psilva's prophecies

Tuesday, January 26, 2010

The State of My Blog Address

Readers, distinguished bloggers, various feeds - A year ago this week, I crossed over into double-digit blog entries (a whopping 10 stories at the time but a relative blog newcomer) and was wondering what magical rant would make this Blog Go to Eleven. Fidgeting with the keyboard and watching the blinking curser as nothing came to mind, I decided to dedicate January 30th as ‘Blog About Your Blog Day.’ The day that all bloggers would share stories, tips and other musings about their own blog. Since I don’t see it as a #trendingtopic on Twitter, it might not have stuck. Annual rituals often need a few years to take, so here’s the State of My Blog address in honor of my own made up writing holiday.

Last week, my good buddy Michael Sheehan of GoGrid (@HighTechDad on Twitter) wrote about the detailed process he goes through when creating a blog post. I gotta give him credit for both having a process and actually documenting it since I typically just see a topic/story, fire up Live Writer and tap away. Often stories come to mind while I’m walking the dog the evening before I post. I think it has to do with clearing my mind of all the day’s clutter and suddenly it’s like, ‘There it is!!.’ I’ll get home, quickly jot some notes or create a title, sleep on it and write it the next day. This was one of them. I typically try to post at least once a week and it’s usually around mid-week. This blog talks about how Thursday is the best day to post and this one backs it up with some statistical charts. I’ve read a couple that indicate that Monday’s are not great since everyone is getting back into the work routine, at least for business blogs. And speaking of Personal vs. Business blogs – Michael’s entry describes his method for personal blogs. I really don’t have a ‘personal’ blog since most, if not all, my entries are work related and published on F5’s DevCentral. I do feed WordPress, Ulitzer, Blogger, Posterous and others for greater coverage but our DevCentral community is my main audience. Even with a business blog, I do tend to incorporate personal stories since what I do as a career does mix with who I am as a person. I still remember years ago when I worked at the Milwaukee Repertory Theater an Art Director saying, ‘I am not my art!’ Always thought that was funny but interesting.

Even though this is a F5 branded blog, I do try to keep it focused on technology, trends, ideas and other industry topics instead of a ShamWow ad for BIG-IP. Most of our readers are familiar with BIG-IP (and learning about the new BIG-IP Edge Gateway announced this week) and I just like to compliment what they already know, offer some new ideas or bring attention to market/technology trends and how F5 solves some of these. Nothing too technical, security focused, a bit of humor, some personal insight and our daily lives – that’s the State of My Blog 2010. How about yours?

And here are a few other stories I considered writing about this week:

Until next time…
ps

Technorati Tags: Pete Silva,F5,security,application security,network security,blogging,blogs

