IT security: What’s hot, what’s not

Four security experts share their insights on the latest security technologies, including data-loss prevention, fingerprint readers and OpenID.

Data-loss prevention, fingerprint readers, OpenID, reputation services — diverse though they might be, these security technologies are top attention-getters among the four gurus we recently gathered (virtually, that is) for a roundtable chat about enterprise security. Our experts — Network World columnists and bloggers Andreas Antonopoulos, Jamey Heary, Dave Kearns and Noah Schiffman — also throw out their opinions on whether we’ll ever break the patch-hack-patch cycle, the true meaning of defense-in-depth enterprise security, and how social networking might affect identity management.

Moderator — Beth: Hello and welcome. We’re going to dive right into our first question, so here goes: What is the most innovative security technology you’ve seen in the last year or so, and why?

See our complete chat schedule and an archive of chats on topics including IPv6, social networking and wireless-LAN management.

Noah_Schiffman: DLP is one of the better technologies I’ve seen this year, as security measures need to be instituted internally more so now than ever before.

Dave_Kearns: Ubiquitous fingerprint readers (for example, eikon). I’ve been following biometrics and specifically, fingerprint technology for the past 10 to 12 years. Each time I think it’s about to take off, the sizzle turns to a fizzle once again. But now the time might be right. Not that biometrics are any more acceptable (even though they are), nor that the accuracy has improved (even though it has), but because the right application has come along.

Andreas_Antonopoulos: The most innovative security technology is the development and quite broad adoption of OpenID — an open, decentralized, free framework for user-centric digital identity. What’s so interesting about OpenID is that it is completely decentralized and allows an individual to maintain one or more independent IDs, of varying levels of security. It allows owners of Web-based applications, services and sites to authenticate the users without forcing them to create yet another user ID.

In fact, I can see a potential synergy between OpenID, back ends and Dave’s ubiquitous fingerprint readers.

Dave_Kearns: You’re the first person I’ve heard mention OpenID and security in the same sentence in a positive way — is everyone else wrong?

Jamey_Heary:  I’m the most excited about the explosion of security companies that are integrating reputation-based controls into their products. Reputation scoring represents the evolution of the traditional whitelist/blacklist approach used in URL filtering and antispam solutions. Classification based on reputation provides you with far more visibility, granularity and control over your traffic-security policies. As reputation matures, I hope to see it moving into other security products like firewalls, [intrusion-prevention systems] and host security clients. The power of being able to classify and control traffic based on its reputation should turn out to be a game-changer for security.

Andreas_Antonopoulos: I think people see OpenID as a means of authentication rather than a framework. The nice thing about it is that it is a framework that can provide really loose authentication and really strong authentication depending on the back end. It does not inherently tie into a specific level or strength of authentication, so its biggest weakness is also its strength.

Noah_Schiffman: But [OpenID] ultimately will be determined by the scale in which it is adopted.

Jamey_Heary: I see a synergy between OpenID and reputation as well. And adding in a reputation score that is earned by the ID holder can give you another type of authorization criteria.

Andreas_Antonopoulos: Exactly! Great synergy.

Dave_Kearns: There are still the problems of untrusted OPs [OpenID identity providers] — and phishing. As to reputation — there’s great promise but still no tried-and-true way to gather the reputation data. Information Cards [the identification specification developed by Microsoft], to my mind, offers much more promise than OpenID.

Jamey_Heary: And the trouble with slander for reputation. There are several reputation databases out there for URLs and spam, but not yet for individual identity. However, if a few social community sites like Second Life, Facebook and so forth picked up [on the idea], a reputation database for individuals could be an created very quickly.

Andreas_Antonopoulos: I see OpenID as the type of solution that succeeds where more complex solutions failed — that is, LDAP vs. X.500, SMTP vs. X.400, TCP/IP vs. OSI.

Jamey, because it is difficult to have a [Uniform Resource Identifier] for identity, to build reputation around it. OpenID offers that URI.

Jamey_Heary: Right, OpenID could take the place of my other idea, which is a digital certificate for everyone.

