iNet Freaks: Security

Showing posts with label Security. Show all posts

It’s tough to keep track of all of your passwords. In spite of advances in biometrics, and increased attention on the value of two-factor authentication, passwords remain the primary means of digital security. They're also one of the weakest links in the security chain. If we can’t get rid of passwords, we need a better way to manage them.

Remember when passwords were going to die out? Bill Gates told an audience, "There is no doubt that over time, people are going to rely less and less on passwords. People use the same password on different systems, they write them down and they just don't meet the challenge for anything you really want to secure."

That was in early 2004. Nearly a decade later we still rely heavily on passwords, and passwords still suffer from all of the same weaknesses Gates described.

I used to be guilty of recycling the same password across virtually every account as well. The sites and services I use broke me of the habit because the password policies are so different from one to the next that it became very difficult to even find a password that meets the requirements of all of them.

Fair enough. It’s a horrible policy anyway. Security best practice suggests you should use different passwords for different sites. Just as you don’t use the same key for your front door, car, bike lock, and safety deposit box, you don’t want to have the same password “unlock” all of your information. If one site or service is compromised and an attacker gets access to your password, you don’t want it to be a universal key to your entire online identity.

Passwords are literally the keys to your online world.

Apple recently unveiled details of the new Mac OS X, “Mavericks.” It is available only to developers right now, but one of the features Apple is adding is designed to help you choose more secure passwords, and manage them effectively without writing it on a sticky note pasted on the front of your monitor.

iCloud Keychain basically takes the password storage and management features of the existing Keychain feature and moves them to iCloud, where they can be accessed by and synced across iOS devices as well. The Mac OS X system running “Mavericks,” and any iOS devices with the upcoming iOS 7 will be able to auto-fill complex passwords from the iCloud Keychain.

That’s awesome for users who live and die by the Apple ecosystem, but it won’t work for someone using a Windows PC with an iPhone, or someone using a MacBook Pro with an Android smartphone—at least not yet. It’s a good solution, but an Apple-centric one.

PasswordBox is a new service that functions much like iCloud Keychain, except that it works cross-platform. PasswordBox is available on Mac OS X and Windows, and it’s available for iPhone, iPad, and Android mobile devices.

Like iCloud Keychain, PasswordBox stores passwords in the cloud using strong encryption to protect them from unauthorized access. When you need to log in, PasswordBox automatically retrieves the appropriate credentials. PasswordBox is free (for managing up to 25 passwords) and provides tools that let you share your credentials with family or friends—should they need the information if something happens to you—without directly revealing your passwords.

There are other services out there like 1Password, and LastPass that let you manage secure passwords more effectively. There is some concern about storing the keys to your digital life in the cloud—but it’s probably more secure than writing it down on a piece of paper and shoving it in your desk drawer, and it gives you access to your passwords any time and anywhere, from just about any device.

Make sure you choose secure ones, and find a tool that lets you remember and use them more easily.

Passwords aren’t dying any time soon. Here's how to manage them effectively.

No comments

Posted at 03:35 | by Unknown

DARPA, if you didn’t know, stands for Defense Advanced Research Projects Agency. It's the government body that develops ridiculous things like flying tanks and other science fiction. Next month, however, DARPA is hitting closer to home with “Plan X”, a one-day workshop designed to flesh out the U.S. government’s strategy for war in cyberspace.

Plan X is a two-pronged affair that consists of a general-access session for your standard contractors and government employees, and a secret session to map out where the US is going in the future of cyber warfare.

What will it deal with, specifically? The event won’t get into research and development of cyberweapons or vulnerability analysis. It’s geared towards defense: In the session, DARPA will focus on ways to “create revolutionary technologies for understanding, planning, and managing cyberwarfare in realtime, large-scale and dynamic network environments,” as well as how to research the nature and history of cyberwarfare. It's all to dominate the “cyber battlespace”, according to a publicly available PDF on the matter.

That all sounds very low-key for DARPA, though, doesn’t it? There's more to it than that.

The program is a tool-building project that DARPA intends to use in order to develop secure operating systems, communication relays, and weapons deployment systems, among other awesome-sounding things like adaptive defense and—best of all—visual maps for cyber warfare.

The idea of a map of the Internet for use in real-time situational awareness planning and strategy for warfare is pretty much the coolest idea ever, if you don’t include the 3D models of data you “navigate” through in the movie Hackers (I kid; that’s lame in comparison).

The best thing about the open secret conference is that it’ll be a hiring event as well, with hopefully the best and brightest in the security industry in attendance to be wowed into working for America by DARPA.

Even though I won't be there, I will keep my fingers crossed that some cool defensive research will come of this conference.

Plan X: DARPA’s Cyberwar

No comments

Posted at 03:08 | by Unknown

Computers, networks, and information security seem to fall comfortably under the heading of science, but science alone is not enough. Security system developer Tripwire recently conducted a survey in cooperation with the Ponemon Institute to find out whether IT professionals consider risk management to be “science” or “art."

Ponemon surveyed 1,320 respondents across the United States and the United Kingdom: IT professionals working in information security, risk management, IT operations, business operations, and compliance. Participants were asked, “In your opinion, is information security risk management an ‘art’ or ‘science’?” Tripwire commissioned the Ponemon Institute to
conduct a risk management survey.

Ponemon defined the two concepts for the purposes of the survey. “Science” means basing decisions on objective, quantifiable metrics and data. “Art” refers to analysis and decisions that are based on intuition, expertise, and a holistic view of the organization.

Two-thirds of those from IT and enterprise risk management or business operations sided with “art,” while nearly two-thirds of the respondents who work in IT security and IT operations chose “science.”

Tripwire CTO Dwayne Melancon weighed in with some thoughts on the results. His take is that those who work in business operations and risk management generally don’t believe a precise answer is necessary in order to make a decision, so they favor art. Those who work in IT operations and security, on the other hand, view the world of risk management as a math problem with a specific answer, so they see it as a “science”.

Melancon explains that the disparity between art and science is the crux of the problem when it comes to managing risk effectively. “People with these viewpoints are talking about the same thing, but they are using very different language, which can make it difficult to come to a mutually agreed point of view.”

The simple reality is that risk management is both an art and a science. Computers are precision instruments that operate purely on ones and zeros. Computers—how they work, how they can be attacked, and how you manage risk and protect them—are devices that function based on science. But there is also a human factor—both in terms of the attackers and the victims—that adds an element of unpredictability, mixing intuition and art with the science.

Attackers are adept at exploiting the human factor to bypass security controls. Effective risk management depends on having the right tools in place—the science—while also having the big picture in mind, and understanding that the user is generally the weakest link in the security chain—the art.