Slashdot Mirror
Computer Security Criteria
Rolf Marvin Bøe Lindgren writes: "For most human endeavors that involve some sort of risk, there are powerful, recognized public interest groups or even government-appointed organizations that investigate and analyze dangers, prescribe guidelines, determine criteria for acceptable risk, etc. This does not seem to be the case for software! I work for a ship classification company. The purpose of such companies are, very simply put, to determine how safe seagoing vessels are, for instance in order that insurance companies can decide insurance premiums. There are, needless to say, numerous conventions and special interest groups to determine safety at sea. That is, as far as I know (and I would very much like to be proven wrong), except the computer systems that the ships use. there are restrictions, laws and regulations involved in just about any object that goes into a ship except the computer system. Everybody seems to know, for instance, that UNIX is safer that Windows, but there are no safety, reliability or security criteria established by any recognized authority that can be used to defend one computer system over another."
"Now, I could ask Slashdot how to go about to form a recognized body, but I have access to competence in that particular matter. What I would rather like to know, is this:
- What might a set of safety criteria be like (I am just now most interested in criteria for computer systems that would address such issues as vulnerability to worms, viruses and crackers)?
- How should one go about to find competent and interested people who would like to be part of a body like I describe, or consultants to one?
I would venture to guess the reason there are so many regulatory bodies involved in overseeing the safety of such things as highways, seagoing vessels, planes, food, etc. and not software, is that in the former situation human life is directly at risk while in the latter human life, is at best, indirectly at risk and usually not at risk at all.
yes i run a goth/punk/emo porn site.
Well to avoid a virus/worm whatever just use an Antivirus program and keep it updated. Sat. Internet access on a ship is nothing new..you can even update at sea. I don't think ocean going vessels can be any more or any less effected by a virus. I'd be more concerend about the corrosion all teh saltwater could do to the equipment..
'mmmmmmmmm.... forbidden donut'
"How do you find people willing to pontificate about what makes one system more secure than another," he naively asked Slashdot. Then came the deluge.
visit the hwky website for a lyrical genius infusion.
Have you looked at any of the work done by SANS (http://www.sans.org) or NIST (which is not necessarily what you're looking for, but in the area of providing guidance, http://www.nist.gov)?
SANS has been publishing a series of "consensus" documents, asking for feedback from people on topics such as securing Windows and Unix versions. They've also put together a working group (pay to join).
If you have looked at these sources, I would be interested to hear how they do or do not fit in to what the author of the original question is looking for.
I work for a ship classification company.
Big ship..
Little ship..
Big ship..
Medium size ship..
http://twitter.com/onion2k
well, have you checked out these things?
http://www.commoncriteria.org/
http://csrc.nist.gov/cc/pp/pplist.htm
The most secure method is to apply the KISS method. (keep it simple, stupid) The fewer lines of code, the fewer places an attacker can gain access. Use lots of encryption, (check on theoretical attacks mostly), and use physical safeguards for the system. You possibly want to use OpenBSD, because of the history behind it (4 years with no remote exploits on a default installation), but choose your base carefully. Encrypt all communications (ESP networking) and make sure you have double and triple safeguards. Better be paranoid, than exploited.
Sorry for not making a huge long rambling post, but you really should check out the Risks Digest
--xPhase
The following sentence is TRUE. The previous sentence is FALSE.
What might a set of safety criteria be like (I am just now most interested in criteria for computer systems that would address such issues as vulnerability to worms, viruses and crackers)?
While there may not be a body of standards regarding security, there are some de facto standards regarding redundancy of data, the breakdown of different methods of communication(connection versus connectionless protocols) are quite well defined as standards, and the general structure of professional applications. Taking these as a starting point, one could build a list of vulnerabilities for each of these standards. For example, in a connectionless environment, one would be worried about DDOS attacks, and methods for identifying the assailant. In a connection-based environment, physical issues such as allowing someone to get access to a LAN line with a laptop inside the company building would be something that would require at least some preventative measures(ID cards at the door, social policies about bringing in computers, etc.)
How should one go about to find competent and interested people who would like to be part of a body like I describe, or consultants to one?
Be very careful. You will need to find people who are trustworthy AND brilliant. Good luck.
First and formost, keep the computer system closed. Do not hook it up to any outside networks. No networks, no phone lines, no serial connections. That will elimiate quite a bit of risk for attack.
If that is not an option, then run the outside network connection through a very tight firewall.
~Sean
Well I know everyone's going to shoot this one down but I personally see a huge amount of time, effort and expense wasted on my own company's systems to protect them from the "scourge of the internet" when, upon detailed inspection, there is no good reason that 95% of these boxes NEED connectivity. Before you go about inspecting the various methods of combating the madness (firewalls, routers, off the wall OS, tying up the PHB, etc.) ask yourself "do our critical systems need connectivity and if so, to what degree?"
Find out about my new childrens book: SS Death Camp Criminal Batallion Go To Monte Carlo For The Massacre
Closest is the international Common Criteria . It's the indirect descendent of the old military orange book (you know, C2 certified, etc.). The attempt is to come up with multiple standards for each security critical component. The components are evaluated against the standard. A higher rating means they meet the standard to a stricter engineering criteria.
Some sample standards (or "Protection Profiles") include proxy and packet filtering firewalls.
My sense is the folks overseeing the Common Criteria would like industry groups to sponsor Protection Profile development. For example, banks could come up with profiles for wire transfer components, ATMs, etc. The shipping industry could be another.
BTW, if you visit the Website, there is an interesting line of Common Criteria-branded clothing, for the geek who has everything!
This probably means that critical systems on things like ships should not be running any flavor of Windows, nor maybe Linux either. There are a bunch of OS's made for embedded systems, and due to their small size and simplicity they are much smaller, probably faster, and certainly less vulnerable or even completely invulnerable to this kind of attack. If your requirements are that stringent, that's what you should be using.
Scientists restrict study to entire physical universe; creationist
Backup systems have to be in place, and why captains have to be able to navigate manually. Just like how yachts have to have motors in case sails break, etc... and to be able to safely navigate in ports.
The threat of virii could be minimal because the physical security of the ship's navigation systems should be locked down. No internet access, no floppy disk drives, closed systems, etc.
However, there have been failures. I remember a Navy Submarine running Windows NT or something, and it crashed (the OS, not the sub). They had backup systems, of course, but they looked pretty stupid. Windows NT Crash on Navy ship
The key point here is that you can test systems anyway : running for long periods of time, checking memory leakage, hardware failure periods, etc... and bugs that come up are corrected for free, usually, when you're talking about expensive navigation systems.
Sure, you can lose money for being out of action for a few hours, but that could happen due to any number of other mechanical failures too, so you just calculate some kind of percentage chance of failure based on past history of the navigation system?
Conversion Rate Optimisation French / English consultant
This is not intended to say "don't bother with security because it's a lost cause". Security is a issue where the hacker always wins though. Even OpenBSD is possible to hack via the SSH exploit. So keep up with the updates, but dont think you're immune.
"And we have seen and do testify that the Father sent the Son to be the Savior of the World"
1 John 4:14
And I work for a railroad that moves a half-million people a day. I like to think they're not too dissimilar industries - when my computers shut down, the railroad stops running. I'm guessing that when your computer stops, the ship stops moving. That it doesn't sink or explode (i.e. there are hardware items that relieve excess pressure, etc.)
There are some differences. My trains have low-level hardware (based around gobs of vital relays) that will stop them from running into each other. I doubt ships have anything like this.
The standards for what you or I do are drastically different from what someone writing software for an airplane's fly-by-wire system has to do. There, if the computer stops or starts doing the wrong thing, it falls out of the sky. Scary stuff.
So, it depends on what the computer controls, but you haven't given us this information.
Sounds to me like the shipping industry is behind the times -- there are lots of other industries that have standards for computer systems. The FDA is becoming much more strict about computer validation and there is a great deal of documentation and testing required to implement a validated computer system. There are also many, many recognized Quality Management Systems in existence that apply equally well to a computing environment.
>Everybody seems to know, for instance, that UNIX is safer that Windows
Sorry, I couldn't ignore this... Validation of a computer system is about proving something is fit for purpose. Documenting requirements, design, performance, data integrity etc. It ain't about what OS you run. There's not a sane business person in the world who will rally behind someone masking anti-Microsoft sentiment as "computer security".
Um, hate to break it to you, but how the hell do you hack a system that's on a ship and self contained? everyone's talking about virus this and worm that, who gives a crap? my guess is that the ship's navigation systems are secluded from anything that would have outside access.
what i'm guessing he wants to know is something more along the lines of this.Windows NT cripples US Navy Cruiser
in which case, he's really asking which software/OS is the least likely to puke and leave you up a creek without a paddle.
Later the EU produced their Green book which looked at availability as well, this is kind of good for information systems but it doesn't really cover real-time control systems.
A long time ago, I worked on real-time control systems. We divided our systems into control/measurement, supervisory and at the top, information systems. At the lowest level, we are talking hard real-time and simple enough to be very reliable. They had to be as they were typically sitting by a man-sized chemistry set. The supervisory systems gave the pretty interfaces, they could crash, but generally they didn't. These were for control rooms, and whilst bypassing them was possible, it wasn't easy. The top level system ran all kinds of complicated software applictions that could and would occassionally crash. Apart from the crudest electrical standards for the stuff in the plant and the control room, there were no evaluation criteria.
I worked for a famous defense contractor located in Fort Worth, TX. My department was responsible for writing requirements for software that was installed on fighter aircraft.
