Post Tagged with: "critical infrastructure"

Heartbleed: Technology Monoculture’s Second Act

April 22, 2014 12:150 comments
Dr. Geer argues that Heartbleed suggests ways that Internet security is being undermined by de-facto technology monocultures.

Say ‘technology monoculture’ and most people (who don’t look at you cross-eyed or say ‘God bless you!’) will say “Microsoft” or “Windows” or “Microsoft Windows.” That makes sense. Windows still runs on more than 90% of all desktop systems, long after Redmond’s star is rumored to have dimmed next to that of Apple. Microsoft is the poster child for the dangers and benefits of a monoculture. Hardware makers and application developers have a single platform to write to – consumers have confidence that the software and hardware they buy will “just work” so long as they’re running some version of Windows. The downside, of course, is that the Windows monoculture has also been a boon to bad guys, who can tailor exploits to one operating system or associated application (Office, Internet Explorer) and be confident that 9 of 10 systems their malicious software encounters will at least be running some version of the […]

Read more ›

History Suggests Heartbleed Will Continue To Beat

April 16, 2014 11:120 comments
Heartbleed probably won't ever go away, and is likely to become an endemic problem on the Internet, experts agree.

The SANS Internet Storm Center dialed down the panic on Monday, resetting the Infocon to “Green” and citing the increased awareness of the critical OpenSSL vulnerability known as Heartbleed as the reason.   Still, the drumbeat of news about a serious vulnerability in the OpenSSL encryption software continued this week. Among the large-font headlines: tens of  millions of Android mobile devices running version 4.1 of that mobile operating system (or “Jelly Bean”) use a vulnerable version of the OpenSSL software. Also: more infrastructure and web application players announced patches to address the Heartbleed vulnerability. They include virtualization software vendor VMWare, as well as cloud-based file sharing service Box. If history is any guide: at some point in the next week or two, the drumbeat will soften and, eventually, go silent or nearly so. But that hardly means the Heartbleed problem has gone away. In fact, if Heartbleed follows the same […]

Read more ›

IDS And The IoT: Snort Creator Marty Roesch On Securing The Internet of Things

April 13, 2014 15:580 comments
IDS And The IoT: Snort Creator Marty Roesch On Securing The Internet of Things

Martin Roesch is one of the giants of the security industry: a hacker in the truest sense of the term who, in the late 1990s created a wide range of security tools as a way to teach himself about information security. One of them, the open source SNORT intrusion detection system, turned into one of the mostly widely used and respected security tools in the world. SNORT became the foundation for Sourcefire, the company Marty helped found in 2001. And Sourcefire went on to fantastic success: first as a startup, then as a publicly traded company and, as of October of last year, as part of Cisco Systems, after the networking giant bought Roesch’s company for $2.7 billion. These days, Marty serves as a Vice President and Chief Architect of Cisco’s Security Business Group, where he’s helping shape that company’s strategy for securing the next generation of enterprise (and post-enterprise) networks. […]

Read more ›

Heartbleed For Poets And Other Must-Reads

April 10, 2014 18:380 comments
The (nerdy) Heartbleed SSL vulnerability story has jumped into the mainstream led to lots of rumination about the proper short and long term response.

It’s H-Day + 2 – two full days since we learned that one of the pillars of online security, OpenSSL, has contained a gaping security hole for the past two years that rendered its protections illusory. As I wrote over on Veracode’s blog today: this one hurts. It exposes private encryption keys, allowing encrypted SSL sessions to be revealed. Trend Micro data suggests around 5% of one million Internet top-level domains are vulnerable.  IOActive notes that Heartbleed also appears to leave data such as user sessions subject to hijacking, exposes encrypted search queries and leaves passwords used to access online services subject to snooping, provided the service hasn’t updated their OpenSSL instance to the latest version. In fact, its safe to bet that the ramifications of Heartbleed will continue to be felt for months – even years to come. In the meantime, there is a lot of interesting coverage and […]

Read more ›

The Heartbleed OpenSSL Flaw: What You Need To Know

April 8, 2014 12:370 comments
Codenomicon warned of a widespread flaw in OpenSSL, a commonly used encryption software. (Image courtesy of Codenomicon)

There’s a serious vulnerability in most versions of the OpenSSL technology that requires an immediate update to avoid exposing sensitive information and Internet traffic to snooping. In response, the SANS Internet Storm Center (ISC) has raised its InfoCon (threat) level to “Yellow,” indicating that…well…the Internet’s not as safe a place today as it was yesterday, before the vulnerability was released. Here’s what we know right now: + Researcher Neel Mehta of Google Security discovered the vulnerability, which was apparently introduced with a OpenSSL update in December, 2011, but only fixed with the release of OpenSSL 1.0.1g on Monday. + Dubbed “heartbleed” (thank the Codenomicon marketing department for that one), the vulnerability (CVE-2014-0160) is described as a TLS heartbeat read overrun. TLS stands for Transport Layer Security. According to OpenSSL.org, vulnerable versions of the OpenSSL software have version numbers ranging from 1.0.1 and 1.0.2-beta. + Codenomicon described the vulnerability as an “implementation problem” […]

Read more ›

Vint Cerf: CS Changes Needed To Address IoT Security, Privacy

April 2, 2014 16:140 comments
Cerf said that the advent of the Internet of Things poses a real challenge to the field of computer science. Namely: how to secure IoT devices. (Photo courtesy of Google.)

