Cost of Attack

For about a year now I have been arguing that we need to raise the cost of attack against our systems.  This is best justified by observing the rate of successful extortion attacks against our systems.  Few seem to be adequately resistant to such attacks.   

However, I am also mindful of the admonition of William Thomson, the First Baron Kelvin, who told us that if one cannot measure it, one cannot recognize its presence or its absence.  So, if one is to advocate for increasing it, one should be able to talk about how to measure it.   I use the mnemonic W.A.I.S.T.   These stand for work, access, indifference to detection, special knowledge, and time to detection and mitigation.  

The first letter stands for WORK.  The cost of attack will almost always include some effort on the part of the attacker, though, of course, some of this may be automated.  Take for example, a brute force attack against a password or a cryptographic key.  The cost is that of a trial multiplied by the number of necessary trials.  The number of trials required is a function of the number of bits, digits, or characters in the password or key.  One can increase the cost to the attacker by increasing the number of bits in the password.  (One can also reduce the value of success by changing the password or key after one use.)

For example, the cost of attack agains the Data Encryption Standard was defined as the cost of an exhaustive attack against the key.  While prohibitively high at the time of the publication of the standard, it was falling in proportion to Moore's Law, as was the cost of encryption.  Thus the DES implementers proposed Triple DES which raised the cost of attack by 2^56, is standardized for use until 2030 and will still be useful for some applications far beyond that.  

Note that the work of one person may be encapsulated in tools and procedures.  The cost of attack has decreased, been made more efficient, by attacker specialization and commerce.  One rogue may specialize in capturing credit card numbers while another may buy the numbers to monetize them in fraud. 

ACCESS is the second element of cost.  The attacker must have some kind of access to the target system.  Today that may be a network connection but in the early days, it meant physical access.  At a minimum an attacker must at least be able to send a message to the target system and observe its effect.  One can raise his cost by the use of physical isolation, "air gaps," gateways, firewalls, strong authentication, or encryption.  Note that strong authentication greatly increases the cost to the attacker while the ubiquitous mobile has been reducing its cost to the defender.  

INDIFFERENCE to detection is a little more subtle but so called "ransomware" illustrates it well.  Today's attacker believes that there is a low probability that he will be reported, investigated, identified, or punished for his attack.  We can increase his cost by increased monitoring, surveillance, and law enforcement.

SPECIAL KNOWLEDGE is often key.  It includes things such as user credentials, how applications work, such skills as programming, knowledge of the victims network architecture and others.  Interestingly enough, while it is often the most important thing that the perpetrator brings to the attack, it may be the one she herself least appreciates.  One will often hear hackers talk about the low cost of an attack, completely discounting the special knowledge and skill, often acquired over years, that they bring.  The attack looks cheap to them but would require much more of the other elements in the hands of another.

The defender may increase the cost of the special knowledge of the attacker by better operational security, so called OPSEC, choosing, identifying, changing, and protecting mission critical information.  We resist the acquisition of special knowledge about our systems, applications, and data by operating in a manner designed to resist the leakage of information about them that might be useful to an adversary.  These may include using code words, and changing key information.  Think TORCH, ULTRA, and MAGIC from WWII.  Think camouflage and disinformation.  Think product, application, and server names; better to call them "apple" and "orange," than "next generation product," "payroll" and "payables."  Think "trade craft."  

Finally there is TIME to detection and mitigation.  While some breaches can succeed in hours to days, others may require weeks to months.  Again ransomware attacks are of special interest.  The time from attack initiation to successful compromise of the victims entire network has been shrinking from weeks to days, in part from the tools, skills, knowledge, improved efficiency of the attackers.  The defender can reduce the time available to the attacker by improved surveillance, detection, and threat intelligence.  

Perhaps the most efficient way to reduce the time to detection and mitigation is out-of-band confirmation of all sensitive activity.  Kenneth Chennault, the President of American Express, told the President of the United States, that by confirming credit card charges using instant messaging, AmEx was often able to detect fraudulent transactions within sixty seconds.  

Note that these elements are fungible; an excess of any one, especially special knowledge, may decrease the need for the others.  If the attacker already has knowledge of a vulnerability, credentials, or applications, then the amount of work or time to detection required may be considerably less.  Increasing the cost of any one, increases the total cost.  Increasing them all proportionally mayincrease that cost exponentially.  

Three cautions:

• "An ounce of prevention is worth a pound of cure."
• "Never spend more mitigating a risk than tolerating it will cost you."  --Robert H. Courtney, Jr.
• At least collectively and over time, even criminals are rational; they will not pay more in the cost of attack than they can expect in the value of success.

Raising the cost of attack is efficient; the cost of attack goes up faster than the cost of the measures to achieve it.  While there is an upper limit, we are nowhere close to it.  The value of success has been going up very fast and the cost of attack has not risen proportionately.  The situation is now urgent and we have some catching up to do.  

2021 The Cybersecurity Disaster Year

 2021 has proved to be a disaster year for Cybersecurity.  Events have demonstrated just how porous our cyber infrastructure is.  Perhaps for the first year in history, compromises have grown faster than the increase in use, uses, and users might have suggested.  

CISA, the FBI and the NSA have warned in a joint advisory that Russian threat actors are actively exploiting and seeking to cause disruption to IT and OT networks, especially around critical infrastructure. The advisory outlines technical details of at least 18 vulnerabilities and malware attacks.

