The Black Liszt

Summary: The Ongoing Problem of Computer Security

This is a summary with links to my posts on computer security.

Computer security is important for the same reason as home security – you don’t want bad guys breaking into your house, wrecking it and taking your stuff! Here are brief summaries of the unending computer security problems and how to solve them.

https://www.blackliszt.com/2023/04/how-to-prevent-the-leak-of-confidential-documents.html

https://www.blackliszt.com/2017/05/computer-security-problems-solutions.html

In the invisible world of computers, security is elaborate, expensive and an ongoing nightmare of failure and ineptitude. But computer attacks are largely ignored, while physical security problems often make the news.

https://www.blackliszt.com/2014/09/cyber-security-and-cyber-insecurity.html

Managers treat managing computer security no differently than anything else. Huge mistake.

https://www.blackliszt.com/2015/06/systemic-issues-behind-the-cyber-security-disasters-at-opm-citi-anthem-etc.html

https://www.blackliszt.com/2015/06/what-baseball-can-teach-us-about-opm-anthem-and-other-cyber-thefts.html

Everyone in the physical world realizes that security falls into two entirely distinct categories. First is for places when they’re closed: security is stopping anyone unauthorized from entering. Second is for places when they’re open: keep visitors and employees from stealing things. Computer security focuses almost exclusively on keeping the bad guys out, largely ignoring the cases of visitors and (above all) employees from stealing things.

Here’s the basic idea of applying retail store methods to computer security.

https://www.blackliszt.com/2015/03/methods-for-effective-cybersecurity.html

Libraries too.

https://www.blackliszt.com/2017/03/libraries-are-more-secure-than-computers.html

Here are famous examples of the “insider threat” in the physical and software worlds.

https://www.blackliszt.com/2013/07/edward-snowden-daniel-ellsberg-ineffective-security-then-and-now.html

https://www.blackliszt.com/2013/07/cyber-security-standards-are-ineffective-against-insiders-like-edward-snowden.html

Although largely ignored, there are practical ways to implement insider-threat computer security.

https://www.blackliszt.com/2017/03/lets-fix-cia-cybersecurity-using-machine-learning.html

The government is terrible at cybersecurity.

https://www.blackliszt.com/2017/06/government-cyber-security-tops-the-oxymoron-list.html

https://www.blackliszt.com/2021/07/the-irs-could-have-prevented-the-tax-data-leak.html

And there is general ignorance about basic aspects of it.

https://www.blackliszt.com/2017/10/the-irs-anti-fraud-contract-with-equifax-is-good.html

Government security experts demonstrate deep ignorance in high visibility cases, confusing outside hacking with typical ignorant-user phishing.

https://www.blackliszt.com/2017/01/russia-hacks-dnc-podesta-email-fake-news.html

In spite of its own incompetence, the government produces mountains of regulations that companies are required to follow. The regulations largely ignore insider threats and don’t work for outside attackers.

https://www.blackliszt.com/2014/05/bureaucracy-regulation-and-computer-security.html

https://www.blackliszt.com/2017/05/security-regulations-vs-security.html

One of the many reasons the regulatory approach to security fails is that the “experts” are always fighting the last war.

https://www.blackliszt.com/2014/09/cyber-insecurity-and-the-maginot-line.html

Institutions that are hacked and lose mountains of customer information make a big show of concern, but don’t in fact help their customers.

https://www.blackliszt.com/2015/02/the-anthem-of-cyber-insecurity.html

https://www.blackliszt.com/2015/02/my-anthem-account-was-hacked.html

Some of those giants wait way too long and then lie like crazy to their customers.

https://www.blackliszt.com/2011/04/chase-data-theft-exemplary-handling.html

Smaller tech-oriented companies do the same thing.

https://www.blackliszt.com/2019/01/computer-security-breach-response-excellence.html

Part of why the data theft parade continues is that the people in charge have no real motivation to make security work.

https://www.blackliszt.com/2015/03/how-to-achieve-cybersecurity-motivation.html

Outside hacks succeed in part because unwitting employees open the door and let the bad guys in.

https://www.blackliszt.com/2019/11/cybersecurity-almost-impossible-to-achieve-heres-why.html

https://www.blackliszt.com/2015/04/internet-drivers-licenses-needed-for-users.html

Ransomware is a new way for hackers to profit from security breaches. Not many of the attacks make the news, but there’s an epidemic of it.

https://www.blackliszt.com/2021/06/the-colonial-pipeline-cyber-security-disaster-in-context.html

https://www.blackliszt.com/2022/12/new-york-citys-metropolitan-opera-crippled-cyber-attack.html

Articles about famous ransomware attacks shows the profound ignorance of “experts” on the subject.

https://www.blackliszt.com/2017/05/the-ransomware-hack-attack-lessons-from-the-experts.html

There are proven ways to protect against and recover from ransomware, which are sadly not widely used.

https://www.blackliszt.com/2023/05/how-to-protect-and-recover-from-ransomware.html

Computer security is rife with specialized terminology and abstruse concepts. It can be hard to understand. But the core concepts are easily understood when you compare hack attacks to physical things like car dealerships or gated communities.

https://www.blackliszt.com/2020/02/why-the-equifax-hacking-disaster-wouldnt-happen-at-a-car-dealership.html

https://www.blackliszt.com/2021/06/gated-communities-help-us-understand-the-ongoing-cyber-security-disaster.html

There is a special security case of law enforcement agencies with a legitimate need to look inside a consumer device. Apple does its best to protect the criminals. Here are the highlights.

https://www.blackliszt.com/2016/03/the-apple-fbi-fiasco.html

And here are the details:

https://www.blackliszt.com/2016/03/apple-can-help-fight-crime-while-maintaining-privacy.html

https://www.blackliszt.com/2016/02/apples-cancer-prevention-strategy.html

https://www.blackliszt.com/2016/02/apples-approach-to-privacy-terrorists-and-criminals.html

Until the uniform wisdom and practice of the ruling experts changes, computer security disasters will continue unabated in spite of massive spending to conform to the regulations intended to achieve security.

How to Protect and Recover from Ransomware

Has your computer system been hit with a ransomware attack? It means your computer systems and security management is incompetent. Did you pay the ransom or did it take over half a day to completely recover from the attack and become fully functional? It means your computer systems administration is incompetent.

An easy way to understand this is to think about what would happen if your laptop computer got locked up by ransomware. While not something most consumers know, it’s possible to do a special reboot of such a computer that restores it to factory settings. Once you’ve got a clean computer, you restore everything (programs and data) from the most recent backup you’ve taken and you’re back in business. You don't have a backup? Shame on you. With a service like Dropbox, older versions of your files are stored and kept, so you should be able to restore from there as well.

If you’ve got a major business with many services and databases, it is of course more complex – but the principles are the same. First, do a better job of protecting against the ransomware attack in the first place – and detecting it early if it gets in. Second, execute your disaster recovery plan, wipe your computers and restore them from backups. Even better, if you’re running a well-administered active-active system, the downtime should be no more than minutes.

Ransomware

Ransomware is a rogue program that gains access to all your programs and data, maybe sends all the data offsite, encrypts all the data so that nothing works. A ransom note is sent demanding so many Bitcoin to be sent; if the ransom is paid, supposedly the data will remain secret and get unencrypted to be available for normal use. Otherwise, your systems will remain unavailable.

Most of the organizations that are hit with ransomware have computer administrators that are run by experienced professionals. Most of them follow the standards of their field, and most are regularly audited to assure that they conform to the applicable security regulations. But ransomware keeps happening!

How we can understand this? The answer is pretty simple: the attackers are using the latest methods of attack, while the defenders and regulators continue to spend lots of money and time following long-since obsolete procedures.

