Slashdot Mirror
Using War Games To Make Organizations More Secure
wiredmikey writes "Along with budget constraints and disconnect between IT and executive management surrounding information security, results of a recent survey show that a major problem is outright lack of understanding of threats. We all know the best way to get that budget increased, is to get hacked. Unfortunately, that could also result in you losing your job. Some companies, however, are taking creative approaches to both raise awareness and identify potential vulnerabilities. A manager with a large financial services group, for example, says that his company addresses security vulnerabilities by staging a series of what it calls 'war games,' in which a user or group of users is tasked with trying to compromise a system, while another user or group of users is tasked with preventing the break-in. Management needs to understand the security threat and its impact to business, and these 'war games' are an innovative and creative way for IT departments to convince executive management on security needs."
Lets play Global Thermonuclear War
The only winning move...is not to play.
"When information is power, privacy is freedom" - Jah-Wren Ryel
longint WarGamesMovieReferenceCount;
It's a Unix system - I know this.
It's the old "with physical access" argument.. except scaled up. Someone within an organization would I imagine have a pretty good chance of compromising the system. Not saying it's acceptable.. but I would guess a reality.
It's the trade off thing. You need to give people access to stuff so they can do their job. The more locked down you make things, the slower they work. Slower work is more expensive.. etc.
So it has to scale. Your new "everything is riding on this" designs... yeah.. spend a fortune protecting it. But can people afford to spend a fortune protecting everything (serious question).
After the lab shakedown, throw the unit into a real environment, and see if it breaks. Obviously security needs to be similarly tested, else you'll never know if it really works.
Information wants to be expensive AND wants to be free. So you have Value vs. Cheap distribution fighting each other.
What happened to the reliable old standbye of kidnapping an executive and/or their family and threatening to return one finger every hour until the organization starts taking security more seriously? We've gone soft, I tell ya...
The main problem, as far as I can see, is that IT people are busy demanding users adopt procedures to deal with threats that don't exist, rather than threats that do exist. In all of the many scare-laden emails from our IT department, I don't believe that I have ever once seen one telling us don't use the same password on multiple systems, that's insecure. They do, however, rigorously enforce the fact that passwords must be changed every 60 days, and are specified to be complex enough that a brute-force attack will take 6E17 years, instead of the old insecure passwords that could be broken in a mere 3E9
http://www.geoffreylandis.com
One thing to be aware of with war games is a knowledge of what they are designed to achieve. Not all of them are there to spot weakenesses, a lot could be there merely to provide assurance or arse-covering. In those cases, "winning" by succeeding in breaking in could be the worst outcome - either personally for the winner, or the people who were supposed to stop them. Often blame and punishment is a much cheaper solution than a fix.
politicians are like babies' nappies: they should both be changed regularly and for the same reasons
The guy that said "you developers had better take things seriously or we'll get hacked" is the one that ends up taking the blame when the developers disobey and do incredibly fucking stupid things to make it easy to get hacked. About the worst I've seen is using the root password for the system as a password for an insecure database for a unauthorised hobby application and storing it as plain text with permissions so anybody could read it from the net if they just typed in the right URL. Of course the idiot had also opened up access as root via ssh despite even warnings about that being forbidden in the config file he had to change. It's only dumb luck and finding it quickly that dodged that bullet. A couple of other bullets were not dodged due to stupid things that were not quite as stupid.
next up... Target hires people to shoplift.
oh wait, that'd be a complete and utter waste of time and money.
I remember doing security studies like this, years & years ago. We called them "Tiger Teams". This is hardly a new technique.
The war-game model works fine when you have a group of employees with an invested interest in making their infra more secure. I can't see how this could work in any of the places I've ever worked for. Many of the co-workers I've had do not want to expend any more energy in their jobs than what is needed to get a paycheck. Many, many companies hire the cheapest labor they can find to click buttons on a windoze box and often they do not have the attention span, skill, interest or enthusiasm to make a 'war-game' anything less than a folly. Don't get me wrong, I think the idea is great I just don't see it working effectively for 90% of the IT industry.
boycott slashdot February 10th - 17th check out: altSlashdot.org
Once the penetration exercise has been executed, you'll need more outsiders to analyse the results and recommend which of your lazy staff (including the lazy management who caused the problem in the first place by employing the wrong people) should be kicked out the door - and how far.
