Slashdot Mirror
Industry IT Security Certification Proposed
Roberto123 writes "The US can build defenses against 'cyberwar' by having government and the private sector work together to confront the threat, a panel of experts said at RSA Conference 2011 in San Francisco this week. 'Chertoff called for a regulatory framework where company executives and board members sign on the dotted line, certifying what steps they have taken to secure their network, what backup systems they have in place and what level of resiliency is built into their IT system. “People take that seriously. Is it dramatic? No, but it moves the ball down the field,” Chertoff said. Schneier concurred, noting that holding individuals at a company accountable for certain protections has worked with environmental regulations and Sarbanes-Oxley, the post-Enron law that requires directors and executives to certify their financial results.'"
This will change nothing, and push us further towards a "Standards and Compliance" posture, and not a real security posture.
-Someone who does this for a living
First post AND dubs? I must be a god!
As a nation, we are fighting either politically or violently on too many fronts here. We have too many wars going on. To name a few:
Now there's "cyberwar". There should be no new wars until we declare victory or admit defeat on some of the existing ones. Actually when I consider how successful the ones in the (incomplete) list above have been, I think we can save a great deal of time just admitting defeat on all of them. Then, instead of a retaliatory "cyberwar" we can do something rational like secure our systems.
Is that really so much to ask? It'd be easier than what we are doing now.
It is a miracle that curiosity survives formal education. - Einstein
I wonder what company he has stock in that would profit from the increased BS.
Makes sense for the protection of the public. Unfortunately, since systems are largely intangible it wouldn't take much to bamboozle inspectors the way Enron convinced visitors that they had a roomful of busy pros trading energy futures.
"moves the ball down the field"...what exactly and specifically does that mean? there are so many more...but, the "value of the company" being the upper limit of cyber-security (indeed, all security combined) expenditures is spot on, even if the breech involved threatens much more than the total value. i look forward to the day that a USA company declares Chapter 7 due to a security breech which threatens to exceed the value of the company.
Ok. If you're proposing something that will be as good as Sarbanes-Oxley... you probably need to find a better idea. Sarbox was a knee jerk response to Enron and has done nothing but drive up costs.
Good thing that those tight accountability rules prevented the massive credit / derivatives bubble.
All "certifications" are scams at some level. Some worse than others, but at some point it's about wanting to get your money while doing very little. It will create a nice new market for testing centers, book writers and publishers, and study material makers, but will ultimately do very little. Think how much Microsoft Certified Engineer....
Hey, I bet HB Gary will want to get a piece of this action!
This might work, if there are actually standards with teeth in them, such as (evolving) PCI standards (PA DSS, PCI DSS) and compliance.
The risk is that they provide a "get out of jail free" card, where complying with a set of minimal standards absolves an organization of liability and/or blame.
Sure. Ask all those shareholders left holding the bag of excrement at Lehman Brothers, Countrywide Financial, GMAC, Wachovia, CitiBank, ... even though the SarbOx forms were filled out and signed by the respective CEO (not one of which has been "held accountable").
Obi-Wan: "I felt a great disturbance in the Force, as if millions of voices suddenly cried out in terror and were sudden
I fully support this - as long as we can hold policy makers to the exact same standards of punishment when things go wrong (like recessions, budget shortfalls, and other issues).
_ _ _ Go for the eyes Boo! GO FOR THE EYES!
And not for the best...
From: http://www.cjr.org/the_audit/audit_notes_hb_gary_federal_ba.php
For one thing, it turns out that the firms involved here are large, legitimate and serious, and do substantial amounts of work for both the U.S. Government and the nation’s largest private corporations (as but one example, see this email from a Stanford computer science student about Palantir).
and:
And perhaps most disturbing of all, Hunton & Williams was recommended to Bank of America’s General Counsel by the Justice Department — meaning the U.S. Government is aiding Bank of America in its defense against/attacks on WikiLeaks.
I completely agree with the vast majority of certs being worthless. Experience, experience, experience is what it's all about.
In Canada, for example, you cannot call yourself an engineer unless you actually obtain the Professional Engineers' license in your actual field. I agree with this level of "experience + professional testing/certification". This is one example of when professional licensure is actually welcome and sets one apart.
I've been in IT for almost 15 years and I cannot tell you the number of so-called "certified" professionals that are only knowledgeable on paper. Most MCSEs and any other certified person cannot operate in the wild as well as expected.
Until IT has professional licensure, it's all worthless. I believe the respective IT subfields should have pro licensure exams on the level of difficulty of,say, the CCIE. If you know it, prove it. Otherwise...
Can we have a similar certification for privacy protection ,please?
Then we can finally have insight into what big companies like Google and Facebook are doing to our data, by letting them comply to OUR rules, instead of the other way around.
If Pandora's box is destined to be opened, *I* want to be the one to open it.