When using a requirements-based system (where you write requirements for software and then the software is written from the requirements), there are multiple checkpoints. First, the requirements document for the software must meet or pass certain criteria. Second, the software must meet or pass the criteria put forth by the requirements document. Third, the software is rigorously tested.
Now, in fighter planes, the software must be incredibly robust - you don't want planes falling out of the sky - and in defense projects, bureaucracy tends to inflate the whole process.
That being said, requirements are an excellent way to control the quality of software, or an installed computer system.
And this is important! We all remember the movie Hackers, in which the Davinci virus was going to cause a bunch of oil tankers to tip over into the ocean. And we all know how closely that movie parallels reality.
--
Disclaimer: The above statement probably includes half-truths, because real truth is too complicated.
Computer security in no way affects human life directly.
"Reboot the air traffic control system."
"How long has the reactor control system been down?"
"Try to get the GPS working again before we enter the harbor in this fog."
Any of these sound like non-life threatening situations? And you did notice the questioner is specifically concerned with the third type of situation I mentioned, didn't you?
Nope, no sig
The FAA has well-known procedures in place for certifying HW and SW for safety. Look up DO-178B, for instance.
It'd be almost trivial for the shipbuilding industry to adapt them to their somewhat lower-risk environment.
--Blair
I've seen Unix boxes left wide open, and I've seen MS Windows boxes closed up damned tight.
In the end, it's up to the admin. While I think it's easier to secure a Unix-like OS than it is Windows, it's also a lot easier to screw up.
Yes, google knows about:
CCITA
ISO/IEC 15408
NSA Rainbow
Which might be of note.
Look at the governments auto safety standards. They are a joke. Look at the Ford F-150. It passes all the government's standards but if you look at the Insurance Institute for Highway Safety:
l /0 110.htm
http://www.hwysafety.org/vehicle_ratings/ce/htm
Its a sad joke what government standards are. Buyer beware.
Sure Windoze apps have buffer overflow holes like [insert good analogy here], but when was the last time your WinVERSION came installed with a plaintext remote login server? Or have you seen Windoze setup with directory services exporting crackable password hashes? .. Unix is safer in many respects (especially to the scheduled-to-be-obsolete Win95/98/ME series), but I don't know that it's a cold statement of fact to say everyone knows that UNIX is safer than Windows. Depends on the attack vector.
If you need text styles to communicate then you don't have a message.
Yes! Exactly. There are several standards for the evaluation of computer security. The more accepted today is the Common Criteria of Information Security Evaluation (Common Criteria for short) and the good old Rainbow series from the US Gov't. Particularly the RED book for the evaluation of trusted computer systems and the orange book for the evaluation of trusted networks. There are many more, but the problem is not so much that we need these standards, but that many companies are not willing to go to the expense of implementing them. This leads to shotty software because no organization or company is paying to check out all of the possible flaws in their systems.
Wherever you go, there I am...
I often see this in /. in threads related to computer security:
.... 4 years with no remote exploits on a default installation
use OpenBSD
I have never used OpenBSD and do not know what "a default instillation" consists of. But can you actually do anything useful with a default instillation?
For instance, if i installed linux but turned off all services (unlike most default instillations), i reckon I could go 4 years without a being rooted [yes, I know there have been privelege elevation exploits found in kernel fairly recently etc, but you get the point]. But I wouldnt actaully be able to do much with it other than as a workstation.
Is an active OpenBSD box, running several service, dishing up some dynamic content etc really any safer than other systems?
Design bases means that information which identifies the specific functions to be performed by a structure, system, or component of a facility, and the specific values or ranges of values chosen for controlling parameters as reference bounds for design. These values may be (1) restraints derived from generally accepted "state of the art" practices for achieving functional goals, or (2) requirements derived from analysis (based on calculation and/or experiments) of the effects of a postulated accident for which a structure, system, or component must meet its functional goals.
The same logic underlies all design. At some point you have to have engineers you trust and they should be versed in the "state of the art" and all applicable studies.
In the nuclear industry we can and do rely on vendor studies. Who else but GE is going to know the maximum power levels that are safe with their reactors? They built a full scale model and proved it.
In the software industry, as you have noticed, things are a little less clear. First, Microsoft is an unethical company. (gotta go before finishing!) You and me both know that Windows is an unstable system. It changes all the time and those changes break programs. Some would even say that Windows is unstable without any changes, and indeed sites that use it typically see 30 day uptimes and no better. Anyone who would relly on such a thing for something that in is in any way needed to protect the public safety is incompetent. How that might be worked into a ship is a matter of judgement. I would not use it except as a game platform in the rec room or to look after some system that is superfuous.
Friends don't help friends install M$ junk.
The answer is obvious if you're looking for the best way to secure an onboard system: hide the ship.
-mm
obscurity mon ami
http://cgi.ebay.com/ws/eBayISAPI.dll?ViewItem&i
Reveal your root pass word! it only takes one command to fuck up linux when your logged in as root! But users are so stupid hackers can easily guess your password is your mothers maiden name!
First, let me point out I work with both *nix systems and Windows. Both have problems. I'm not going to address these problems.
My thoughts on this are, what levels of security are required? I've never heard of someone hacking an oil tanker, but just because I've never heard of it doesn't mean it hasn't happened, or is impossible.
My opinion is that the most important thing you would need software for is navigation software, in order to determine location, and software for weather reports, so you can plan ahead for adverse weather conditions. Can you get both for either OS? Sure (but I don't know names). Do they work? Well, if they didn't we'd have a few more ships crashing into reefs.
It gets away from secure systems, in my opinion, and more towards robust systems. Maybe it's just words, but I view secure and robust being different.
EFGearman
--
Atomic batteries to power! Turbines to speed!
I think most slashbots are muslim.
The MacOS running WebStar as a server has never been exploited.
In fact in the entire securityfocus (bugtraq) database history there has never been a Mac exploited over the internet remotely.
That is why the US Army gave up on MS IIS and got a Mac with WebStar.
I am not talking about BSD derived MacOS X (which already had a couple of exploits) I am talking about Mac OS 9 and earlier.
Why is is hack proof? These reasons
1> No command shell. No shell means no way to hook or intercept the flow of control with many various shell oriented tricks found in Unix or NT
2> No Root user. All mac developers know their code is always running at root. Nothing is higher (except undocumented microkernel stufff where you pass Gary Davidians birthday into certain registers and make a special call). By always being root their is no false sense of security.
3> Pascal strings. ANSI C Strings are the number one way people exploit Linux and Wintel boxes. The mac avoids C strings historically in most of all of its OS. In fact even its roms originally used Pascal strings. As you know pascal strings are faster than C (because they have the length delimiter in the front and do not have to endlessly hunt for NULL), but the side effect is less buffer exploits.
4> Stack return address positioned in safer location than intel. Buffer exploits take advantage of loser programmers lack of string length checking and clobber the return address to run thier exploit code instead. The Mac places return address infornt of where the buffer would overrun. Much safer.
5 : Macs running Webstar have ability to only run CGI placed in correct lodirectoy cation and correctly file typed.
6> Macs never run code ever merely based on how a file is named. ",exe" suffixes mean nothing. For example the file type is 4 characters of user-invisible attributes, along wiht many other invisible attributes, but these 4 bytes cannot be set by most tool oriented utilities that work with data files. For ecxample file copy utilities preserve launchable file-types, but JPEG MPEG HTML TXT etc oriented tools are physically incapable of creating an executable file. the file type is not set to executable for hte hackers needs. In fact its even more secure than that. A mac cannot run a program unless it has TWO files. The second file is an invisible file associated with the data fork file and is called a resource fork. EVERY mac program has a resource fork file containing launch information. It needs to be present. Typically JPEG, HTML, MPEG, TXT, ZIP, C, etc are merely data files and lack resource fork files, and even if the y had them they would lack launch information. but the best part is that mac web programs and server tools do not create files with resource forks usually.. TOTAL security.
7> There are less macs, though there are huge cash prizes for craking into a MacOS based WebStar server. Less macs means less hacvker interest, butthere are millions of macs sold, and some of the most skilled programmers are well versed in systems level mac engineering and know of the cash prizes so its a moot point, but perhaps macs are never kracked because there appear to be less of them. (many macs pretend they are unix and give false headers to requests to keep up the illusion, ftp http, finger, etc).
8> MacOS source not available traditionally, except within apple, similar to Microsoft source availability to its summer interns and such, source is rare to MacOS. This makes it hard to look for programming mistakes, but I feel the restricted source access is not the main reasons the MacOS has never been remotely broken into and exploited.
Sure a fool can install freeware and shareware server tools and unsecure 3rd party addon tools for e-commerce, but a mac (MacOS 9) running WebStar is the most secure web server possible and webstar offers many services as is.
I think its quite amusing that there are over 200 or 300 known vulenerabilities in RedHat over the years and not one MacOS remote exploit hack.
You wanna get everyone looking over our shoulders all day long!
M@
Krispy Cream is people
The real problem has very little to do with software and very much to do with the people running the software.
I don't care how secure your unix system is, if your root password is "password" or you let root telnet into it, you're system is insecure. Selecting "unix" over "NT" should not save you money on insurance if it's the same moron running either machine.
Not to mention that there is some inherent risk in change. If you declare that "Unix is secure" and give a break to anyone using it, you're going to end up with a former NT administrator forced to admin a system he knows nothing about. (The same would be true in reverse.)
-- Don't Tase me, bro!