Ransomware actions and defense

The rogue program may enter your computers because of inadequate security or through a phishing (email) attack. Sadly, the vast majority of computer systems lack internal systems security systems; i.e., they try to guard the walls and doors of the computer castle, but have nothing monitoring the behavior of people and programs that are inside.

Because of this massive gap in security regulation and practice, the rogue program often does its evil thing for days before the data lockup is detected, and by then it’s too late.

Once the problem is detected or announced, competent disaster recovery techniques, which are supposed to be standard practice, should enable rapid restoration of service complete with all data, normally within hours when properly done. For the last couple of decades, a more modern form of always-on computing has been practiced by many companies, in which there are multiple copies of all the required hardware, software and data operating at multiple locations, each of them servicing some of the load and all of them containing all of the data. Ransomware is helpless against this widely proven method of computing. The incredible “success” rate of ransomware is testimony to how few institutions use this proven method.

For example, here’s Microsoft’s description of their disaster recovery solution (they call it site recovery). Here’s the equivalent at Amazon AWS, and specifically for ransomware. And here’s a case study of a hospital system that uses the service for disaster recovery and ransomware protection/recovery.

Conclusion

Ransomware is terrible, one of the major consequences of the much-lauded cryptocurrency technology. Its numerous victims every day demonstrates how bad standard computer security and regulations are.The fact that an institution can be locked for days and all too often pays the ransom demonstrates how bad standard computer systems administration and disaster recovery systems are. The usual methods to make things better don't work.

There are many examples of companies large and small that are well-protected and that recover quickly should an attack succeed. The answers are out there. But because software is invisible, the vast majority of management can't see it.

Note: this was originally published at Forbes.

How to Prevent the Leak of Confidential Documents

There is a proven method for preventing the kind of leaks of highly classified documents that are recently in the news. The regulators, security experts and military doggedly keep trying to make their ineffective methods work, ignoring decades of failure.

While there's lots of detail, the basic approach of the security method all the authorities insist will keep our secrets and confidential information safe is simple:

• For outside attackers (hackers), build walls that are thick and high and have locked and guarded front doors. Keep the bad guys out!
  
• For traitorous insiders, enforce elaborate background checks to assure that only properly vetted employees have access to secret documents. Everyone who can access documents is a certified good guy!
  

Makes common sense, right? Everyone thinks so. The trouble is, the methods don’t work.

• Outsiders: In spite of ever-growing stacks of detailed regulations, the bad guys keep breaking in. While not in the news, there are literally dozens of successful ransomware attacks per day. The walls never seem to be thick or high enough.
  
• Insiders. Edward Snowden, Bradley/Chelsea Manning, and many others less famous. A large fraction of the giant data thefts from corporations and governments were done by insiders. The certification of good guys is never good enough.

So what can be done? Retailers of expensive goods have been using methods that work for a long time. Even some libraries use the methods! They can be translated to work for computers, something which has been done in various places for decades. For reasons known only to them, the authoritative Experts continue to ignore the method that works.

In simple terms, what works is comprehensive, highly detailed surveillance. Every person who accesses any computer in an organization has to log in. Once logged in, every system supports controls on what the person can see and do. If you're a customer service person, for example, you can access customer records, but not the organization's financial records. The idea is that each person has a normal pattern for interacting with the system, and deviations from that normal pattern should be flagged and examined; if the deviations are strong, the person's access should be halted until the issue is resolved. Suppose the normal pattern for a customer service person is that each time they take a call, they find and interact with a person's record. The system knows and routes every phone call. What if the person suddenly starts accessing more customer records than the phone calls they handle? If it's more than a couple, a red flag should be raised.

In the case of the IT person who appears to have stolen the confidential documents, there is no way a person with that role should be accessing such records! WIth a good surveillance system in place, their access would be immediately revoked after the first access and someone would find out what the problem was.

Who is Censoring US Intelligence Agency Criticism on Amazon?

