Bruce Schneier on What He Knows Best

Over at CSO Magazine there's a wonderful interview with Bruce Schneier, where he talks about cryptography and security. He has several good points, such as the physical security industry versus the IT security camp, and how true security really boils down to people problems. There's some good commentary on post-9/11 airport security regulations as well.

Comments

Here's a link

[Sir Haxalot]

to his website.

Re:Here's a link

[Anonymous Coward]

If Slashdotters can use Google, then why is there an Ask Slashdot?

Re:Here's a link

[orthogonal]

Seriously, give it a break, man. We can use Google and Google Cache without your help. If you want karma, post something insightful - NOT A DAMN LINK.

Sir Haxalot's posts help me, becaue I have to type with a straw held in my teeth, you insensitive clod!

--yours sincerely,
Dr. Stephen Hawking

CSO Magazine

[cnb]

That sounded too much like SCO Magazine :)

Re:CSO Magazine

[Joel Carr]

In related news, SCO sues the CSO Magazine for trademark infringement due the undeniable similarity between the two names and the blatent attempt by the CSO magazine to unlawfully align itself with the SCO Group by using SCO patented methods to similitaneously pump up their stock and destroy their business at the same time.

In a seperate filing the SCO Group also sued the CSO Magazine for illegally copying SCO IP from the Linux kernel, which is the sole property of SCO. CEO of The SCO Group, Mr Darl McBride, reportedly stated that SCO's Technical Engineers had discovered 3 billion instances of IP theft of the word 'the' used in the CSO Magazine that were blatently copied letter by letter from SCO's Linux kernel. Furthermore, 699 instances of attempted obfuscation had allegedly been detected in which two of the letters of the word 'the' had been reversed in order to spell 'teh'.

Darl McBride continued by explaining that readers of the CSO Magazine could buy temporary protection from the wrath of the SCO Group by buying a license to possess and read the CSO Magazine for the low price of $3 billion X $699. Readers were urged to take advantage of SCOs generosity now, because in 6 days time, at 6 minutes past 6, readers would be required to pay the full prices of double the amount presently required.

At a recent SCO Forum, examples of the alleged copying were presented. When quized what relevance the presented examples of 'SCO 0wNz0r j00' and 'All your base are belong to SCO' had to the case, a SCO official stated that SCO owned the IP to both examples and all derivatives there of and that they hoped to slip these into the lawsuit without anyone noticing.

More news at 6.

---

Re:CSO Magazine

[bobv-pillars-net]

Furthermore, 699 instances of attempted obfuscation had allegedly been detected in which two of the letters of the word 'the' had been reversed in order to spell 'teh'.

In a countersuit, CSO magazine accuses SCO of violating the DMCA by breaking the encryption used to obfuscate the word 'the'.

Bruce

[Anonymous Coward]

Paranoia paranoia
Everybody's coming to get me
Just say you never met me
I'm going underground with the moles
Hear the voices in my head
I swear to god it sounds like they're snoring
But if you're bored then you're boring
The agony and the irony , they're killing me
I'm not sick but I'm not well
And I'm so hot cause i'm in hell
I'm not sick but I'm not well

Re:Bruce

[lanswitch]

Just because you are paranoid
don't mean they're not after you...

Kurt Cobain.

Physical Security vs. Computer Security

[Nerdgasm]

I often wonder why it has to be this way. Wouldn't it be just as logical to make the two place nice? Perhaps if the two fields worked more closely they could actually learn something off each other.

Re:Physical Security vs. Computer Security

[abramsh]

Making physical and IT play nice is hard, but it is getting better every day. There are now even products on the market (ahm.. plug) that can help in this area such as eTrust 20/20

Paranoia rules

[Alien54]

and then there is this article in the Straights Times about the latest thing in spyware on steroids.

I can see all of the glazed eyeballs out there as you tell folks that they need to learn about firewalls and computer security, etc. Some folks just don't want to be bothered.