There are a few regulations currently in place that dictate computer networks onboard commercial vessels. A big one is IEC-945. The IEC-945 testing is a standard for test of equipment intended for installation in the bridge. IEC-945 assists in meeting the requirements of SOLAS (Safety Of Life At Sea) that is also adopted by IMO (International Maritime Organization). ISO (International ORganization for Standards has a technical committee (TC-8) and a subcommitte 10 (SC-10) that deals with computer applications. (never looked this one up before) The guiding principle with the shipping company I work for is that no computer that controls navigation can be on the network. We make sure we have ABS approval before penetrating bulkheads for cable runs and the cable must be of a type that does not produce smoke if burned. Otherwise it's anything goes as far as software: Windows, Novell, etc... We just ensure compatibility with the shore-side and go from there.
Although i am not in that part of market any more. I 've worked under conditions equal to the safety standard for nuclear sites IEC60880 and the coming IEC61508 as I recall from memory. So take a look at this organisation and their other standards. (www.iec.org)
I recall that a while ago some navy ships were stopped dead in the water due to computer failure, so there are legitimate concerns. Most ships have a large number of fallback systems - notably crew - that can recover from most problems.
Large ships also benefit from a reasonable physical security structure - limited bridge and engine room access for crew - that help computer security
In light of a natural physical isolation, limiting the net access of the navigation computers is a natural and effective security boost.
Most of the 'essential' computer systems that are currently used are not OS based, but embedded. It would be silly to worry about the electronic fuel pump in your car getting a worm. These embedded systems are often virus proof because they use ROM program space. Any bugs are the result of programmer error and insuficient testing
So, I suspect that only high-level systems like navigation are vulerable to worms. Now, let's take a look at possible damage
Massive failures can be caused by hardware, so there must be a backup system regardless of the software that you choose
The same redundant systems can also be used to keep the master system honest
In general good policy and management is more important that what software is used.
Maybe now that companies are offering hacker insurance some standards and guidelines will develop?
On the other hand...when has the computer industry ever mirror any real world industry? We still don't have the equivalent of the Consumer Product Safety Commission nor is there product liability, recalls, or defect-related lawsuits.
If there were, Microsoft would make the Ford/Firestone fiasco look like nothing.
- JoeShmoe
.
-- I wonder which will go down in history as the bigger failure: the War on Drugs or the War on Filesharing
There is one answer... the US government has published a civilian version of a process that the DoD has been using for a while. It's called the NIACAP (NSTISSC 1000), here.
Simply put: It defines a complete, scaleable, tailorable and relevant process to design, test, certify and maintain a system for use.
IF: 1. Good, well informed individuals identify vulnerabilities during system design and testing,
2. The upper management commits to following the maintenance plan, and
3. The priciples of good system design are followed (i.e. KISS, enforcement of least privilege), then many security issues are non-issues.
IMHO, one of the most important things in certifying a system for a critical app is to get the underlying SW from a reputable vendor, one who identifies "Day 0" exploits immediately, preferrably one on the Common Criteria List, and offers a modularized package to limit the amount of unused but potentially vulnerable code in the system. No system is going to be immediately perfect now and for its entire lifespan, but follow a good maintenance plan and you may even be able to make a M$ system secure!
"If you know yourself but not the enemy, for every victory gained you will also suffer a defeat." -Sun Tzu
It all depends on the industry in question. Take as an example, light bulbs. When you buy a lightbulb for you bathroom light, no one really cares. But when you buy a light bulb for your car headlight, you start running into safety regulations. And when you buy a light bulb for your left airplane wing, the FAA is going to be breathing down your neck.
I help build software for invasive diagnostic medical devices. The FDA (and similar organizations for other nations) is very concerned about the software we use. They don't have a checklist of brands, makes and models of software, since that's not the nature of software. But they do audit our development process. ISO compliance is easy. FDA compliance is hard.
For our next project, some boneheads decided on Win2K and "embedded" Win2K. I personally think the decision is stupid. But it probably won't affect the final quality of the device. Why? Because it won't be a stock Win2K, it will be the embedded version, stripped of everything we don't need. We will be in charge of the hardware it runs on. It will be tested under rigorous protocols. Etc.
The FDA doesn't care that it will have Windows on it. But they will care that it operates safely. That means it can't crash while diagnosing a live patient.
A Government Is a Body of People, Usually Notably Ungoverned
So I was watching "Win Ben Stein's Money" just now, and I think I've spotted a pattern:
The fattest contestant makes it to the final round.
I'm going to have to watch a few more episodes to confirm my theory, but I think I might be on to something here...
On a related note, WTF's up with Nancy Pimental's neck, anyways?
"You're just scared like a little white pussy. I'll fuck you till you love me, you faggot!"
I would venture to guess myself that software is very hard to regulate in a normal sense. On complex pieces of code (KISS standard aside) it is nigh impossible to completely prevent bugs 100%of the time. That's the ideal, but that's why we call it ideal.
If a bug occurred in a very unique situation, and it took 20 years for that situation to come about and it caused just one death, people would still ask, "Why wasn't anything done to prevent this?" Something was done (hopefully), and standards and regulations help, but in the end that's pretty much all you can do.
I don't think he's asking as much about viruses or hackers in this case, but those are also valid questions. I tend to believe what is stated downstairs in this argument -- I've seen Unix systems that were wide open and Windows Boxes sealed tighter than a drum, and it's up to the admin. I'm not really sure if there's a test or anything that sysadmins must pass to become licensed sysadmins, but if there isn't (and I'm not talking about certification) there should be one, at least as far as sensitive data like this is concerned.
Also, a real life situation when computer software caused multiple deaths was in the case of the London Ambulance Service, which used a very poorly constructed computer system and was directly linked to 20 or 30 deaths (due to late ambulances) in the few days it was active.
I find that it is. It DOES have most things turned off by default, but it is easy to turn stuff on. Simple flags in /etc/rc.conf. I use it for a web server, and a firewall, and everything seems hunky dory.
The Orange Book / TCSEC. The Rainbow Series. The Common Criteria. The FIPS PUBS.
Pick up the relevant O'Reilly book, Practical Computer Security, and spend some time with everyone's friend Google.
Tom Swiss | the infamous tms | my blog
You cannot wash away blood with blood
As someone more erudite (and wittier) than I once said,
"The most unsafe part of an automobile is the nut loose behind the steering wheel."
The insurance company auditors that have grilled me about our IT infrastructure (for business continuity purposes) NEVER ask what kind of hardware or software we use - they ask "Do you have a backup plan?" "Have you tested your backup plan?" "Do you have antivirus software installed?", etc.
Now I assume that some value could be given to the relative security or insecurity of hardware or software for the purpose of calculating risk and premium costs (much like the airbags on my car save a few buck a year) - but I expect the procedural implemenation and system policies (the 'driving record') will continue to have the most weight.
Everyone will start to cheer when you put on your sailin' shoes.
But when you're rooted (say, through the recent openssh hole) can you really honestly say that OpenBSD has no exploits? ANY system is going to be secure with all the services shut off by default.
Here is another clue I got today from my uni lecturer. If you wanted to run a secure web server, would you run it on NT, Linux, Solaris or the Mac?
*Up go hands of Linux advocates*
Answer: Mac because it is the least available operating system and as such fewer attacks have been created for it, even if there are hypothetically more bugs. As such, you would be less likely to suffer a problem, all else being equal
Back to the article, would a measurement take into account this type of situation? Does Mac get a high rating for low rate of incidents or a low rating because it (probably) has more bugs than Linux. Open question
To be perfectly honest, is the computer on a ship going to be networked externally? Maybe the control systems on board are linked by a network, but surely there is no need for vital systems to be connected to the outside world?
If the ship needs a internal network connected to an open network, then it should be entirelly physically separate to the control systems. No firewalls, no fancy security measures. Just no route between the two.
More of an issue is software reliability and stability. I won't get into the linux/windows argument, but generally, a more stable, stripped down system can be easily achieved with linux. In windows, you run the whole OS, no two ways about it, even if it just adds to instability and problems.
Generally, on essential computer systems, such as those on planes, radar, life support systems, and sattelites, are as simple as possible, and undergo rigerous testing. The development is often frozen early on because of this, resulting in reduced features, but better overall performance. It can take several years for changes to propagate throught the system... this can be annoying if it is as simple as a GUI change (say, one display needs to be frequently accessed, but requires several button presses, where another, rarely used display has instant access off the yoke).
Hardware reliability could be a problem as well - though I should imagine these systems are ready built by people who know what they are doing. I wouldn't trust off the shelf boxes and bog standard cat 5 linking them.
Redundant systems are probably a very good idea - as is some form of power conditioning and UPS system, as ships power may not be the best.
There is a lot to consider, but I think you may just as well turn to someone who has experience with aviation computers as well as someone who knows a lot about closed network security.
And imagine.... maybe the dodgy oil tanker plot in hackers could come true...
Well, I apologize (considering the /. readership) for not knowing squat about UNIX, but I recall reading in Microsoft's EndUserLicenceAgreement that it specifically states that (paraphrasing) "This product is NOT to be used in a life-critical situation". I remember it well, because I was installing these NT boxes in hospital Surgical Suites! Does UNIX have a similar disclaimer?
your lecturer is advocating security through obscurity. by that measure, the most secure possible web server is one you've written yourself, regardless of your competence level, because it's one of a kind.
I would like to see that point of view competently defended in the public court of security experts.
