Alan Expressions

This is the second in a series of articles on Navigating and Understanding Vendor Security Claims. You can check out Part 1 here.

When good Encryption Goes Bad or “What the hell happened to WEP?”

Many sites will banter around the term encryption like encryption is all that matters. Just because you are using good encryption does not mean your data is safe, the encryption must be implemented properly in order to keep your data secure.

The classic example of “Good technology, bad implementation” is a wireless security protocol called Wired Equivalent Privacy (WEP), which was introduced in 1999 and is still a feature of all mainstream WiFi network cards in your computers today. The core components within WEP were good but implemented in a poor manner, which left the wireless security on millions of computers broken. Within a few years of WEP being released someone had figured out how to break the encryption key within an hour. Vendors made many adaptations to the protocol to beef up its security with varying levels of success. WEP was replaced several years ago by WPA but to this day WEP is still the most compatible wireless encryption protocol so many people use it, especially in homes and environments with older devices.

These same issues relating to bad development decisions may arise in any security implementation. Going back to our online backup vendor example: What if the backup vendor cached your unencrypted data to a temporary directory on their server until they had free processing time to encrypt it? The attacker would never need to compromise your encryption for new data; they would just need to monitor the temporary directory for the cached data and copy the interesting information. In a severe instance perhaps the hacker automatically sends a copy of all data passing through that directory out to another server on the Internet. This scenario would be avoided if the customer were doing the encryption before the data was sent to the provider, although it still relies on the vendor developing their software in a secure manner and being wise about their service architecture.

The final example I will give on this topic since it has been in the headlines recently is Dropbox, which I have mentioned in previous posts. Their website states that they are encrypting customer data with AES. It was later revealed that all customer data is being encrypted using a single encryption key and that the Dropbox staff could decrypt the data if deemed necessary.  This might be fine for some people or organizations but for others it would be a completely unacceptable situation since a single encryption key being compromised could put all data within Dropbox at risk.

If you need a service but are uncomfortable trusting vendor security claims another thing you can do is double encrypt your data. In this situation you would encrypt the data on your servers, then encrypt it a second time before it is sent to your provider using their encryption method. By doing this even if your vendor’s network is completely compromised including your backup private keys the result of a hacker decrypting your data will be more encrypted data, for which they do not have the keys since you performed the first layer of encryption in-house. At that point unless it is a highly skilled, targeted attack against your organization the attacker is probably going to move onto an easier target.

The moral of this section is: Just because the buzzwords are there does not mean your data is safe. Dig deeper to find specific information as to how they assure that their security and encryption implementation is secure whether it be through an advanced quality assurance process, secure development and testing regime, external code and security audits and constant reviews, or any combination. The more they do the better.

Are there cases where encryption is a liability?

In my opinion, Yes. This will not be true for most people most of the time but it can be.

When you encrypt or digitally sign (a topic not covered in this article but closely related) your data using a well-constructed key and encryption or digital signature system you have done something in addition to securing your data. You have guaranteed that the data was yours.

Do you want all your data to be traceable back to you? Think about this for just a moment.

Imagine you are in court “So Mr. Weiner, you say you did not send that photo of male genitals to six female colleagues?” “No, I did not sir, my twitter account was hacked.” “Was the image yours?” “I do not know.” “After analyzing your office computer we have found a copy of the image and twitter data encrypted under an account that only you had access to. The forensics team determined that there is no evidence of data tampering or unauthorized access on that computer. Are you sure you did not send the photo?”

What just happened in this example? Assuming the court understands the basics of encryption and data security Mr. Weiner is damned because he sent the images from his encrypted data store containing both the image and the twitter cache showing the sent image. It becomes a bit like DNA evidence, there is a very large hole to dig yourself out of if you want to prove it wasn’t you. At this point I will point out that I am not a lawyer and am covering this topic just to get people thinking.

Being a computer guy I know people that digitally sign every email, which provides a guarantee that the email is original and was not tampered with in transit from the writer to your computer. This is another item I question; do I want every piece of email I send to have a digital signature guaranteeing that I sent that email? Are you planning on running for political office? If so do you want your “Guaranteed” email quoted out of context by your opponents?