Monday, January 18, 2010

Cybercrime, the Easy Way

The Dummies series is a great collection of ‘How to’ instructions on a wide array of topics and while they have not published a ‘Cybercrime for Dummies®’ booklet (and don’t think they will), DYI Cybercrime Kits are helping drive Internet attacks. Gone are the days when you had to visit a dark alley to get a crook’s cookbook. You don’t need to be an expert or tied to some sophisticated crime ring but now you can infect, spam, phish and generate other dastardly deeds with the best of them. Similar to downloading and using iTunes, P2P applications, IM services, Skype and others to accomplish those specific tasks, you can get a Cybercrime toolkit to go with your black ski mask, getaway car and evil lair hideout. You don’t really need any technical knowledge since all you do is install the program, tell it what you want, customize the message, send the infection and wait for the program to tell you when you’ve hit gold. The early ‘hacking’ sites like www.2600.com or www.L0pht.com use to allow you to download your favorite virus to send to friends. Granted, many organizations used their malicious code to test their own systems and they’ve since become more industry friendly and still provide great insight into the ‘black-hat’ing’ community. I’ve even used L0phtcrack several times over the years. Remember, downloading a root kit isn’t necessarily a crime, it’s what you do with it that might be.
The initial data breach numbers for 2010 are already staggering. In just a couple weeks, around 1,233,432 records have already been breached according to Privacy Rights Clearinghouse – that’s an average of over 68,000 a day. During 2009, Panda Labs saw a 77% increase in banking theft Trojans compared to 2008 which directly corresponded with the increase in available kits. As this trend continues, the ‘Kids with Kits’ will be competing with the ‘Established Mobs’ for your passwords, money, identity and any other valuable items/info to sell or use themselves.
Certainly, users need to be extra vigilant when receiving suspicious emails with ‘Click Here:’ boldly pronounced and organizations need to realize that their systems will be poked, prodded and tapped even more this year. On the web facing front, deploying a Web Application Firewall, like BIG-IP ASM, not only protects against the typical, well known attacks like SQL Injection, DoS, Brute Force and Web Scraping; but can also help with identifying that bad-boy with IP Geolocation and ASM has always helped to keep you compliant. BIG-IP GTM v10.1, with the new DNSSEC feature, secures your web property against DNS Cache Poisoning and other malicious redirects. The FirePass SSL VPN and other BIG-IP products offer End Point inspection to ensure that the requesting host abides by your security policy prior to gaining access and Encryption to keep the traffic secure. The BIG-IP MSM takes a bite out of unwanted spam. Even BIG-IP LTM with it’s virtualization capabilities among other security features provides some network firewall functionality and with BIG-IP PSM, you get powerful security services for HTTP(s), SMTP, and FTP at BIG-IP speeds.
Now that it’s gotten easier for anyone to become a cybercriminal, your defenses must be also be easy and quick to deploy. F5’s BIG-IP systems give you the control, power and ease of use to thwart both the organized crime syndicates and those rookies just getting into the game.

ps
Technorati Tags: Pete Silva,F5,security,application security,network security,virus

Wednesday, January 6, 2010

New Decade, Same Threats?

Do I call it Twenty-Ten or Two Thousand Ten? Just not Two Thousand and Ten since that pesky decimal takes us back 10 years. Eh, either way, the new year and decade brings out all the predictions for the coming year with this one taking the cybercriminal approach. The various 'Year in Reviews' also make appearances since we need to understand where we came from to know where we’re going. These are always interesting due to the various points of view even if many of the predictions are the same: social media threats, not necessarily more but smarter malware/botnets, using the cloud for crime, financial DDoS, rogue software, Mac and Mobile malware, more breaches and a whole host of others. Compliance and Health Care, while not threats, seem to be the areas of security focus in the coming year along with online banking.

From a government perspective, while much has been written about compromised drones and Warplanes, the real concern at the Pentagon is Electronic Espionage – breaching the network. Being able to not only see data, such as intelligence reports, but manipulate the data. Imagine if an ammo request was intercepted and changed to reflect a new delivery location. That would be bad. I’ve written about Corporate Espionage as part of the 26 Short Series and do think it’ll continue. Trade Secrets, product plans and customer data are all tasty treats to the cybercriminal. One of the reasons I think that this type of data is a target is due to regulatory compliance, but maybe not in the way you think. I look at it from a more ‘human nature’ position. The more locked up, secret, hidden or protected something is, creates a perception of greater value or worth. If you see a door with 5 locks on it verses one with just a single lock, you’d probably think that Door Number 1 has the good stuff since more protection was deployed. If you’ve ever walked through the Tower of London to see the Crown Jewels, you’ve also seen the huge, thick vault doors that keep them safe at night. With all that security, it must be extremely valuable.

In some ways I think compliance creates the same ‘perception’ and increases the attack potential. Companies are required by law to protect, store, encrypt and generally safeguard certain private/sensitive data – the crown jewels so to speak. Don’t get me wrong, I’m not advocating to ignore compliance and current regulations – such as PCI – are needed. I even think some could go a little further in prescribing security protections but it also tells cybercriminals – this is the good stuff. If you want a huge score, hit here. We might see an increase in Gas Station terminal thefts as we get closer to the July 2010 PCI deadline for unattended, Point-of-Sale PIN entry devices as thieves probably want to beat the deadline too. 2009 proved that while little scams and thefts will continue, it’s the big breach of regulated data that gets the biggest payout and the most news coverage. That’s what I see coming in 2010.