For what it's worth I just got back from a Carribean cruise on one of the newer "largest" cruise ships "Explorer of the Seas"
They had two small-ish internet cafes on board - don't know the actual specs (almost have to be satellite based...)
The point is I tried to telnet into my university email account but they had the terminals locked up to only web useage - I asked if I could get a telnet window open at the ship's info desk and was told no due to security reasons.
Apparently there was a fairly significant problem on another ship where someone did some damage to the ship's systems through telnet (virus? hack?) that casused the entire week cruise to be cancelled (screwed the nav system or some-such) - since then they seperated the guest's systems from the ship's and limit guests to only web access.
Might just be a story they tell to anyone wanting to telnet but sounds plausible - lucky for me my addled brain remembered our university has web access to our email accounts... still - 50 cents a minute on board - ouch...
Aren't there groups withing the ACM/IEEE etc. that allready do this?
if you go to nsa.gov they can provide some background on security or operating system hardening against known and unknown vulnerabilities. I highly recommend using them as a basis for locking down your operating system. =)
Click on 'classifications', then try to use any of the links on the left, register of vessels and such. The link for that is file:///registerofvessels. Needless to say, that link doesn't work too well on a public internet.
You can do quite a lot with a default install of OpenBSD. A default install does not have all services turned off - for example, SSH runs by default. The idea is, however, that you should have a pretty good idea what services you're adding, and be careful to ensure you do so securely - generally this is a much better idea than starting with a system whose services were enabled by default and then attempting to secure neccessary ones and disable unneccessary ones...
Any system, no matter what software or OS you decide to use, still has a possiblity of error simply because it is a somewhat complicated high-level system. When you turn more and more over to software, then you inevitably create a greater likelyhood of error somewhere along the line. The best thing to do to prevent the error resulting in a more serious problem is to have backups, either much more low-level software, or, even better, manual controls for everything that would need to be used in case of an emergency. At the very least have manual controls for basic navigation so if the problem is serious the vessel isn't stranded.
The best idea is just to have manual systems for everything that can be controlled manually, so the ship could continue functioning at somewhat normal level while the problem is solved. Humans may not be foolproof, but when the system crashes, they're all we have.
it can only be safe if it is not connected to the outside, off, and unplugged from the wall.
Implementing a system with an air gap is definitally a good security measure. However, it is really only practical for certain systems. On a ship, an air gap might be applicable for systems that run the ships controls (i.e. engines, environmental controls, etc). These systems may be very important for ship safety and have no need to be in contact with the outside world.
Then there is the navigation and communication systems. These are very important for a ship but may require limited access to the outside (GPS, etc). This should be completely seperate from the air gapped systems above and of course implement all other possible security measures (firewall, etc).
On a modern ship there will likely be a third level of systems used for personal communication. Web browsing, Email and the like are not vital to the safety of human beings onboard the ship an thus do not require as stringent security.
Using a multiple-system and multi-tiered security model like this may affer the best combination of security, price, and convenience due to not having to secure everything to the highest order.
-- Find the Truth...
"Captain -- the minesweeper program's crashed again!"
I never said that OpenBSD has no exploits. What I'm saying, is that they have the least amount of them. You can install it out of the box, and as long as you pick a decent root password, you can leave it plugged in, and stay safe for quite a while. Can you do that with ANY other operating system. No patches, no other configuration, nothing else.
The problem lies with the users. Obviousely the users must be more informed about computer security. I have been using a firewall since before I got dsl. Why, because I'm cool. You can be cool too. Subscribe to my costly newsletter today, if you want to be cool.
Ask three questions:
1) What are the consequences of failure:
(Nav system steers you into rocks == bad)
2) What's the risk of that failure mode happening
(GPS systems == highly reliable)
3) Are there redundant systems using different methods, or other forms of backup ?
(LORAN and GPS systems, skilled pilot knowledgable of local reefs)
Assign an arbitrary scale to each of these criteria, and use it to consistantly evaluate effected systems. Over time you'll build up a body of knowledge about effected systems.
Note that this will bias strongly toward older, proven systems rather than upgrade of the month type, which for critical software is exactly as it should be.
-- Pat
The biggest problem with communication is the illusion that it has occurred
Yes, [everyone knows] UNIX is safer that Windows. BUT, that is in general, not specific.
I can write my own Unix, make it fully posix, even pay for legal use of the unix name. (I don't have the money, but I could in theory) I'm a fairly good programers, and I've done some OS level work. However I know next to nothing about writting a secure system, and apart from the backdoors that I intentionally put in my code, there will be many accidental security holes. However it would still meet the standards to be called unix by all measures.
The point is your standards need to mandate a solution that works. Require code audits by qualified external parties if it is net connected. Make sure your external parties are well chosen (example Bruce S. or applied cryptology fame, or his company), but make sure you have several different experts represented. Make sure the requiremetns are reviewed. Accually, you probably have processes for reviewing the machanical areas of the ship, extend those processes to the software. Remember, anything you can do in software I can do with gears (though in some cases I don't know if there is enough metal on earth to accually make all those gears, not to mention the relability) so your mechanical review process should extend to software.
Do you let your suppliers buy an engine (eg from Cummins) off the shelf and put it in, or do you require that your mechanicial engineers examine the engine design first. If they can buy any engine, then they can put in any software. If you need to see all the engine design, then you need all the software design.
Simply do any Google search on "FDA 21 CFR" and you'll find hordes of information that you can use.
In any case, the visuals are really starting starting to kick in now, so I'm going to go lay down for a bit.
Please try to hold the fort while I'm gone. If you need anything, just leave me a message, I'll check it when I get up in 7-8 hours.
See you then - XOXO
"You're just scared like a little white pussy. I'll fuck you till you love me, you faggot!"
Ah yes, good old security-through-obscurity. Shouldn't you say, "there are fewer publicized attacks created for it"?
I don't care if it's 90,000 hectares. That lake was not my doing.
MacOS is safer than Linux OR windows.
:
Consulting self apointed experts have nothing to do with reality of waht is safest.
Use Bugtraq to make your decision based on historical fact.
The MacOS running WebStar as a server has never been exploited.
In fact in the entire securityfocus (bugtraq) database history there has never been a Mac exploited over the internet remotely.
That is why the US Army gave up on MS IIS and got a Mac with WebStar.
I am not talking about BSD derived MacOS X (which already had a couple of exploits) I am talking about Mac OS 9 and earlier.
Why is is hack proof? These reasons
1> No command shell. No shell means no way to hook or intercept the flow of control with many various shell oriented tricks found in Unix or NT
2> No Root user. All mac developers know their code is always running at root. Nothing is higher (except undocumented microkernel stufff where you pass Gary Davidians birthday into certain registers and make a special call). By always being root their is no false sense of security.
3> Pascal strings. ANSI C Strings are the number one way people exploit Linux and Wintel boxes. The mac avoids C strings historically in most of all of its OS. In fact even its roms originally used Pascal strings. As you know pascal strings are faster than C (because they have the length delimiter in the front and do not have to endlessly hunt for NULL), but the side effect is less buffer exploits.
4> Stack return address positioned in safer location than intel. Buffer exploits take advantage of loser programmers lack of string length checking and clobber the return address to run thier exploit code instead. The Mac places return address infornt of where the buffer would overrun. Much safer.
5 : Macs running Webstar have ability to only run CGI placed in correct lodirectoy cation and correctly file typed.
6> Macs never run code ever merely based on how a file is named. ",exe" suffixes mean nothing. For example the file type is 4 characters of user-invisible attributes, along wiht many other invisible attributes, but these 4 bytes cannot be set by most tool oriented utilities that work with data files. For ecxample file copy utilities preserve launchable file-types, but JPEG MPEG HTML TXT etc oriented tools are physically incapable of creating an executable file. the file type is not set to executable for hte hackers needs. In fact its even more secure than that. A mac cannot run a program unless it has TWO files. The second file is an invisible file associated with the data fork file and is called a resource fork. EVERY mac program has a resource fork file containing launch information. It needs to be present. Typically JPEG, HTML, MPEG, TXT, ZIP, C, etc are merely data files and lack resource fork files, and even if the y had them they would lack launch information. but the best part is that mac web programs and server tools do not create files with resource forks usually.. TOTAL security.
7> There are less macs, though there are huge cash prizes for craking into a MacOS based WebStar server. Less macs means less hacvker interest, butthere are millions of macs sold, and some of the most skilled programmers are well versed in systems level mac engineering and know of the cash prizes so its a moot point, but perhaps macs are never kracked because there appear to be less of them. (many macs pretend they are unix and give false headers to requests to keep up the illusion, ftp http, finger, etc).
8> MacOS source not available traditionally, except within apple, similar to Microsoft source availability to its summer interns and such, source is rare to MacOS. This makes it hard to look for programming mistakes, but I feel the restricted source access is not the main reasons the MacOS has never been remotely broken into and exploited.
Sure a fool can install freeware and shareware server tools and unsecure 3rd party addon tools for e-commerce, but a mac (MacOS 9) running WebStar is the most secure web server possible and webstar offers many services as is.
I think its quite amusing that there are over 200 or 300 known vulenerabilities in RedHat over the years and not one MacOS remote exploit hack.
gears and software analogy off are not similar... programs can recurse and programs can generae code and programs can self replicate. In fact a computer can control a servo arm to play ping pong. playing ping pong with prure analog machinery is probably impossible.