Moderator — Julie: Let’s talk about the fingerprint readers Dave mentioned early on in this discussion. Anyone else excited about those?

Andreas_Antonopoulos: I’m very excited. In fact, the first thing I thought when I saw the form factor of the fingerprint readers on laptops was ‘Hey! you could put that on the bottom edge of a cell phone.’

Dave_Kearns: Or on a smartcard.

Jamey_Heary: For biometric, I prefer voice analyzers, given that most devices already have microphones. The problem with fingerprint readers is they are not ubiquitous enough yet.

Noah_Schiffman: I’m an expert on biometric authentication techniques. I’ve designed many biometric authentication systems and worked on biometry research. One of the problems with fingerprint authentication is the frequency of 2-D imagery that’s used. True biometric authentication would be accomplished with full 3-D analysis of all the fingerprint ridges in terms of depth and width.

Andreas_Antonopoulos: We’ve adopted fingerprint authentication as a second factor on all our machines. We’ve found an interesting gender bias. They don’t work as well for women, in general. Slimmer fingers create smaller “pad” surfaces to scan. Add to that the use of hand creams, which is arguably more common for women, and they have many more errors. Noah, does 3-D imaging solve the gender bias problem?

Noah_Schiffman: It depends on a pressed vs. swiped read, but in general, lotion, grease or anything on top of the finger is going to produce invalid results.

Moderator — Julie: How do you swipe a fingerprint?

Noah_Schiffman: Swiping is the motion of moving the finger across a thin scanning aperture.

Andreas_Antonopoulos: Swiped has the advantage of form factor, but suffers from this issue. So ladies: Dry hands or successful authentication — your choice.

Noah_Schiffman: Totally right.

Andreas_Antonopoulos: Still though, I’d like to see fingerprint readers on cell phones. Then you can make the cell phone carry a soft token.

Dave_Kearns: I’m told that cell-phone geography changes too often to add fingerprint readers to most of them.

Moderator — Julie: We still need to get feedback on DLP, which Noah brought up early on, and reputation services as hot security technologies. Thoughts on DLP?

Andreas_Antonopoulos: DLP is great, but more as awareness-training than true barrier. Determined users can get stuff out, but it certainly helps educate those who accidentally violate policies. It also shows IT where they need to provide better mechanisms for data transfer.

Jamey_Heary: DLP is having a hard time taking off, given its complexity. There is still not a good solution out there.

Noah_Schiffman: As internal threats and corporate data loss have surpassed that of the external threats posed by hackers, DLP has become very relevant and important. But, yeah, I agree DLP is slow to take off.

Moderator — Julie: Does DLP technology work today? What needs to improve?

Andreas_Antonopoulos: It’s easy enough to do the basic pattern scanning — that is, 999-99-9999 is an SSN. But . . . figuring out that the minutes from the board meeting on the fire sale of the company is sensitive?

Jamey_Heary: First, companies have to understand the type of data they have. Then they have to figure out how to classify that data. Today this is mostly a manual, very time-intensive process.

Andreas_Antonopoulos: Right! Most DLP discussions start with ” . . . and then we stop it from leaking,” but the real problem is finding and classifying. If you already know what is sensitive and where it is, it’s easier.

Noah_Schiffman: The thing that needs to improve regardless of security systems is the constant weakest link of the end user. Risk assessment, data classification and other forms of data valuation need to be in place before DLP can be effective.

Moderator — Julie: DLP: It’s the old structured vs. unstructured data issue — and this won’t be solvable until we change human nature.

Dave_Kearns: Correct, Julie.

Jamey_Heary: We need a DLP-classification engine.

Andreas_Antonopoulos: Which is why companies that have intellectual property in document and content management and natural-language processing could end up grabbing the DLP market.

Noah_Schiffman: DLP classification currently is extremely difficult, even for the government.

Dave_Kearns: Everything is difficult for the government . . .

Noah_Schiffman: As a DoD consultant, I’ve seen this many times. The number of classified documents is unknown because there is no requirement to account for most of them; however, some estimates put their numbers in the hundreds of millions.

