The End of IT Security As We Know It

New threats call for new approaches IT and network managers face an ever-escalating battle to ensure communication systems and applications are useful and safe from intruders who would exploit the enterprise for underhanded fun and profit. Various technologies are supposed to stop interlopers, but these fixes aren’t perfect, and the threats keep coming. Consider the timeline pictured here. It illustrates the numerous Internet exploits that have arrived during the "communication" age. The image indicates that the speed of exploit-creation is rising, making IT security management harder every year. (Thanks to Dmitri Alperovitch, principal research scientist at email security company CipherTrust Inc., for the virus list.) At InfoSecurity Canada, a conference held in Toronto from June 19 to 21, security-focused technologists gathered to discuss this trend. Their words paint a disturbing picture of the state of IT security, but they also hint at a brighter future. High CostTech-based fraud can hurt the pocketbook. According to the Internet Crime Complaint Center, which tracks cyber crime in the US, online fraud losses hit US$182 million in 2005. According to the US Treasury Department, proceeds from Internet fraud yielded more money than illegal drug sales do. The numbers are debateable – how does one calculate such things? Still, on the face of it, Internet-based crime is a problem. Popular fixes have problems, too. For spam, email content filters are too easily flummoxed by odd spellings (filters might catch "Viagra" but not "V1agra"), and behaviour-based filters yield too many false positives. During his InfoSecurity presentation, Alperovitch predicted that personalized email viruses, spam and scams are on the way. Gleaning an individual’s personal details by searching the Internet and various "Web 2.0" applications such as blogs, someone could hijack an IM account and target the victim’s buddies. "It’s a lot harder for the user to realize they’ve been scammed," Alperovitch said. On the Web, people could use well-honed search-engine practices to gather information about site owners. Poor website programming sometimes exposes information that companies and individuals would prefer to keep quiet, such as database entries, even social insurance numbers and credit card numbers. This is known as "Google hacking," but don’t blame Google Inc. "Everyone talks as if Google is the only one at fault," noted Nish Bhalla, founder of application-protection firm Security Compass. "But you can use any search engine." New FixesTechnology providers are devising novel ways of dealing with these problems. CipherTrust, for instance, runs the TrustedSource Reputation System, which assigns good and bad reputations to individual IP addresses. Given traffic patterns collected across its entire user base, CipherTrust can detect if an IP address is a particularly bad spammer – for instance, if the address is often idle but prone to fits of massive mail-outs, chances are something’s up, Alperovitch explained. Businesses are automatically included in the TrustedSource system when they purchase IronMail, CipherTrust’s email security appliance. One unique, ill-fated anti-spam method was much discussed at the conference: Blue Security Inc. and its Blue Frog PC application. Call it the revenge model: Blue used customers’ computers to collect spam and, in turn, flood spammers with cease-and-desist messages. Upon unveiling the system in 2005, Blue’s representatives were quick to say it didn’t constitute a distributed denial-of-service attack on the spam industry, although Blue’s critics said the system was just that. Ironically, Blue itself was slammed by a spammer-led DDoS attack, and the firm shut down in May. Alperovitch noted the relative ease with which Blue’s nemeses, vexed by its attempt to pour something of a spammer’s own medicine down his superlative- and exclamation-mark-laden throat, destroyed the firm’s prospects. "All it took was about $10,000 to take down a company with $4 million in financing," Alperovitch said. But this frog isn’t cooked, not yet. An open-source software group, The Okopipi Project (www.okopipi.org), is building on Blue’s work and aims to develop a similar product. "The Okopipi Project is chartered to create an anti-spam opt-out tool which will operate in a completely P2P and open-sourced manner," reads the group’s hopeful website. That’s the email protection story. As for corporate website protection, an increasingly popular method is the aforementioned Google hacking, even though it’s as much a black-hat’s tool as it is a guard against such ne’er-do-wells. With Google hacking, network penetration testers apply sophisticated search-engine techniques to examine a website’s mettle. Bhalla from Security Compass described how penetration testers use search engines to hunt down a company’s Web server and check its version. Is it an older iteration? That’s a red flag. If the version’s out-of-date, bad guys could use documented attacks specific to that version to crack the server. And if the Web server can be cracked, who knows what other mischief one might take on? Fraudsters might search for the term "It worked" in association with Apache Web servers, and discover a box still in default mode – and if the server’s in default mode, the passwords might be in default mode too. If a hacker searches for "outlook.pst", she might come across information about an individual’s Outlook email folders, ripe for review. "It’s amazing how many have their .pst files on the ‘Net," Bhalla said. Router configuration details, confidential information, database information… Google hacking can help companies identify these holes in their websites and patch them, inasmuch as Google hacking might also give black-hat crackers a disturbingly rich amount of information with which to hector enterprises. Bhalla warned IT people to check with their employers before Google hacking their employers’ online properties. "Make sure you have permission first," he said, pointing out that companies could fire workers for unapproved penetration tests. Bhalla also said a good reference book for Google hacking is "Google Hacking for Penetration Testers," and a good reference for threat assessment – essential to IT security – is Microsoft Corp.’s guide, "Improving Web Application Security: Threats and Countermeasures." Both are available through online bookstores. Beyond the nuts and bolts of IT security lies an illimitable question: whose problems is this? Is it the business’s job alone to ensure website security, or should search engine providers scale back their products so only "public" information gets out? Some InfoSecurity Canada attendees seemed to think the responsibility belongs to website owners, while others wondered if the search engine providers could do more. Bhalla, equitably, said it’s everyone’s responsibility. What Is Success?Perhaps an even bigger question hinges on the definition of "success": how do we measure it? It’s been said the only way to ensure 100% network security is to turn the damned thing off, but that’s no option. Alperovitch said companies successfully secure their communication links when end users understand how important security is, and they employ the training they’ve received to do the right thing. "Combine technology with education, so when the user gets that spam message they don’t open it." Brian Bourne, president of IT integration firm CMS Consulting Inc., wondered if user-education is all it’s cracked up to be. He noted how virus evolution has yielded email attachments that pop open even if users don’t click on them. So much for that old saw: "Don’t open email attachments from people you don’t know."And who can say education covers all the bases? Bourne pointed to a June Dark Reading article ("Social Engineering, the USB Way") about penetration testing. In the story, author Steve Stasiukonis, founder of Secure Network Technologies Inc., explained how a credit union hired his company to perform network penetration testing. But the word got out among the financial institution’s workers, which meant Secure couldn’t use the usual tricks to glean information – talking to smokers outside by the ashtray, for instance. So Secure went insidious. The penetration testers loaded a bunch of portable USB storage drives with password-collecting Trojan applications, and scattered the drives around the credit union’s parking lot and smoking area. "Of the 20 USB drives we planted, 15 were found by employees, and all had been plugged into company computers," Stasiukonis wrote. "The data we obtained helped us to compromise additional systems." How many companies think to tell employees never to use USB sticks they find in parking lots? On the other hand, isn’t this common sense? But then, how often does common sense coincide with end-user behaviour? Too often they’re mutually exclusive. The upshot: education requirements are always changing, teaching techniques are mutable, and it’s hard for IT managers to keep up. So what’s the answer?A joke illustrates one approach: two hikers cross a bear’s path and they freeze. The bear eyes them and advances. One hiker pulls a pair of running shoes from his pack and laces them on. "What are you doing?" says the other. "You can’t outrun a bear." "I don’t have to outrun the bear," the first hiker says. "I just have to outrun you." Maybe businesses don’t have to outrun spammers and virus-senders – a futile race. Perhaps, instead, companies should aim to outrun their neighbours. "The answer may be to be stronger than the guy next door," Bourne said. Is that too cynical? Possibly. Businesses have to decide for themselves. And their conclusions had better come from a fair amount of soul searching – it helps to define IT security success before buying into protective measures like CipherTrust’s IronMail, the Okopipi project and Google hacking. By setting a goal, be it a certain number of spam messages filtered or passing a network penetration test, businesses might find themselves better prepared for the inevitable next threat. IT Fraud DictionaryPharming: Redirects Internet browsers away from legitimate financial websites, sending users to fake sites that mimic the real thing. Pharm sites collect usernames and passwords. Users should watch for spelling and grammatical errors – a sign that the site might be an impostor. Phishing: An email purporting to come from a legitimate financial institution says there’s a problem with the user’s account and requests that the user responds with his username, password and other credentials. As with pharming, users should watch for spelling and grammatical errors. They should also keep in mind that most financial institutions do not contact customers by email and ask for credentials. Vishing: Phishing with a voice twist. An email purporting to come from a legitimate financial institution says there’s a problem with the user’s account and requests that the user phones a provided number to sort things out. When the user calls, a voice mailbox requests that the user leaves his account information. Users should call the financial institution’s customer-service line and verify the situation instead.

The End of IT Security As We Know It

News | 09/01/2006 4:00 am EDT

To keep reading, get a free trial.

Already a Subscriber?

Reuse & Permissions

Inside The Wire Report

Information

Hill Times Publishing

Get in Touch With Us