2021 The Cybersecurity Disaster Year

 2021 has proved to be a disaster year for Cybersecurity.  Events have demonstrated just how porous our cyber infrastructure is.  Perhaps for the first year in history, compromises have grown faster than the increase in use, uses, and users might have suggested.  

CISA, the FBI and the NSA have warned in a joint advisory that Russian threat actors are actively exploiting and seeking to cause disruption to IT and OT networks, especially around critical infrastructure. The advisory outlines technical details of at least 18 vulnerabilities and malware attacks.

It may well have been worse than we know.  We know that many, not to say most, of our systems were vulnerable, to the corrupt supply chain (e.g. SolarWinds) or to vulnerable open source software (e.g. log4j), at least for the time it took us to appreciate and mitigate the exposures.  Few of us know that that window of opportunity was not used to covertly install backdoors into our networks for later exploitation.  It is at least possible, not to say likely, that hostile forces took the opportunity to stockpile compromises that they did not immediately have the motive or resources to exploit.  

it seems unlikely that our adversaries, particularly nation states, missed the opportunity presented to them by these exposures.  SolarWinds was an attack, planned and resourceful.  While we can identify and remove the SolarWinds code, it is near impossible to know about,  identify, or remove covert back doors installed using it.  

How can we mitigate the risk that such covert backdoors represent?

First, we must implement process-to-process isolation.  We can no longer operate a flat enterprise network.  We must structure the network so as isolate high risk applications, such as user owned devices, browsers, and e-mail, from sensitive data and services.  We can do this in part physically structure in the network, and in part by end-to-end application-layer cryptography.

We must implement strong process-to-process authentication ("zero trust") not just horizontally, that is system to system, but also vertically, up and down the stack. For example, the application must authenticate the database manager and the database manager must authenticate the application processes that use it.  It is urgent that we isolate covert compromises, backdoors, and vulnerabilities, before they are exploited and so that they do not put the entire enterprise at risk. 

Second, we must implement a policy of "least privilege."  While such a policy involves somewhat more administrative burden than the all too common laissez faire policy, security does not need to be free to be efficient.  It must only be cheaper than tolerating the risk.  If the covert backdoor has no privileges, it can do no harm.  

Third, we must demand that software come with a digital bill of materials.  When a vulnerability is found in widely used software, we must be able to quickly determine whether or not and where, we may have instances of that vulnerable software installed.  We should not have to beat the bad guys at scanning for the vulnerability.

Fourth, we must hold developers and suppliers of products that include software responsible for the content of that software, if not for its quality, at least for any malicious code which they ship.  While we may tolerate poor quality software and the now expensive patching regime forced on by that poor quality, that is not the same as tolerating malicious code which the supplier did not even write.    

I am tempted to go on but I want you to focus on the first and second.  These are policies that are specifically implicated by the risk that our networks are already compromised but they are not limited to that risk.  They are efficient because they address the entire range of cyber risks.  

A Leapfrog Enterprise Security Strategy

Recently I was quoted in an article on newly reported, but somewhat old, breaches.  In the report I was quoted as suggesting that these breaches suggest that security has fallen behind and that, just in order to catch up, we need a "leapfrog" strategy.  This post will suggest what such a strategy might contain.

Mine would start with strong authentication close to the users, i.e., at the end point. Strong authentication will start with privileged users and move to all employees. We have known about the limitations of passwords and what to do about them for thirty years. It is way past time to get on with it. Going forward, the end point of choice will be the mobile computer, colloquially referred to as a "smartphone."  This device already contains powerful sensors that can be used for authentication of claims to identity.  Apple Touch ID and Samsung Face Unlock are simply early examples of what can be done.  These are quick and easy to use and, in combination with possession of the device, constitute strong authentication.  

My strategy would include reducing the number of privileged users, the reduction of their privileges, and accountability for the use and exercise of privileges. It would include involving two or more people in the exercise of sensitive but rarely used privileges. We have too many privileged users and too little visibility into how those privileges are used.

It would include the automatic notification of the subjects of records and the owners and managers of accounts of all use, changes to, or transactions against those records or accounts. If we are to detect breaches on a timely basis, we must increase and improve transparency and accountability.

It will include isolating e-mail and browsing from mission critical and other sensitive systems and data. The intelligence is clear that many, not to say most, compromises begin by duping the users of these two applications.

It will include end-to-end end, end-point to application, not perimeter, not operating system, encryption. We cannot continue to operate large enterprise networks as flat spaces, as spaces in which any system may address any other system in the network.

It will include restrictive, i.e., "white list only," granular access control close to the applications and data. It will probably include access control at every layer, e.g. between the application and the database, between the database and the file system.

These measures are neither expensive nor disruptive. Google has demonstrated that even strong authentication can be flexible and convenient. They can be implemented in parallel. There are vendors recommending them and with products and services to implement them.

This is an "off-the-top of my head" list; I am sure I have omitted something important. However, it is informed by fifty years of thinking about this problem. I am sure that many of my colleagues have measures not on my list but which they would include in a leapfrog strategy.