Randon thought - with the decline of things like boot disk viruses, etc, best security most folks can understand is that they are safe so long as they are not on the internet.

Re:Paranoia rules

[Scrameustache]

I can see all of the glazed eyeballs out there as you tell folks that they need to learn about firewalls and computer security

Well off course, imagine their looks if you told them they had to learn about locks and physicall security!
All they want to do is buy the lock and not loose the key. That's the problem with computer security: You can't simply buy the lock and try not to forget your password, you need to learn security. Way too much effort for busy people who have other things on their minds.

Re:Paranoia rules

[krymsin01]

Latest thing? That sounds like NetBus to me. *shrug*

Face it, people have been breaking security measures since the first one was thought up, and someone is going to come up with a new security measure to try to fix the old one. LOOP.

The only people benifiting from any of it are the people breaking the security and the people who are paid to come up with the new measures. The rest of us are just left to be vulnerable. Always.

"People problems" are the LAST of your worries

[JeffTL]

Whereas I will be flamed into Hades for suggesting, just suggesting, that "Actually, technology usually IS the solution": Social engineering is the least of your worries. Cryptography, authentication et cetera create the need for social engineering: if you leave the computers without passwords and the serviceman's door unlocked, you can't worry about whatever-you're-protecting being unprotected from social engineering, bribery, and whatnot. Y'know why? What industrial spy (as an example) is going to bribe the guards when he can telnet?

Re:"People problems" are the LAST of your worries

[spitefulcrow]

Exactly. Much easier to get a throwaway shell accoutn somewhere to make your accesses less traceable than it is to bribe people to get to the physical equipment. Social engineering is less of a problem because it's harder to carry out without getting caught. Amen to what Schneier says about 'cyberterrorism' hype. I think that instead of trying to prevent these vaguely defined events, people should focus on the other problems with the Net - e.g. script kiddies who get a couple hundred annoying bots set up with IRC trojans. Just a bit of education or some public service announcements to get people to stop downloading e-mail attachments from people they don't know, etc., would probably reduce the number of vulnerable machines available for hackers to compromise. In short, fighting common cybercrime seems more worthwhile to me than preventing 'cyberterrorism.'

Re:"People problems" are the LAST of your worries

[Daniel_Staal]

Ah, but his point is quite often the computers have passwords, and the serviceman's door is still unlocked. Then someone walks in the door, and in reaction the security people demand blood tests instead of passwords, but still leave the door unlocked.

What industrial spy is going to bribe the guards when he can telnet? None. But quite often he can't telnet, but he doesn't need to bribe the guards; he can walk in anyway.

Re:"People problems" are the LAST of your worries

[michael_cain]

I am always entertained by my brother-in-law's tales of the physical security around the critical machines in the Army's command-and-control bunkers in Germany in the late 1980s. He was a civilian contractor doing installation and upgrades of the software written by his company. The computers themselves were physically isolated. The room was under armed guard. The guards never knew their watch schedule more than 24 hours in advance. A small number of people entering or leaving the room were selected at random by some device (the guards could not influence it) for complete strip search. If you were out of touch for 72 hours, your security clearance was canceled (on holidays, he had to check in at a US embassy at least that often).

As my brother-in-law said, "These people take their paranoia seriously!"

Re:"People problems" are the LAST of your worries

[Beryllium Sphere(tm)]

Mmm, you do have a point. What happens, though, if you follow your examples backwards through the chain of causation?

If you have computers without passwords, that's because people didn't put passwords on them. If the serviceman's door is unlocked, it's because the administration didn't make a rule that it should be locked, or because there was a rule but nobody cared about it, or because leaving the door unlocked was the only way to get some other job done.

In other words, people problems again.

Thing is, you're right that technology is the solution, but only if the problem is technological. To invert your example, what industrial spy is going to telnet when he can make cold calls posing as a headhunter and get information pre-filtered by helpful humans?

it should be

[Alien54]

it should be Straits Times - need morning coffee. of course

Just today .....