I agree entirely that there needs to be a regulatory branch to standardize software security, simply based on the fact the major software players really don't care. I hope this standardization branches off into a wider array of issues and not just security, but product stability. Such rules that could be forcefully enacted are: - Required testing of a product on a designated amount/type of test beds - A required amount of man hours put into product testing - Governmental bodies to beta test all products to deem if they are fit to go into the market place Wouldn't it be nice to buy a piece of software that doesn't crash on installation or execution? Or software that doesn't have completely retarded default values to make no sense whatsoever? I don't know. Maybe I'm just pipe dreaming. Software that has a 90+% success rate upon first release. Yeah. Right.
Do you not realize that the vast majority of network server software is not even developed by the 'bundler' (e.g., OpenBSD, RedHat, etc), so the 'remote exploit' issue is quite irrevalent. As to the question of how many are enabled by default, there is practically no services enabled by default on RedHat (I'm not sure how many; I use custom installs). Even inetd isn't running on many RedHat systems.
DISCLAIMER: The company I work for does software safety work.
Many comments (as well as the poster) seem to imply that safety and security are the same thing. This is simply untrue, and this is one attitude that causes unsafe software systems to be put into production. A perfectly secure (or reliable) software system can still kill everyone involved. Repeat after me: security and reliability ARE NOT safety.
If you want to know about safety, ask an expert in safety. Don't ask security or reliability experts about the safety of your system. Ask the wrong expert, and you'll get bad advice. Certianly, whatever you need to determine, take the matter up with an appropriate expert.
Let us supose that someone discovers a bug in the MAC O/S that is only relevant to online control. almost no MACs are used for online control, what is the probability your bug will ever get fixed?
The original story in this case is posted with the intention of obtaining a particular answer. The poster is not really interested in what system would be secure, he wants to have his original prejudice reinforced.
Design of ship control systems is a real time control problem. As such it is not an application for which 'Linux' is a solution, you have to be much more precise and specify exactly which real-time enhanced Linux you are considering. It would also kinda help to actually specify the problems to be addressed
As for 'security', one would hope that you would not be hooking your control systems up to the Internet or running any sort of user application other than controls for the ship. The references to worms viruses etc suggest to me that the poster does not understand the problem or is trolling for anti-Microsoft stories to tell his manager.
Looking for an Information Security student project suggestion?
Try http://dotcrimeManifesto.com/
Many medical diagnostic machines must be validated by the FDA for use. A friend of mine works for a medical instrument company, and the hardware/software check are quite involved. You might see how the FDA and the various hardware manufacturers handle this issue.
Don't you understand the importance of gratifying your own ego? Instead, you remind us of a useful link, and go away! How lazy can you get?
Answer: Mac because it is the least available operating system and as such fewer attacks have been created for it, even if there are hypothetically more bugs. As such, you would be less likely to suffer a problem, all else being equal
You forget that we live in a dynamic world. What's going to happen if system administrators all decide to move over to Macs? Do you think crackers will continue to develop exploits for *nix/Windows if there is no "market" for them? Of course not. They will start developing exploits for Macs. If Mac software are not BETTER designed than *nix/Windows software, you're going to see an explosion of Mac exploits. Many of these new Mac exploits will be based on the same principles of initial exploits resolved by *nix/Windows systems long ago.
can't find the link but netcraft tells the truth
The actual department of the U.S. National Institute of Standards and Time is CSRC I would point you to the Computer Security Expert Assit Team and their guidlines
Their audit and risk checklists are quite extensive.
I worked for a financial software company which needed to assure its clients that our software was secure. The way we did this was approach a security consulting company, like ISS, pay them a reasonable fee, give them access to the source and engineers, and produce a report of their findings. We then shared that report with our customers, with comments about how we're addressing the various vulnerabilities. This provided the practical level of assurance that our customers needed.
Ahh..
Another day, another "Tell Me Exactly How To Do My Job post masquerading as an Ask Slashdot question.
:)
------
Today's Top Deals
I do realize that, OpenBSD goes through the code that it packages, and does some secure de-bugging. They change some of the code to protect from buffer overflows, and things of that nature. They send the changes up the tree, for the maintainers to use. OpenBSD (and BSD's in general) don't care if they are the most widely used, they just want their stuff to work.
Everybody seems to know, for instance, that UNIX is safer that Windows, but there are no safety, reliability or security criteria established by any recognized authority that can be used to defend one computer system over another." So how does everybody seem to know that one is safer then the other.
take your linux, and eat it.
:)
:( :( :(
your super secure, bug free os seems to have a little problem with its zlib
http://news.com.com/2100-1001-857008.html
but its not a problem right? of course not, linux doesnt have "bugs" just "issues". open source is far better because bugs get caught earlier... well zlib is pretty damn old. But all the linux zealots will be like "its not a "bug" its just a simple "issue" that will get resolved, because linux can't have bugs! its just too cool to have bugs!"
foff.
i wonder if this cnet article makes slashdot front page. be funny if it didnt because it hurt your precious linux
In Microsoft's anti-monopoly case, Microsoft's lawyers had to use WordPerfect to prepare their case because MS Word didn't meet the relevant bar association standards. If I remember correctly Word didn't count words reliably, so both sides couldn't be certain that they were looking at complete documents.
Also I believe there is a similar set of standards for accountants using spreadsheets.
Most of us just assume that our software is going to work and tell horror stories when it doesn't, but for those whose very careers depend on the accuracy of their programs, software is indeed very closely monitored.
- The machine could not malfunction in a way which would harm the patient, and
- The machine would not report erroneous data which could lead to harm from subsequent mis-treatment of the patient.
How you'd demonstrate such things given the legendary instability of Windows, I have no idea.Scientists restrict study to entire physical universe; creationist
so Internet security isn't an issue. For a shipboard computer, you only need two things:
* No network connections to non-trusted systems (i.e., onboard crew and passenger personal systems)
* Solid stability and reliability in operation.
Given those, your ship computers should be secure.
shit, i think the man asking questions here is "the pauge". he's just looking after a way to get into those poor tankers ballast control systems. and make a million bucks(email worm virus... sounds familiar).
If you wanted to run a secure web server, would you run it on NT, Linux, Solaris or the Mac?
*Up go hands of Linux advocates*
Answer: Mac because it is the least available operating system and as such fewer attacks have been created for it, even if there are hypothetically more bugs. As such, you would be less likely to suffer a problem, all else being equal.
This is short sighted, becuase it does not take into account what you are securing AGAINST. If you are securing against random, non targeted attacks from script kiddies, you might be right, becuase said script kiddies aren't going to spend the time to figure the system out... but if you are trying to secure against a real, concerted attack by agents of a competitor trying to steal your ideas or ruin your business, then you have made a very grave mistake.
When you say "all things being equal", then you are saying that 1 defaced web page is exactly equal to 1 stolen top secret formula, which is preposterous. A hypothetical question can not consider all types of attacks to be equal and still produce a valid and meaningful result.
If you use that logic, then using a completely open and unsecured network would be ok if you sealed the computer in a locked metal box, since it would deter physical attacks by baseball bats (ALL attacks are of equal value, right?). Or you could say that adding the line "WWJD" to the telnet login prompt would be a valid defense since it would lower the instance of attacks by Christians by 80%.
Go set him straight.
"Your superior intellect is no match for our puny weapons!"
does this mean shitty and shoddy? Anyway, I like the term, even if it's accidental.
"For our next project, some boneheads decided on Win2K and "embedded" Win2K". While Mundie is sent out to "enrage" us with anti-GPL rhetoric, Microsoft are hard at work on getting windows in every place they can. From VoIP solutions, to embedded, to medical and industrial, to phones, to consumer electronics. They are beginning to make a very "dangerous" end run around all other technologies. We got a taste of this when code red shut down routers because they had embedded IIS. The fight for the desktop is becoming irrelevant, as it is turning into the battle for technology itself.
Well, I thought maybe I could take the day off, but this post makes it clear that it is downright dangerous for me to leave you creatures alone for even short lengths of time.
... is." It is not correct to say "The purpose ... are."
Like so many posts here on Slashdot, this one falls off the cliff with its very first step out the door. To add insult to injury, after leading me on a wild goose chase with that first sentence, the author then leaves me stranded out in the forest by ending his run-on sentence with the word "etc." Maybe the St. Bernard will come and rescue me.
I must also remind the author that standard English requires a verb form to be in agreement with the subject of the sentence. In general, agreement depends on three factors: person, number, and tense.
The author has violated this rule in the sentence beginning with "The purpose of such..."
The subject of this sentence is not "companies", rather, it is "purpose". Therefore, it is correct to say "The purpose
Frankly, I stopped reading immediately upon discovery of this blatant error. Clearly both the author and his "editor", Michael, are incapable of meaningful written communication.
I am quite impressed by the replies I have received both here and by mail. I would like to take the opportunity to try to address, as well I might, the issues that have been raised in the replies.
I see that I have not stressed clearly enough the sort of security I am most concerned with, although some of you have guessed. Hacker attacks is probably the least of our troubles, because most ship's computers do not have a permanent Internet connection. In fact, in some cases ships regularly have no way of contacting shore and more frequently does not have any permanent connection, be it ground radio or by satelite.
So the basic problem is computer systems that go down during navigation, or need a lot of maintenance. Typically, one would obviously not want a "classic" Macintosh or Windows 98 on board, because these are systems that are apt to erratic behavior that only experts can fix. GPS systems typically run on Windows NT.