Related Resources

Tuesday, December 22, 2009

Post-Blog Report: 26 Short Topics about Security

Aloha and welcome to the post-blog report. Over the last 5 months, I’ve been writing a blog series called, 26 Short Topics about Security and wanted to share some observations. First, I went about this since there are so many IT challenges when it comes to security and it’s virtually impossible to cover them all. Plus, I’m always looking for interesting stats and stories pertaining to security and thought I’d gather them up in one place. It’s sort of a 2009 ‘Security Greatest Hits’ (or Misses, if you’re a Devo fan).

If you are a blogger and sometimes have difficulty producing a consistent stream of valuable conversations, a blog series will do the trick. You’re not alone since Perseus reports that 66.0% of surveyed blogs had not been updated in two months, "representing 2.72 million blogs that have been either permanently or temporarily abandoned.” I had a daily urge to continue my quest and keep the flow going rather than jumping on ‘whatever the topic/crisis of the day’ was and writing about that. Interestingly, the timing of many of the topics coincided with a recent event, so it worked out well. Specific keywords in the titles, like Firewall, Virtualization, Twitter or any other term that’s hot (frequently searched) drew the most readers even if the title was a little ‘out there.’ And like any writer, I was a little surprised by the entries that got the most attention. You know the routine, you think something is fantastic but nobody cares and the ones you feel are a little weak get massive reads. Go figure.

The other thing I tried during this series is to both include a ton of links (Don MacVittie called it a link-fest) to referring stories along with links to the previous stories in the series for easy perusal. When one got read, so did multiple others which positively influenced Pages per Visit and Average Time on Site – key metrics for any website. Finally, I’m thinking about recording the blogs to offer an audio version (à la Audio Whitepapers) of the series.

Now to put a bow on this – All 26 Short Topics about Security:

Bonus blog: Bit.ly, Twitter, Security & You

Wednesday, December 16, 2009

Catch some Zzzzzzzzzzzzz

It used to be the ‘stuck to our side’ pagers that go off at 3am telling you that a server crashed that would keep you up at night. You’d drag yourself out of bed (or the chair at the data center that you fell asleep in), tippy-toe to the computer in hopes of gaining remote access or wonder to the car, still in your PJs, to drive to the facility. In February 2009, InformationWeek & Dark Reading conducted a survey entitled, ‘What Keeps Infosec Pros Awake at Night.’ They asked more than 400 IT pros, among other things, what are their most serious threats, how are they prioritizing their defense of these and what are they going to do to keep their data safe in 2009 and beyond. At the time, 52% said they were concerned about Internal threats – either employees or partners, accidental or malicious. This makes sense since there were several articles in early 2009 which looked at Laid-off workers turning to Cybercrime. They also feared the loss/theft of a laptop/potable storage device which might contain sensitive information that can lead to a corporate security breach. Their biggest wish was for end users to be smarter about security and understand the risks. Automated technology allowing IT pros to focus on emerging threats rather than day-to-day firefighting came in 2nd. They just wanted to have the time to find ways to make their systems more secure, and compliance was driving it.

Recent data from Verizon’s addendum to its Data Breach Investigations Report actually shows that most (73%) data breaches come from External sources, not insiders. Granted, the InformationWeek data was garnered from a survey (point in time opinion) and the Verizon info was generated by analyzing disclosed/investigated public data breaches (over time) and it doesn’t include undisclosed incidents with internal investigations. Verizon concluded that breaches which warranted public disclosure were primarily done by external sources. I’m sure that many internal incidents that didn't affect a large swath of the public were never disclosed, which could slightly sway the results but interesting nonetheless. So the fear was Insider threats yet the actual data implicates outsiders. I started wondering if this one of those Perception vs. Reality things or as Stephen Covey puts it, “We see the world, not as it is, but as we are.”