Once some examples have been made, maybe *then* your staff will start to take an interest in security.
As Machiavelli pointed out hundreds of years ago: fear is a great motivator.
politicians are like babies' nappies: they should both be changed regularly and for the same reasons
First off, I love the idea of wargames. They're fun, I used to participate in them from time to time. But it flat out shouldn't be done for a business unless the environment is extremely well controlled: 1.) live systems critical to the business can BREAK with hacking attempts 2.) any shells spawned during the wargame can be exploited by other attackers that aren't participants... 3.) during the wargame IDS are basically useless which is the PERFECT time for an insider to make a move, or an informed attacker to start his campaign
Steve Jackson games originated this almost twenty years ago.
I can see the fnords!
To break into the would-be attackers apartments the night before and shoot them? Too pro-active?
Until politics gets in the way. I seem to remember Randal Schwartz getting involved in this way back in the 90s at Intel (and a variety of other people who were tasked with 'ensuring that the security was sufficient'.
When they probed, and used the techniques crackers would to obtain access, they were charged with Felony crimes. Despite that being in their effective remit.
Incidentally, Randal spent about a decade fighting Intel on this, until 2007 when the charges were quashed retrospectively (as they shouldn't have been brought in the first place).
This really is rediscovering what we all used to do in "the good old days", and tell the sysadmins about, making things more secure. Approach the sysadmin and gain the 'unofficial' approval, probe the systems, feed back and get beer and pizza for the effort..
That changed late '90s to get a lawsuit landing on you instead as the suits got scared. At that point, security got rather worse (strangely, company management seemed to think that lawsuit threats were a better investment than real security spending).
This is a GOOD thing!!!
"The mind works quicker than you think!"
Such as... acoustic *cough* couplers *cough*?
Though in stark contrast to any director (apparently all filming for a perceived tech-illiterate audience) at least ever since Colossus, no self-respecting sighted hacker would have needed, used or wanted a voice synthesizer.
Rumour (that spelling for a reason you'll see) has it that Commodore's sales took a hit in Europe that Christmas season as Wargames and/or rather its media reception got parents concerned of putting the tools (with 1541 drives, though not from the movie) for summoning Soviet-response armageddon under their kids' trees.
At any rate it wasn't until Gen'82 so much rather than Gen'62 that the geeks would really get the girls (and better yet, even geek girls worth any wait)... ;-)
Are you saying you didn't think Ally Sheedy was cute?
I beg to differ.
So basically they rediscovered what the Penetration Testers do regularly? Wow, way to go InfoSec group of that company... you just started doing what's being recommended and the approach taken by anyone who knows anything in INFO SEC.
The likes of Lightman, in their high-school years at least, only had a chance at the Jennifers of this world in the movies rather than in meatspace a/k/a IRL until 1995 approx. is all I'm saying. ;-)
On a more serious note, "beaten by the bully of the block" would have been his more likely fate back in the day, with Jen being with the team captain (through not much of a choice of or own), and most of their educators at least implicitly defending the notion that all of this was condoned as a "perfectly natural pecking order".
BTW must have been odd for Sheedy, herself and award-winning writer since age 12(!) IIRC, to be cast as someone needing Broderick's (hacking) help with her grades (and then ending up with the next nerd in Short Circuit soon thereafter)...
We periodically had "hack nights" when I worked as a sysadmin. We were fortunate enough to have times where I network wasn't being used. We'd start at 10:00 PM.
The rules were: no looking at the code until you find a bug.
Don't execute a brute-force attack or DoS attack unless you have a reason to and clear it with the other admins (since doing this right makes a horrible mess).
While the actual quantity of "hack nights" was limited--it opened our awareness to whole new possibilities of attacks.
Must've worked well, none of the systems we administered have ever been compromised--and we had plenty of outside attempts to do so.