It may well have been worse than we know.  We know that many, not to say most, of our systems were vulnerable, to the corrupt supply chain (e.g. SolarWinds) or to vulnerable open source software (e.g. log4j), at least for the time it took us to appreciate and mitigate the exposures.  Few of us know that that window of opportunity was not used to covertly install backdoors into our networks for later exploitation.  It is at least possible, not to say likely, that hostile forces took the opportunity to stockpile compromises that they did not immediately have the motive or resources to exploit.  

it seems unlikely that our adversaries, particularly nation states, missed the opportunity presented to them by these exposures.  SolarWinds was an attack, planned and resourceful.  While we can identify and remove the SolarWinds code, it is near impossible to know about,  identify, or remove covert back doors installed using it.  

How can we mitigate the risk that such covert backdoors represent?

First, we must implement process-to-process isolation.  We can no longer operate a flat enterprise network.  We must structure the network so as isolate high risk applications, such as user owned devices, browsers, and e-mail, from sensitive data and services.  We can do this in part physically structure in the network, and in part by end-to-end application-layer cryptography.

We must implement strong process-to-process authentication ("zero trust") not just horizontally, that is system to system, but also vertically, up and down the stack. For example, the application must authenticate the database manager and the database manager must authenticate the application processes that use it.  It is urgent that we isolate covert compromises, backdoors, and vulnerabilities, before they are exploited and so that they do not put the entire enterprise at risk. 

Second, we must implement a policy of "least privilege."  While such a policy involves somewhat more administrative burden than the all too common laissez faire policy, security does not need to be free to be efficient.  It must only be cheaper than tolerating the risk.  If the covert backdoor has no privileges, it can do no harm.  

Third, we must demand that software come with a digital bill of materials.  When a vulnerability is found in widely used software, we must be able to quickly determine whether or not and where, we may have instances of that vulnerable software installed.  We should not have to beat the bad guys at scanning for the vulnerability.

Fourth, we must hold developers and suppliers of products that include software responsible for the content of that software, if not for its quality, at least for any malicious code which they ship.  While we may tolerate poor quality software and the now expensive patching regime forced on by that poor quality, that is not the same as tolerating malicious code which the supplier did not even write.    

I am tempted to go on but I want you to focus on the first and second.  These are policies that are specifically implicated by the risk that our networks are already compromised but they are not limited to that risk.  They are efficient because they address the entire range of cyber risks.  

Customs and Border Protection Facial Recognition Program

 Customs and Border Protection (CBP) compare a traveler's face to the photo on their passport to authenticate their identity and associate the traveler with the information in the passport.  Historically, this comparison has been done by the CBP agent.  The traveler presented his passport to the agent who opened it to the traveler's photo and compared the traveler's face to the photo. This has been a time consuming, somewhat cumbersome, and error prone process.  

Now this process has been automated.  The traveler faces a digital camera and a computer compares the traveler's face to faces in its database, the database of photos that were submitted along with applications for passports (or visas).  If a match is found, the traveler has been identified.  This process is more complete, faster, more convenient, uniform, and less error prone than relying upon the capability or skill of a human agent.  

For travelers who have just been on a cruise, this identity check is all that is required.  Having been so identified the traveler can go straight to baggage claim. International air travelers may still be interviewed by an agent who will ask all the questions that agents have always asked, such as where the traveler has been, where they are going, and the purpose of their trip. The computer will show the agent all the information that is associated with the traveler in the database.  

Tests of this technology conducted over months suggest that the technology correctly identifies about 98% of travelers entering our shores.  Any exceptions are resolved by an agent using the same methods and procedures CBP has always used.  

While CBP has taken steps to incorporate some privacy principles into its program, the Government Accounting Office (GAO) has criticized its notices to travelers about the technology and particularly their failure to adequately notify travelers that they may opt out of the program and enter through the archaic procedures.

The American Civil Liberties Union (ACLU) is "alarmed" about the program.  They fear that "DHS has already laid out - and begun implementing - a clear plan to expand face surveillance."  Of course, this program is not surveillance but merely automation of an established application.  The ACLU is concerned that facial recognition technology in general is "riddled with bias and inaccuracies," and "the program will likely result in harms ranging from missed flights to lengthy interrogations or worse."  Here the proof is in the pudding.  So far, travelers endorse the program for its speed and convenience. 

The ACLU also fears that facial recognition technology "threatens to supercharge DHS's abusive practices."  Certainly there have been abuses at the border.  I caution clients to be prepared for them.  However, most have been abuses of their authority by individuals.  While I have faulted DHS and CBP for their failure to caution against these abuses, I have found no evidence that they were the result of policy or programs.  In my sixty years in information technolgy, I can recall no useful technolgy that was not been abused or misused.  

As a security practitioner, I have preferred facial recognition, and speaker recognition, to such mechanisms as fingerprint (recently shown to be less reliable than we have believed for a century https://tinyurl.com/fingerprintreliability) or even the precision of DNA.  Facial and speech, are the only two "biometrics" that can be recognized by ordinary people, even infants, better than computers.  We are wired for it.  Indeed, it is only recently that computers have achieved parity with people in recognizing. All the other biometrics have relied upon experts to  interpret them for us.