Andreas_Antonopoulos: In a way, we are replicating the same approach as we did in the early days of spam — signatures and grep, and it only goes so far. Where’s the Baysian DLP? Where’s the context-aware DLP?

Moderator — Julie: Because Baysian has worked so well for spam, which brings us to reputation services — your thoughts?

Andreas_Antonopoulos: Reputation is great. It’s dynamic and adaptive, and can be used in many different areas of security.

Moderator — Julie: Is it easy to fake a good reputation, or easy to classify some domain as bad (and it isn’t)?

Noah_Schiffman: Yeah, making a blacklist into a whitelist or vice versa is not difficult for a talented hacker.

Dave_Kearns: Reputation would be great if there was agreement on the meaning, agreement on aggregation, agreement on ‘edit-ability,’ and so forth.

Andreas_Antonopoulos: Or if not agreement, then at least common protocols for describing those attributes so that you can exchange them.

Jamey_Heary: I haven’t seen these issues. Dave, can you elaborate?

Dave_Kearns: Well, Jamey, show me where reputation data is aggregated, and who gets to edit it.

Andreas_Antonopoulos: Not if the reputation is distributed and not centralized.

Jamey_Heary: Today each company builds and controls its own reputation database. We need a public reputation infrastructure, similar to what we have with PKI today.

Andreas_Antonopoulos: Yes, we need standards (XML) for describing and exchanging reputation data — federated reputation, basically.

Jamey_Heary: Exactly.

Andreas_Antonopoulos: Funnily enough, it’s [peer-to-peer] where you see that developing.

Jamey_Heary: I’d like to see reputation brought into firewalls, and IPS and host security clients as well.

Andreas_Antonopoulos: Well, we should separate three concepts: reputation scoring, reputation storing and reputation users; and all three should be application independent.

Noah_Schiffman: That sounds pretty complex.

Moderator — Julie: OK, time is short. Let’s move on to Question 2. What do you think is the ultimate solution to end the patch-hack-patch cycle that is the cornerstone of today’s enterprise security?

Andreas_Antonopoulos: The biggest problem with the patch-hack-patch cycle is that patching is not an issue of scale (hard-to-patch lots of computers) but one of unintended consequences (dangerous-to-patch critical computers). As a result, companies quite happily bulk-patch all their desktops but leave critical servers unpatched while they exhaustively test the patches. An enterprise has to balance the risk of a known exploit in the wild vs. the possibility of a conflict causing a critical server to crash. Since many exploits can be mitigated through other means (perimeter firewalls, application firewalls, proxies, patch proxies) the balance almost always leans against patching. Virtualization allows you to do high-fidelity testing on a clone. High-fidelity testing means that the clone is indistinguishable in every way from the original, so if the patch works, it will work on the critical server too. Pre-virtualization you could do that only by building a complete replica of a production environment. Even servers from the same batch might have different chipsets, different BIOS, different [network interface cards]. Accurate testing was difficult and costly.

Jamey_Heary: The reality is that operating systems and applications will continue to have security vulnerabilities for years to come. The ultimate solution would be for all software companies to produce both secure and bug-free code. Since that will not happen in my lifetime the question moves to ‘Is there a way to secure a nonsecure operating system or application?’ The utter failure of solely signature-based approaches in this regard leaves us with the main alternatives of behavior- or modeling-based approaches — modeling being the ability to intercept traffic, run it in a virtual environment, see if it does anything bad, if it does, then drop it before it gets to the actual hosts. The problem with modeling, of course, is performance.

Dave_Kearns: The sun goes nova.

Moderator — Julie: Dave, short of death to the planet, have you got any ideas?

Dave_Kearns: There aren’t any that are realistic. If you allow users access to sensitive data, then hackers will find a way to get to it also. Social hacking is still very effective.

Noah_Schiffman: I have one word that will answer all security questions: crypto.

Jamey_Heary: How can crypto help with an application vulnerability?

Noah_Schiffman: Good question. Depends on the vulnerability.

Jamey_Heary: Let’s take cross-site scripting, then.

