Measurable Security

Metrics are critical for continuous improvement, understanding where you sit in relation to where you need to be. Perhaps you've seen this before. I'm familiar with most of these projects, but this initiative in particular was new to me.

http://measurablesecurity.mitre.org/directory/areas/systemassessment.html

Nice list guys. Cross-posting here.

System Assessment

The narrative text description for this page is currently under development. Please check back later.
In the meantime, standardization efforts in this area of cyber security include the following:

• Common Vulnerabilities and Exposures (CVE)
• Common Weakness Enumeration (CWE)
• Common Weakness Scoring System (CWSS)
• Common Weakness Risk Analysis Framework (CWRAF)
• Common Configuration Enumeration (CCE)
• Common Platform Enumeration (CPE)
• Open Vulnerability and Assessment Language (OVAL)
• Malware Attribute Enumeration and Characterization (MAEC)
• Common Vulnerability Scoring System (CVSS)
• Software Identification (SWID) Tags
• U.S. Federal Desktop Core Configuration (FDCC)
• United States Government Configuration Baseline (USGCB)
• U.S. Defense Information Systems Agency’s (DISA) Security Technical Implementation Guides (STIGS)
• Center for Internet Security (CIS) Benchmarks
• Security Content Automation Protocol (SCAP)

Asymmetric Defense Failures

No. I'm not talking about the cost of an attack vs. the cost of defending the network. I'm talking about traffic flows. Communications are bidirectional, ingress and egress, yet many still focus on only ingress protection mechanisms.

You need both. For example, your firewall and intrusion prevention system (malware, etc.) may do a fantastic job at identifying incoming attacks. However, you also need egress detective and protective controls. For example, your DLP system can help identify data exfiltration – egress – and your network behavior anomaly detection appliance can help identify potentially compromised hosts communicating to command and control servers.

There's actually much more to write about on this topic. But for now, suffice to say that intelligent context and control of communications are important from both perspectives.

8TH Annual Dallas CPA Society Education Conference

May 4, 2012 between 8am and 5pm at the Loews Anatole – The Dallas IIA is joining up with the Dallas CPA society (over 6,800 members!) to provide two topics (50 minutes each) for their 8th annual conference (over 1,200 attendees at last year’s event).  Mr. Greg Estes asked for a cutting edge audit related topic that would appeal to corporate CPAs.

I responded with a track discussion covering cloud computing risks. The goal is to share perspective and understanding of outsourced data management and processing.

Here is the topic submission:

Cloud Computing Introduction and Risk Management

Join us on a journey to discover – and understand – the cloud. We’ll open the discussion with a review of Cloud Computing and what its heralded arrival means for your company or your clients. It’s here to stay and transform data management. The cost reduction, operations impact, and business elasticity are real benefits. However, there are also real, tangible, risk factors to consider. We will exam these risk factors and discuss solutions for managing risk in cloud computing environments. Slides and supplemental information will be posted to www.cloudauditcontrols.com. 

Common Audit Regulations, Standards, Practices, and Guides

These link to the original information sources.

The Abbreviated List

• Common Regulations and Standards SOX | GLBA | FFIEC | Basel II| FCRA | HIPAA | NERC | NRC | CFAA | FISMA | FRCP | FISCAM |Privacy Act of 1974 | Safe Harbor | NYSE  | PCI-DSS | COSO 
• Audit Practices and Guides | ISO 27001:2005 | ISO/IEC 27002-2005| OGC ITIL | BCI | CobiT | ISACA | AICPA | ISACA | OECD

Cloud Security and GRC: Internal Controls

Environmentally Friendly.

Here's the flow of a security presentation I sometimes use to stimulate thought and focus around controls and how they can be orchestrated, coordinated, to deliver contextually rich information security and cloud auditing relevant views of the environment.

Environmentally Relevant. 

The enormous data set produced by monitoring and management tools delivers useless information if the data isn't comprehensive of the its environment. Several years ago I worked for a Network Access Control (NAC) company. During Proof of Concept demonstrations we often found more devices on the network than the organization thought was possible. It wasn't uncommon to discover 15-20% more than a company thought they had on the network. One particular example found - not kidding - 20,000+ devices more than their estimated 40,000 devices the company thought they had worldwide. Yes, this is extreme. But it's also those experiences that drive my belief you have to know what you have before you can secure it. 

Here is how I summarize action items during discussions around this topic.

Circling Back: Repeatable Processes

Do you have any doubt - whatsoever - that a well-coached sports team with good talent can beat a loose gathering of the world's best talent? It takes more than talent to have repeatable success. Effective leadership and management provide purpose, methods and metrics for performing consistently at the top of your game. The fundamentals are taught early and revisited often in sports. Coaches want their players to master and lean into the basics under the stress of physical and mental exhaustion. It's what drives the extra effort in the last seconds, driving towards the goal, to square up your shot and follow through.


Mastering Fundamentals Take Time. 
Malcolm Gladwell, in his book Outliers: The Story of Success, illustrates the strong correlation between the amount of time invested in a particular skill and the outcome. Mastery, according to his research, typically occurs after 10,000 hours (e.g. ~20 hours/week over 10 years). Examples included the obvious, such as athletes and musicians. Examples also included the not-so-obvious, such as Bill Gates programming for 10,000 hours prior to his break starting Microsoft.

Now - I'm not suggesting that developing an effective IT GRC program is going to take 10 years. However, I am suggesting that developing a strategy aligned with your business purpose, goals, and constraints is difficult to create, audit, and effectively manage. Also, it will take you longer than 10 years if you never start.


The Manager Administers; the Leader Innovates.

Warren Bennis wrote a list of differences between leadership and management in his book On Becoming a Leader. Read through some of them here in the context of the three cycles we discussed in the previous blog postings. Each cycle has to be managed to function, and each cycle requires leadership to innovate and respond to changing conditions.

Here's what happens when a system breaks down from a lack of experience and maturity that develops over time, working through difficult challenges. It's a flash back to the 2004 Olympic Men's Basketball team fielded by the inventors of the sport. Basketball and Apple Pie are about as American as it gets. That, and sweet tea in the South.

The individual parts in this particular system are among the best the world has ever seen. But they failed miserably as a team. They didn't know how to work together, and they hadn't worked together long enough to infuse corrective feedback into their operations. For my friends that love American football... Love or hate the Dallas Cowboys, the insane sync between Tony Romo and Jason Witten emerge when they are under pressure. The same should happen with your own operations.

The 2004 Men's Olympic Basketball Team. [From Wikipedia]

The revamped 2004 team consisted of some young NBA  [super]stars early in their careers, such as Carmelo Anthony and LeBron James, and also included recent Most Valuable Players Tim Duncan and Allen Iverson. The team was coached by Larry Brown.

After struggles in several exhibition matches, the vulnerability of the 2004 team was confirmed when Puerto Rico defeated them 92–73 in the first game of the Olympic tournament in Athens. The 19 point defeat was the most lopsided loss for the USA in the history of international competition.

After winning close games against Greece and Australia, The USA fell to Lithuania, dropping to 2–2 in the Olympic tournament. Even after an 89–53 win over Angola, the Americans entered the knockout rounds in fourth place due to goal average, the lowest seed of their group. The Americans faced undefeated Spain in their quarterfinal game, winning 102–94.

The semi-final match saw the team defeated by Argentina, 89–81, ending the United States' hold on the gold medal. ... Before 2004, American teams had only lost two games in all previous Olympic tournaments, whereas in this one the American team lost three.

VMware vCloud Director Segmentation: PCI and HIPAA Firewall Controls

This came up last week and I thought I would post here to keep the information easily accessible.

Yes. You can use vCD to segment environments that are required to comply with HIPAA and/or PCI.

The firewall functions in vCD in no way preclude you from using vCD to host production Primary Account Number (PAN) or electronic Private Healthcare Information (ePHI) as long as you comply with all of the other controls required to host the information. Here are the details from the requirements along with specific comments.

PCI has an entire section devoted to firewall controls (Requirement 1: Install and maintain a firewall configuration to protect cardholder data), of which the most restrictive requirements are [1] the ability to implement ACLs, and [2] SPI/Dynamic Packet Filtering.

Link to Data Security Standard | Link to Navigation Document 

Requirement 1.3.6 

Verify that the firewall performs stateful inspection (dynamic packet filtering). (Only established connections should be allowed in, and only if they are associated with a previously established session.) 

HIPAA has specific segmentation requirements for health care clearinghouse functions found here. Although they are specifically called out as Administrative Controls, the definition for this bill is defined as:

Link to 45cfr164.304 

Sec. 164.304  Definitions 
Administrative safeguards are administrative actions, and policies  and procedures, to manage the selection, development, implementation, and maintenance of security measures to protect electronic protected  health information and to manage the conduct of the covered entity's workforce in relation to the protection of that information. 

Note the lack of any detailed requirements – intentionally – to allow a broad range of solutions to fit the requirement.

Link to 45cfr164.308 

164.308(a)(4)(ii)(A)

(ii) Implementation specifications:

    (A) Isolating health care clearinghouse functions (Required). If ahealth care clearinghouse is part of a larger organization, the clearinghouse must implement policies and procedures that protect the electronic protected health information of the clearinghouse from unauthorized access by the larger organization. Sec. 164.304 Definitions 

The Circle of Trust - Cloud Audit Assurance

Assurance is the grounds for confidence that the set of intended security controls in an information system are effective in their application. 
(NIST  SP 800-37 and SP 800-53A)  

Cloud Audit Assurance. 

What can you do to provide assurance that your cloud infrastructure serves the purpose for which it was designed while protecting the data? Where do you start? Where does trust begin? Let's discuss three cycles that may help frame the discussion and an approach that may work for you. There's truth in the effectiveness of simple models that are easily understood and that can deliver repeatable results.

Start with the Business: Solution Alignment Cycle.
A previous post discussed GRC in the context of the business. We have to understand the objectives of the business and how the infrastructure and workloads align and support the objectives, in the context of risk, while managing compliance concerns. One of the great values of GRC tools is their ability to continually monitor and measure the effectiveness of your GRC program. A governor, or speed limiter, is a device used to measure and regulate the speed of a machine, such as an engine (wikipedia..). The important analogy is the feedback mechanism to regulate the effectiveness of the mechanical engine to perform as expected. The illustration below shows a simple cycle that is intended to be self governing.

Governance (alignment to business objectives) greatly affects how Risk (probability and impact) and Compliance (authorities, contracts, policies) are managed. Frameworks (COBIT, etc) may be used to help drive the GRC program, whose effectiveness is measured using GRC Tools. The workflow of the GRC Tool helps to continuously regulate the cycle.

Manage the Technology: Solution Delivery Cycle.
The Storage, Network, Compute, and Hypervisor (infrastructure) and Solutions (work loads), deliver a service. The effectiveness of a solution (capacity, performance, alignment/ability to meet needs/applicability) continually drives the selection and amount of technology assets required to deliver the solution. Put differently, the measurement of the effectiveness of the solution drives the hardware and software requirements.

Add Secure Operations Processes.
The PCVMR cycle was discussed in the previous post using the mission of a submarine. Provision the technology assets. Configure in accordance with your authorities, best practices, and policies. Validate against your checklists and using (as risk appropriate) additional tools, scanners, or third party resources. Monitor for deviations from your baseline. Accurately Respond and improve your processes based on what you learned.

Mission Operations - PCVMR Cycle

Reminiscing About the Past

Assurance.

Leading off the previous post, let's delve deeper into the processes that helped provide mission assurance to the crew taking the boat down to operational depth. We spoke of submarines and the mature operational approach that allowed a crew barely out of high school, most with no formal education, to not only function in these demanding environments, but excel and push themselves and their equipment to the extremes. 

Why were we successful? 

It was more than top-notch training. It was more than engineering and equipment superiority. It included a deep knowledge of operational processes that work in orchestration with the equipment and a firm understanding of the mission objectives and risks. The effectiveness of everything was measured and fed back into the processes and equipment.

Provision | Configure | Validate | Monitor | Respond

The PCVMR process cycle provides insight into how we were able to attest to the assurance of our boat to keep us safe and deliver on her mission. Here's how it works.

Provision: Equip yourself with the right systems for your mission. Submarines are equipped with systems appropriate for accomplishing their mission. Ballistic missile and attack submarines have very different missions and very different equipment... and crew and training. The highly specialized Submarine NR-1 was outfitted with equipment and capabilities not found in other subs because that's what her missions required. 

Configure: We sometimes laughed at a few of the Standard Operating Procedures (SOPs), but we respected them. Some would say, "Rules are written in blood." That's because somebody paid a heavy price for that stupid rule to check that breaker or valve lineup twice. Every system had a checklist for every operational lineup. These lineups are thoroughly tested by smart engineers, and every effort is made to follow the book. It's one thing if you're throwing your leftover litter into a McDonalds wastebasket. It's another to dump or pump it overboard underwater. One is casual. The other is very carefully handled. 

Validate: Everything was checked twice before getting underway. Every critical system was reviewed. Every change. Anyone that's spent time underway will recall the repeat-backs required on the phones as you read from a procedure to senior operator. The senior operators then repeated the same requests to watch officers for final permission. Everyone backed each other up to validate actions. Important actions were verified formally by a second person and signed off by all parties involved. Some critical actions required multiple validations and checks based on the affect of the system to the ship's mission. Once everything is known, you have entered an operational steady state, or a known state of operations. 

Monitor: Despite the best intentions to engineer flawless equipment and set everything up correctly, things go wrong. Systems are heavily monitored, automatically and manually, many both, to identify state deviations, or changes in the known state of operations. These may be intentional by the crew and known. These may be intentionally malicious from an external source, or changes could exist because of an inexperienced operator. The monitoring systems (some of which are redundant) help identify the early state of changes to give operators the most time to respond appropriately. Monitoring occurs across many complex related systems, and you need to identify issues as quickly as possible to minimize their impact. 

Respond:  It is the operator's experience and well-rehearsed drills that helps lead the best response. Realistic drills are part of every day life underway in preparation for when something bad happens. You expect something bad to happen. And it does. It's the workflow, methodical analysis, and rapid response that make the difference between "that was close!" and a new SOP. Rules are written in blood. Responses to incidents are debriefed for details that could could have managed the incident better than what was done. After Action Reviews. Post Incident Reviews. The outcomes of these meetings completes the PCVMR Cycle as they affect the Provisioning, Configuring, Validating, Monitoring, and Responding. 

Can you see how this translates to cloud security and audit? We'll dig into that next. It's time to walk out of the bubble and back into the cloud:).