A critical review I wrote of a book on Amazon was censored/suppressed. Was it profane or otherwise deserving deletion? No. It simply gave one star and pointed out errors and omissions, while acknowledging that fans of US Intelligence Agencies would admire the book. The review appeared briefly, then the link to it went bad. I interacted with customer service, who said they would submit a trouble report. I wrote another review, which appeared briefly then vanished. I tried once more. The last review was up for months. I got a warning from Amazon warning me that an unspecified review I had written failed to meet community standards, and if I did it again I would be banned. The review stayed up for many more months. And then it disappeared!

Spies, Lies and Algorithms was published by the Princeton University Press. It was written by Amy Zegart, a prominent, well-connected Professor at Stanford. I'm writing up this little experience because I suspect it's not an isolated incident; It's a step towards a society run like Orwell's 1984. Here's the story.

US Intelligence Agencies and Cyber-security

The grossly misnamed US "Intelligence" Agencies continue on the path of proclaiming their wonderfulness while US cybersecurity continues its free fall into unmitigated disaster. I describe the details of the sad state of cybersecurity in both government and private sectors in these posts.  For government cybersecurity, see this. Here is a detailed analysis of the DNC server hack declared by Intelligence agencies to be a Russian hack. They failed utterly to prove it, and ignored the clear evidence that the most prominent emails never resided on the DNC server!

It should come as no surprise that they are doing what all bureaucracies do, i.e., protect themselves and their reputations by hiding the facts and suppressing criticism. The author of the book clearly and explicitly takes the side of the Agencies on this issue and similar ones. While she has given courses to congressional staffers on cyber issues, she clearly does little but echo the propaganda of Agency Experts.

The Book

Amazon, always serving up books they think I might buy, showed me Spies, Lies and Algorithms: The History and Future of American Intelligence by Amy Zegart.

What a cleverly designed cover! I checked it out. The author seemed to be well connected and educated about the Agencies and recent events. Take a gander at her background:

Amy Zegart is the Morris Arnold and Nona Jean Cox Senior Fellow at the Hoover Institution and Professor of Political Science (by courtesy) at Stanford University. She is also a Senior Fellow at Stanford’s Freeman Spogli Institute for International Studies, Chair of Stanford’s Artificial Intelligence and International Security Steering Committee, and a contributing writer at The Atlantic. She specializes in U.S. intelligence, emerging technologies and national security, grand strategy, and global political risk management.

Zegart has been featured by the National Journal as one of the ten most influential experts in intelligence reform. She served as a commissioner on the 2020 CSIS Technology and Intelligence Task Force and has advised the National Security Commission on Artificial Intelligence. She served on the Clinton administration’s National Security Council staff and as a foreign policy adviser to the Bush 2000 presidential campaign. She has also testified before the Senate Select Committee on Intelligence and advised senior officials on intelligence, homeland security, and cybersecurity matters.

Skipping my usual practice of carefully scanning the reviews, I bought the book.

I then read the book. The author was nearly everything you could want: highly educated, knowledgeable, articulate, connected. There was just one little problem: she has completely bought in to the deep state, to the extent of denying that there is such a thing. She faithfully ignores what they ignore, reflects their lies and omissions and shows near-total ignorance of computers and the "algorithms" of her title. That's all! In fact, her book scared me, because it was such a compelling read to anyone who was ignorant of cybersecurity (i.e., practically everyone) or hadn't dug into the big lies.

The Reviews

I've written a number of reviews of all sorts of products since joining Amazon in early 1998. Most have been positive, all of them constructive. I thought this book needed a review from me; while my immersion in the Intelligence community was trivial compared to the author's, my knowledge of cybersecurity and related subjects clearly eclipsed hers.

I went to the review section and found a handful of authoritative-person reviews, all highly complementary, and about a dozen reviews by readers, all but one very positive.

The sole negative review, 1 star, was by a self-described retired Intelligence officer who titled his review "bias detracts too much." 57 people found it helpful. He didn't go into detail but said:

She tries to deny it but the Deep State is real and is our biggest challenge. ... She tipped her hand with selective alarm and omission of key events rampant in the first chapter.