Noah_Schiffman: I guess we’re talking about Web-page and user authentication. Social engineering will always exist, unfortunately. There is no cure.

Andreas_Antonopoulos: Jamey’s answer also includes virtualization. We have an overlap. Essentially sandboxing and manual testing both depend on a high-fidelity replica of the production environment. Honeypots, too. We’re seeing dramatic improvements in patching because of virtualization — reduction in time to patch and cost to patch. This is directly from our primary research.

Jamey_Heary: Why does virtualization affect patching, or are you meaning because you can test it first?

Dave_Kearns: Reducing the window of opportunity helps, of course, but isn’t a cure.

Andreas_Antonopoulos: Jamey, because you can test it (manually) or sandbox it (automatically).

Jamey_Heary: Bottom line is that the patch-hack-patch cycle will be with us for some time to come.

Andreas_Antonopoulos: Yes, you can only shorten the cycle.

Jamey_Heary: I haven’t seen any solution, other than the ones I mentioned initially to help this — due to the proliferation of attacks that let you jump out of a virtual machine and into another one make patching on VMs of utmost importance. For that matter, it makes host security of VMs especially critical.

Andreas_Antonopoulos: Jamey, indeed, but the ease of maintenance more than makes up for the host security issues (which are minor to non-existent).

Noah_Schiffman: Vulnerability disclosure standards still need to be agreed upon.

Andreas_Antonopoulos: Disclose early, disclose often and disclose fully.

Noah_Schiffman: Andreas, isn’t that what we’re trying to do? Disclose fully — like the MIT guys?

Andreas_Antonopoulos: Indeed! At least in the IP world. I was discussing SCADA [Supervisory Control and Data Acquisition] security with an expert, and he was surprised to hear my opinion that ‘secrecy’ is the reason that SCADA security sucks.

Jamey_Heary: SCADA is a mess.

Andreas_Antonopoulos: SCADA is a mess because they don’t dare do disclosure.

Jamey_Heary: The answer has always been to just air-gap the SCADA network, but in reality very few SCADA nets are actually air-gapped.

Noah_Schiffman: What about malicious code that can detect virtual machines and perform [denial-of-service] attacks . . . causing the machine to close or crash?

Andreas_Antonopoulos: Noah, you can make virtual environments more resilient than physical ones. Not that we do — we can. . . . Perhaps some day we will.

Noah_Schiffman: As long as you’re not replicating insecure physical ones. . . . And, yeah, you’re right. Hopefully one day we will.

Andreas_Antonopoulos: Indeed. Resurrecting unpatched zombies, all named “Test01.”

Jamey_Heary: Andreas, virtual machines have the same host security issues that all other non-virtualized hosts have (which are extensive).

Andreas_Antonopoulos: Jamey, sorry, I thought that by host you meant hypervisor.

Jamey_Heary: Ah, got it.

Moderator — Julie: Time for Question 3. Steve Bellovin of firewall fame is championing a new model — where the hard exterior remains, a hard center is added via application firewalls and the authentication role is removed from the Web server. Instead, he wants a new Web SQL language (NewSpeak), which includes no verb that would execute an insecure action. What are your thoughts on his plan?

Dave_Kearns: Not particularly new. This is another form of entitlement management, which is a good approach.

Andreas_Antonopoulos: There is no such thing as a hard perimeter. Companies today are not value centers. They are nodes in a value network. What I mean is that much of the value generated by a modern company may lie in the information supply chain, in the partners, in the network, rather than inside the “walls” of the company. As a result, business value cannot be generated through a hard perimeter. The perimeter becomes porous and eroded from all the “trade routes” that are poked through it. In the end, security has to be layered in depth, on every node, every endpoint and every device. You can’t maintain a “bubble” approach to security when you generate most of your value by poking holes in the bubble. So, we’re seeing companies moving from a perimeter model to a layered model where architecture-centric security (DMZ, perimeter, access) is supplemented by identity-centric, transport-centric and transaction-centric security. The perimeter is still there, but it’s only a coarse-grained defense to stop the most obvious and “noisy” attacks.