[losttoy]

we changed the admin password of a colleague's Win2k machine who'd forgotten his password. But we also reminded ourselves just how important is physical security.

Cringely's view on security -- log analysis is key

[GringoGoiano]

Cringely put out an article (Changing the Game: How to Save the World by Taking Back Control of Our Data) a week or so back emphasizing security through recording all activity in any given IT infrastructure. Cryptographic techniques may be great, but social engineering, cracked buffer overflows, and short-sighted or stupid actions can always leave some crucial data exposed.

Rather than throwing your hands up when you've found you've left data exposed, or you've discovered some insider has been poking around documents they shouldn't be looking at, you should be able to track down all access to all information at all layers of your infrastructure. You hopefully can uncover traces of specific incidents, find any other similar unnoticed events that are now part of history, and find the culprits.

So logging and log analysis are key to securing any site. You need to log:

• web servers
• DB access
• app server use
• custom applications
• machine login sessions
• network events
• key card access to buildings
• maybe even disk I/O info
• ... and many others ...

... and you need to do it in a way where you can correlate information from all these disparate sources to uncover patterns of abuse. Cringely mentions that Addamark (he calls them the next "Oracle") is the first company with a viable solution for storing and analyzing the massive logs involved. I've looked at their site, does anybody know anything about this product? Sounds very useful.

Audio Interview

[Rabid Penguin]

He also gave an interview on Minnesota Public Radio covering similar topics on September 29. Follow the link for a RealMedia archive.

Too late is too late

[repetty]

Yeah, logs are good. Prison sentences are good, too. But they are all after the fact.

For my own part, postmortems aren't nearly as important to me as preventative measures. But that's just me.

--Richard

An example

[jjohnson]

I make a weekly trip to put our tape backups into a safety deposit box at a nearby bank. For $35/year, we get bank-level security and convenient off-site storage.

For the two years I've been doing this, I've had a small, running battle with the president of the branch, who wants to enforce a rule that all use of safety deposit boxes must be done in the booths provided for privacy; presumably, he wants to avoid any appearance of, or liability for, the bank employee knowing what's in my safety deposit box. However, switching the tapes in the box can be done in 5 seconds right there, whereas taking a booth makes it a 2 minute affair. The tellers all know me, so they let me do it right there, except for the couple weeks after a stern policy memo has been issued.

The reason I don't sacrifice another 1 minute, 55 seconds, is because I don't care that the tellers know--they'd figure something out with my weekly trips anyway. But the real crux is that, putting the tape backups into a safety deposit box makes it one of the strongest links in the security chain. The server room door is always locked, the servers logged off, etc. The weakest link now is that a competitor would offer one of my employees $20,000 to sneak the tape backups out one night. In comparison, the cost of breaking into a safety deposit box, removing the tapes, and returning them after copying, all undetectably, would be in the hundreds of thousands of dollars, if it could be done at all. They can't bribe a teller because the bank has only one of two keys for my box--when I've forgotten my key, I'm SOL.

This is what Schneier means by system security. Insisting on me using a booth is like upgrading your encryption when users are writing their passwords on stickies attached to their monitors.

Re:An example

[asdfghjklqwertyuiop]

Insisting on me using a booth is like upgrading your encryption when users are writing their passwords on stickies attached to their monitors.

Isn't that the truth. Years ago a place I worked had a machine on the DMZ script-kiddied. One of my bosses then insisted that we set up a password policy on the win2k domain behind the firewall (which was unaffected by the incident, that's the whole point of a DMZ). The password policy required "strong" passwords - varying case, numbers, puntuation, minumum length... so now the vast majority of all users in the company keep their passwords on a sticky note on the monitor because they can't remember them.

Re:An example

[fm6]

Insisting on me using a booth is like upgrading your encryption when users are writing their passwords on stickies attached to their monitors.

Or like most banks' online transactions, which are encrypted by the maximum key length supported by non-export browsers, but makes no attempt to make its users use high-entropy passwords to access that encrypted data. My own bank just uses my ATM PIN, which only has 10,000 possible values!

Most security measures serve to make people feel more secure, not make them safer. As witness the Maginot Line and the NRA.

Though it does occur to me that a bank might have non-security reasons for insisting that safe-deposit boxes be accessed privately. Many boxes contain contraband, "dirty" money, and other stuff the bank works very hard at not knowing about. If they get in legal hot water, they can point at their see-no-evil policies as evidence of their non-complicity.

Without even reading the article ...

[BillsPetMonkey]

( ... hey I never do anyway!) can I guess that Bruce says something like:

"Technological solutions don't work for human problems. 9/11, Bush, P2P vs. RIAA are human problems. Cryptography can't help you here either, so look elsewhere. "

Just a hunch.

Re:Without even reading the article ...

[swordgeek]

yep, that's about right. That's what Bruce always says.

The thing is, he's right. And he's determined to get his point across, so he's going to keep saying it until people start listening.

Re:Post-9/11

[bj8rn]

It may be stupid [*], but it's bloody catchy. I don't know how to measure the 'goodness' of a term, but if catchy = good, then it's really hard to come up with something better.

[*] Come on, the day that really changed the world and you call it A NUMBER? All those other days have good names like Bloody Sunday, but a number... It sounds so empty, so devoid of emotions. Or maybe that's why it's used -- to show the world that America wasn't shaken, that the Star Spangled Banner is still waving (is that why the flag found in the ruins of WTC was shown in Salt Lake City?) and so on.

Re:Cringely's view on security -- log analysis is

[blibbleblobble]

"You need to log:... disk I/O"

Isn't that recursive?

I just want to put on file that I put on file that I put on file that I put on file that I put on file that I put on file that I saw somebody read a file on disk. Damn, now I need to report myself.

Forensic investigation matters more than you think

[GringoGoiano]

Mr. Schneier contrasts problems of physical security with IT security throughout his article and emphasizes that in both domains criminals and terrorists will, at times, hit their mark. (He also implies losses to crime are greater than losses to terror, and that society emphasizes the terror while neglecting sensible countermeasures to crime -- but that's beside the point I want to make here).

In the physical world criminals always leaves tracks. Fingerprints, footprints, bodily fluids, DNA, personal effects, the air they breathe, traces from tools of their trade, etc. Sometimes the criminal is smart and leaves so few of these clues, or they're so undetectable or indistinguishable from the background (e.g., the air they breathe) that they get away. But at least in the physical world forensic experts can resort to physical evidence to track down the perps and extract justice or revenge.

Mr. Schneier complains that the physical security types take ineffective measures to prevent damage in the physical world and could learn a thing or two about mitigating risk from the IT community. (Confiscating those nail clippers from grandma isn't going to prevent a hijacking!) But I think Mr. Schneier is short-sighted too, and the IT security people haven't learned yet that gathering evidence in the electronic world is key! You need to lay down the dust to track electronic footprints through the network. Your electronic gated community isn't going to keep out everyone, and logs are the dust in which cybercriminals leave their footprints! If you don't collect and analyze your logs, you're just left with 500,000 stolen credit card/social security numbers and the air they breathed.

Re:Cringely's view on security -- log analysis is

[Agent Green]

And the best quote on the article regarding those kinds of databases:

"Definitely. Terrorism is rare, while crime is common. Security systems that require massive databases in order to function--TIA, CAPPS 2--will make crime easier. They'll make identity theft easier. They'll make illegal government surveillance easier. They'll make it more likely that rogue employees of the governments and corporations that maintain the systems will use the data for their own purposes. In the United States, there isn't a government database that hasn't been misused by the very people entrusted with keeping its information safe. IRS employees have perused the tax records of celebrities and friends. State employees have sold driving records to private investigators. This kind of thing happens all the time."

Ummm

[Neon_Mango]

Ok so lots of valuable company data is moved from your facility to a bank by an employee on a weekly basis? I think the weakest link in the chain is you. I'm just saying what's to stop someone from taking the tapes from you in transit? Sure the bank has good security (cameras, security guards, a vault), and your company most likely has good security too but when your in transit couldn't someone stop you and take the tapes from you (by force if needed)? Just out of curiosity are there any backup software packages (like something made by Veritas or Computer Associates) that will not only compress data before backup but also encrypt it?

Re:Ummm

[tyen]

...but when your in transit couldn't someone stop you and take the tapes from you (by force if needed)?

My associates Mr. Smith and Mr. Wesson will be pleased to make the acquaintance of that someone. Actually, I conceal carry a .45 ACP manufactured by a company called Kimber, but few Slashdotter's would recognize that name. I'm one of the principals of the company, so carrying concealed at the office is condoned.

Re:Ummm

[jjohnson]

I'm the one who makes the switch every week, unless I'm unavailabe, in which case it's the sysadmin.

You're sort of right, but not really due to the particular circumstances. The bank is a ten minute drive through a semi-rural/industrial setting, down major roads with lots of cops who don't have much to do. A carjacking is unlikely in the extreme.

Also, there's just the fact that, since we're a manufacturer of commodity housewares, where industrial espionage itself isn't terribly useful, the risk of an attempt is pretty low. If the tapes I was carrying were for Dow Chemical, it would seem more likely.

I'm not aware of any encrypting backup packages.

Re:Ummm

[2short]

So, someone wanting your data badly enough to take it by force can still take it. But you've ensured that they have to kill you in the bargain. Good thinking.

Re:Ummm

[tyen]

If your data is that sensitive that you can conceive of someone killing to get at it, you hire pros to transport it. There are professional courier services that work with this kind of risk, though they are expensive. Otherwise, life is full of risk, deal with it and move on or continue to cower and whimper on your knees.

Re:Ummm

[tyen]

Carrying concealed is allowed in select states in the United States, provided an individual goes through a licensing process that is renewed every few years. Very irritating that we have to ask the Leviathan Government permission to defend ourselves, but a minor nit compared with some of the grosser violations of our freedoms that are more important to roll back.

Re:Ummm

[2short]

I quite agree. The point I was trying to make was this:
Without disputing your right to have a loaded firearm about your person, I don't think it's a very smart way to mitigate the risk of someone stealing your data; or a very smart way to mitigate almost any risk for that matter. Unless you're in law enforcement or the army, the risk from being armed (accident, escalation of otherwise non-fatal assault, etc.) far outweighs the very small chance that being armed will actually be helpful.
I understand that life is full of risks, and I don't cower in fear. I go where I want and do what I want. But I don't increase my risk in order to feel a false sense of security or machismo by carrying a firearm. I've never been in a situation where, in hindsight, I've wished I had a gun. Nor do I expect to ever be in such a situation. I have been in a couple situations where, in hindsight, I'm quite thankful I didn't have a gun.

CSO has a magazine?

[HiggsBison]

And why would the Chicago Symphony Orchestra be interested in Bruce Schneier's views on security and such? A better way to keep a Stradavarius safe?

(No, I didn't RTFA. Why do you ask?)

Re:Post-9/11

[kiltedtaco]

The point is that he's refering to something that's changed since that date which I won't mention since it offends you. It doesn't matter how much time has passed since then, it changed alot of security procedures. Since he's refering to those specific changes, post-9/11 is the best term.

Re:Post-9/11

[bj8rn]

I think you're right, but still you're forgetting something. What was also blown up was the WTC twin towers. You hardly hear about those other buildings that were destroyed, or even the Pentagon (have they rebuilt the part that was damaged?), what everybody talks about is these two towers. Should new buildings be built in their place, or should 'ground zero' (hell, that sounds much worse than 9/11) be turned into a memorial (of what?)?

