and security. Compliance regulations are the motivators for This is an intuitive leap--watch what is actually much of the data security/data integrity action happening to data, don!t simply trust that the that is being taken by companies. They are a locks are secure—that will turn recent data reaction to the fact that we!re not doing a good security mistakes into both a security and bot- job of protecting data from being compro- tom line business advantage. mised. If we get data governance and protec- tion right, compliance will fall in step behind it.

As president and CEO, Joel Rosen drives the business strategy and day-to-day operations of Tizor. Previ- ously, Joel served as president and CEO of NaviSite, a managed services infrastructure provider, where he led the company through a successful initial public offering and grew revenue tenfold to $100 million. Tizor Sys- tems Inc., Maynard, MA, provides the world!s largest companies with the only data auditing and protection so- lutions that can monitor and report on all critical data activity across the enterprise – including databases, file servers, and mainframe applications – for compliance assurance, data protection and theft detection. Joel can be reached at 978-243-3231 or via e-mail at [email protected]. Visit Tizor!s Web site at www.tizor.com.

www.insecuremag.com 83 NetStumbler http://www.net-security.org/software.php?id=160

NetStumbler is a tool for Windows that allows you to detect Wireless Local Area Networks.

Kismet http://www.net-security.org/software.php?id=218

Kismet is a wireless network sniffer. It is capable of sniffing using almost any wireless card sup- ported in Linux.

WifiScanner http://www.net-security.org/software.php?id=381

WifiScanner is an analyzer and detector of 802.11b stations and access points. It can listen alter- natively on all the 14 channels, write packet information in real time, can search access points and associated client stations, and can generate a graphic of the architecture using GraphViz.

KisMAC http://www.net-security.org/software.php?id=625

KisMAC is a free stumbler application for MacOS X, that puts your card into the monitor mode. Unlike most other applications for OS X it has the ability to run completely invisible and send no probe requests. www.insecuremag.com 84 Wireless technologies, including Wi-Fi, are subject to security issues because data is transmitted through the air. Because encryption methods are not util- ized on hotspot networks, everyone within range can “listen in” or capture po- tentially sensitive data.

One of the main benefits of networking in vide a safer and more secure hotspot experi- general is the ability to share files among ence for your users. other network users. However, this is not such a desired feature on public networks, because Understanding everyone!s responsibilities the users probably do not want others brows- ing through their files. This article addresses Everyone has certain responsibilities when it these issues and more, enabling you to pro- comes to the safety and security of your Wi-Fi hotspot, as Table 1 below illustrates.

Hotspot Administrator/Owner The User

Inform users of the risks when using a hotspot or Beware of the risks when using a hotspot or unsecured wireless network. unsecured wireless network.

Give users safety and security tips. Follow the safety and security tips.

Enable VPN1 Passthrough. Use VPN connections.

Isolate clients. Disable file sharing.

Filter hotspot content. Use personal firewall software.

Secure user information. Keep an eye on valuables. www.insecuremag.com 85 Hotspot administrator/owner VPN Passthrough is enabled by default (and responsibilities should not be disabled) on wireless network- ing equipment, such as routers, access points, You as the hotspot administrator or owner or hotspot gateways. This Passthrough fea- have the obligation to do many things to help ture opens the ports that VPN connections ensure your hotspot users have a safe and use. You can find the Passthrough settings in secure experience. the Miscellaneous or Security section of your wireless device configuration utility. Inform users of the risks Isolate clients One of the most important responsibilities that you have as a hotspot administrator or owner Some wireless devices, such as routers, ac- is to ensure that your users understand the cess points, or hotspot gateways, have a cli- risks associated with using an unsecured ent isolation feature. It is a simple and inex- wireless network, such as your hotspot. Fol- pensive version of the VLAN feature that is lowing are three such risks: available on enterprise equipment. Client iso- lation blocks the traffic between the users on • Internet activity can be monitored. the network. Therefore, users cannot access • Login information from unsecured Internet each other!s shared files. This benefits the services and websites can be intercepted. people who forget to disable file sharing on • Any shared files are open for others. their computer while using the hotspot.

People who have the right tools can capture NOTE: Keep in mind that if your Wi-Fi hotspot the data that is flying through the air. Because uses multiple access points (APs), you should hotspots do not use encryption, all the infor- enable the client isolation feature for each AP. mation that is sent over the wireless network This is because the isolation feature can be can be captured. This includes the usernames implemented only on an AP-to-AP basis. and passwords when logging into web-based applications, such as websites (that do not Filter hotspot content use SSL with a HTTPS address), e-mail ac- counts, FTP connections, and other services You can use a few filtering methods to help that do not use encryption or other security keep your users safer while using your Wi-Fi methods. hotspot:

Give users safety and security tips • Filter web content (to block pornography, foul language, and so on). After informing the users of the risks associ- • Block certain Internet ports (to prevent the ated with using your Wi-Fi hotspot, you should use of file-sharing programs, POP3 e-mail, provide solutions or methods that will help and so on). limit or eliminate these risks and issues. • Block specific websites. These solutions, as shown in the following list • Block websites based on keywords. and discussed later, summarize the steps that users can take to ensure a safe experience The filtering and blocking features of particular while using public hotspots: wireless routers and hotspot gateways vary greatly. • Use VPN connections. • Use secure (SSL) websites. Web content filtering solutions allow you to • Disable file sharing. easily block illegal or inappropriate websites. • Use personal firewall software. This solution is great for hotspots that might serve a majority of youngsters; however, it Enable VPN Passthrough typically is not feasible for general hotspots. Actively filtering the websites that users visit Users can use VPN connections to secure typically requires the use of hardware, such as their information that is being passed through a proxy server, and is too expensive and time- the public wireless network. In most cases, consuming for most hotspot owners. www.insecuremag.com 86 Many wireless routers and gateways allow User responsibilities you to block users from using certain Internet ports. These ports are associated with certain Even though you can take precautions to applications and services, such as port 80 for make your hotspot safer and more secure, it is web browsing. up to the users to ensure their security.

Following are some ports you might want to Beware of the risks block: The saying “Ignorance is bliss” might come • 21 - FTP (prevent large transfers) back to haunt people who ignore the risks and • 25 - SMTP Server (disable sending of POP3 issues of using unsecured wireless networks e-mail to help prevent spam from originating such as hotspots. Even if users do not follow at your hotspot) all the advice to limit or eliminate the risks, • 1214 - Kazaa (online file-sharing program) they should at least educate themselves. • 3689 - Network Jukebox protocol Therefore, when it comes to the safety and • 6667 - Universal Internet Relay Chat (IRCU) security of using Wi-Fi hotspots, the main re- sponsibility of users is to be aware of the is- Many wireless routers and gateways, allow sues, so that they can properly protect them- you to block users from visiting specific web- selves. sites or those that contain keywords you de- fine. For example, if teens are spending hours Follow the safety and security tips on a certain website, and it is causing prob- lems, you can add that website address to the Hotspot users should follow any safety and list. This prohibits the teens from accessing security tips that you or others give them: the website. • Use VPN connections. Using these methods can also help protect • Use secure (SSL) websites. you, as the hotspot owner, from users who are • Disable file sharing. performing illegal activities through the Inter- • Use personal firewall software. net access you are providing. • Keep an eye on valuables.

