Shifting the Balance of Cybersecurity Risk: Security-by-Design and -Default [pdf]
1–10 of 33 posts
Re: Shifting the Balance of Cybersecurity Risk: Security-by-Design and -Default [pdf]
#2[flagged]
Re: Shifting the Balance of Cybersecurity Risk: Security-by-Design and -Default [pdf]
#3I would take this document more seriously if they removed the Canadian government logo, I remember in early 2021 how easy it was to exfiltrate passport and other PII from the a certain Quebec gov agency agencies, because they had web apps written in ASP.Net and didn't do proper authorization/authentication measures, so anyone with basic knowledge of curl and python could easily exfiltrate mass amounts of data. People are stupid, they upload sensitive documents (passport info) and other things under the assumption that the government is competent enough to secure their stuff.
Re: Shifting the Balance of Cybersecurity Risk: Security-by-Design and -Default [pdf]
#4I would take this document more seriously if they removed the Canadian government logo, I remember in early 2021 how easy it was to exfiltrate passport and other PII from the a certain Quebec gov agency agencies, because they had web apps written in ASP.Net and didn't do proper authorization/authentication measures, so anyone with basic knowledge of curl and python could easily exfiltrate mass amounts of data. People…
One might consider that the Quebec government having such significant problems is all the more motivation for the Communications Security Establishment to drive change.
Re: Shifting the Balance of Cybersecurity Risk: Security-by-Design and -Default [pdf]
#5Hopefully one day we can get away from systems that are vulnerable by design such as Windows, Linux, iOS, AWS, etc. where security was not considered during their design process and are thus structurally doomed to perpetual vulnerability as decades of history have shown that security can not be bolted on. Only a greenfield redesign incorporating security designed, verified, and demonstrated to thwart the best efforts of nation-state attackers such as the NSA is adequate for the future. Even now we see commercial systems regularly targeted by groups identified as nation-state or state-sponsored attackers, so anything less than stopping nation-state attackers is inadequate to protect against expected and proven threats.
Luckily, we have historically had systems and certification processes adequate for the task such as the Orange Book Level A1 which SCOMP and GEMSOS [1] were successfully validated against, and the Common Criteria SKPP [2] which required a NSA penetration test with no identified deficiencies that INTEGRITY-178B [3] was successfully validated against. The practical evaluations obviously being in addition to the formal specifications and formal proofs of correctness needed to demonstrate a secure design as part of the validation process.
Only by the application of principles used there, which have demonstrated success against nation-state attackers, to do greenfield redesigns of the entire computing stack is meaningful security against proven threats possible. Everything else is lipstick on a pig that is attempting to bolt on security which has never once succeeded in providing meaningful security against the threats we find ourselves faced with today despite decades of effort, billions of dollars, and endless failed attempted validations by large software companies via these same certification processes. In fact, so many, such as Microsoft and Apple, have failed that the Common Criteria standard [4] itself points out that (to paraphrase a bit) it is likely economically infeasible to retrofit an existing product line to protect against attackers with a "Moderate attack potential" as nobody has ever succeeded.
[1] https://www.cse.psu.edu/~trj1/cse443-s12/docs/ch6.pdf
[2] https://www.commoncriteriaportal.org/files/ppfiles/pp_skpp_h... Page 116
[3] https://www.commoncriteriaportal.org/files/epfiles/st_vid103...
[4] https://www.commoncriteriaportal.org/files/ccfiles/CCPART3V3... Page 39
Re: Shifting the Balance of Cybersecurity Risk: Security-by-Design and -Default [pdf]
#6Hopefully one day we can get away from systems that are vulnerable by design such as Windows, Linux, iOS, AWS, etc. where security was not considered during their design process and are thus structurally doomed to perpetual vulnerability as decades of history have shown that security can not be bolted on. Only a greenfield redesign incorporating security designed, verified, and demonstrated to thwart the best efforts…
Security was absolutely considered during the design process of Windows and iOS. I'm less familiar with AWS and Linux history but it's hard for me to imagine AWS wasn't designed with security in mind given a lack of security would mean people freeloading off of Amazon's servers and security was hardly an unknown subject at the time of AWS's design.
One of the main selling points of Windows NT when it was released was per-object ACLs. Windows NT was designed to be sold by the government and military, Dave Cutler wasn't oblivious to the fact that the OS would need to have security in order to get lucrative government contracts. So I'm not really sure how "Just consider security during the design process" is going to save us given all the wildly insecure systems we have where security was considered during the design process.
I also don't see Microsoft releasing "Securedows" and replacing Windows, I see any such potential Greenfield secure system as being a specialised product with limited performance/functionality for high security applications which will complement low security systems.
Also as passé as the concept is, you really can get a fair degree of security by just disconnecting servers from the internet because few hackers are willing to travel halfway across the world and sneak into a building to infiltrate a network. We're probably never going to able to run nuclear missile silo's out of AWS even if they redesign it from the ground up.
Re: Shifting the Balance of Cybersecurity Risk: Security-by-Design and -Default [pdf]
#7Hopefully one day we can get away from systems that are vulnerable by design such as Windows, Linux, iOS, AWS, etc. where security was not considered during their design process and are thus structurally doomed to perpetual vulnerability as decades of history have shown that security can not be bolted on. Only a greenfield redesign incorporating security designed, verified, and demonstrated to thwart the best efforts…
I think it's unfair to say those didn't consider security. Security was one of the big features of the Windows NT familiy in its early days, and Linux also obviously has a lot of security in its design. Their problem is that the threat model completely changed since their design.
Windows and Linux were written with the assumption that a computer has multiple users, most of them without admin privileges. The threat model includes things like account security, processes from one user influencing processes of other users, (at least on Windows) users viewing files of other users, non-admins modifying the computer configuration, one user taking all resources, etc. They mostly solve these problems well, but some of these problems are now much less relevant, some of the core assumptions have become less valid over time (the admin/non-admin split), and many new considerations are now part of the threat model, such as protecting against rouge applications run by the same user, untrustworthy peripherals, etc.
This is one of the issues with security-by-design: your definition of security will change over time, in ways your design can't easily accomodate
Re: Shifting the Balance of Cybersecurity Risk: Security-by-Design and -Default [pdf]
#8[flagged]
[flagged]
Re: Shifting the Balance of Cybersecurity Risk: Security-by-Design and -Default [pdf]
#9Hopefully one day we can get away from systems that are vulnerable by design such as Windows, Linux, iOS, AWS, etc. where security was not considered during their design process and are thus structurally doomed to perpetual vulnerability as decades of history have shown that security can not be bolted on. Only a greenfield redesign incorporating security designed, verified, and demonstrated to thwart the best efforts…
Security was absolutely considered during the design process of Windows and iOS. I'm less familiar with AWS and Linux history but it's hard for me to imagine AWS wasn't designed with security in mind given a lack of security would mean people freeloading off of Amazon's servers and security was hardly an unknown subject at the time of AWS's design. One of the main selling points of Windows NT when it was released was…
Microsoft has continuously attempted and failed over multiple decades to get Windows NT of any flavor or configuration certified against anything more stringent than EAL4+ which is not even certified to protect against attackers with a "Moderate" attack potential. A older version of the standard prefaced EAL4 as being limited to protecting against "casual and inadvertent threats". That does not, by any measure, qualify as a vote of confidence in the security of the product. Under the old Orange Book standard EAL4 would approximately qualify as level C2 as Windows systems contemporaneously certified against both the Orange Book and the Common Criteria were certified at EAL4 and C2 simultaneously. A post-mortem on the Orange Book evaluation criteria [1] clarified that C2 was designed to allow commercial systems with no security to get used to the idea of doing a certification so that they could in the future design a proper system with actual security [2]. To add insult to injury, Microsoft has only ever achieved these levels with stripped-down, hardened versions so they could only achieve such vaunted heights as "protection against attackers with a Enhanced-Basic attack potential" after security configuration.
Also note that EAL4 is the level pointed out in the Common Criteria as being the highest level a existing commercial product can be retrofitted to. The standard explicitly points out that to achieve a higher level requires a greenfield redesign with security designed to achieve higher levels from the start (hint hint they added that in because Windows kept failing in their attempts to get their EAL4 quality system certified at EAL5).
Maybe you are correct that security was considered during the design process of Windows, but the security designed in is nothing short of a complete and utter joke. No security professional of any competence at designing systems that can actually protect against skilled adversaries would stand behind their security pedigree. I mean, for gods sake, even they would not stand behind their own security pedigree; find me one person on the Windows development team who would dare declare that Windows can survive against a NSA penetration test. It is laughable just thinking about it.
As for their ability to sell to the government. The total incompetence of the entire commercial IT world is so complete that under pressure to allow COTS vendors to make billion dollar deals with the government the procurement standards were lowered to allow EAL4 systems in high security contexts (as long as they were never connected to the internet, thank god for small wins). It has actually regressed even further in the recent years as in recent years they lowered the standards further to allow commercial firewalls and antivirus systems which are generally only certified to EAL2 under the swiss-cheese theory where if you just stack enough systems with egregious holes together then the system will be secure. We can see how that is working out. It is now to the point where now they just allow anything that is "certified" at any level.
That every commercial IT system is at best EAL4 quality is part of the reason why everything is so horribly vulnerable these days. The world runs on systems certified to absolutely not protect against "moderate" threats. To rise above that we must use systems that are designed for real security from the start as we have already seen from history that none of the existing systems can be retrofitted to do so.
[1] https://www.stevelipner.org/links/resources/The%20Birth%20an...
[2] https://www.stevelipner.org/links/resources/The%20Birth%20an... Page 6, Column 2
Re: Shifting the Balance of Cybersecurity Risk: Security-by-Design and -Default [pdf]
#10Hopefully one day we can get away from systems that are vulnerable by design such as Windows, Linux, iOS, AWS, etc. where security was not considered during their design process and are thus structurally doomed to perpetual vulnerability as decades of history have shown that security can not be bolted on. Only a greenfield redesign incorporating security designed, verified, and demonstrated to thwart the best efforts…
I think it's unfair to say those didn't consider security. Security was one of the big features of the Windows NT familiy in its early days, and Linux also obviously has a lot of security in its design. Their problem is that the threat model completely changed since their design. Windows and Linux were written with the assumption that a computer has multiple users, most of them without admin privileges. The threat mo…
It is absolutely fair to say they did not consider security (at least to a level that can be considered real security). They targeted a Orange Book Level C2/Common Criteria EAL4 level of security (at best) which is a level that was not even really intended to indicate there exists any security at all, and, as a result, were permanently unable to retrofit beyond that. They attempted to many times and failed every single time despite decades of effort. There are multiple systems designed both before and after that were designed to achieve the higher levels of security and succeeded. The security designed in was incompetent at the time and incompetent now and, as history has shown us, unfixable.
To then address your second point indirectly, I agree that there are systems, such as Windows, that have "security" designed for systems where all agents are inherently trusted. These systems are not inherently worthless as it is perfectly fine to use in situations where security is unnecessary such as children's toys or running a disconnected device. It is, however, unacceptable to use such systems in contexts that require a minimal level of security such as banks and hospitals like how they are used now. Using systems designed only to protect against casual and inadvertent attacks in critical systems is engineering malpractice.