The next most popular review, granting 5 stars and titled "There is some bias: here's why it isn't important" mostly demonstrates the power of being in the bubble:

I am a politically conservative individual studying intelligence and the IC for a number of years. Amy’s summary is accurate, thorough, and well-written. ...
I couldn’t find any factual inaccuracies that would render the book a decorative piece or kindling.

These reviews demonstrate the problems of the Intelligence community and its image. It isn't about bias so much as it is about ignorance and denial.

Writing a Review

I dove into writing a review. My goal was to praise the author for her evident virtues, but to give a few facts to illustrate the basis for my giving it 1 star. I typed it into the box Amazon provided without keeping a copy of what I gave -- silly me. I posted it and waited. Three days later I got a notice that my review was posted.

Hooray! I clicked to see the full review. This is what I got:

Cute dog, but what's going on here?

I went back once a day for many days and clicked again. The review never showed up.

Next I got online with Amazon customer service in a chat. After a bit of effort, the person agreed that the error about the Zegart review was a problem. I asked him to submit the issue for resolution, and he said he would. I waited until he said it was submitted.

Writing a Review Again

After a number of days with no change, I decided to simply post another review, this time saving what I had written. My submission of the second try was confirmed:

I never received the confirming email from Amazon saying that my second try at a review had been posted. But I kept checking, and to my surprise, my second review was posted. The bad link to the original review (Feb 12) now led to the new review (Feb 19). Hooray, it's posted! Here's a screen shot of the first part of it:

There's nothing bad going on here -- I'm just being paranoid! And the review has already gotten several votes for being Helpful.

The Second Review Disappears

I went to the page again, and noticed that the total number of reviews had gone down. I look for my review. I was thorough. It's not there. Not there.

I had a thought. I had saved the original confirming email I got from Amazon pointing to my original review (which never showed up), which mysteriously DID point to my second try at a review. I click, and here's the result:

At least they're different dogs...

The Second Review Magically Reappears

I went to the page again and found, to my great surprise, that the elusive review was back!!

Just as a test, I wrote a positive 5-star review of socks I had bought on Amazon.

The Warning

A day or two later after the reappearance of the review, this showed up in my inbox:

Notice the careful wording. Notice that the exact review was not referenced, and that no specific violation of the guidelines was identified. I carefully read the community guidelines. Nothing that I wrote could be construed as violating them. The only offense of the review was to point out the deep issues of the Intelligence Community and to give a couple specific examples that illustrate it -- one of them the supposed Russian hacking of the DNC server.

The second review stays up for many months, and then...

I checked the review occasionally over the following months. It stayed up and received dozens of "helpful" votes. It was second or third on the list of "critical" reviews.

Then, more than 6 months later, I got this.

Nothing about which content I posted that violates the Guidelines. No links. Nothing about removing the awful content. I'm just supposed to know, I guess. Naturally, I suspected that the Zedaris book review was the issue, so I went to the book's page. The book is doing well -- it's now an editor's pick in nonfiction. I went down to the reviews. The "Bias detracts too much" 1-star review is still up and went from 57 up votes to 102. Sure enough, mine is gone.

Boy, those misinformation police at Amazon are really on the job, giving proper notice and telling you what law you violated. And prompt! And careful to only take down evidence-based reviews that might change some minds. Or something.

The last chapter

I wrote all of the above. Before posting it, I checked once more and found to my surprise that the review was up again! It wasn't on the top reviews list, even though it had over 50 "helpful" votes, but it was there. Oh well, much ado about nothing. The review is visible, my post is irrelevant.

Many months later, I had an impulse to check again. The review is gone again!! I carefully checked, looking at all the 1-star reviews, which takes some clicking just to get to them. The "bias detracts too much" review is still there, still with exactly 102 up votes, unchanged from at least 6 months ago. I bet that somehow the review isn't shown to many people. The handful of other critical reviews each had just a couple votes at most.