Secure user information These items are discussed in the following sections. You should keep your user!s information se- cure when it is traveling over the wireless hot- Therefore, to protect your user!s information, spot and in any databases where sensitive use SSL encryption on all applicable web information is stored. pages, which secures the login or payment information. Most hotspot gateways have this Because hotspots are for public access, they feature. usually do not use encryption methods—such as Wired Equivalent Privacy (WEP) or Wi-Fi In addition, if you are using a RADIUS server Protected Access (WPA)—such as used in or a hosted solution, you should look into and private networks at homes and businesses. understand the security measures taken to keep the user information safe. Therefore, all the information that is passed through the wireless network is unsecured, Use VPN connections and others can easily decipher the data. How- ever, data that is sent to and from a website If users are conducting sensitive business, that uses SSL encryption, indicated by the such as checking unsecured POP3 e-mail ac- padlock in the lower-right corner of the web counts via hotspots, they should use VPN browser and a web address of https, is safe connections to encrypt the information. Many and secure. businesses provide this service to their em- ployees to access the corporate network while away from the office.

www.insecuremag.com 87 Typically, VPNs securely connect remote net- dows XP, that have built-in firewall capabili- works or give people secure connections to a ties, or you can purchase software that pro- remote network. However, typical consumers vides the protection. Some hotspot-specific can also use VPN connections to secure their software solutions provide firewall features. hotspot experience. Even if your users do not You can also look into consumer software ti- intend to connect to remote networks, they tles, such as ZoneAlarm from Zone Labs or might use VPNs because the information Kerio!s Personal Firewall. passed through the VPN tunnel is encrypted and secured from end to end. Keep an eye on valuables

Use secure (SSL) websites Users should keep an eye on their valuables while using public hotspots, or others will. Us- When hotspot users are viewing sensitive in- ers should keep items such as their laptop, formation, such as web-based e-mail and PDA, or briefcase with them at all times. banking information, they should ensure that the website is implementing SSL encryption Summary on the website login page and during the en- tire sensitive session on the site. As discussed Given that Wi-Fi hotspots use the airwaves to in a previous section, others cannot see the transmit data and that they are used by the login and other information when SSL is in public creates many security issues. This arti- use. cle discussed ways to prevent and overcome many safety and security issues with public Disable file sharing Wi-Fi hotspots.

Before people use public hotspots, they Keep in mind the main concerns: should ensure that their PC has no actively shared files, folders, or other services. The • Public Wi-Fi hotspots are inherently not se- sharing features that operating systems pro- cure. People who have the right tools can in- vide today are useful when using private net- tercept the information that users send over works; however, this is not the case when on the airwaves. However, users can take certain public networks. measures to protect themselves. • Inform users of risks, and give them tips to Use a personal firewall stay safe and secure while using your public Wi-Fi hotspot. When using Internet connections, at home or • Enable features such as VPN Passthrough, on a public hotspot, users should use per- client isolation, and web filtering to give users sonal firewalls. Firewalls help prevent people and yourself a safer hotspot experience. from accessing your PC through the Internet. You can use operating systems, such as Win-

Eric Geier is a computing and wireless networking author and consultant. He is a certified wireless network administrator (CWNA). He is an author of and contributor to several books and eLearning (CBT) courses.

This article is an excerpt from the Cisco Press book “Wi-Fi Hotspots: Setting Up Public Wireless Internet Ac- cess” and you can find out more about it at www.tinyurl.com/yt5kqo

www.insecuremag.com 88

Dr. Amit Sinha specializes in wireless communications and network security. Prior to joining AirDefense, he held various research positions at MIT, HP Laboratories, Intel and Texas Instruments. He is also the author of 15 patents dealing with different inventions in 802.11 infrastructure and wireless security. Amit received his S.M. and Ph.D. degrees in Electrical Engineering and Computer Science from MIT.

People use wireless networks on a daily 5. Ensure that your laptop is updated with the basis and are growing concerned about latest security patches. the possible threats. What advice would you give to mobile users so that they could 6. Avoid hotspots where it is difficult to tell make and keep their laptops secure on any who!s connected (hotels, airport clubs, con- network? ferences).

Taking the following precautions significantly 7. If the hotspot is not working properly, as- mitigates security risks associated with mobile sume your password has been compromised, wireless access: report to hotspot service provider and change your password at the next immediate opportu- 1. Install a firewall. nity.

2. Use hotspots only for internet surfing. 8. Read all pop-up windows in their entirety.

3. Enter passwords only into websites that in- 9. Do not use insecure applications such as clude an SSL key on the bottom right. non-encrypted email or instant messaging while at hotspots. 4. Disable/remove the wireless card if you are not actively using the hotspot. 10. Explicitly disable municipal Wi-Fi access from within the enterprise. www.insecuremag.com 90 Despite the insecurities of 802.11, the spot, the user will readily provide his or her number of wireless networks is growing username and password. rapidly. What should be done in order to raise awareness of wireless security 2. Automatic Networking - In addition to trick- problems? ing an unsuspecting user into connecting to their laptop, hackers have the benefit of taking There is significant user indifference to wire- advantage of the increasingly wireless-friendly less security especially given the fact that ra- nature of the Windows XP and MAC OS X dio frequency connections are not “visible”. operating systems. Due to the self-deploying Enterprises should define and enforce explicit nature of wireless, a wireless laptop will con- wireless access policies. Organizations should tinue to “probe” for APs it has been connected manage and enforce customized WLAN poli- to in the past. These probes are easily picked cies based on the desired security and ac- up in the air by freely available wireless moni- ceptable uses for each WLAN device. In addi- toring tools and tools such as Karma allow the tion, on going user IT training should include hacker to become the exact network a user!s wireless security sessions where users are laptop is looking for. exposed to the dangers of insecure wireless access, rogue devices, etc. 3. Wireless Driver Exploits - Several new Wi- Fi client driver based vulnerabilities have been Security auditors can raise awareness by re- revealed. These vulnerabilities typically exploit quiring strict compliance with emerging regu- malformed management frames to run remote lations such as the Payment Card Industry!s code on client machines. Data Security Standard which is quite specific about wireless security requirements. Similarly 4. Man-In-The-Middle Attacks - A man-in-the- strict adherence to other regulations such as middle attack is a type of attack where the HIPAA and SOX will also result in increased user gets between the sender and receiver of wireless security awareness. Further, enter- information and sniffs any information being prises should conduct frequent vulnerability sent. In some cases users may be sending assessments using wireless experts that unencrypted data which means the man-in- comprehensively test wireless weaknesses the-middle can easily obtain any unencrypted and misconfiguration issues. information. In other cases, the attack could be used to break the encryption key. A significant part in the process of devel- oping wireless networks is ensuring that 5. Malware Injection - AirDefense has also the data located on wireless-enabled de- identified several instances where unsuspect- vices is secure. What do you see as the ing wireless users received a fake web page most prevalent threats to that security? with a mouse-activated web overlay. Any click of the user!s mouse would trigger a download Today!s mobile workforce is extending the of harmful content, such as a virus or Trojan. edge of the enterprise network. Hotels, hot- spots and other public access wireless net- 6. P2P Wireless - Ad-Hoc mode connections works are prime locations where hackers ex- allow one wireless device to directly connect ploit wireless vulnerabilities to gain access to another device. Default ad-hoc mode usu- into unprotected laptops. Following are some ally does not require authentication or encryp- of the most prevalent threats: tion. This allows hackers to easily connect to an enterprise laptop without going through the 1. Evil Twins & Wireless Phishing - An Evil more involved Evil Twin setup. Often mobile Twin is an AP offering a wireless connection to users leave their wireless card on when con- the Internet pretending to be a trusted wire- necting to the enterprise wired network. This less network. The unsuspecting user sees the can result in an easy access wireless “bridge” Evil Twin hotspot which looks identical to the into the wired network that circumvents fire- legitimate public network the user logs on to walls and traditional wired perimeter security. every day. By presenting the user with a famil- iar scenario, such as a login page to a hot-

www.insecuremag.com 91 What are the biggest challenges related to home networks only if the VPN is enabled. the implementation of wireless LAN secu- Having the ability to define and administer fine rity policies for mobile users in the grained and enterprise specific policies is enterprise? hard.

The biggest challenges related to the imple- 2. Scalability – WLAN monitoring and policy mentation of wireless LAN security policies enforcement gets challenging when dealing are: with large organizations with hundreds of thousands of users and global presence. 1. Flexibility – To accommodate enterprise specific policies. E.g., some enterprise want to 3. Manageability – Many organizations feel enforce a no wireless policy while others overwhelmed by too much information and might want to guarantee that all authorized false positives that entail monitoring for policy users use WPA2. Some enterprises might compliance. want to allow access to certain hotspot and

Passive discovery of wireless networks using wardriving tools may be unsettling but it is not technically illegal.

What's your take on wardrivers? Some say of 802.11 (Wi-Fi) networks exist albeit to a they're harmless while other label them as lesser extent in WiMAX. criminals. 1. Rogue Base Station - This scenario is very Passive discovery of wireless networks using similar to rogue/evil-twin Wi-Fi APs that wardriving tools may be unsettling but it is not broadcast credentials (MAC address, SSID, technically illegal. This would be similar to lis- etc.) of a trusted or preferred network in an tening to someone standing at a street corner attempt to lure users into connecting to them. and shouting out random personal informa- In WiMAX, every Subscriber Station (SS) re- tion. Trying to decrypt encrypted transmis- quires strong authentication using X.509 digi- sions or intentionally interfering with someone tal certificates. This was done to prevent theft else!s WLAN is illegal. The act of wardriving of service by unauthorized users. However, per se is relatively harmless from an enter- there is no such requirement for Base Stations prise!s perspective. However, it should serve (BS). This asymmetric treatment of BS and as an early warning for them to beef up wire- SS is very similar to many Wi-Fi implementa- less security. If someone is doing a persistent tions. The 802.16 standard makes no mention wireless reconnaissance scan chances are of BS authentication. As such, it would be they want to discover vulnerabilities and po- easy to setup a rogue BS and trap authorized tentially exploit. users to connect and reveal confidential in- formation. It could also be used for DoS at- With the growing number of wireless users tacks where a SS shows strong signal living outside urban areas, the last few strength and connection but no network ac- years have seen a growth in the number of cess because it is connected to a rogue BS. WiMAX deployments. What are the possi- ble security risks associated with the de- 2. Denial of Service - All RF protocols are fun- ployment and usage of WiMAX technol- damentally vulnerable to DoS. With a strong ogy? enough jammer most wireless communica- tions can be disrupted. While WiMAX uses The 802.16 standard is definitely more "carrier sophisticated forward error correction codes grade" than the original 802.11 standard and and modulation techniques that are robust to has a better security infrastructure. However, interference, an intelligent jammer can disrupt as with all standards, there exists vulnerabili- a specific session without the need to brute ties in 802.16. Several popular vulnerabilities force jam the whole medium.

www.insecuremag.com 92 The 802.16 MAC is contention free and uses Encryption Key (TEK) related problems have scheduled transmissions. The BS broadcasts also been revealed. The TEK generated from a UL-MAP frame that is available to all sta- the AK has only a 2-bit identifier space, which tions (authenticated or not) that determines is insufficient during the AK lifetime. Further who transmits when. An attacker can use the the TEK does not have any freshness assur- schedule information to inject valid frames ance. The standard used DES-CBC for en- (e.g. replayed frames) to disrupt a stations cryption. However, 56-bit DES is proved to be communication slot. Since the interference is vulnerable. completely "in-band" it is much more effective. Wireless hot spots, and especially rogue 3. Management Frame Spoofing - The lack of access points setup as hot spots to trick authentication of powerful management users, raise unique concerns for the mo- frames in 802.11 resulted in popular DoS at- bile warrior. What can be done in order to tacks such as de-authentication/dis- mitigate the risks associated with their us- assocations attacks. Such attacks disrupt a age? wireless session between two nodes by inject- ing spoofed de-authentication/-dis- Wi-Phishing is the act of covertly setting up a assocations messages by a third party pre- wireless-enabled laptop or AP (such as an Evil tending to be one of the communicating Twin) but for the sole purpose of getting wire- nodes. The 802.16 MAC has similar man- less laptops to associate and track key- agement frames (e.g. Reset and De/Re- strokes, allowing the hacker to capture pass- register) that can force a subscriber station to words and credit card information. This con- disconnect and re-initialize. Unlike 802.11, cept is very similar to the email phishing these frames have cryptographic protections scams, where a message is sent to users from spoofed identity. Authentication is tricking them to enter confidential information, achieved using a SHA-1 in the form of an such as bank account information or other HMAC digest computed using the message sensitive username and password combina- and a secret key. While the HMAC provides tions. The process of tricking someone to vol- management frame protection, several MAC untarily provide confidential information has frames remain vulnerable to simple "replay" been used for years in a variety of forms and attacks. In a re-play attack, a valid frame is generally referred to as “social engineering”. transmission is captured and replayed. The presence of an HMAC requires that the mes- Both WEP and WPA have its problems. Is it sage be replayed without any modification. time to introduce a new wireless network Typically, frames use transient information security standard? If yes, what features such as serial number or a time-stamp to should it have? thwart replay attacks. IEEE 802.16 remains somewhat vulnerable to interference from WEP is broken. WPA is better than WEP. brute force replay DoS attacks, because there However, WPA Pre-Shared Key can be is no mechanism in place to specifically detect cracked if you use small dictionary based and discard repeated packets. An attacker passwords. WPA2-Enterprise based on IEEE could repeat many messages (whether valid 802.11i is secure. The current problems in or not) in an attempt to interfere with the WPA2 lie mostly around misconfigurations proper operation of the network. There are and implementation issues. WPA2 also does several ways in which the victim network not currently address management and con- might respond, depending on the exact con- trol frame authentication that is the basis of tent and timing of the replayed message. several types of masquerade and DoS at- tacks. Protection of some management 4. Privacy and Key Management Issues - frames is being addressed in IEEE 802.11w. Several weaknesses in the PKM of 802.16 However, rogue APs continue to be a big se- have also been revealed. All key negotiation curity gap not addressed by 802.11w. Further, and data encryption key generation rely on the 802.11w does not address control frames that Authorization Key's (AK) secret. The AK is can still be exploited for denial of service at- generated by the BS. However, the standard tacks. The problem with Wi-Fi security is that has not described the AK!s generation. Traffic security was not designed into the original www.insecuremag.com 93 standard. Standards based security patching erly applied. Usage policies for employees will never completely solve the Wi-Fi security should be outlined and duely communicated. problem given backwards compatibility re- quirements and the proliferation of legacy 3. Monitor – Once WLANs have been rolled networks. out, monitoring the network 24x7 for security, policy compliance and WLAN health is re- Based on your experience, what advice quired. would you give to organizations that are considering deploying wireless networks What are your predictions for the future and increasing their mobile workforce? when it comes to wireless security?

Organizations planning wireless LAN rollouts As we have seen in several high-profile recent should focus on each of the following 3 as- data breaches, wireless is often the Achilles pects: heel when it comes to network security. Wire- less threats and attacks will continue to rise as 1. Plan – Proper RF coverage and capacity hacking tools get more sophisticated and easy planning using accurate simulation tools that to use. As wireless networking proliferates, factor in expected usage patterns and applica- more and more data breaches and malware tions, propagation characteristics of building delivery will occur over the air. Organizations materials and future growth plans are impor- will realized that traditional wired security tant in maximizing the subsequent ROI from paradigms such as Firewalls and VPNs are WLAN. Poor planning invariably results in re- not enough and a layered approach to secu- curring management and support costs. rity that incorporates wireless authentication and encryption along with wireless monitoring 2. Secure – Once APs are deployed, security and intrusion prevention is critical for overall configurations should be checked and prop- network security.

www.insecuremag.com 94 Prior to co-founding AirMagnet, Mr. Kuan was the first software engineer at Precept Software, where he developed IP multicast and IP video streaming technologies. His prior experience includes engineering design at Empirical Tools and Technologies and systems architecture at The Wollongong Group. Mr. Kuan holds a Bachelor of Science in Information Engineering from Na- tional Taiwan University and a Masters in Computer Science from Stanford University.

People use wireless networks on a daily mised, this setting will limit the damage to the basis and are growing concerned about mobile device itself without spreading to the the possible threats. What advice would connected wire network. you give to mobile users so that they could make and keep their laptops secure on any 3. Use "on demand! instead of "automatic! network? connection method for those wireless connec- tion profiles without mutual authentication Wireless users should be suspicious at all mechanism. Typically, those profiles are for times, especially regarding those too-good-to- hot spots (no encryption) or home usage be-true service offerings. Here are a few good (static WEP). habits that might keep users out of trouble: 4. Never use "ANY! as the SSID for any wire- 1. Turn on Personal Firewall or Windows less connection profile. Mobile users should Firewall in the Wireless Network Connection only connect to the SSID he or she knows is Properties. This will prevent unauthorized in- legit. coming connection attempts. 5. Never connect to known wireless network 2. Turn off Internet Connection Sharing. If a especially ad-hoc (peer-to-peer) networks. mobile device!s wireless security is compro- www.insecuremag.com 95 6. Use wireless service with WPA2-Enterprise rity policies for mobile users in the enter- (802.1x) security whenever possible. Use prise? WPA2-PSK at home where the 802.1x server is likely not available. The biggest challenge resides in the natural paradox between information security policies 7. When using hot spot wireless services, and mobile user's wireless freedom and con- avoid sending confidential information such as venience. personal financials or company proprietary documents unless a VPN is used. Software products exist today to help enforce mobile user wireless policies, so implementa- Despite the insecurities of 802.11, the tion of security policies can be managed rea- number of wireless networks is growing sonably well. rapidly. What should be done in order to raise awareness of wireless security prob- The challenge however remains in the policies lems? themselves. The most secure policy may call for wireless connection to the enterprise wire- As is often the case, education is key to rais- less network only, and nothing else. Such pol- ing awareness. However, industry wireless icy prohibits wireless connection to mobile vendors and OS vendors hold the key to edu- user home wireless nets, hot spots, hospitality cating the masses about wireless security and suites, etc. Obviously, this is not the most best practices. Often times, security best prac- flexible and mobile user-friendly policy. tices are compromised in the name of ease-of- Should enterprises compromise? The real use or plug-and-play propaganda. People world practice lies somewhere in between a need to be informed of the risk they take when strict and lax policy. they cut corner or do not protect their wireless networks. Vendors need to take a leadership What's your take on wardrivers? Some say roll in ensuring that information is available. In they're harmless while other label them as addition, vendors need to provide solutions criminals. that are easier for the general public to deploy and use. It can be done with proper engineer- Considering the percentage of insecure wire- ing. less networks (totally unencrypted, not even static WEP), wardrivers are the least of the A significant part in the process of devel- problem. They do not make the already terri- oping wireless networks is ensuring that ble security situation much worse at all. A the data located on wireless-enabled de- hacker can already easily gather similar infor- vices is secure. What do you see as the mation with very primitive tools such as most prevalent threats to that security? Netstumbler.

Wireless devices are typically mobile devices Why blame wardrivers? I see them as the such as laptop, voice handset, scanners, and messengers who are delivering the bad news. etc. The most prevalent threat is the loss of The wireless world would not be a more se- those wireless mobile devices, which contain cure wireless world without wardrivers. the credentials to join the wireless network and ultimately into the wired network. It is criti- With the growing number of wireless users cal to ensure the security of the wired network living outside urban areas, the last few threatened by the loss of wireless devices with years have seen a growth in the number of credentials to enter the wired network. Such WiMAX deployments. What are the possi- credentials stored on the wireless device allow ble security risks associated with the de- the perpetrators to enter the wired network, ployment and usage of WiMAX and potentially even enterprise servers/ technology? domains, without physically attaching to the wired network or even being on premise. Leveraging WiFi security standards and tech- nologies, WiMAX started out with a much bet- What are the biggest challenges related to ter security framework and authentication/ the implementation of wireless LAN secu- encryption algorithms. www.insecuremag.com 96 A security flaw such as the static WEP in the knowledge. Security from a network security WiFi world is not expected to take place in standard point of view, the next step is pro- WiMAX any time soon. Secondly, WiMAX in- tected management frames. 802.11 today frastructure and base stations are expected to transmits management frames (AP beacons, be set up by WISP unlike Wi-Fi deployments, client association requests, etc.) unencrypted. where less security-aware consumers and By spoofing management frames, wireless SMBs are heavily involved. Thirdly, WiMAX services can be easily interrupted, for example sniffing technologies has only been available fake AP attack, de-authentication attacks, dis- to lab environments due to the extreme cost. association attacks, and etc. A new standard Ordinary hackers are not likely to have access to authenticate and encrypt management to such tool. frames will reduce the risk of such attacks.

So, what are the security risks for WiMAX? Based on your experience, what advice Physical layer denial-of-service attack using would you give to organizations that are RF jamming devices is the simplest one to considering deploying wireless networks conduct. There are also theoretical MAC (layer and increasing their mobile workforce? 2) denial-of-service attacks using unencrypted management frames. As WiMAX deployment First of all, use the highest security level pos- takes place and CPE becomes more avail- sible. WPA2-enterprise (using 802.1x authen- able, more risks may unfold. tication server instead of pre-shared key) with AES encryption is the way to go. Secondly, Wireless hot spots, and especially rougue define a secure, practical, and enforceable access points setup as hot spots to trick wireless policy for the wireless infrastructure users, raise unique concerns for the mo- and mobile devices. Lastly, monitor on wire- bile warrior. What can be done in order to less network according to the pre-defined pol- mitigate the risks associated with their us- icy on all possible aspects from security to age? performance and from layer 1 (RF spectrum) to layer 7 (voice application for example). First of all, wireless connection profiles for hot spots on a mobile device should not be set to What are your predictions for the future "automatic! connect. Instead, use the "on de- when it comes to wireless security? mand! option, which will prompt mobile user to confirm the wireless connection. The extra Wireless security standards and vendor prod- step may be a little inconvenient but may be ucts have caught up with the known vulner- the most effective to spot foul play. For exam- abilities. It is true that low tech denial-of- ple, a red flag should be raised immediately if service attacks such as RF jamming are still the SSID for your home wireless network sud- easy to conduct, but data security and wire- denly becomes available to you in your hotel less network penetration risks have been ad- room. dressed by the IEEE standards and vendor products. This is by no means to say that wire- Road warrior should always be suspicious and less security is home free. cautious. Wireless phishing attacks, which im- personate wireless services and web sites, In the near future, the obvious security chal- are difficult at times for mobile users to spot. lenge is practically deploying these security As a general practice, mobile users should technologies properly and timely. The eco- never send confidential information over un- nomic impact of upgrading to the latest secu- encrypted wireless networks. rity technologies and the lack of IT expertise to implement the upgrade remain to be resolved. Both WEP and WPA have its problems. Is it Further in the future, vulnerabilities against the time to introduce a new wireless network current security and authentication/encryption security standard? If yes, what features algorithms may still be discovered by on-going should it have? research and the black hat community. That cat and mouse game will not stop in the wire- WPA2 addresses the problems in WEP and less security arena. WPA. WPA2 is secure to the best of our www.insecuremag.com 97 Merwyn and members of the Office of the CTO drive Aruba's IPR, Standards, Federal, Security Vulnerability Assessment, Rapid Prototyping and long term technology strategy. Merv is an active and voting member of the IEEE 802.11 working groups. He has issued and filed numerous patents on wireless, secu- rity and high availability networking. Prior to Aruba, Mr. Andrade was a Wire- less LAN technical leader at Cisco Systems. Mr. Andrade is an industrial electronics engineer from Bombay, India.

People use wireless networks on a daily Despite the insecurities of 802.11, the basis and are growing concerned about number of wireless networks is growing the possible threats. What advice would rapidly. What should be done in order to you give to mobile users so that they could raise awareness of wireless security make and keep their laptops secure on any problems? network? Educating security professionals as to the With more focus on exploiting client-side wire- risks associated with different wireless net- less vulnerabilities, I tell customers and pros- works is a significant contributor to helping pects to assume that anyone can connect to people recognize and mitigate inherent wire- their workstations directly. less risks.

Attacks such as AP impersonation (so-called Projects such as the Wireless Vulnerabilities "evil twin") are difficult to mitigate with mobile and Exploits (www.wve.org) database allow users; the lack of lower-layer defenses (e.g. organizations to remain informed about wire- open networks) mandates stronger upper- less threats while supplying a reference layer security precautions. source for wireless intrusion detection and vulnerability assessment tools.

www.insecuremag.com 98 A significant part in the process of devel- emerging threat is Wireless telephony devices oping wireless networks is ensuring that including dual-mode smart phones with saved the data located on wireless-enabled de- pre-shared keys and/or credentials that allow vices is secure. What do you see as the unmitigated access to enterprise resources most prevalent threats to that security? and significantly increase risk when lost or stolen. The most prevalent threat to mobile devices is not high-tech or elite; it is simply lost or stolen Can handheld devices be exploited using devices. I was working with an organization zero-day and innovative techniques? Of recently who had deployed a handheld credit course, we've seen that almost globally card processing system, using strong encryp- across devices with IEEE 802.11, Bluetooth tion for wireless traffic, but with a simple pre- and WiMax as potential attack surfaces. How- shared key mirrored on all devices for authen- ever, the more universal attack of theft with tication. With a handheld loss rate between 5 weak local data storage mechanisms repre- and 10%, each lost handheld network threat- sents a much more practical target. ened all customer payment card data. Another

My primary concern with WiMAX technology is that it was designed with the service provider's security interests as a priority.

What are the biggest challenges related to the point where it is an indispensable part of a the implementation of wireless LAN secu- wireless toolkit for system administrators, rity policies for mobile users in the auditors and pen-testers. Were it not for war- enterprise? drivers, I believe more wireless networks would remain vulnerable today. The ubiquity of wireless networks is one of the biggest attractors to the adoption of the tech- With the growing number of wireless users nology, but it is also one of the biggest secu- living outside urban areas, the last few rity challenges. Organizations can take steps years have seen a growth in the number of to protect their enterprise networks, but for WiMAX deployments. What are the possi- many users, mobility extends beyond the or- ble security risks associated with the ganization's walls. Wireless access in hotspot deployment and usage of WiMAX locations, hotels and often home environ- technology? ments are inherently risky since the only net- work admission control is physical presence My primary concern with WiMAX technology is or payment for service. These challenges can that it was designed with the service pro- be mitigated by secure wireless overlays that vider's security interests as a priority. This is uniformly enforce and create "principle of least exemplified in the WiMAX Privacy Key Man- privilege" isolation via in-built firewalls, cen- agement (PKM) protocol, where significant tralized device and user to poilcy enforcement expense is assumed to protect WiMAX pro- point encryption and defense in depth through viders from theft of service, but leaves con- tightly integrated wireless intrusion prevention sumers vulnerable to man-in-the-middle and all whilst ensuring seamless mobility. base station impersonation attacks. While the IEEE 802.16e specification for WiMAX in- What's your take on wardrivers? Some say cludes support for the Extensible Authentica- they're harmless while other label them as tion Protocol (EAP), it is not a mandatory por- criminals. tion of the specification, and it is yet unclear as to how vendors will deploy WiMAX tech- I strongly believe that wardriving has signifi- nology. This is especially disappointing, since cantly contributed to the steady growth in the lack of mutual authentication was one of strong encryption and authentication methods the early security lessons learned in IEEE needed to protect wireless networks. Kismet, 802.11 network evolution, but repeated with while once a wardriving tool, has matured to the development of WiMAX. www.insecuremag.com 99 Wireless hot spots, and especially rogue sating controls. A WPA2 EAP-TLS authenticat- access points setup as hot spots to trick ing Laptop that forces you to perform multi- users, raise unique concerns for the mo- factor authentication needs to be treated and bile warrior. What can be done in order to firewalled differently by the network v/s a mitigate the risks associated with their WPA2 EAP-TLS authenticating smart phone usage? with credentials pre-saved for ease-of-use.

When mobile users leverage open or even Based on your experience, what advice encrypted networks at hotspot locations, they would you give to organizations that are need to remember that they are sharing the considering deploying wireless networks network with anyone else within range of their and increasing their mobile workforce? location. Before organizations deploy or significantly A raised sense of awareness is necessary grow their wireless networks, they should be- here, leveraging secure upper-layer protocols come familiar with the risks and challenges such as SSL/TLS, with careful attention to associated with wireless security. For some suspicious activity such as browser certificate organizations, the risks associated with wire- warnings or the lack of SSL for web page less technology will surpass the potential authentication requests. benefits. Other organizations may be willing to accept the risks to gain the rewards and IPSec tunneling can be a useful countermea- benefits associated with mobile computing. sure against the threats in hotspot locations. Deploying wireless networks without under- By initiating an IPSec tunneled connection to standing the risks and challenges may unnec- a corporate server with split-tunneling dis- essarily expose organizations. abled, users can mitigate many common at- tacks. What are your predictions for the future when it comes to wireless security? Both WEP and WPA have its problems. Is it time to introduce a new wireless network The exploit targets of the future are embedded security standard? If yes, what features platforms. As more organizations leverage should it have? patch management technology, publicly re- leased exploits have a shorter lifetime. Ad- The known flaws in WPA/WPA2 have been vancements in mitigating exploit vectors make limited to denial of service vulnerabilities, or it more difficult to reliably exploit common weaknesses in authentication mechanisms Windows targets. meant for consumer networks. Both WPA and WPA2 represent significant improvements In contrast, embedded devices are often de- over the security provided by WEP, with WPA2 ployed without advanced security features, using CCMP representing the "gold standard" are seldom patched with any kind of regularity, for strong encryption in wireless networks. and number in the billions of devices. Multiple Combined with a strong authentication vulnerabilities have been discovered on both mechanism, WPA and WPA2 are a formidable access points and wireless client drivers rang- mechanism to protect wireless networks. I ing from denial of service conditions to full don't believe a replacement for WPA/WPA2 is code execution attacks. With a widespread warranted, since it solves the problem it was number a devices that can be exploited for designed to solve. network access and any traffic encryption keys, it seems likely this will be a new target Other vulnerabilities in wireless networks re- for attackers. main, which will require very different solu- tions. It is important however to not just rely Unfortunately, organizations cannot mitigate on one technique to tighten wireless security these vulnerabilities other than responding since the end-points will naturally be very di- quickly to vendor security updates, and for se- verse and need multiple defense-in-depth lecting vendors who show expertise in a pro- techniques discussed earlier to offer compen- active security development life-cycle.

www.insecuremag.com 100

Pravin is a wireless networking pioneer and an accomplished researcher with numerous patents to his credit. Recently he rolled-out a very large scale out- door WLAN network connecting two cities in north India. He regularly serves on program committees of networking and wireless conferences. He is the Associate Editor of IEEE Transactions on Mobile Computing. Pravin has a B.Tech. in Computer Science from IIT Kanpur, India and an MS/PhD in com- puter science from the University of Maryland, College Park, USA.

People use wireless networks on a daily 5. Avoid connecting to your preferred wireless basis and are growing concerned about network in locations where you don!t expect it the possible threats. What advice would to be present. It could be a trap (or honey-pot) you give to mobile users so that they set up by a hacker. Communicating through a could make and keep their laptops secure suspect wireless network is risky, unless you on any network? are using a VPN client to protect all communi- cation. 1. Use strong encryption and authentication protocols (such as WPA2) while using WiFi at 6. Remove any peer to peer network connec- work. tions from your wireless network connection profile. 2. Exercise caution while using WiFi at public hotspots & home. 7. Use strong password to protect access to your laptop. Don!t keep sensitive data in 3. Use a VPN client – (highly recommended). shared folders.

4. If you don!t have a VPN client installed use 8. Turn off your wireless card when not in use. SSL and avoid accessing valuable data over open (unencrypted) connections. www.insecuremag.com 102 Despite the insecurities of 802.11, the quickly before malicious users find new op- number of wireless networks is growing portunities to make another news headline. rapidly. What should be done in order to raise awareness of wireless security A significant part in the process of devel- problems? oping wireless networks is ensuring that the data located on wireless-enabled de- • Perception that 802.11 is "insecure! exists, vices is secure. What do you see as the but most users don!t yet know how those "in- most prevalent threats to that security? securities! affect them. The extent of security exposure is also not fully understood. • Many wireless-enabled handhelds are still using WEP encryption to protect wireless • The nature and extent of wireless insecurity transactions. Breaking WEP encryption is now exposure is different at home, at work and at considered a push-button exercise. Upgrading public hotspots. Likewise, threat scenarios are these devices to WPA or WPA2 is not always also different in each market segment (for ex- possible. ample, retail, education, financial, government & Enterprise). More vertical market focused • Support for more secure protocols (for ex- articles and presentations are needed so that ample, WPA & WPA2) is now available on lap- end users can better appreciate how insecuri- tops, yet many users continue to use WEP or ties of 802.11 affect them directly. no encryption at all at home and at work.

• Ironically, a bad news often spreads faster. • Wireless medium offers an adversary direct In the Internet space it took a couple of high layer 2 access to wireless-enabled devices. profile breaches before everyone realized that This level of access is often not possible in a wired firewall was a necessity. The recent wired systems. The extent of exposure for the TJX wireless breach has already served as a data stored on wireless-enabled devices is wake-up call in PCI retail market segment. I higher. Strong passwords must be used to sincerely hope that awareness spreads protect data.

New means of detection and enforcement (such as Wireless IPS) are needed to implement wireless LAN security policies for mobile users. Yet, market acceptance has taken time.

What are the biggest challenges related to ios traffic originating from and destined to the implementation of wireless LAN secu- mobile users does not even flow through the rity policies for mobile users in the enter- wired network. It is, therefore, not possible to prise? enforce wireless LAN security policies using wired security systems. New means of detection and enforcement (such as Wireless IPS) are needed to imple- The above two myths and the lack of wireless ment wireless LAN security policies for mobile threat perception have been the two main bar- users. Yet, market acceptance has taken time. riers for implementation of wireless LAN secu- rity policies in the enterprise. Myth #1: Personal firewalls, anti-virus and VPN clients can also protect mobile users What's your take on wardrivers? Some say from wireless threats. Most wireless attacks they're harmless while other label them as exploit vulnerabilities in wireless Layer 2. Nei- criminals. ther firewalls, anti-virus nor VPN clients pro- tect wireless Layer 2. Human eye can spot whether a physical door is locked or unlocked. Wireless is invisible Myth #2: The existing wired side controls and hence most users are unable to see (firewalls, Network IDSs) are also adequate whether their wireless doors are locked or un- for monitoring wireless security policy viola- locked. tions and enforcing controls. In many scenar- www.insecuremag.com 103 Wardrivers are like people with night vision On the access point side, I expect a WiMAX equipment. They are going around detecting base station to be owned, controlled and op- which wireless doors are locked and which erated by a mobile carrier in licensed spec- ones are unlocked. They are playing an im- trum. Due to spectrum licensing issues, Wi- portant role in spreading awareness about MAX base stations will grow in a controlled wireless LAN security problems so that users fashion. The threat of rogue WiMax base sta- can take necessary precautionary measures tion may not be very high. before any damage is done. Wireless hot spots, and especially rogue With the growing number of wireless users access points setup as hot spots to trick living outside urban areas, the last few users, raise unique concerns for the mo- years have seen a growth in the number of bile warrior. What can be done in order to WiMAX deployments. What are the possi- mitigate the risks associated with their ble security risks associated with the de- usage? ployment and usage of WiMAX technology? There are two ways to solve this problem:

On the client side threat scenarios for WiMAX Client side solution will be somewhat similar to those for WiFi. A Freely downloadable wireless connection WiMAX client can act as a bridge between a manager agents are available. These light- public WiMAX network and a private enter- weight client agents can protect laptops users prise network. It will be necessary to use a from rogue hotspot threats. wireless connection manager agent on Wi- MAX clients to monitor and enforce policy de- Infrastructure side solution cisions. A hotspot provider can install a WIPS (wire- less intrusion prevention system).

Deploying a wireless network is a more complex task than rolling out a wired network, yet the effort required is well worth it.

Both WEP and WPA have its problems. Is it To maximize benefits, a wireless network time to introduce a new wireless network must be properly planned, deployed, moni- security standard? If yes, what features tored and secured. The best results are should it have? achieved when a wireless infrastructure is rolled out in conjunction with an overlay wire- Both WEP and WPA have its problems but less intrusion prevention system. Wi-Fi infra- WPA2 is relatively secure (there are no obvi- structure provides 24x7 mobile access while ous flaws reported as yet). The industry does WIPS ensure secure and uninterrupted ac- not need a yet another new standard for secu- cess for all mobile users. rity. What is instead needed is more education on how to correctly configure and use WPA2. What are your predictions for the future when it comes to wireless security? Based on your experience, what advice would you give to organizations that are More and more security features will be em- considering deploying wireless networks bedded inside Wi-Fi infrastructure offerings, and increasing their mobile workforce? yet need for a dedicated wireless overlay se- curity will continue in "high security! market Deploying a wireless network is a more com- segments. plex task than rolling out a wired network, yet the effort required is well worth it. It has been The complexity and cost of deploying, config- proven beyond doubt that wireless access uring and managing wireless security will con- provides productivity growth and infrastructure tinue to reduce. This will alleviate "insecurity! cost reduction. fears and lead to ubiquitous deployment of wireless. www.insecuremag.com 104 Prior to joining Fortress Technologies, Barsoum was a Principal Architect with EZchip Technologies and the Principal Systems Architect at Quarry Technolo- gies. Barsoum has also held engineering positions working on DSLAMs at both US Robotics and 3Com. He holds a B.Sc. and M.S. from Worcester Poly- technic Institute, an MA from Brandeis University, and has earned credit towards the completion of a Ph.D. as a Guggenheim Fellow at California Institute of Technology.

People use wireless networks on a daily POP and SMTP as the biggest culprits. Mobile basis and are growing concerned about users should only use SSL-secured versions the possible threats. What advice would of these applications. you give to mobile users so that they could make and keep their laptops secure on any Despite the insecurities of 802.11, the network? number of wireless networks is growing rapidly. What should be done in order to Wi-Fi security has come a long way since the raise awareness of wireless security days of WEP. For the road warrior, there is a problems? multitude of threats that are independent such as rogue APs, physical loss of the device, and Both WEP and wardrivers have done a tre- weak passwords. To keep the laptops secure, mendous job improving the awareness levels at a minimum, we recommend the use of a of the user community. This level of aware- personal firewall combined with encryption of ness has brought tremendous pressure on the the hard drive contents and a VPN to access vendors and the standards committees to the corporate data. A personal wireless intru- bring products to the market with a much sion detection solution can also be beneficial. higher level of security. We live in an open so- An additional concern is the use of Internet ciety where innovation fuels the efforts of se- applications that send unencrypted data with curity researchers and vendors. www.insecuremag.com 105 A significant part in the process of devel- the chain. Humans select weak passwords, oping wireless networks is ensuring that weak PSKs, and disable security software. the data located on wireless-enabled de- The trick is to be realistic about defining the vices is secure. What do you see as the set of security threats and outlining a set of most prevalent threats to that security? steps to defend against these threats. Under- defending clearly leaves ample room for vul- There are two main threats for the wireless- nerabilities to be exploited. On the flip side, an enabled devices. These are rogue APs and over-zealous security policy alienates the user loss of the device. With the physical size of base which ends up avoiding or turning off mobile devices shrinking and their data capac- these security mechanisms. ity increasing rapidly, the impact of losing a device can be a real threat. We feel that en- In general, a balanced approach to security cryption of the content stored on the wireless works best. I like security tools that don!t get device is an absolute necessity. Decryption in the way, that operate seamlessly and make should require user authentication. In addition, it easier for the user to do the right thing vs. the ability to disable the device from access- the wrong thing. For instance, in our products, ing the network and remotely zeroizing the we have a mechanism to generate a truly ran- contents is very important. dom number to be used for as a PSK, instead of relying on the user to come up with a ran- What are the biggest challenges related to dom number. Another mechanism we use ex- the implementation of wireless LAN secu- tensively is what we call a “device ID”. This is rity policies for mobile users in the enter- an ID that is cryptographically tied to a particu- prise? lar device. If the device is ever lost or stolen, the administrator can simply disable the de- Not surprisingly, human factors are the big- vice!s ability to access the network, even of gest challenges to implementing a WLAN pol- the user!s password is compromised. These icy. Humans are typically, the weakest link in kinds of mechanisms go a long way to creat- ing an effective security policy.

Humans select weak passwords, weak PSKs, and disable security software.

What's your take on wardrivers? Some say (802.16d) provides for only one way authenti- they're harmless while other label them as cation (BS authenticates the SS) using a criminals. device-specific certificate. In general, this model is adequate for a broadband device sit- Wardrivers raise the level of awareness to the ting outside the firewall (where a cable mo- common problem of unprotected Wi-Fi access dem sits today). There are some parts of the points. I think that in general they provide a standard that are less than ideal. For instance, service to the community. One needs to real- only the AP contributes randomness (via a ize that the vulnerabilities are there. Wardriv- nonce) to the key mixing process. This is not ers are just shining the light on them. adequate in the case where a higher level of assurance is desired. Also, like Wi-Fi, the With the growing number of wireless users management messages are neither en- living outside urban areas, the last few crypted, nor authenticated. This presents a set years have seen a growth in the number of of challenges mostly around protection WiMAX deployments. What are the possi- against DOS type attacks. We think WiMAX ble security risks associated with the de- (802.16d) security level is adequate for con- ployment and usage of WiMAX technol- sumer broadband applications. For high as- ogy? surance environments, there are serious shortcoming such as one-way-authentication The security model in WiMAX (802.16d) mir- (susceptibility to rogue APs), key mixing is- rors that that of DOCSIS Cable Model stan- sues, and lack of user authentication. These dard. Both of these models are protecting present real challenges for our customers. against theft of service primarily. WiMAX www.insecuremag.com 106 Wireless hot spots, and especially rogue nately, EAP-TLS requires a PKI infrastructure access points setup as hot spots to trick which most enterprises are less than eager to users, raise unique concerns for the mo- invest in. bile warrior. What can be done in order to mitigate the risks associated with their Separately from protecting the user data, it is usage? also important to protect the management channel, which today is neither encrypted nor Mitigating these risks requires a security im- authenticated. 802.11w, when ratified will en- plementation with multiple defense elements. crypt the management channel to provide pro- These elements include personal firewalls, tection against a number of attacks. strong VPN security. The addition of a per- sonal wireless intrusion detection system sim- Based on your experience, what advice plifies the implementation of a corporate policy would you give to organizations that are for wireless network access. considering deploying wireless networks and increasing their mobile workforce? Both WEP and WPA have its problems. Is it time to introduce a new wireless network I believe the most important thing for an or- security standard? If yes, what features ganization to do, is a proper threat analysis for should it have? the proposed usage model. We recommend strong AES-based encryption both on the WEP obviously was a poorly designed imple- WLAN as well as a WIDS solution. For the mentation based on an OK (not great) cipher, mobile handheld, we recommend an AES- namely RC4. WPA addresses some of these based encryption for the both the WLAN and shortcomings within the limitations of RC4. the VPN solutions. We also recommend hard WPA2 is built on AES and is much stronger. drive (or flash) encryption as well as mecha- WPA2 comes in two flavors: personal and en- nism to erase the device or render it unusable terprise. Personal mode uses a pre-shared if it is lost or stolen. key, while enterprise mode relies on 802.1x authentication. What are your predictions for the future when it comes to wireless security? We believe WPA2 is secure. Whatever weak- nesses that may exist are related to the actual The use of AES and a solid cryptographic de- implementation and choice of mode or EAP sign has improved the security of Wi-Fi tre- type. For instance, in PSK mode, the entire mendously. This is leading to broad adoption level of security hinges on the strength of the of the technology. Over the next few years, PSK used. Since most people, use fairly weak the focus is likely to turn to securing the man- pass phrases, the resultant security level is, in agement channel of the various wireless tech- most cases, much less that what AES offers. nologies. This is starting to take shape already In Enterprise mode, WPA2 relies on the with 802.11w and we expect similar efforts for strength of the EAP type used. EAP-TLS pro- 802.16. vide a very high level of security. Unfortu-

www.insecuremag.com 107 Before Trapeze, Dan Simone worked at several prominent companies. At Bay Networks (now Nortel Networks), he drove the development of hubs, switches and net management products. At Motorola, he headed up design, installation and management of the corporate LAN. Dan co-authored the point-to-point protocol over Ethernet (PPPoE) and holds several patents.