In February 2009, when the economic crisis was in full swing, layoffs were a daily occurrence. There were many documented cases in the early 1990’s of crime/fraud that occurred during that recession and many believed it would happen again – but this time with technology's help. Stories started to appear indicating that this scenario might happen again and when the few that did happen were spotlighted (like the current trial of Terry Childs) - folks believed, or feared, that a new wave was coming. The data that came out other end, seems to show that those internal threats were less than expected, except maybe in the financial industry. The other side is that sometimes perception is more important than reality. With the perceived immanent danger of rogue ex-employees, IT departments had a wake up call to reexamine how they handle access termination, a critical piece of data preservation. In life and security, our view of the perceived risk is based on our past experiences/beliefs and that ultimately shapes our reality. My reality and your reality might be very different but we always have the power in how we respond to events, even ones out of your control. So as 2009 winds down and you get some needed rest (maybe), revel in the fact that this challenging year is almost over, you did the best (hopefully) you could and there will be a whole new set of threats, breaches, viruses, vulnerabilities, scams, malware and many other incidents that put security at risk as thieves typically work through the holidays. Plan as best you can and take the new ones in stride as a challenge to all of us to get even better at protecting all our critical assets – including the living, breathing ones.

And there you have it – 26 Short Topics about Security. Yea, we made it! But wait, there’s more. Stay tuned for the Post-blog Report where we look back at the series, pick some favorites and share what I’ve learned about putting together a chain of blogs over the course of 5 months covering a single topic. Should be fun.

ps

#26 out of 26 Short Topics about Security
Previous stories: 25, 24, 23, 22, 21, 20, 19, 18, 17, 16, 15, 14, 13.5, 13, 12, 11, 10, 9, 8, 7, 6, 5, 4, 3, 2, 1

Technorati Tags: Pete Silva,F5,security,application security,network security,virus,

Monday, December 14, 2009

It all comes down to YOU - The User

One of my favorite Security writers, Bruce Schneier, had an interesting entry last week called Reacting to Security Vulnerabilities where he discusses the recent reports about the security flaw in the SSL protocol and how we as users should relax and essentially, ‘do nothing.’ “What?!? – Do nothing??” Yup, and he has some good reasons why. Usually, new exploits, threats, breaches and the typical security stuff that garners the headlines, makes security folks jump. Jump to search the internet for anything related, jump to see if our systems are infected or vulnerable, jump to put an action plan in place to reduce the risk. These are reactionary behaviors when gloom gets delivered and we fully don’t understand the risk. I’m not saying ignore warnings or plan for the worst, but since several new ‘weaknesses’ seem to get published on a monthly basis, you do need to prioritize and put some context around it.

With anything in life, there are certain things we have control over and others we do not. For many years now, we’ve been warned that it is risky to click on embedded links in a suspicious email or dangerous to click through the certificate warnings from your browser and hopefully many people have changed their behavior. That’s within our control. But when a researcher finds a specific vulnerability in a particular protocol, potentially affecting several vendors, there is really not much an individual user can do. Sure, you or the IT department can check with their vendor to see if it applies to their product but would you immediately stop using something when it’s a critical part of your infrastructure. Once again, which is usually the case for security, you must weigh the risks and determine if it’s within your control. Bruce points out that many of the vulnerabilities affect systems that are out of our control and if your data is already out there, unplugging your computer will not lessen the potential exposure.

What you can do is simply stick to your general security practices (AV/FW, OS patch, Auto updates, backups, common sense), which already protect you from a slew vulnerabilities but let the experts/vendors figure out the best way to handle new exposure(s) since they must deal with them on a daily basis. If the risk is too great and your infrastructure is vulnerable, push your vendor for an answer. Most vendors, especially with security products, are fairly reasonable and typically move fast when it comes to security holes – their reputation and revenue are at risk. You can also report to CERT if you’re not getting a response but most vulnerability ‘finders’ alert the vendor fist and give them a chance to fix or respond to it.

Protecting yourself from the multitude of threats on the internet can be daunting, never ending, and always changing so you do need to be vigilant with the things you can control but as you peruse the Top 9 Beaches of 2009 or the Top 15 Most Common Attacks, you find there was/is little you could do to avoid them.
ps

#25 out of 26 Short Topics about Security
Previous stories: 24, 23, 22, 21, 20, 19, 18, 17, 16, 15, 14, 13.5, 13, 12, 11, 10, 9, 8, 7, 6, 5, 4, 3, 2, 1

*For the record, F5 is listed on the US-CERT site as being potentially vulnerable but we have tested our products/versions and are not vulnerable to this issue. F5 Networks has published a security advisory in the past to cover similar vulnerability and provide best practice recommendations. These best practice recommendations can be found at the F5 support site:
https://support.f5.com/kb/en-us/solutions/public/6000/900/sol6999.html
https://support.f5.com/kb/en-us/solutions/public/10000/700/sol10737.html

Tuesday, December 8, 2009

X marks the Games

Sony Playstation Celebrates Its 15th Anniversary, Happy 20th birthday, Game Boy, Happy 10th anniversary, Sega Dreamcast! and November Marks the Launch Anniversary of Many a Gaming Platform. Gaming has come a long way since the Atari 2600 and the Fairchild Channel F when we would screw those little U connectors to the UHF/VHF thingy. Then we got ColecoVision’s arcade quality games like Donkey Kong and the early Nintendo’s and Sega’s to today’s Sony PlayStation, Microsoft Xbox (there’s your 24th letter) and Nintendo Wii. These days, not only can you hook you console up to your TV monitor, you can connect to the internet and play games online, even without a console. While gaming threats & breaches don’t always make the splashy headlines like stolen credit cards and hacked financial applications, there is still plenty of things to worry about while you’re having fun. Whether you’re a player or provider, the risks are out there and many (both technical & social) are no different than the exploits, malware and thieves we typically hear about from general online communities.

Over the last couple years, a number online gaming sites experienced DDoS attacks that forced outages and tossed some sites offline and even Pirate Bay got hit with a DDoS attack when their users were not happy about the sale to Global Gaming Factory. Even back in 2004, there were articles that covered the Security Issues of Online Gaming and a few of those mentioned still hold today.

For users, the risks loom since they spend a lot of time and money on these games and there are always crooks out there looking to exploit that. There is also significant amount of social interaction with other players and many of the social media threats, like being tricked into exposing personal or financial information, are just a prevalent. And it’s not just hidden criminals. Full on media companies offering rewards, points or other game enhancements trick users into signing up for bogus offers and monthly subscriptions all while capturing their email address, credit card and other personal info. This is quick money for game developers (and social sites, advertisers and others) even if it is done in an unscrupulous way.

Malware infection whether it be worms, viruses or bots are also a risk. Most of us have learned that we should not click on an embedded email link for fear of computer infection. But do you use the same technique when searching for a new/hidden game file or conversing with another player over IM? They might have been part of your online ‘team’ for some time and you’ve exchanged tips. Then they promote some cool new ‘add-on’ and send you an IM saying, ‘download this hidden gem – earn points faster!!’ Would you use the same caution as a phishing email or click away? If the game required administrative rights for installation, would you grant it? Would you allow all JavaScript and ActiveX to run, knowing the inherent browser risks? Also, since you’re playing online, you have to be connected to a server somewhere. Is that server vulnerable? Has it been compromised? If it has, then you too can be vulnerable – it’s really no different than other server exploits. This applies to game operators also. How are you protecting your infrastructure from malicious behavior?

This document (pdf) from US-CERT has a nice overview of avoiding online gaming risks, was an inspiration for this blog post and offers several protective measures….which look a lot like the general security good practices we hear on a daily basis:

• Use antivirus and antispyware programs.
• Be cautious about opening files attached to email messages or instant messages.
• Verify the authenticity and security of downloaded files and new software.
• Configure your web browsers securely.
• Use a firewall.
• Identify and back up your personal or financial data.
• Create and use strong passwords.
• Patch and update your application software.

Not to dampen any of your fun this year as many of us rip open new gaming consoles, connect them to the internet and start firing away, just use the same caution, suspicion and protection when you enter that fun zone. Don’t let your guard down just because you’re having a great time – that holiday glee can morph into your winter of discontent with a single click.
ps

#24 out of 26 Short Topics about Security
previous stories: 23, 22, 21, 20, 19, 18, 17, 16, 15, 14, 13.5, 13, 12, 11, 10, 9, 8, 7, 6, 5, 4, 3, 2, 1

Related resources: