Just received SANS NewsBites’ May 19, 2009 issue (Vol. 11, Num. 39) and one article caught my eye. Seems that the sponsors of these Cyber Challenges need some help in naming them:
…a week from Friday…three national cyber games will be announced at a Center for Strategic and International Studies (CSIS) luncheon. The competitions are part of a huge talent search and talent development program to find and nurture the young people who have the skills to become the next generation of great security professionals… But we are trying to agree on a name for the SANS competition. Please pick the one, two or three you like best and send them back to email@example.com. Thanks in advance.
SANS War Games
SANS NetAttack Games
SANS King of the Hill Challenge
SANS Security Challenge
SANS InfoSec Challenge
SANS Challenge Net
SANS Security Warrior Competition
SANS Capture the Flag Student Tournament
SANS War Game Challenge
SANS War Games Challenge
SANS InfoSec Faceoff
It’s a great idea and sounds like loads of fun. How about we help them out? I chose SANS War Games, SANS Security Challenge, and SANS InfoSec Faceoff.
Last month, I posted “What’s Your Identity Exposure Index?” I’ve had some interesting feedback. This one stood out:
I was really interested in your article about online identity exposure. Since I’m on the web most of the day – for my job, Twittering, creating a brand for my jewelry business – a Google search for my name delivers all accurate results on the first page. However, after taking your suggested test, my iEi was still only 1.6, which made me feel a little better. Do you have any suggestions for lowering that score…or is the damage already done once it’s done?
I’m still researching this issue, but I can tell you from personal experience that once something is on the web, it’s likely to be there for a very long time. I have managed to get some erroneous public records removed from the web, but some very old USENET postings have resisted my efforts at removal.
Public records are just that, public; but governments are prohibited from revealing, willy-nilly, sensitive information about their citizens. This means that if a “public” record somehow shows up on the Internet with sensitive information revealed (SSN, police reports, legal information, e.g.), a complaint on the proper channels will usually get the record removed.
I’ll give you the best solution I know, one that I’ve been using for some years now: If you are on line regularly, do everything you can to post and reveal the information that you *want* people to find. A blog is great for this. Using my blogs, over the past five years I’ve managed to push the junk well beyond the third page of most search engine results. I can live with that.
Depending on whose reports you view, spam accounts for from 85 to 95 percent of all emails sent. This may hold true over the Internet at large, but as with any other statistical data, there are local and regional variations. My own inbox is an exception to the general rule; I get far more legitimate emails than spam.
The company I work for provides spam filtering for several SMBs, so I have to hand real data that I can evaluate. Based on last week’s numbers, we processed nearly 100,000 messages in our filters. Of those messages, nearly 70,000–70%–were spam; nearly 30,000–30%–were accepted as legitimate. Our data has its own wild variations: one set is very low with only 18% spam; another set reaches a high of 92% spam.
I’m not a statistician, but it’s easy for me to see how big a problem spam has become. I’m not ready to say email is dead as a business communication medium, but it certainly needs an overhaul.
Without a doubt, SANS offers some of the best and most trusted computer security training and certifications. Today, I was thrilled to find that they’re currently offering four free mini-courses. I already completed the Windows Intrusion Discovery course and started on Cyber Forensics and let me tell you, there’s nothing “mini” about the content.
….(there are four – pen testing, forensics, vulnerability testing and Windows intrusion detection). They are very short…but you actually learn a lot in a short time. What is most interesting about them is how close the online teaching is to live classes. When the instructors are good enough,
on-demand courses are just wonderful- perhaps better than traveling to attend a live class because you can replay and review sections (Tivo-like) whenever you want. And you get real time feedback on mastery with quizzes at the end of each section. They are at
If you don’t have a SANS portal login, you’ll need to create a free account to gain access to the courses and other material on the site.
Each course presents a five-question assessment test (you can take it more than once) and you get a certificate of completion.
By the way, if you register for any full length SANS OnDemand course before June 15th, 2009, you’ll save 25% off the cost of tuition—a significant discount.