Now, if the GPS system goes down, it doesn't have to be a disaster because the radar will still work, but problems can occur in a roundabout way. A famous example is this: The GPS goes down because somebody trips on the antenna base and ruins it and fails to report it. GPS and the ship's auto-pilot switch to Dead Reckoning, which means that the ship calculates its position based on speed and initial course. If there are strong currents or even sidewinds DR becomes wildly inaccurate quite rapidly. This particular ship drifted for 24 hours before somebdy noticed that the computer display showed that the autopilot was navigating by DR. This would not happen if the crew were paying attention to their job, but this ship had serious morale problems.
There are also computers that monitor the state of the engines and warning messages from various information centers.
Now, I know of no record that can give a clear picture of the frequency or gravity of computer problems at sea. Judging from a typical office, you'd have computers out of order all the time, but the analogy doesn't hold because the computers typically run only one program and are usually set to start them automatically at powerup, so the most typical causes of computer error is eliminated.
No, I don't ask for a set of regulations that would outlaw Microsoft. I know that Unix systems are supposed to be more reliable than the obvious alternatives (hackability not being much of an issue here) but I lack criteria for reliability that could be used to challenge or clarify this position. The ship industry would clearly benefit from being made aware of
-- Rolf Lindgren, cand.psychol
I liked this. Screw you moderators.
*pause*
Wait, what does this combo box do? Hmm....
I can either submit this or mod the parent up...
I'd rather bitch and moan. I like to mod up interesting points, not waste my mod point trying to mod up a dissed funny. So I repeat:
SCREW YOU MODERATORS!!!
I hope people meta-mod you down.
What you are asking for is impossible to find, as you are dealing with certain "human" characteristics. A system is only as accessable, easy to use, secure and reliable as the people who administer, install and work with the technology. We can't make blanket statements like "Windows is less secure than Unix" simply because a good Windows admin can make that Windows machine more secure than an Unix box that has a junior or bad admin. That human factor cannot be understated and is the reason why just such a report or committee is impossible.
The surrendering chatter-monkeys of Europe have much to teach us about how to lose wars, lose international prestige, and turn first-world powers into sagging, helpless welfare states.
They insist that we must let them teach us these valuable skills!
Fuck that. Europe just wants to drag us down the same rathole of poverty, decadence, and irrelevancy they live in. Fuck that.
Sun Tzu said that "the perfection of war lies in sapping your opponent's will to fight", didn't he? Well, he lived a long time ago. Back then, if you wanted a meal, you had to prepare it. Nowadays, it's all done for you: Just pop some frozen crap in the microwave. Likewise, back then if you wanted a spineless, helpless opponent, you had to sap his will yourself. These days, you just attack Europe. They come pre-de-backboned for your conquering pleasure. They couldn't even stand up to Serbia.
The strong will always survive. Let Europe rot.
"Christianity neither is, nor ever was a part of the common law." --
The Common Criteria:
here and here.
Which supersedes the Orange Book:
here and here.
"This message is composed of 100% recycled electrons."
I believe security enhanced linux, created by the NSA, is an ideal technology which ought to be integrated into Linus's kernel.
You might be interrested by those reads :
www.ieee.org
www.swebok.org
both are links to organisation that defines what is software quality. In those, you should find metrics to evaluate whatever quality you're looking for(security included).
CMU's cert organization can help with certain falvours of Unix (maybe windows) with an emphasis on data center computers (e.g. ftp or web servers) as opposed to command and control computing (like ships at sea). www.cert.org.
Also of use to Windows admins and similar folk is bugtraq at apparently a new URL. Ahoy and good luck.
I think a large part of evaluating this topic would be software fault-tolerance. Mostly, I think that the methods in this area are full of crap, and there are some papers out there to back me up. Search for papers by Leveson for the nay sayers and Avizeinis for the proponents. These are papers describing methods of developing fault tolerant software systems. I think you would like to say that a software system that will keep running in adverse conditions is better than one that won't. Hardware fault tolerance is much better in the reliability area, and N-way redudancy makes more sense there, since you're protecting against faults other than design faults. Software's problems are design faults, and so the fault is likely to be replicated N-times. A good book on this topic, extremely technical in nature is edited by M. R. Lyu "Software Fault Tolerance".
The FAA method is probably better in general. Test EVERY line, full call path, every branch etc. Its a real pain and makes software SUPER expensive. I think tools like Balista would be a big help, if people used them. But then you still have to test against a well defined spec; and I would love to see one of those for the software that I write....
I would hope that you have the leverage to increase the use and methods of tools like ballista and maybe make passing an independant test get a better discount on insurance. It appears that there some good links already, but the Software Engineering Institute at CMU does research in this area, mostly for US DoD, but I'm sure they have lots of lofty ideas, if not good practice. HP and IBM have also done some interesting work, but its been a while since I was looking into this topic.
You might find my Secure Programming for Linux and Unix HOWTO useful. It's a set of guidelines for writing secure programs, including writing web applications, clients, viewers (including word processors), setuid/setgid programs, and so on. It's focused on Linux and Unix, but most of the general principles apply to all systems.
- David A. Wheeler (see my Secure Programming HOWTO)
*NITSCAP .doc file]
*DITSCAP
*Common Criteria
*FIPS 102 Not to mention all the other FIPS criteria, esp. regarding crypto and PKI.
*NIAP (Information Systems Certification Procedures and Assessment Scheme)
*A Plethora Of Schema and Policy
*Ye Olde Rainbow Series
*MIT GASSP [warning,
And these are just US criteria...other nations have their own. These are becomming very important, if typical job requirements on security-jobs list are any indication. Need a BS, a clearance, and 5 years practical experiance in everything from LAN wiring, vulerability finding and exploit production, penetration testing, firewalls and IDS, to the evaluation and application of these federal criteria, and everything in between. And that will get you an entry level position!
"These people look deep within my soul and assign me a number based on the order in which I joined" --Homer re:
Um, yeah, whatever. The regime now in power in Iraq has a long history of a) launching wars of conquest against its neighbors in cases where it was not threatened in any way at all; b) using chemical weapons against its own citizens (hello?!) c) devoting considerable effort to expanding its chemical and biological arsenals and developing a nuclear arsenal as well.
Them's called "facts", son. The European approach is to hide one's head in the sand until it's too late, and then wring one's hands and whimper about "international law". The US approach is to kill the problem while it's small. The US approach saves lives. The European approach cares nothing for lives. All Europe cares about is short-term convenience.
The European mentality killed tens of thousands of civilians in the Balkans in the past decade, and millions -- literally millions -- of civilians during the second world war. The United States cleaned up their mess in both cases, at great cost to ourselves. What thanks do we get? No thanks at all, as it turns out. The Europeans aren't just helpless children; they're insolent and ungrateful as well.
Letting Europeans run around loose with their own countries is lunacy. They can't handle the responsibility.
"Christianity neither is, nor ever was a part of the common law." --
This would not happen if the crew were paying attention to their job, but this ship had serious morale problems
Seaworthiness therefore depends in part on the crew. This is common sense. Is it taken into account in your ratings?
It's the same with computer systems. Asking a person, who might or might not know his job, to set up a ship's computer system on any particular OS will produce widely varying reliability results. If you were to do a very careful FMECA (failure modes, effects and criticality analysis) and iterate the design of a ship's computer you would probably find that a simple system designed to do the job was the right thing to use. Using a general-purpose computer for anything connected to navigation seems to be a definite request for a screwing.
Ever since Buckley's "Overdrive", where he used (and bragged about using) an HP-65 calculator to do his sight reductions, I have been very concerned about the idea that people are depending on electronics to do their navigation. Sounds as though the watch officer(s) were actionably slack in this case, if they weren't conscious of the quality of their fixes.
I believe you are asking the wrong question here. Perhaps what it is you need to know is "how well are computers integrated into ship's management, and how dire are the consequences of failure?" A job like this done well is probably nearly invariant with OS, but this job is bound to be done poorly in a lot of cases. That's why I suggest FMECA and a safety-based, rather than OS-based, review of critical systems.
OK, first off if your looking primarily from an insurance standpoint any number of criteria can be used.
Since the computers are in a marine environment are they resistant to (salt)water?
Is there a knowledgable(sp) computer tech on board, and what are his additional duties. Is he/she there to make sure the computer system stays online or is he/she also cleaning out shitters?
One computer system is much like the other much as one OS is much like the other. Both Linux and Windows (pick your version) have it's bugs, and will the particular bugs have an effect on the operation.
In any operation there ideally should be enough spare parts around that you could build another complete unit if needed, but there's never an ideal situation.
The list could go on and on and on, but there are a few major points...
1) environment
2) support personell
3) inventory
4) access
Most here will be talking from an electronic security aspect, but on a ship the major focus should be physical security.
Steve's Computer Service, Hobbs, NM
Looking at space station software (i work in the operations group for the MSS - but this is a personnal opinion, not engaging anyone else), there are signs of things that should be done by anyone claiming to be writing safe software:
- Clear methodology: the system is completely specified, and software requirements then flow from that. Requirements are inspected by a team of people and are detailed. Validation test specification tokens flow from the requirements. Each requirement will be tested. The validation specs are written. Only then can software be written, along with test equipment software. The software itself must be configuration controlled. Once baselined, the software can't be changed other than with the writing of software non-conformances (SNC: it says "oops, this function doesn't quite conform to its spec) or software enhancements (SE: it would be nice if it did this). In other words, the flow is controlled and you can't just hack to code: each piece of code flows from design specs to requirements to code, and in parallel from req'ts to validation spec to test results and documentation.