... I will be busy building a new wooden fence around my property to keep out flies. I think that I will be about as successful ...
I love stacking my barbecues in the shed at the end of summer - you can't beat a bit of grill on grill action.
I strongly believe that it's possible to reduce the treat of "cyber war" by actually fixing the security problem at it's source, our computers and servers. Imagine if it were possible to greatly reduce the number of security holes on the average pc or server. If this were the case, we wouldn't need to have politically motivated filtering and other types of control to "save us" from our own systems.
The internet is just a big network, and while BGP seems to have it's issues, with some work they can be solved. The network itself is just a "series of tubes", as it's been described in the past, and you don't have to guard the tubes if the ends are secured.
There is a deep design flaw in the operating systems and applications we use on a regular basis. Historically it's been possible to tightly control the code we run, so it was reasonable to trust the code to do its job. This assumption no longer is valid.
We can no longer afford the luxury of trusting our applications.
We can't even afford to trust our drivers with kernel mode.
We can't afford to trust the system processes to stick to their designated roles.
We have to trust some code, why not trust as little of it as possible? Micro-kernels present the smallest amount of code required to manage the operating system. There has been much research in this area, and recently there have been "proven" micro-kernels which theoretically have no flaws in their implementation of their specifications.
Now, the kernel needs device drivers and other system processes to make a usable operating environment for the user and programs. A kernel which doesn't trust its drivers must use a new strategy. One way forward is to use the concept of capabilities. A "capability" is a token / key (really, just a big number) which allows access to a resource. Each device driver, system process, etc... is given the appropriate set of keys to the resources that are required to do the job. If the key isn't present, the access is not allowed.
Thus a disk driver wouldn't get access to the internet. A clock driver wouldn't need to either. The system time demon would get access to a log file, a specific set of internet ports and addresses, and the clock. Any bug or vulnerability in one of these drivers would only affect it, and the capabilities it happened to have at the time.
Applications would have to be re-designed as well, for example, if you want to open a file in OpenOffice, the program opens a system dialog box to get the name and path to a file, it then opens the files as required. The new version would instead call a slightly different dialog box, which would them return the file handle (a capability) to only that file. The save dialog would also be modified in a similar fashion. If there are libraries required, etc... they can be included in the applications home folder. A capabilities based version of OpenOffice would thus work the same way, but be far more secure.
With this approach, we end up with secure systems that are still usable.
I think I've shown fairly well that we must re-design things from the ground, a decidedly non-trivial task, but it is the only way to avoid having government overlords telling us what code we can and can't use. If we wish to own our own systems as free men, we need to get our act together and fix things now, before it's too late and we loose the freedom to write our own code.
The path we are on ends with computers we merely have license to use, secured by the government, censored by the government, rented from big corporations, running applications we rent or buy from app stores. This is a future we need to avoid.
Thank you for your time, attention, and comments.
I agree. What a horrible proposal this is. Really, the slow, creaky federal government thinks that it can possibly regulate something as dynamic as computer/network security. It's completely laughable. You know what happens when the government and "private" industry get together to regulate, don't you? You get fat-cat, lobbyist heavy companies paying off corrupt politicians to pass rules that benefit them at the expense of everyone else. Beyond this, every company with a computer network will be at the mercy of class action lawyers should they run afoul of the regulations. Humph.
The tech guys and not some PHB should be singing this as the PHB can say our systems are fine and have no idea about what state they are in at the time.
The requirement for this certificate will be a series of classes or a test, which in itself requires a 'nominal fee' to take. More bureaucratic nonsense serving no purpose other than fill the pockets of people who have no clue about what they're actually selling.
That's the only word possibly describing such a "certificate". Worthless.
We're talking about an industry that reinvents itself every 3 months. I am neither kidding nor exaggerating. The average turnover of your knowledge is 3 months. 6 months tops. After a year, everything you knew is worthless because the threats are something completely different. There are of course timeless "best practice" rules (never give out passwords, verify your communication partner...), but a step by step guide to the tune of "do this and be secure" is a myth. You'll be secure NOW. It's by no means a given 3 months from now when new exploits emerge, new attack vectors become known and of course you can toss it out the window with the next generation of you hard- or software.
Now, I don't know whether you ever tried to get some "standard" approved. It takes 3 months 'til you find the guy that tells you it will take a year. So even if you manage to do it on time (which would be a first), you'd be a year behind.
Or, in IT security times, an eon.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
You ARE aware that this will lead to a hotseat game, right? Here's how it works:
PHB: "Sign here!" ... but ... we're not secure!"
Techie: "But
PHB: "Sign here or you're fired!"
Techie: (gulp) Ok... let's hope...
When something happens, Techie gets fired and replaced. Nothing else changes. Start script at line one.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
So the very first, and most important certification is: Everything's open source... right? right?
No?
How long do you think it will take for them to make one of the certs "Microsoft Genuine Advantage Certified"? A month?
The reason for IT is the aggregation of information. The problem is the aggregation of Information. It's like putting all your eggs in one basket. We need a fundamentally new way of aggregating the information and a new way of accessing it. But it will never be perfect as long as we aggregate the information.
Certifying that you, the CEO know what the hell the nerds did to the system to make it safe and that you agree it is reasonable and sufficient. This won't do a damn thing to help the situation. What would help would be if after ANY security breach of any size, the company be forced to send a press release outlining all details of the breach including the technical details of what the hacker did and failings of their own system or policies. Post the same details to all known social networking sites as well as on their own home page. Post formal apologies to the American people on YouTube. Then the top three levels of executives, the board of directors and the top 5 shareholders would be required to stand in front of the company headquarters and cry out the details of their failure for 12 hours regardless of the weather. That would then drive the necessary "giving of a damn" at all levels necessary to actually empower the IT group to get the job done and secure our economy from enemies foreign and domestic.
Okay, show of hands. Who else stopped reading the summary when the hit the word "cyberwar"?
(Okay, I'll admit I scanned the rest of it, but saw "Chertoff" and really stopped reading.)
OMFG . . . when cluelessness attacks. How can anyone say that the post-Enron regulatory framework was anything except a clusterfuck? Show me the goddamned accountability in terms of real jail time.
I scream. You scream. I assume that means we're both acquainted with the problem. We proceed.
Step 1: don't let your users write/modify your program (e.g. buffer overflows, SQL injection, XSS attacks, URL manipulation, etc,etc,etc)
That will cover about 90% of it right there
How about the government (and it's little FCC dog too) getting away from our networks and infrastructure, and leave people the fuck alone so we can try to survive this monetary terrorism, without all this fucking disruption and uncertainty of the future.
Fucking government better go after the banksters before the people rise up and go after this fucked up government since there's no jobs left except murder and war!
No patents will be enforceable when it comes to implementing Microsoft's proposed "collective cyberdefence".
echo '[q]sa[ln0=aln80~Psnlbx]16isb572CCB9AE9DB03273snlbxq' |dc
Because of this, what's required is not a standard for security controls, but a standard for security management. One has existed for some years, is widely used in Europe. It's called ISO 27001. Much ignored in the USA when it started life as a British Standard (BS7799).
They start mandating that any computer that can read or write to a arbitrary area of ram or storage is a security tool, only to be sold to certified professionals. The rest will be sold something even more strictly controlled then the iOS devices, and if found jailbroken will be prosecuted as if trafficking in military grade hardware.
The corporations will be happy, the big brother government will be happy, the rest "fuck em".
comment first, facts later. http://chem.tufts.edu/AnswersInScience/RelativityofWrong.htm
The problem is that these are all just symptoms. The real problem is a society which does not value wisdom. And as a society, we're not wise enough to recognise the problem, much less invest in resolving it.
Much in the same way a PMP certification ensures you get great project management, an IT security certification will ensure we have excellent security professionals out there.
You were mistaken. Which is odd, since memory shouldn't be a problem for you
for security practitioners and there will be fewer security practitioners.
While I am not fond of, or supportive of, Government certification processes, I am sure than anyone working for a non-IT company as a sysadmin knows how seriously (NOT) most of the PHBs take the issue of making sure the company networks are secure. And not just from external Terrorists. I work for a scientific research firm that is run by a bunch of PhDs (the worst kind of PHBs) who have all the answers. Getting them to understand, and act on / pay for, the things necessary to secure our company network from script kiddies, or any bozo on the net who has a hanker to hack, is a task that even Hercules would think twice about taking on. Yes, the Government will do this all wrong and it will end up costing a mint, but that is not to say that there aren't unresolved problems under this particular rock.
Ah, but it isn't supposed to be the techie signing the paper.
What do you suppose said disgruntled techie does after being fired? Keeps his mouth shut?
Is this the same dude who got rich by forced irradiation of flying public by TSA (which he recently lead?)
I smell another ISO paper chase brewing. A standard will be created and then there will be a surge of meetings, documents prepared, more meeting, certification classes, more meetings, etc. They will follow the standard on paper without knowing what it means in actual implementation.
If my previous experience with ISO holds true.
putting the 'B' in LGBTQ+
...they can certainly fool Homeland Security. I imagine that "certification authorities" in the Cayman Islands capable of ginning up the requisite answers and documentation began organizing even as the breath left Chertoff's mouth as he made that statement
There is absolutely no evidence to support the hypothesis that Corporate America will not try to find a way to evade or defraud any regulatory requirement or "business standard" that costs them so much as a zinc penny.
Orwell: "In a Time of Universal Deceit, telling the Truth is a Revolutionary Act"