Quick: On a scale of 0 to 5 (0 being nearly invisible, 5 being at risk), how much of your identity is exposed on the Internet? If you’re wondering, there are some tests you can try that will give you a good idea of you Identity Exposure index (iEi). Here are the tests I performed and some calculations you can use. I chose these tests because they could give an identity thief enough information to impersonate you under the right circumstances. For example, knowing your mother’s maiden name and a former address might be enough to get past a security question or two. Heaven forbid your Social Security number shows up anywhere on line!
Keep in mind that this isn’t absolute by any means; it’s more of a quick-and-dirty estimate. But what you find might surprise you.
Use any top search engine. I used Google. My test results are shown in parentheses.
1. Search your name in the form you commonly use; e.g., Ken Harthun, not Kenny, Ken G. or other variants. Count the number of accurate hits on the first page. (9)
2. Search your full legal name as it appears on your birth certificate. Count the number of accurate hits on the first page. (3)
3. Search your mother’s married name, with and without her middle name and middle initial. If her maiden name shows up anywhere on the first page, count 10; if not, count 1. (10)
4. Search the last six digits of your Social Security number, including the dash. If your name shows up anywhere on the first page, count 10; if not, count 1. (1)
5. Search your home phone number with area code. If your current address is shown, count 10; any former address, count 5; else, count 1. (5)
Now, add all the scores. Maximum score is 50. Divide by 10 to get your iEi. It’s your choice whether or not to round off.
As you can see, my score was 28, so my iEi is 2.8, which is above the median. For comparison purposes, I also did the tests using my wife’s information and her iEi is 0.7. That makes sense because she does almost nothing on the web, save for checking her one Yahoo! mail account.
I’m interested in some feedback on this for a future article and to further refine the tests.
As usually happens with major disaster events—in this case the impending Swine Flu pandemic—email scammers are busy perpetrating pharmaceutical and other types of scams. In some cases, they’re using celebrity names to grab attention. Spam is hitting inboxes with various subjects. The following list, compiled by McAfee and posted on the McAfee Avert Labs Blog, shows some of the subject lines they’ve seen:
First US swine flu victims!
US swine flu statistics
Salma Hayek caught swine flu!
Swine flu worldwide!
Swine flu in Hollywood!
Swine flu in USA
Madonna caught swine flu!
They also report a 30x increase in the number of domain name registrations mentioning “swine.” It’s a good bet that many of those names will be used by scammers.
I’ve alerted my clients to this latest wave and sent reminders to everyone that should they receive any such emails, they should immediately delete them. That’s good advice to pass along.
My last post on this subject discussed the 10 Immutable Laws of Security. This one takes the next step–also a Microsoft “archived” essay, but still relevant today. These are so self-evident that I’m not even going to burden you with my thoughts. Print this out and hang it where you can see it as a constant reminder these are the 10 Immutable Laws of Security Administration:
Law #1: Nobody believes anything bad can happen to them, until it does
Law #2: Security only works if the secure way also happens to be the easy way
Law #3: If you don’t keep up with security fixes, your network won’t be yours for long
Law #4: It doesn’t do much good to install security fixes on a computer that was never secured to begin with
Law #5: Eternal vigilance is the price of security
Law #6: There really is someone out there trying to guess your passwords
Law #7: The most secure network is a well-administered one
Law #8: The difficulty of defending a network is directly proportional to its complexity
Law #9: Security isn’t about risk avoidance; it’s about risk management
Law #10: Technology is not a panacea
I don’t know about you, but I sometimes get a little queasy when I’m thoroughly overloaded dealing with security and other user issues. So, while this post is completely off-topic, it’s certainly therapeutic; laughter, after all, is the best medicine. (Yes, I know. This has been floating around for a long time.)
What if Dr. Seuss wrote technical manuals? Here’s what you’d get:
Here’s an easy game to play.
Here’s an easy thing to say:
If a packet hits a pocket on a socket on a port,
And the bus is interrupted as a very last resort,
And the address of the memory makes your floppy disk abort,
Then the socket packet pocket has an error to report!
If your cursor finds a menu item followed by a dash,
And the double-clicking icon puts your window in the trash,
And your data is corrupted ’cause the index doesn’t hash,
Then your situation’s hopeless, and your system’s gonna crash!
You can’t say this? What a shame sir!
We’ll find you Another game sir.
If the label on the cable on the table at your house,
Says the network is connected to the button on your mouse,
But your packets want to tunnel on another protocol,
That’s repeatedly rejected by the printer down the hall,
And your screen is all distorted by the side effects of gauss
So your icons in the window are as wavy as a souse,
Then you may as well reboot and go out with a bang,
‘Cause as sure as I’m a poet, the sucker’s gonna hang!
When the copy of your floppy’s getting sloppy on the disk,
And the microcode instructions cause unnecessary RISC,
Then you have to flash your memory and you’ll want to RAM your ROM.
Quickly turn off the computer and be sure to tell your mom!
I’m going to take a lot of heat for this post. Maybe. Unless I’m right (which I usually am). So, let me just get it out of the way: The state of security on the Internet today is NOT YOUR FAULT. Neither is it the fault of the clueless surfers who click on any and every link in their email and say “yes” to every popup on their screen. It’s not the fault of those who love to install the “little bitty kitty” screensavers that are loaded with adware and the ones who use the “fun web products” emoticons and stationery with similar bent. No, it’s not your fault.
It’s M….no, it’s U….no, it’s…hell, it’s the software developers who don’t have a clue on how to write a secure application. The end user—be she a geek or a regular consumer user—has no way of knowing that there are security holes on the software she uses. And she shouldn’t have to be concerned about it, now, should she? NO.
The more I have to deal with the malicious–and sometimes just crappy–stuff that people manage to get on their systems, the more I want to grab the programmers, web app developers, and insecure software purveyors by the throat. Conspiracy theorists speculate that since the anti-malware software industry is a multi-billion dollar cash cow, we don’t have a chance of ever seeing truly secure software. I don’t think that’s true. There’s enough crap out there to keep the anti-malware industry busy for a long time.
But it does make one wonder, doesn’t it?
I search the web constantly for security-related news and content. One day last month, I came across a series of articles on TechNet buried in the archive. Microsoft prefaces the articles with this statement: “Archived content. No warranty is made as to technical accuracy. Content may contain URLs that were valid when originally published, but now link to sites or pages that no longer exist.” Well, I find the content interesting and relevant, certainly worthy of bringing to your attention. Here are the 10 Immutable Laws of Security according to Microsoft with my comments included:
We tend to take the programs and utilities we run for granted. We trust them to work as advertised and not harm our systems or corrupt our data. What we often don’t consider is that our computer is being controlled by the programs it’s running and those in control of it are the programmers who wrote the software. This isn’t a problem with normal software since we tell it when to run, what data to manipulate, and when to quit; we are able to exercise a measure of control. We still “own” our computer. With malware, “To run or not to run, that is the question” and those are our only two options.
As in #1, there’s a degree of trust that the operating system is doing what it’s supposed to be doing. If the OS is altered by a bad guy, then it’s doing his bidding, not yours.
Physical security isn’t complicated. My Security Maxim #8 covers it admirably.
That’s an understatement. Not only is it not your website anymore, but you’ve just become an unwitting accomplice in whatever havoc the bad guy wreaks. There is no reason in the world to allow anyone to upload programs to your website before you have the chance to vet them.
I am reminded of a friend who was baffled when he discovered that his PC was part of a P2P network being used to transfer pirated music. He couldn’t understand why his firewall “quit working” suddenly (he had P2P blocked on his router). Long story short, his teenage son had guessed the router password and changed the configuration. Heed my advice and make your passwords unguessable.
If you can’t trust the admin, you can’t trust the PC. The administrator can install anything he wants.
Make sure that your decryption key is kept in a secure place, not on your computer. It’s best to memorize it, but if you can’t, store it on a memory card and put it in your wallet. Make two copies and keep one in some other physically secure place. The first place the bad guy is going to look is on the hard drive.
Out-of-date malware scanners of any kind won’t protect you against the inevitable new variants that come along.
As it says in the article: “All human interaction involves exchanging data of some kind. If someone weaves enough of that data together, they can identify you.”
No matter how sophisticated the hardware and software become, they’ll never replace common sense and sound security policies and practices.