These buildings had a great value, if not economical (was there really that big a need for office space when they were built? Right now, there certaintly isn't much need for offices, so why build new towers?) then symbolical -- why else bother attacking them? Many have called the WTC towers the symbols of capitalism, or of America(n). The history of the world may not be split into before and after it, but the history of USA is, at least for some time.

Re:stupidsecurity.com has been slashdotted!

[hugesmile]

I wouldn't assume that a misbehaving system is due to slashdotting. My buddy's hard drive HAPPENED to crash on 1/1/2000 (hey, someone's had to). He blamed it on Y2K. Maybe it was slashdotted too. Sorry, non-Americans, when I referred to 1/1, to y'all, that would be reversed... 1/1, that is.

FleshNet

[TooTechy]

It just popped into my head. It has to be...

FLESHNET

But, Slashdot always says...

[t0ny]

People are the biggest problem? Everyone on Slashdot always says its Microsoft...

Does this mean they arent really the experts they pretend to be? Im confused.

Re:Post-9/11

[MCZapf]

I think people started referring to the attacks using "9/11" because they were not limited to one place, unlike, say, Pearl Harbor [Day]. It was too hard to refer to the events themselves, so they refer to the day.

CSO?

[IGnatius T Foobar]

CSO?

Aren't they the people who are trying to stamp out Lniux with a bunch of frivolous lwasuits?

Dyslexic lawyers of the world, untie!

Re:Post-9/11

[2short]

You're actually saying there's no great economic value to office space in lower Manhattan? No one could be that misinformed; I conclude you are entirely uninformed. That is probably the most valuable real estate on the planet.

While we're at it, "economical" isn't the word you want, and "symbolical" is not a word at all. Try "economic" and "symbolic".

"... the Pentagon (have they rebuilt the part that was damaged?),"

Yes.

"Should new buildings be built in their place..."

"Should" is subjective. "Will" is a a certainty. I say again: most valuable real estate on the planet.

Okay.. but you are getting off topic.

[mindstrm]

You started by saying that your secuurity is pretty good, and giving us a breakdown.. now you claim you aren't the weak link, because who would want the tapes?

That doesn't change the fact that you are the weak link.

Also, the bank manager has a very good, and valid, point. Wheras you see convenience, he sees the possibility of a complaint down the road, and heck, bank protocol wasn't followed; the employees had information they should not have, which makes them more suspect.

Re:Okay.. but you are getting off topic.

[jjohnson]

I think that the weakest link is one of the employees in the I.S. department (myself included) being bribed to sneak the tapes out. What I was disagreeing with was your characterization of my transporting the tapes as being the weak link. While I can see a competitor laying out for a bribe, I can't see one organizing a carjacking, which would be much more expensive, more risky, and less useful, since we'd know the tapes were gone. What I was disagreeing with was the attack vector you proposed.

My point about the tapes being less than valuable to our competitors is part of my assessment of our security risks. If we were developing weapons systems for the military, it would be plausible for one of our competitors to kidnap me en route. As a manufacturer of commodity housewares, though, I think that the tapes have a limited value that serves to discount certain scenarios. Bribery to make a secret copy of the tapes is plausible. Killing me (or risking it) to get the tapes isn't.

PIn is safe.

[mindstrm]

You are mixing up two things here. Yes, a PIN is easy to brute-force, if the system will allow you to do it. Most will not; after a few wrong attempts, your account is locked. What are the odds of guessing the right 4 digit pin if you only get five attempts?

You don't need a high entropy password if it's not possible to brute-force against the system.

Many banks insist that they KNOW what is in a safe deposit box, so you don't put, say, things that could explode, or start a fire, in them. That's not to say they know the exact contents, but they often supervise. I think maybe you watch too much TV if you think banks have safe deposit boxes full of "dirty" money. (though no doubt there is some out there)