The Internet of Things has tremendous potential but also poses a tremendous risk if the underlying security of Internet of Things devices is not taken into account, according to Vint Cerf, Google’s Internet Evangelist. Cerf, speaking in a public Google Hangout on Wednesday, said that he’s tremendously excited about the possibilities of an Internet of billions of connected objects, but said that securing the data stored on those devices and exchanged between them represents a challenge to the field of computer science – and one that the nation’s universities need to start addressing. “I’m very excited,” Cerf said, in response to a question from host Leo Laporte. He cited the Philips HUE lightbulb as an example of a cool IoT application. “So you’re going to be able to manage quite a wide range of appliances at home , at work and in your car. Eventually, that will include things you’re […]

Read more ›

Is Analog The Answer To Cyber Terrorism?

March 17, 2014 09:405 comments
Ralph Langner, an expert on the security of industrial control systems, suggests that the critical infrastructure sector might consider the use of analogue systems as a backstop to cyber attacks on ICS software. (Image courtesy of the Library of Congress).

Ralph Langner is one of the foremost experts on the security of critical infrastructure that we have. So, generally, when Ralph says something – whether its about Stuxnet, or cyberwar or the security of nuclear power plants – folks listen. And these days, Ralph is wondering, out loud, whether our reliance on digital systems to manage critical infrastructure has gone too far. The answer, he suggests, may be to go “back to the future,” as it were: reintroducing analog systems into the control process chain as a backstop for cyber attacks. Case in point: the Department of Homeland Security’s ICS-CERT warned on Friday that firmware for Siemens SIMATIC S7-1500 CPUs (Central Processing Units) contain nine vulnerabilities that could enable attacks such as cross site request forgery, cross site scripting and URL redirection. (Siemens has issued a firmware update that patches the holes.) Langner is among the world’s foremost experts on […]

Read more ›

Government: Safety of V2V Outweighs Security, Privacy Risk

February 3, 2014 20:46Comments Off
Government: Safety of V2V Outweighs Security, Privacy Risk

After months evaluating the safety and security of vehicle-to-vehicle (V2V) communications technology, the U.S. government announced that it will begin taking steps to enable the technology for light vehicles. In a statement Monday, U.S. Transportation Secretary Anthony Foxx said that V2V technology represents the next generation of auto safety improvements – a modern analogue to seat belts and air bags. “By helping drivers avoid crashes, this technology will play a key role in improving the way people get where they need to go while ensuring that the U.S. remains the leader in the global automotive industry.” Vehicle-to-Vehicle Communications comprises wireless technology that allows automobiles to exchange information with each other in realtime, as well as with roadside or road-based devices. V2V systems communicate in the 5.9 GHz band and can also use common WiFi signals to communicate. V2V communications allow a vehicle to sense and respond to threats and road […]

Read more ›

After Snowden, State Department Eyes Cloud-Nationalism

January 31, 2014 08:30Comments Off
After Snowden, State Department Eyes Cloud-Nationalism

Amid the very public debate about the civil liberties implications of Edward Snowden’s revelations about NSA spying at home and abroad, the potential business fallout from the leak of classified information has been a footnote. But as the disclosures wear on, business leaders in the U.S. and elsewhere are beginning to discern the impact of the Snowden leaks. One place they’re voicing their concerns is The State Department, where technology vendors have been complaining of blowback from international customers, according to a senior State Department official who spoke with The Security Ledger. “We’re talking to cloud providers, including some very large cloud providers, about the challenges they face abroad,” the official said. The State Department has heard anecdotal reports of US firms losing business due to concerns about government surveillance, but companies have been reluctant to advertise lost accounts. At the same time, the State Department has heard of foreign competitors drumming […]

Read more ›

Experts: Despite Warnings, Slow Progress Securing Industrial Systems

January 16, 2014 12:03Comments Off
Experts: Despite Warnings, Slow Progress Securing Industrial Systems

Despite increased media attention to the security of industrial control systems and critical infrastructure, progress in securing those devices has been slow, experts say. Despite progress in some areas, critical infrastructure - including energy and transportation networks- remains vulnerable to attacks leveled at known security holes for months or years because of a lack of vendor response or customers who lack the incentive or know-how to patch vulnerable systems. That according to some of the world’s top experts in cyber security and industrial systems, who are gathering this week at an industry conference in Miami. The S4 Conference, sponsored by the firm DigitalBond, is one of the premiere conferences for cyber security as it pertains to industrial control systems and often coincides with disclosures from industrial system vendors about serious security holes in their products. The security of industrial control systems has been a top concern of IT security experts and government […]

Read more ›

Security Ledger Uses: