Sun Security Blog
Security
|
As mentioned I was visiting the USA last week, and stopped-in
on my
former colleague
and friend
Keith Watson,
who introduced me to the delights of
MCPlus+ ("EmCeePlusPlus") -
a nerdcore / geek-rap act who
sing about cryptography and maths.
Cryppies will want to listen to track 4 off the album 'Algorhythms', viz Alice and Bo b. w00t.
tags: mcplus+ mcplusplus nerdcore security slotd solaris Permalink | Comments [2]
This is a posting in the
Security
Community 'Reference' Category ; the function of postings that are
placed in this category is to aggregate links to other, useful
postings in a single meta-posting which can be referenced via a
link in the Security Community Blog sidebar, and which will be
re-posted on the blog each time it is refreshed by a member of the
security community.
This posting is a list of security video blogs which have been posted to the community.
tags: rbac security slotd solaris training videos Permalink | Comments [2]
So
a friend
punted
this URL over to me:
InfoWorld: Should vendors close all security holes? ...and I shared the link and article with our security community chat channel, inviting comment. The result itself surpassed what I was intending to write, and provides food for thought:
...and on rolls the paranoid chatter which drives all us security geeks. I thought I would post this and open it up to discussion than just leave it hanging. In summary I would suggest (in slight disagreement with the "fix it when it goes public" position cited by the article) that the consensus amongst our little group is that we should fix everything because that's the right thing to do; but pragmatic prioritisation in the face of exploitation is wise. You just can't rely on that, since you don't always know when you're being exploited. - alec
tags: engineering hacking schneier security slotd vulnerability Permalink | Comments [0]
So I posted this:
A man is going on vacation (ie: on holiday) - and he's worried about the possibility of someone breaking into his house whilst he's away; so he checks all the window locks from inside the house, steps outside, walks around the house to inspect for anything he's missed - checking that patio doors, etc, are locked - then locks his front door and drives off. What's he done wrong?...which is my usual schtick for trying to explain the importance of doing things in the right order, because even if you have the right security-ingredients you can still mess up by not using them properly, or not laying them out in a sensible manner. I was blown away by some of the creativity that was provided in the responses - the person who went for the jugular and got my typically sought-for answer was Andy Paton: While he was busy checking the windows and backdoor he left the front door unlocked!!...which is the obvious flaw in the process; it's astonishing how many people completely miss that. That said - and thank you Andy - this being an open question there is always room for a different perspective, eg: trojan horses: ...the systemic: ...the architectural and integrational: ...and the slightly tongue-in-cheek operational risk: ...all of these are legitimate and interesting answers; even the last one by analogy of the occasion I saw someone enable system-auditing in a particularly nitpicky mode, only to see the machine crash from filling its root partition two days later. This is related to the reason I generally put /var/log and /var/adm on a partition completely separate from root and the normal /var - it's a signature perversity of a Muffett-specified machine, but your machine is at less risk from log-flooding. So, next time I have to stand up and give this talk to somebody, I'll have something extra to say. Thank you folks, and thank you for sharing. Thank you also to Tom for this little gem which made me smile: He should check that the front door is locked, from the inside? My father's old front door you could open the lock through the letterbox using a handily located small crowbar....which just goes to prove that security can be perfectly acceptable if it fits your environment; I still know places where nobody bothers to lock their doors when they go out for the day, but nowadays they seem somehow fewer and further between... -alec
tags: architecture integration security slotd solaris Permalink | Comments [1]
Can you think like a security geek?
So: A man is going on vacation (ie: on holiday) - and he's worried about the possibility of someone breaking into his house whilst he's away; so he checks all the window locks from inside the house, steps outside, walks around the house to inspect for anything he's missed - checking that patio doors, etc, are locked - then locks his front door and drives off. What's he done wrong? Feel free to critique. My answer will be posted tomorrow, unless it appears in the comments beforehand. :-) ps: if you've heard me explain this before, please keep schtum. This is just for fun.
tags: puzzle security slotd thinking Permalink | Comments [8]
So Techdirt writes:
Last week, security expert Bruce Schneier caused a bit of a stir when he said that there shouldn't be a security industry. While his comment engendered a lot of debate, it really wasn't a particularly radical statement. As he's made clear in his latest Wired column, all he meant was that IT vendors should be building security directly into their products, rather than requiring customers to purchase security products and services separately. ...citing Bruce as reported at Silicon.COM:
"The fact this show even exists is a problem. You should not have to come to this show ever. [...] We shouldn't have to come and find a company to secure our email. Email should already be secure. We shouldn't have to buy from somebody to secure our network or servers. Our networks and servers should already be secure." ...and I think he is right, as I find Bruce generally is. My experience bears this out - I have friends who ask "What Anti-Virus Software / Malware Detector / Intrusion Detection System Should I Use?" - and in none of these cases do I actually have an answer for them. Sometimes they must really wonder what I do for a living, if I'm a "security expert" and don't know what AV software to use. It's true, however. Given what I use at home (Solaris, Mac, Linux, and an solitary and rarely booted XP system), plus the manner in which I connect to the Internet (NAT/firewall built in to my DSL router) and the fact that I understand the value of keeping security patches up to date, not running services/daemons unless they are necessary, and cycling WEP and login passwords occasionally, with all that in place I don't have to use any specialist security software at all. Instead I use what tools I have available with my network hardware and software platforms - generally some form of Unix - making sure they're all properly deployed. Sometimes I get a hacker knocking on my door, I've certainly seen a few attempts in my logfiles, but it's not something I fret about since there's very little exposed to attack, and of the latter it's all generally well-maintained. So why should I worry? Beats me. The Silicon.COM article also contains this quote from Graham Cluley at Sophos:
"I can't imagine there ever being a 100 per cent secure operating system because a vital component of programming that operating system is human." Well yes, Gray, you're right, but one of the things you've left unstated is that there is no such absolute thing as 100% security. Security is relative: 100% security means "100% Adequate" security, that the security features you've deployed are proportionate to the exposure you make in transacting with the rest of the network, plus mitigation of any risks you face in terms of availability ("I can't access my Gmail! Argh!") or physical security ("Someone stole my laptop!") No, there won't ever be a 100% secure system, but people who care are currently able to get systems which are adequately "secure by default" and if they know how to use and maintain those systems properly then yes, there won't be a security industry any more. - alec
tags: by default schneier secure security slotd solaris Permalink | Comments [1]
Today's SLOTD is a thought-piece - I'm not going to talk directly
about the digg.com / HD-DVD key story which you can
perfectly-well read about for yourselves
and thereby keep more up-to-date with a dynamic story than is possible
by reading my witterings; moreover there are many viewpoints on the
underlying question of using encryption to "protect" digital media
which retailers "sell" (or perhaps "license"?) to everyday people who
buy them in aggregate with small shiny plastic disks,
and there are wiser people than I who work for Sun who I
intend to chivvy about writing about this topic in the future.
Hello, Susan. :-) However, last week I posted a video about web2.0 security and am in some ways delighted that an example of the gap I didn't cover, coming to the public consciousness so soon. Our fearless leader two years ago was described and quoted thusly:
redcouch.typepad.com ...and the flipside of that is summed-up in a nutshell: if you manage to do something which trashes your authenticity, makes you look artificial, opaque, plastic, or disrespectful of the members of your community, then you can suffer in a way that hasn't really had adequate comparison since the days of tar & feathers, stocks or other forms of community social humiliation. Sun Microsystems has its own internal vocabulary, and one of the phrases which used to be common was that of the CNN Moment - a "damaging public infrastructure failure often experienced by dot-com enterprises" which presumably would be big enough and embarrassing enough to end up on the front page of the eponymous website. What I am finding is less obvious to some of my colleagues (and customers) is that as mainstream media websites become less relevant, blogs and other communities become more relevant in terms of how people will perceive you and your company; and the distributed nature of blogs means that stories don't get retracted, they get amplified. So nowadays we should fear "blog moments", or perhaps social-tar-and-feathering, since once humiliation is stuck to your brand then it's awfully hard to wash off. So there's your security risk for today, and its respective mitigation: if you're going to engage with your community then do respect them and don't junk those amongst them with whom you have an issue; instead you need to engage with your community about the underlying problem - eg: "Our advisers think this is a legal risk to us, so we're very sorry but we're suspending this thread until we sort this out..." - and you'll come out of it a lot cleaner, and with fewer feathers. And sadly there is no shortcut. No amount of firewalls, VPNs, privilege management, cryptography or methodology will save you from the business risk of not "getting it". - alec
tags: blogging blogs security slotd sun Permalink | Comments [0]This was a great weekend for WiFi on OpenSolaris (and thus future releases of Solaris and Solaris Express) [build 64]. Not only did we get a driver for the Intel Centrino 3945 chipset but more importantly (well at least in the eyes of a security geek like me) we got support for WPA-PSK. I've been working with the project team, not as a core developer - mostly design advice and codereview, on this for quite some time now and I'm really glad to see it integrated I'm really pleased with the architecture and the implementation. Yeah I know lots of other operating systems had this already and now we do to! This combined with NWAM which integrated its first deliverables into build 62 and we are really going somewhere with usability and security for Solaris on laptops. Now I can put WPA-PSK on my home router again instead of relying on WEP, not brodcasting my ssid and MAC address restrictions. Meanwhile the project team are now off developing WPA Enterprise support, I expect to work with them a little as they design and implement that support. - Darren tags: opensolaris slotd wifi wpa Permalink | Comments [2]I attended InfoSec Europe at Olympia in London earlier this week. I find this show generally a little to "PC" biased sometimes so I wasn't expecting to get too much out of it. I spent most of the time looking around for encrypted storage solutions and products. Last year I found an excellent hardware only encrypting disk drive that is approved for UK government use. This year I found a device by a company called SafeBoot. Initially I almost discounted this device because I was expecting it to be Windows only. The device is a small USB flash drive with a fingerprint reader to access the data, I think it is their phantom product that I saw. While the device can only be configured from Windows the lock/unlock functionality works on any system. We tried it out under the MacOS X laptop we had with us (this ensures there are no drivers needed for this) and it works just fine. What was even nicer is that a simple software eject under MacOS caused the drive to relock again. So I fully expect this to work just the same under Solaris. Under MacOS X the encrypted part of the device that you need your fingerprint to unlock appears as a removable drive that doesn't have the media in it - until you swipe your fingerprint. Pretty cool little device, I don't have one at the moment to try it out but it looks promising. I can even see some uses for this in a primarily Solaris based solution, so you might see this or something like it in the future.... Apparently the device can also allow the crypto functionality to be used by the host OS, but only Windows. I wonder if I can get them to write (or collaborate with us to do so) a driver for the OpenSolaris cryptographic framework. - Darren Permalink | Comments [0]
OK - so I was at a very interesting customer today, and conversation swung around to "defense-in-depth" and that bastion of IT security, the firewall.[1]
We were in the midst of some on-the-fly rearchitecture discussion (read: "if we replumb it all in a more elegant fashion, what needs to be fixed or added in order to make it safe?") and it turned out that an extra firewall to demarcate a line between some public and private machines, would make matters a lot more secure. "It'll cost a lot, this new firewall", says their long-haired sysadmin. "Why", says I? "Firewall license" says he, and names a largeish four-figure number. Eek. That's more than the hardware! So one of the things I've never understood - and I've told him this - is why the "Cult Of Firewall" is such that only a "dedicated box or appliance" running "genuine firewall software" for which $$$$$$ are paid, is what people go running towards whenever firewalls are mentioned. Sure, in an enterprise context where people bandy words like "five nines" (ie: 99.999% uptime) - or "extreme(ly) high availability", or where you need "management consoles" - then do buy an enterprise solution where you might be able to sue the vendor if it blows up. But if you are a small-to-medium organisation with your own in-house pet geeks, then why not take advantage of general-purpose functionality of general-purpose operating systems and deploy Solaris, Linux or *BSD as a firewall? Consider your choice carefully, minimise it to the utmost, but it'd be a lot cheaper and often perfectly adequate and more than adequately performant. I started at Sun in 1992 and if I had had more business sense back then, and if I had had more money, then I would have cottoned on to the number of SparcStation2's that I was buying, to act as "routers" for our intranet. This observation might have led me to invest in Cisco and its dedicated routers, and made me a tidy profit. Oh well. But the thing about IT security is that "what goes around, comes around". Maybe it's time for the comeback of the general-purpose operating system, in tiny tasks, on more-than-adequately-powerful hardware? - alec
--
tags: ipfilter security slotd solaris sun Permalink | Comments [3]
A bit of an experiment for you today - Last night I fired up iMovie
and talked into my webcam about Web2.0 and the future challenges of
security, and edited the results into a short video. The results are
included below, and more context - including links to the referred-to
paper from 1997 - is available
in the original blog posting.
I hope to do one of these videos - filming colleagues, asking questions - about every other week, and perhaps weekly once we get some experience. - alec ps: when we were setting up the security community blog, I made a point of saying that it "shouldn't and won't be filled with pictures of cats - the postings will stay on topic"; please note that the cat in the video therefore is an incidental cat, rather than the focus of the commentary. :-) Permalink | Comments [1]
This is a really quick one - keep an eye on Darren's blog; he's posted the first installment in a series which will discuss the relative configurations and merits of "sudo" versus RBAC in Solaris, and is attracting the attentions of Powerbroker users, and perhaps others who are intrigued at the notion of delegating small parts of root privilege to ordinary users.