- Clear documentation: design docs, sofware specs that related to system requirements, test specs, test reports that clearly trace each requirement through and shows they've all been satisfied and all work, etc.
- The test systems themselves need to follow the same methodology
Basically, i don't think you can use criteria like "uses UNIX, uses good lib, etc". You need to see if everything has been thought out, everything has been validated, nothing's bloated. I'd say language of implementation would figure into this as well, but if you do it right, you can write very safe code in c; it's just that you might find more errors in testing than in building, which is not the case with Ada. Traceability is a huge part. Preventing disasters is one thing; making sure every little glitch can be traced back and fixed is another. If that software has excellent design, requirements and test traces that are configuration-controlled, and has good, documented methodologies, you're still not assured there won't be any faults (there can still be discreptancies in the requirements, for example), but you know they'll be able to find the root of the problems that might pop up.
If people started writing more stuff in 'modern' languages, buffer overflows would be vitually non-existent...
Start with:
Bruce Schneier at Counterpane Systems
Ross Anderson at Cambridge
and especially: Nancy Leveson at MIT
A google search will generate contact information. Good luck!
It's been pointed out that ships whose absolute-position navigation systems (GPS, LORAN, radar, etc.) conk out depend on dead reckoning: determining position based on speed and initial course.
It occured to me that this is the way software purchased are too often made: rather than determining exactly what is needed, purchases are based on what's already there and how fast development has proceeded. It seems like people buy the newest version not because they need it, but because it's available. Most users I know would be doing just fine with Word 97, (heck, most of them would do great with WordPerfect 6 for DOS) but they have upgraded to Word 2000 then Word XP because it's there. (I used to use WP6/DOS extensively, and it NEVER crashed on me.)
If Microsoft spent more effort making Word 2000 and Windows 98 more stable than succumbing to feature creep, the world would be a better place.
If people wouldn't upgrade for the sake of upgrading, they could demand that future software versions be compatible with older versions: a document in Word XP should be openable in Word 1.0.
Give me my freedom, and I'll take care of my own security, thank you.
that way you don't have to do any testing because you know it's Unbreakable :)
Go back, reread the articles, put on your critical thinking cap and try to explain to yourself what must have happened.
The article talks about a software problem, not an OS problem.
Many people have brought up the SECURITY question here, myself included. But the issue is SAFETY.
SECURITY asks, will the lock keep out intruders?
SAFETY asks, will the lock allow personnel to pass quickly in the event of an emergency?
SECURITY asks, will the window resist breaking in an intrusion attempt?
SAFETY asks, will the window resist breaking if accidently impacted? Can the window be used as an egress in an emergency? If the window breaks, will the fractured glass cause injury?
SECURITY asks, can intruders compromise the ships navigation or control systems?
SAFETY asks, will failure or compromise of the navigation or control systems have a negative impact on life or property?
SECURITY asks, does the system have permission to perform task A while being restricted from performing task B?
SAFETY asks, are the navigation or control systems able to the specified job in the specified manner?
SECURITY asks, how will access be controlled in the event of a system failure or compromise?
SAFETY asks, how will catastrophic failure be prevented in the event of a single system failure or compromise?
Hopefully, these questions will give you an idea of the kinds of questions a computer systems safety panel would be responsible for answering. Security is concerned with authority, which is NOT the question here. Safety is concerned with protecting the life and health of personnel and the physical integrity of assets.
That being said, Michael should go back and revise the headline to read "Computer SAFETY Criteria."
Give me my freedom, and I'll take care of my own security, thank you.
Wow, that's a pretty good strategy you guys got there: Surrender and become a client/dependency of a dictatorship. There's a lot of future in that! Let's not forget that "older and wiser" statesman Vidkun Quisling, either.
Back when China was allegedly laughing at your efforts, they weren't laughing very hard. Why not? Because they had been colonized, humiliated, brutalizeed, and robbed blind by European powers. How did that happen? I'll tell you: They had that precious attitude that Europe has now. But they learned their less. Try invading China now and see what you get. They're on the road to recovery, God bless 'em.
"Violence doesn't solve anything", you say? Violence "solved" Hitler pretty thoroughly, as I recall. It also solved the massacres in Serbia. Ask a few surviving Balkan Muslims whether they'd prefer to have been killed, or to have a few Serbs bombed into the stone age. I bet you they're pretty satisfied to be alive and to have Milosevic's evil bastards dead instead.
There are two solutions to a war: Winning, and losing. Losing is a shitty option, and winning requires violence. That's life. It's not "idealism". It's reality. You don't always get to choose not to be in a war. Kuwait didn't get to choose not to be in a war with Iraq. Czechoslovakia, Poland, and France didn't get to choose not to be in a war with Germany.
"Today's enemy is a friend tomorrow?" Let's focus real hard and remember the peace that France and England dictated at the end of WWI -- and the peace the USA dictated at the end of WWII. Your punitive madness led to another war. Our generous terms made permanent friends and allies out of our old enemies. Don't try to teach Grandpa to chew cheese, Junior.
"Christianity neither is, nor ever was a part of the common law." --
"Use lots of encryption ... Encrypt all communications (ESP networking) and make sure you have double and triple safeguards."
But use encryption carefully! Encryption systems don't just use algorithms, they use protocols, and many a system using secure algorithms has been taken down because the entire protocol was poorly thought out and implemented. In fact, overuse of encryption can actually make systems easier to break.
Again, KISS.
-Baka!
First of all, none of this applies to MacOS X, which has all the virtues and flaws (plus some on both sides) of BSD.
... the "classic" Mac environment was in many ways more secure, because it was considerably less flexible than *nix or even NT. No remote login, no useful scripting or programming environments: not much, in fact, of anything at all. It might decide to crash every fifteen minutes, but it was also secure in the sense that a door without a handle is secure.
But
There has been a lot of work on establishing standards for safety critical systems. search google or try http://www.afm.sbu.ac.uk/safety/ as a start
Everyone's saying "it should be designed like such and so" and "keep it out of the water" (duh) and so on. That's all well and good, but the question here is about measurement. You've got your theories, you've implemented them, now how do you decide whether they hold up?
The only way I can think of is to do some good old fashioned actuarial analysis. It's a lot of work and a lot of time, but basically answering this question involves (1) collecting gobs of data and (2) analysing it. As well intentioned, well-researched, and sensible as the rest of the front end design advice might be, it's basically a lot of handwaving. It's about where the rubber hits the road, not a theoretical discussion about what chemicals should be used to make tires.
--Lawrence Lessig for Congress!
I work on computer system for the Industrial sector. The systems I work on control petrochem plants and refinery. These applications are very critical because if the systems fail then a plant could blow up and no I'm not joking.
.dll that crash's the applications that is running the ships systems.
In most of our applications we currently use Windows NT. The reason for using NT is that it is a pretty stable platform, as far as Microsoft goes, and for security it is great.
The Networks for the systems are totally isolated. The only connection to the outside world might be a router that is really locked down that only allows certain 'safe' machines to get through. Most of the time these machines are used to back up the data or to pull data out for historical or corp use.
That being said I would defiantly look at redundant systems. Basically a system that keeps a copy of what is going on in the master machine so if it does crash the backup and take over. This can also be applied to the GPS. Have redundant GPS setups and have the antenna located in two different locations.
As for the Software, restrict the access to the machine to ONLY the people that need to use it. Setup NT to be a captured account and restrict that account so no one can do any installations unless they can login as an admin. That way you don't have Joe hand coming in and installing his new game to give it a play and in the process overwriting a critical
Also the standard antivirus software. It still amazes me how many people do not run antivirus software on there servers. All it takes is one person not paying attention to pop in a diskette and bam ur infected. This is defiantly not good for a critical system.
So in summary:
- Lock down the systems to allow ONLY those ppl access that need it
- Redundancy, Redundancy, and Redundancy
- Last, Antivirus software to catch those ones that might slip through.
M. Prindle
Software is different in three regards.
I think this will change drastically as soon as software makers start to have real liability for the products they sold (free software is a seperate issue), like other engineers do. Then it might just happen that you will not find anybody willing to do software where their feeling tells them the art is not advanced far enough. And software production will be slower and more careful. And even more important those that fail repeatedly will have to leave the business!
Most ACs are not even worth the keystrokes to insult them. Be generically insulted and ignored otherwise.
Wrong. Use Linux with Solaris as fallback or the other way round. These systems are compatible with each other and you can use one as a backup for the other.
Maybe use both with a hard-coded failover or a combined system where both OSes have to be successfully hacked in order to compromise the system. Depends on what kind of security you need.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted and ignored otherwise.
I never said that OpenBSD has no exploits. What I'm saying, is that they have the least amount of them. You can install it out of the box, and as long as you pick a decent root password, you can leave it plugged in, and stay safe for quite a while.
I am quite willing to spend the extra time to secure my linux system in order to get better driver support. Not everybody is able to do this though. These people should carefully consider whether to use OpenBSD or pay a Linux-expert to secure their installation. Or whether to use another Unix(-like) system. If you don't need the better drivers, OpenBDS should be a very good choice.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted and ignored otherwise.
Yes, you can. Your Windows box can randomly throw 'sploits at a box you don't know exists until it finds one the admin didn't patch or didn't know about. Often, you don't know your Windows box is doing this, because you don't know that it's been thoroughly zombied.
One-of-a-kinds generally don't help as much as you might think because what you gain in obscurity you lose in maturity (ie, some script kiddie stuff will still work becuase the author made the same mistakes that were found and removed from Apache years ago).