My review -- gone again!

Update on Dec 2023:

I tried to write a review of a book. I got this:

All my reviews have been deleted!

I've reached out to them again. Something's going on!

Conclusion

Somewhere operating deep within Amazon there is an operation to suppress criticism of the CIA/FBI/NSA/whatever. I guess it could be Amazon employees who feel the same way, without official blessing. Or maybe, as we now know was the case with Twitter, there was an explicit back-channel connection to one of the 3LA's (3-letter agencies). After being allowed to be viewed for many months, my review garnered dozens of "helpful" votes. During that time I thought that the "image protecting" operation was walking a fine line between total suppression and letting low-attention items like my review alone to avoid attracting notice. But then it was visible again, just hard to find. And now, roughly a year after it was originally posted, it's gone.

FWIW and to be explicit about it, my review was NOT politically motivated. It was driven by facts and competence, consistent with these posts. Specifically see this. The job of the agencies is to enforce the law and protect us all from criminal and foreign attacks, a job for which, sadly, they have a track record of failure. And the job of prestigious professors who teach people about cybersecurity is to objectively assess the quality of the work, not ignore failures and incompetence.

New York's Met Opera is Crippled by a Cyber Attack

New York City's Metropolitan Opera has been the victim of a cyber attack that has shut down its website, box office and call center. As of this writing, performances continue while restoration work continues.

The Met Opera

The Met Opera is an incredible organization. Here it is on its Twitter page:

As they describe themselves on Twitter, they are "The world's greatest singers on the world's greatest stage."

I live a short walk away from this wonderful place and have enjoyed many amazing performances there over the years.

I've got tickets to see the Saturday matinee of their new production, The Hours. Something came up on Thursday that led me to go online to see if I could change to another date. This is what I saw:

Wow. Now it's Friday, and they've been down since Tuesday. It's a big deal:

No small loss, as the company handles about $200,000 worth of tickets each day.

Aida and The Hours, two major operas that are always popular with audiences, went on stage with an unusually empty theater, not even last-minute sales at deeply discounted prices helped save the day.

They are really scrambling. The Met Opera made an important announcement on Twitter:

And then said:

Just $50 tickets -- cheap for the Met -- and they're doing it for Dec 14, while this tweet was made on Dec 9. Their systems went down on Dec 6. So they're not planning on a resolution soon. And they have to use the symphony's box office instead of their own.

Computer Security and Cyber Attacks

The Met has "called in" the FBI, but that's a move that has yet to help any cyber attack victims. Here's why.

The Met has said nothing about the nature of the cyber attack. However, the fact that it's been days makes me think that it's likely to be a ransomware attack or something like it, because normally you'd just have to restore all your computers from backup or employ your disaster recovery protocol, which would normally take hours, not many days.

Ransomware is a relatively new kind of attack in which the hackers encrypt all your computers and won't give you the key to unencrypt them unless you pay a ransom, usually in terms of untraceable Bitcoin. Ransomware is amazingly widespread, hitting dozens of hospitals, corporations and government agencies many times a day. It's gone way beyond a crime wave -- it's a crime hurricane, and shows no signs of stopping.

It's likely that the Met followed all the regulations and expert advice for running their computers and keeping them secure. The trouble is, the regulations are ineffective and the experts don't know what they're doing -- they can't even keep their own systems secure, as has been famously illustrated many times over. Here is an understandable explanation of the issues. There are effective methods of cybersecurity, It's just that all the experts ignore them. In the middle of this post is a description of how smart people can recover from a successful attack in under an hour, if they've set things up correctly -- not unlike the way smart people have electric power backup generators for their homes.

Conclusion

I really hope the Met Opera recovers soon. Meanwhile, the cyber attack hurricane continues to intensify, largely staying out of the news, with the regulators and experts deepening their cluelessness as they press for larger budgets.