Think about all those funny emails you have, the lewd jokes, the political rant you wrote after a few too many beers, and anything else you may have sent or stored in your encrypted account or data store. Do you want that data to be able to be tracked back to you with certainty?

If you are a corporate encryption user there is a good chance your company is practicing a technique called “key escrow”, which is where the corporation maintains a copy of the encryption keys so that they can access your data in specific situations, such as during a legal proceeding or to meet regulatory requirements. In these cases your company can always access your encrypted data if necessary. It also leaves open a potential attack vector for someone looking to gain access to your data. Rather than target your account they might choose to target the key escrow system within your organization, which might give them access to everyone’s encryption keys.

A privacy paranoid individual would argue that encryption is always good but that is only if the data is not found in the first place (there are techniques to hide your data while also encrypting it), you are willing to give up the keys to a proper authority, or you are doing something illegal for which the punishment is worse than the potential repercussions for denying the court access to your data. Which looks worse, having a hard drive containing illegal data that you can claim was an innocent mistake or showing up in court and refusing an order to provide your encryption keys, which implies that you knew you were violating the law and want to hide it.

If you are breaking the law and hoping to leverage encryption to protect your data your risk maybe more perception than what is contained within the data itself since the authorities already had some evidence in order to arrest you in the first place.

In real life, rather than the armchair quarterbacking that I offer above, I encrypt my notebook hard drives and encourage others with portable machines to do the same. This is not because there is anything illegal on my computers but because if my notebook is lost or stolen I don’t want to worry about what data was lost. Losing a computer would suck, losing a computer with all my important data on it would suck about a hundred times more.

What is Hacking?

Hacking itself is not bad, it is the use of something for a purpose other than was originally intended.

Some people have attempted to differentiate Hacking by calling “bad” hacking by a different name such as “cracking” but it has never caught on, it is Hacking, just a different type. You can be a good driver or a bad driver, either way you are still driving.

Most of us partake in some form of hacking every day, although not to the degree that people like the folks participating in Make Magazine or in the more extreme Lifehacker articles do. When you took that broom, sawed the tines down to two inches then used it as a rain gutter cleaner that was hacking at a basic level. You repurposed something in a way the manufacturer never intended.

A second part of understanding hacking is that there are two main types of technology hackers, recreational hackers and hackers with a financial or reputation goals.

For the Hackers with a financial or reputation goals you could become a security consultant, penetration tester (a professional hacker), steal identities or credit cards; it all serves the same purpose only some types of hacking do not result in jail time if caught.

Recreational hackers are folks like George Hotz, smart folks with time on their hands that are interested in tinkering, understanding how things work, and enabling them to do unintended things. Sometimes these folks end up doing stupid stuff, like defacing Bank of America’s website, which can land them in jail or make them the target of a lawsuit but at the end of the day it isn’t about money or fame, it’s a hobby or passion.

The Terms of Service Tightrope

All vendors storing your data online are going to have Terms of Service or Terms of Use that disclaim most or all of their responsibility in a security breach or data loss event. Some will provide reassurances or some basic guarantee but if you read the details you will probably find that their liability is only a token effort, not anything that will save your business.

With this said no vendor wants their security compromise or data-loss event to be front-page news so they do have some incentive to keep your data safe other than taking your money every month. For them a security breach will likely mean lawsuits, competitors eating them alive or in the case of regulated data the potential for fines.

If you are looking to outsource more than your non-essential applications, such as a health organization outsourcing their Electronic Health Record and Billing, which are critical to the organization and contain confidential data you will want to perform due diligence by scrubbing the terms of service for exceptions you require, put business associate agreements in place where necessary and analyze any contracts closely.

As a small business you won’t have much leverage with many vendors but if you are a medium or large business it is worth twisting arms a bit to see where you can realize some compromise. If the vendor cannot provide assurances you require you can keep hunting or take your own precautions to secure the data before it is sent to them. This might not be possible with services such as Electronic Health Records but if it is an online Disaster Recovery or Backup service you may be able to take action to add additional layers of security.