Got time? Spend some of it coding or testing
There are at least two huge flaws in this; firstly, a generic attack (or a manual followup to a generic probe) is more likely to work, and secondly the hack-attack numbers reflect a smaller population, not necessarily a smaller proportion of a population. It's a great comfort to know that you're unique as you sit there looking at your Mac server full of zeroes.
If I wanted to take advantage of the features advocated by the lecturer, I'd use something like Roxen on Linux on a MIPS box, chrooted and as far as possible readonly (chown/chmod then chattr +i then remove the chattr binary, and if possible also mount -o ro).
Got time? Spend some of it coding or testing
Mac has a really HIGH rating, but is poor in performance. OS-10 is better then OS-9 obviously.
Webstar is very very good as far as security goes (Under os-9)
But I'm told there are some plugins that can be exploited. Don't recall which ones.
Of course OpenBSD is also very good.
and you should know better there josh.....
IEC 61508: "Functional safety of electrical/electronic/programmable electronic safety-related systems".
This standard, which also applies to software (see 61508-3: Software requirements), defines some very stringent requirements for systems that have anything to do with safety, i.e. where a failure of the system could endanger life.
See the IEC's website for more...
As for the "missiion critical" nature of such a box; I ask all you experienced, mult-platform administrators out there would you rely on a mac that was actually being used for something (ie: not just sitting there, on) in a life or death situation?
--
"we live in a post-ideological world..." - Billy Bragg.
Yeesh... not sure what the mods are doing me modding me up. It wasn't meant to be a serious post, nor was it a serious gesture by my lecturer.
The point I was trying to make (and my lecturer too I imagine - I slept thru much of it) is that the incidence of problems is not purely a function of "security" but also a function of "attack likelyhood". Of course these are dynamic variables and aren't even completetly independent variables but they do illustrate a point.
If you are going to measure security, do you measure it by "measuring" empirical results to form your conclusion or do you go into the black art of measuring security by non-empircal means like how many holes you "think" there are.
That's the serious point that *I* wanted to make. And if my parent miraculously got an overrated moderation count, this deserves a (+1) insightful =P
The problem with the Rainbow series was that things that reached the A1 level were so secure that very little useful work could be done on them. A number of years ago I was involved in creating a secure computer room/system for a defense establishment. It has Tempest rated walls (Faraday cage, lead lined), no networking, mandatory access controls on all users and objects etc. At first there were a large number of systems running on it. Then someone decided that "we need to share data and it isn't REALLY that neccessary to have MAC" on one system. Then another... In about a year and a half, there were only a couple of systems using that room. Part of security is availability as well as security. The Rainbow series guaranteed confidentiality but availability lost out. Companies will go into security when there is more money to make being secure than being feature-laden. And that will only happen when somebody gets sued for $1/2 billion for letting private information be lost for lack of controls. Then there will be an Underwriters Lab for software, becuase the demand will be there to show that your system is secure. Another CISSP.
Given the cost and reliability of paper charts, it would seem highly imprudent not to take at least a set of the most crucial ones.
Of course, forintercontinental shipping charts aren't terribly useful for most of the trip, though.
Any sufficiently advanced technology is indistinguishable from a rigged demo
--Andy Finkel (J. Klass?)
That would be bad design. Systems controlling critical functions should be physically secured and certainly not anywhere near *any* kind of wider network access, least of all Outlook.
It boils down to criteria listed in several posts here already. There's no point in having the best, most secure OS if you leave it with a floppy drive, unattended root logins, Outlook, NFS exports. Since PCs are so cheap, why risk so much to save maybe $2,000 per PC?
Xix.
"Everything is adjustable, provided you have the right tools"
Have you tried British Standard BS7799? I think it has been turned into an ISO standard (or is underway). It defines how to turn your organisation into a secure/reliable environment - and more importantly how to prove that it is. It takes into account the fact that systems change, and that they are not reliable - and helps you work around/knock down the risks to a level you are comfortable with. It is used mainly for companies - but I don't see why it couldn't be used for any organisation (read: ship-board network/control system). In fact, get in touch with them on http://www.bsi-global.com and see if they would be interested in defining a sea-borne computing standard (they do that kind of thing with private firms as long as the standard becomes public domain...).
Alternatively, call a manufacturing network supplier. Think about the kind of reliability that Ford or GM requires on the assembly line - they don't allow any crashes! (har har har) There are (as usual) several competing standards which could be converted to nautical use.
Pimping my Karma Whore since 1847.
We are at the moment working on the ULTIMATE-LIFE-SAVER-SOFTWARE (TM). Now we're finalizing the alpha readiness tests, and are about to release the Beta-version.
The system works by estimating the users remaining life-expectancy-rate. And interfere when there's 3ms left, saving the users life.
This system is to be sold on a license-by-save basis, meaning that each time a save has been made; the user must buy another license at a new price. Different packages can be bought depending on the users need. The Nine-life package is expected to become particularly popular, and will be the "flag-ship" of our company. The price scheme will be customized to fit any profession or region of the world.
Software/hardware requirements:
- 500MHz P3 CPU
- 512 Mb RAM
- 40 Gb SCSI HD
- Windows 98
- RS232 port.
We will soon offer a half-price two-life license of the beta package, for users that are willing to report bugs, and help out with our beta-tests.
This is not an open-source-project and the company does not except liability for any direct or indirect damage caused by this software.
Enjoy!
hElDlik
You can't troll worth a shit these days.
You also most likely have no clue what an overflow bug is. An overflow bug gives you the ability to execute rogue exectuable code. With said code you can delete and corrupt files. Period.
Female Prison Rape in NY
Computers for main functions (propulsion, steering, cargo) in a ship have been in use since the mid seventies, and although lagging somewhat behind in the beginning when it came to Rule coverage, all major Shipping Classification Societies today have Rules which cover above use of computers onboard ships. This relates both to hardware and software. E.g.:For DNV (Det Norske Veritas) see Rules Pt.4 Ch.9 (Instrumentation and Automation) Sec.4. This is 2,5 pages of what experience have taught us are the most important aspect concerning computers onboard. However, everything else in Pt.4 Ch.9 concerns computers as well as other technology platforms, the Rules are written to be as technology independent as possible. The gradual increase due to expense Considerations in the use of PC's as workstations, , are something we haven't taken lightly. The hardware needs to prove itself by going through environmental/EMC testing (See Rules Pt.4. Ch.9 Sec.5 and Standards for Certification 2.4), and the software is tested by Approval Test of Application Software, where normal operation as well as reaction to most probable system failures are tested. Admittedly the first Windows versions were not secure, but today's versions are mostly acceptable, that is if you know which precautions to take. Of great concern is young eager software designers who haven`t learned their lessons and read necessary safety documentation before diving into the design phase. It seems DNV as a Classification Society have a similar problem. We would not object if you do some more homework and then revert with your findings! By the way, DNV does have a group working with software analysis as well, as far as I know they are mostly used in the consulting role, for manufacturers developing extremely safety critical systems. One last information: DNV consists of 5400 individual spread all around the world, all trying their best to fulfil our intentions of keeping our customers on the right track with regard to safety matters.
Design of ship control systems is a real time control problem. As such it is not an application for which 'Linux' is a solution, you have to be much more precise and specify exactly which real-time enhanced Linux you are considering. It would also kinda help to actually specify the problems to be addressed.
Also it may well matter quite a bit if the ship in question is a supertanker, aircraft carrier, bulk carrier, destroyer, liner, ferry, etc.
Bruce Schneier's Secrets and Lies : Digital Security in a Networked World. Many of your questions will be answered, and you will walk away from the reading with much better questions.
Guns don't kill people; Physics kills people! - John Lithgow as Dick Solomon on Third Rock From The Sun
Try 'loses'.
-josh
No, I did not know that. I thoght they still ran on BSD, that all efforts to port had failed and that they put a few win2k machines up front. Eh, what do I know?
Hotmil Hacked Go team!
Hotmail still using non-microshit software last summer Oh yeah, at leas one of the posters there notes that NT code has lots of BSD in it too. Fanboys like you know that, don't you?
the start of their effor, summer of 2000 Don't look like it happened does it?
Oh well, it's silly to talk to trolls. I like the graph of Hotmail's uptime. It looks like they figured out how to load balance hide their individual machine's poor performance last summer. Since their switch from BSD and solaris (which billgates still uses for his own site) their best uptime was 66 days or so, ptttthfit. You might have a look at Netcraft's good uptime page to see where your mighty 115 day spree really sits. Hint, multiply times ten to get real uptimes that free code provides!
Friends don't help friends install M$ junk.
Well, considering that MacOS X is running the exact same remotely accessible software packages that you would run on Linux, Solaris or whatever (OpenSSH, Apache) when used as a web server, you'd probably have the exact same bugs in both.
/etc/inetd.conf has everything commented out.
Modulo kernel bugs (which seldom allow remote root exploits, generally they make systems vulnerable to denial of service attacks) and differences in other remote services enabled in the system.
MacOS X is fairly secure by default, you even have to enable sshd and httpd (apache) explicitly. Like many other modern BSD systems, inetd is enabled but
In particular, go see the Benchmarks and
testing tools published by the Center for
Internet Security
http://www.cisecurity.org
They have benchmarks (essentialy Minimum Security
Baselines or Current Best Practice type documents)
for NT/2000, Solaris, Cisco IOS and others in
progress. Each Benchmark comes with a tool
for checking compliance.