Jamey_Heary: With the risk of sounding too old-school, I believe that the next-gen security model for enterprises remains a defense-in-depth, collaborative security architecture. The majority of businesses have not moved to this architecture as of yet. This is especially true for the internal areas of networks and data centers. This is due to several reasons. Foremost are the costs, support issues, and complexity involved with implementing a pervasive defense-in-depth security architecture. The newest piece of this security architecture is how to deal with the rapidly expanding virtualization of servers and applications. I see this as the next great hurdle for security architects and vendors.

Noah_Schiffman: I definitely agree with Andreas. If there was truly a hard perimeter, this model wouldn’t be needed.

Dave_Kearns: Yes, there is no longer a “frontier.”

Andreas_Antonopoulos: It’s like the old castle and moat. That model died. But did it die because of gunpowder (as they teach in school)? I say, no, it died because of trade. If you were in a walled city that was in the center of a massive trade-route network, what happened if you shut the gates? Within a week there’s a shanty town bazaar outside the walls where all the trading happens.

Noah_Schiffman: Defense in depth will always be a gold standard. What you place in the layers can affect how strong that defense really is.

Jamey_Heary: Agreed. Today’s networks are perimeter-less and suffer from ubiquitous access to all it resources. But I find that many customers have yet to catch up to that fact in security — thus we need defense in depth.

Andreas_Antonopoulos: Exactly. It worked when we had “the firewall” on “the Internet connection.” Now we have a mesh — and that creates a mess.

Noah_Schiffman: Just as there will always be the security hole of a “user,” there will also be the problem of the “lazy developer” that fails to write secure code. Stored procedures are another layer, and this [Bellovin] model seems to be another mirror of that kind of security.

Dave_Kearns: Jamey: “Many” customers still think six- or eight-character passwords are enough.

Jamey_Heary: Dave, some think that passwords are enough.

Andreas_Antonopoulos: Take a cue from nature. Nature doesn’t do perimeter security, but defense in depth.

Dave_Kearns: “Nature” doesn’t do defense at all — each entity does its own.

Andreas_Antonopoulos: From the cell up, there are layers and layers. Otherwise, the first cut in our finger would give us a fatal infection. 

Noah_Schiffman: Does anyone think the five- to 30-second decryption time is a bit long with the NewSpeak model?

Dave_Kearns: Yes, I do.

Jamey_Heary: Dave, entities are what make up nature.

Dave_Kearns: Jamey, then nature is a perimeter.

Andreas_Antonopoulos: Dave, that’s what I meant: Each entity carries many layers of defense, not just a single perimeter.

Jamey_Heary: No, nature is the network.

Andreas_Antonopoulos: Nature is the Internet, and you will be bathed in viruses at all times, so you need more than just a “bubble” to protect you.

Noah_Schiffman: Sounds like Microsoft, with the forest trees and leaves. No more nature talk.

Moderator — Julie: You guys sound ready for Question 4. Does the rise of social networking impact the future of identity management, and what is the solution to managing identity when we each now have dozens or more digital personas out in the wild?

Dave_Kearns: Yes, it does. Just as the rise of personal computing had a profound effect on corporate computing, so too will the rise of personal identity management impact the world of enterprise identity. The enterprise identity — and all of its attributes — becomes merely another persona in the entity’s base identity.

Jamey_Heary: Online social networking should be viewed as being very similar to social networking in reality. You never really know if the person you are socializing with is telling you the truth or if they are trying to con you. Individual virtual reputations, to continue my previous theme, could help with online social networking. We could issue individual digital certificates, or some equivalent, to each user that wants to participate on a social network site. The enrollment for the digital certificate can be used to verify you are who you say you are. Then we can use this certificate to track your online reputation score. But just like in reality, we have to watch out for people who try and slander others.

Andreas_Antonopoulos: We always had a dozen identities. We just pretended they were all unified. Now we’re embracing our multifaceted nature and expressing it with multiple contextualized identities — that is, we can be different things to different people. I can be a parent, a teacher, a colleague, a patient or a dwarf warrior. It depends on the context of the interaction I am having — and I ‘want’ to keep my identities separate.

Dave_Kearns: Andreas, it depends on the relationship.

Andreas_Antonopoulos: I don’t want my PTA group seeing my patient records. What I’m saying is that multiple identities are better for privacy since each identity is limited and contained.

Jamey_Heary: I agree, Andreas, but it would be nice to have a common reputation score for all of them.

Dave_Kearns: Multiple personas or multiple roles — but you really only have one identity.

Andreas_Antonopoulos: Yes, practically.

Moderator — Julie: When it comes to protecting our identities and our enterprise data, what can be done if we all have 100 social or digital identities?

Noah_Schiffman: Once again this is a threat that is very susceptible to social engineering. Limiting your identities will limit the number of threats. You can always encrypt your identities, but then your friends will only be cryptographers.

Dave_Kearns: Did we mention better training for users?

Andreas_Antonopoulos: Julie, we use identity federation and use whichever identity is relevant for the transaction.

Moderator — Julie: An enterprise can’t limit the identities of its employees. I personally have about six of them, four of which I use for work.

Andreas_Antonopoulos: Can they all be tied to a root identity that uses strong authentication? Sure.

Noah_Schiffman: Andreas, I agree. Appropriate identity usage is important. But if that root identity is compromised or impersonated, the implications could be significant.

Andreas_Antonopoulos: We can’t limit identities — neither do we want to. Part of the reason identity theft is so much more prevalent in the U.S. is that you have a unifying index key: the SSN. Fragmented identities are more secure because you can’t compromise them all in one go. In Europe they don’t see our identity-theft problems.

Jamey_Heary: Great point, Andreas. We need to move away from the ultimate control an SSN provides.

Andreas_Antonopoulos: Right, Noah, which is why I don’t even see the need for root identity. I’d rather have several OpenID URIs with different levels of authentication. Social OpenID URI: user name and password. Banking OpenID URI: fingerprint and token. Healthcare URI: challenge response or whatever.

Dave_Kearns: It’s not a question of “need,” Andreas. You have an identity — and you can’t dispose of it.

Andreas_Antonopoulos: But I don’t necessarily want all my personas tied to my root identity using a single identifier. There’s no need for it.

Dave_Kearns: But they do tie to you — no matter what the identifier is.

Noah_Schiffman: As long as OpenID is built on the Web, there will be inherent problems.

Andreas_Antonopoulos: Noah, all my apps are on the Web, so that’s where my identity is today.

Jamey_Heary: We all need a digital certificate that we can call our own.

Dave_Kearns: Or two or three.

Andreas_Antonopoulos: Jamey, we all need multiple independent digital certificates, not one. One is too dangerous.

Jamey_Heary: The thought being that if the PKI infrastructure goes down, then everything else burns, so it matters not. 

Andreas_Antonopoulos: I don’t want the same certificate to open my hospital record and my fluffybunny34@facebook identity.

Jamey_Heary: Why not? You are not ever giving them your private key. It is a public key infrastructure, so it doesn’t matter. That’s the beauty of PKI.

Andreas_Antonopoulos: That assumes I can keep my private, private. Most can’t, so . . .

Dave_Kearns: Andreas, have all the certs you like — they still tie to you.

Andreas_Antonopoulos: I’d rather have them separate.

Jamey_Heary: Most won’t even know where their private key is or how to get it.

Moderator — Julie: Jamey, it will be a fingerprint on the cell phone, that you left in the cab, right?

Noah_Schiffman: Jamey, I’m pretty good at finding private keys.

Dave_Kearns: Jamey, security through obscurity?

Noah_Schiffman: Trying to get people to adopt OpenID will be more difficult than e-mail. OpenID, being a URL, will be a hard concept for people to accept.

Andreas_Antonopoulos: You already have OpenID most likely, from Yahoo or AOL or somewhere else.

Noah_Schiffman: Andreas: My OpenID is currently ClosedID.

Moderator — Beth: And with that said, and our time limit reached — thanks, everybody, for joining us today.

Why San Diego city workers expect apps up and running in 30 minutes or less | Return to main page: The Best of the New Data Center