Physical Security

This is the Gates, Guns and Guards portion of keeping your data secure. If the datacenter housing your data is properly secured you avoid a real risk to data security. Downloading 200 Terabytes of data over the average Internet connection would take months. Stealing the servers out of an insecure building would only take a few hours, plus a Oceans 11-style planning event just for fun.

When evaluating online vendors something we often do not think about is where the data is and what keeps people from accessing the data if they walked into the facility where the equipment is located.

In my last blog post I mentioned finding out where the datacenters were so that you know whether the vendor is geographically diverse. In addition to being geographically diverse you will want to ask about how the facility is secured and who can gain access to the equipment.

There is a computer security mantra related to physical security. For this article I will quote a variant from a Microsoft TechNet article: If a bad guy has unrestricted physical access to your computer, it’s not your computer anymore.

Social Engineering

Social Engineering is the act of manipulating or hacking a human-based system to gather the data you are looking for. Why go through five online systems attempting to answer questions to reset someone’s password when a well-placed, friendly call to customer service could do the same?

For a company storing or hosting my important data or systems I would expect that they have a system built to validate people’s identities, keep their facilities are secure, require multiple levels of approval to access and that they would not let a guy dressed as a telecommunications technician with no other credentials wander around the building unfettered and provide him keys to the wire closets.

This might not be something you can find out ahead of time but it is worth asking about. If you cannot get a straight answer as to whether they train their staff to look out for Social Engineering attacks you could test by calling their customer service number and see what information you can gather about your organization or whether they will reset your password without giving them your real credentials.

Another form of Social Engineering attack is the Phishing attack. A phishing attack is where a hacker sends out emails or other communications with a link or request for data while impersonating a legitimate tool or website. Normally this is to gather your usernames, passwords, personal data, or perhaps install malware onto your computer, from which they can gather data or launch attacks later. A variant of Phishing is called Spear Phishing and is targeted at a specific organization.

Other Factors

We have focused primarily on computers, encryption implementation and access to those systems. Just like your home, the front door lock is only one aspect to proper security. Other factors we will not be digging into during this article include items such as:

• Proper network security infrastructure including firewalls, intrusion detection and prevention systems (IPS/IDS) and secure network development and architecture.
• Host/Computer-based intrusion detection software, antivirus/anti-malware and other tools enabling vendors to monitor, act on, and protect against security events.
• Network Monitoring infrastructure, enabling vendors to monitor the health of the network, set baselines and alert automatically if there are changes in expected activity. In a perfect world these systems would be tied closely to the Intrusion Detection and other traffic-monitoring systems. A great real-life example of this is the online password site LastPass saw a network data anomaly and immediately took steps to secure their data. Breaches are not a good thing but they are to be commended for having monitoring systems in place with someone watching them so that they noticed when traffic changed on the network and took proactive steps to secure user’s data. After a move like that my trust in the company went up rather than down, whether or not there was a breach.
• Regular audits, secure development, and quality assurance processes with a focus on data security.

So I’ve done or verified everything above; is my data secure?

No one can guarantee that your data will be 100% safe. If an organization has enough money and is determined to gain access to your data there is a good chance they will, even if it means bribing your janitorial firm to photocopy your important data in middle of the night. What you need to do is determine what is reasonable.

Information Security is a compromise between ease of use and protecting user data. As has been said many times, the only secure computer is turned off, in a vault, with no network connectivity. At that point it becomes unusable so the system’s value is destroyed. Security teams are always attempting to strike this balance so that they protect the infrastructure while keeping the systems usable. If systems are not usable the users will find other ways to get the job done, which will almost always be more risky than making some compromises up front.

Security is a huge topic, protecting your data is an industry unto itself. Our goal here is to help you make good decisions and detect questionable statements without being a security expert.

>>>

If you made it this far, congratulations. Eat a brownie and blame me for destroying your diet. In the next article we will look at some specific examples of security claims and compromises.