The number of times I've dealt with customer queries about that sort of thing, I feel that I'll soon be citing his blog like holy writ.
-alec
tags: security slotd solaris sudo Permalink | Comments [0]Historically, Trusted Solaris was a completely separate environment from "regular" Solaris. The Solaris 10 11/06 production release finally broke the mould, when Trusted Extensions integrated into the main Solaris release. Granted, the packages which need to be installed on the top of an unlabelled Solaris 10 install still need to be installed using an extra install tool, but you'll nonetheless find them on the regular distribution media under the Solaris_10/ExtraValue/CoBundled directory, right alongside the SunVTS hardware validation test suite. Configuring everything once the packages are in place is a more interesting proposition, but there's a good recipe here (for laptops). We make no bones about the fact that Trusted Solaris began life as an engineering project for the US Government, first went live 17 years ago, and has seen little use in the commercial world (with one or two notable exceptions) by its nature as a separate product with military heritage ever since - however, now that it's no longer a separate product, we believe that the time is right for commercial adoption. To this effect, we've been looking at some of the areas in the commercial world where its capabilities have a natural fit. So far, the partial list looks like:
Update: If we extend this a little further, we have: Any organisation where leakage of internal data is an issue could benefit from having a simple, two-label system of "Public" dominated by "Internal", where "Public" is the Internet connection and "Internal" is the Intranet. If all users are (as is the default) denied permission to downgrade data, then it becomes much more unlikely that internal data will leak. Giving users the ability to upgrade data by default still allows external data to be brought internal. This works well even when organisations do not differentiate between classifications of internal materials, and the Safe Browsing mechanism comes into its own, when web sites on the intranet need to make pointers to materials in the wider world.Press Officer and Auditor roles could also be created, which would potentially be the only roles allowed to downgrade data as part of the external release process. In educational establishments, denying the ability to upgrade and downgrade data means that while a number of websites can readily be viewed (assuming filtering software is already in place on the Internet link), data can't readily be plagiarised using cut and paste from external sources into essays, etc. Also, if Public and Internal zones are installed as whole-root rather than sparse-root zones, such that careful use of pkgrm can subsequently be used to deny access to internal tools (such as IM) in an external context, so cyber-bullying could be more readily tracked; bullies wouldn't be able to create anonymous / pseudonymous external accounts "on the fly" from which to abuse their victims. As well as co-location facilities, law firms may wish to extend their "duty of care" capability, in terms of ensuring segregation of client data, by having a compartmented label per client. If you have some more ideas, please add them in a comment :-)
tags: extensions security slotd solaris trusted Permalink | Comments [0]
One of the great, obvious, simple ideas which went into Solaris 10
was the Reduced Networking Cluster; after fragmenting and massaging
the core Solaris packages a bit, it became possible to offer a clean,
minimal, even spartan
installation of Solaris, a lightweight foundation upon which software
could be added as and when only necessary, leading to a very tiny and
yet supported machine configuration.
A colleague recently asked me for more information about the Reduced Networking Cluster, and frankly I was stumped, and then Glenn Brunette piped up that he'd written all about it back in 2004:-
The topic for this article is the Solaris 10 Reduced Networking Software Group (also commonly known as the Solaris 10 Reduced Networking Meta Cluster). This software group is new and joins the five existing software groups available in Solaris today: Core, End User, Developer, Entire and Entire + OEM software groups. The Reduced Networking Software Group is positioned as a subset of Core and represents the smallest amount of Solaris that can or should be installed and have a working and supported system. Note that for support reasons, it is not advised to remove packages installed by the Reduced Networking Software Group. ...etc; it's quite a long article but worthwhile, since it's one of the sadly few documents which look at this feature from an architectural perspective. So, folks, if you are into Minimized Solaris Configurations, you want to start with "SUNWCrnet". Less really is more, and it costs you nothing. :-) -Alec
tags: minimisation minimised minimization minimized security slotd solaris sunwcrnet Permalink | Comments [0]
I asked
Susan Landau
about the new edition of
Privacy On The Line
which is just out, and she kindly answered in the third person:
Whitfield Diffie and Susan Landau have updated their book on crypto and wiretap policy, "Privacy on the Line: The Politics of Wiretapping and Encryption." Now all I need to do is get Susan blogging. :-) - Alec
tags: diffie landau privacy security slotd sun Permalink | Comments [0] |
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