People use wireless networks on a daily turn off your Wi-Fi radio in your laptop in a basis and are growing concerned about public place if you!re not using it. Lastly, if you the possible threats. What advice would are a home wireless user, be sure to enable you give to mobile users so that they could the encryption that came with your AP. Even if make and keep their laptops secure on any the only option available to you is static WEP, network? this is better encryption than none at all and often enough to make the casual hacker look As a mobile user, there are several things that elsewhere. Naturally, where possible, use can be done. First, use the personal firewall WPA or WPA2 as that protection of far that is bundled with most current laptops. This stronger than WEP, which does have technical will limit the traffic that makes it past your net- flaws. Every device that has been Wi-Fi Certi- work adaptor to other services on your laptop. fied since the fall of 2003 includes at least Second, always use some form of encryption WPA. when sending sensitive data. For most indi- viduals, this means making sure there is se- Despite the insecurities of 802.11, the cure link between their web browser and the number of wireless networks is growing site they are communicating with. You can rapidly. What should be done in order to usually tell this is the case when you see the raise awareness of wireless security “lock” symbol in your browser. Is it also a good problems? idea to disable any services you are not using on your laptop that allow outside communica- The biggest issue is simply a lack of knowl- tions. These can invite trouble. For example, edge of the various techniques that can be www.insecuremag.com 108 used to protect wireless communications and TLS are well known and widely supported en- perhaps more importantly, a willingness to be cryption and authentication protocols. All en- sure to use them at all times. Because this terprise class suppliers of wireless LANs sup- has been such a fundamental issue from day port these protocols. However, many end user one, a lot of attention has been given to wire- devices do not. For example, a retail store less security. Today, it is possible to build ex- may have scanners that were purchased tremely secure wireless networks if the proper years ago and support static WEP at best and steps are taken. Unfortunately, users have no strong authentication. This represents a been known to get lazy when it comes to se- major hole in any secure deployment. Enter- curity and don!t expect that they may be the prises must insist that all their client devices subject of an attack. In a business setting, pro- support the full 802.11i standard and are fessional IT staff should surely be aware that WPA2-Enterprise certified. the Wi-Fi network needs to be secured. In a home environment, the end user needs to be- The second largest problem is authentication. come aware that the product out of the box The Enterprise must first select one or more typically is in a mode with encryption off. They protocols that are supported by its end de- then need to proactively turn encryption on. vices, then create the appropriate database and possible PKI environment to support it. A significant part in the process of devel- The creation and maintenance of this data- oping wireless networks is ensuring that base is a necessary evil to deploying a world the data located on wireless-enabled de- class secure WLAN. In addition, the various vices is secure. What do you see as the authentication protocols have support for vari- most prevalent threats to that security? ous features such as key distribution, fast roaming, two-way vs. one-way authentication, The most effective means of attack involve etc. that can make the selection of a the stolen or lost devices and/or social attacks. proper protocols a difficult and potentially con- The threat of a lost laptop is by far a greater fusing tradeoff. However, standardizing on one threat to corporate and personal security than of the strong methods backed by the Wi-Fi Al- over the air attacks. This is particularly true liance as part of WPA2 testing such as EAP- when the proper authentication and encryption TLS, PEAP-GTC, or PEAP-MSCHAPv2 is a is in place within the wireless infrastructure. A good start. stolen laptop typically provides much useful data directly. If it doesn!t, often passwords and What's your take on wardrivers? Some say usernames are stored within the system mak- they're harmless while other label them as ing access to the data far easier. Unfortu- criminals. nately, this is not really a wireless problem but a mobile computing problem in general that Whenever a valuable service is being pro- must be addressed through means that are vided for free, it will attract a crowd! This independent of the network access method. should not be a surprise to anyone. The easi- Some examples of solutions in the market- est way to stop wardrivers is to always make place that can help are strong laptop pass- sure that your wireless network is secure. words, log on methods that include biometrics or tokens with changing PINs, and even hard Even some of the least expensive APs on the drives that automatically encrypt themselves consumer market come with fairly simple and in the event they are removed from the laptop. sophisticated ways to secure them, for exam- ple, WPA. Most wardrivers will move right on What are the biggest challenges related to to the next AP once they see that the network the implementation of wireless LAN secu- is protected by WPA or WPA2. That said, even rity policies for mobile users in the for a wide open network, connecting to a net- enterprise? work that isn!t yours is plain and simply theft of service. However, if those installing the wire- There are primarily two major roadblocks. The less network are not taking any steps to indi- first and biggest is the availability of proper cate the network is private or any steps to se- security protocol support by all the enterprise!s cure the network, they have no one to blame client devices. For example, WPA2 and EAP- but themselves for the theft. www.insecuremag.com 109 * With the growing number of wireless us- 802.1X authentication with AES encryption, ers living outside urban areas, the last few they can be assured they are running top years have seen a growth in the number of commercial quality algorithms that have no WiMAX deployments. What are the possi- known attacks. The Wi-Fi Alliance also certi- ble security risks associated with the de- fies a version of this called WPA2. There are ployment and usage of WiMAX no documented hacks of properly configured technology? WPA2 systems, or WPA systems for that mat- ter. Customers should insist on WPA2- Most of the early deployments of WiMAX have Enterprise capabilities in all their client devices been as last mile replacement for cable mo- as well as their wireless infrastructure if secu- dems, DSL, or T-1 lines. Security issues asso- rity is important to them. ciated with this application of WiMAX are no different than any time you are sending sensi- Based on your experience, what advice tive data across the public internet. End to end would you give to organizations that are encryption of some sort (e.g. SSL or IPSEC) considering deploying wireless networks must be used. As WiMAX applications con- and increasing their mobile workforce? tinue to grow and we see increasing numbers of WiMAX client devices, all of the same is- Wireless networks have a tremendous ability sues for which Wi-Fi had to find solutions will to improve productivity, enable a whole new exist. Luckily, solutions such as 802.1X, AES class of applications, and change the way or- encryption, and other technologies are largely ganizations think about access to data. This is independent of the underlying MAC layer, e.g., much like the change we experienced with the 802.11 or 802.16 technology. WiMAX has the introduction of the Web. Organizations should advantage of being able to learn from some of insist on a wireless infrastructure that scales, the early mistakes in the Wi-Fi market. has sophisticated yet easy to use centralized management, and adheres to all of the latest Wireless hot spots, and especially rogue security standards. The industry made a sig- access points setup as hot spots to trick nificant change over the past several years users, raise unique concerns for the mo- moving away from standalone access points bile warrior. What can be done in order to to APs that are “thin” or centrally controlled. mitigate the risks associated with their More recently, this approach has been im- usage? proved further with hybrid architectures that are centrally managed while still utilizing the Users of hot spots and mobile users in general AP for the heavy lifting of traffic forwarding should put pressure on their providers or cor- and encryption. This has lead to more sophis- porations to deploy the necessary security ticated services, more consistent services and features required to address this problem. security policies, and better scalability all while Technical solutions, such as VPN!s with mu- achieving lower cost of ownership. For organi- tual authentication, exist. Also, within the zations that expect to deploy more than even IEEE!s 802.11 working groups, new exten- a few APs, this is the architecture of choice sions to the 802.11 standard are bring devel- today among leading enterprises. oped to secure over the air control and man- agement messages. This will further help to What are your predictions for the future identify and contain rogue devices. when it comes to wireless security?

Both WEP and WPA have its problems. Is it Mobility is one of the few services that end time to introduce a new wireless network users have consistently been willing to pay for. security standard? If yes, what features The cellular phone is a great example. We should it have? willingly gave up a “5 9!s” reliability and con- sistently clear communications for a higher We already have a standard network security priced service that could deliver neither. Why? solution that is backed by the IEEE, National Because it is mobile and we value mobility Institute of Standards and Technology (NIST) over everything else. In the future, if your ap- and the Department of Defense. It is call plications, equipment, and infrastructure does 802.11i. Within this standard, if users insist on not support wireless, it will be obsolete. www.insecuremag.com 110