My question is simple: When will customers scream loud enough to make the complacent, computer-ignorant grandees in charge of the attacked organizations stop their support of computer executives who say impressive-sounding things while they continue to march to the suicidal orders of experts and regulators whose commands have been overwhelmingly proven to amount to holding up giant "welcome criminals, this is a defense-free zone" signs while spending ever-growing money to harm the organizations that pay them? WHEN??

The IRS Could Have Prevented the Tax Data Leak

If the IRS had wanted to prevent the leak of tax returns recently reported by Propublica, they could have done it. The methods are simple, effective and in use. They just didn’t implement leak prevention methods. Why? The problem isn’t money; the IRS spends billions of dollars a year on computer systems. Will this embarrassment get them to fix things? I’ve read through the “IRS Integrated Modernization Business Plan,” the April 2019 document that describes how the IRS will spend many billions over the next 5 years to “modernize” their computer systems, and nowhere in the document is there a hint that they’ll do anything but spend more money to implement more of the ineffective security systems they already have.

The IRS doesn’t create or invent cybersecurity methods; they try to adhere to all the security regulations, follow the standards and take the advice of agencies that specialize in cybersecurity. These other agencies employ top experts who set the standards that institutions follow to protect their computer systems and confidential data. So what’s going on here? Did the IRS suffer the tax data leak because they failed to implement one of these clear standards? Or is there something missing or wrong with the standards that affects the IRS and all the other organizations that are guided by them? Let’s see.

Cybersecurity is a complex issue. I’ve used the metaphor of a gated community to explain general computer security; while the walls and gates of a gated community tend to be secure and well-maintained, the equivalent in the computer world is a patch-work of incompatible wall sections from different manufacturers which are never built properly and often need fixes to be applied, which the computer managers too often take months to apply if they do the work at all.

It’s possible that a hacker broke into the IRS. But what probably happened is that an IRS employee or contractor with legitimate access to IRS data decided to make a political statement by grabbing the files of ultra-wealthy Americans, smuggling them out of the agency and giving them to Propublica. This is known as an “insider” threat. Here’s the shocker: modern corporate and government cybersecurity standards and regulations fail to prevent or even detect insider threats!

Insiders stealing the data of the company or agency they work for has happened many times. The famous Edward Snowden case is a classic example of an insider stealing secret information and leaking it for publication. Snowden was a contractor who worked at the super-secret NSA (National Security Agency). He saw the surveillance of citizens that was being performed by the agency and didn’t think it was right, so he gathered lots computer files documenting the behavior and sent the files outside the agency for publication.

Snowden did electronically what Daniel Ellsberg did decades ago physically. Ellsberg was a military officer who had helped create reports describing in detail secret operations the US conducted during the Vietnam war. While working at the Top Secret RAND Corporation he gained access to a copy of the reports and walked out the door with them in his briefcase. He gave them to the press, where they were headlined as the Pentagon Papers.

The NSA has a positive reputation for cybersecurity. The cover story in Wired Magazine in June 2013 featured a description of a visit to NSA HQ in Fort Meade with its elaborate security measures. The strong impression given is that an organization that has so many strong walls, locks and cameras must be able to do the equivalent in the invisible world of computers. The timing of the cover story was perfect. Edward Snowden started leaking secret NSA documents in December 2012; the leaked documents were published shortly after the publication of the Wired Magazine issue praising the ultra-security of the NSA.

There are systemic issues that result in most of the successful hacks of governments and large companies which I describe here. What it comes down to is two main factors: the people in charge don’t understand the world of computers; the people in charge take a slow, regulatory approach to security, while the opposition is fast and creative.

For the IRS, the data loss is similar to books being taken from a library without being checked out, and can be fixed using electronic versions of methods that librarians use: check the books anyone walks out with!

Personal tax information is valuable, like the goods sold by high-end retailers. Think about jewelry stores; nearly anyone can go in the store, but all the valuable jewels are closely watched as they are taken out of display cases, tried on and put down. You don’t get away with slipping a diamond into your pocket and walking out of the store. Systems like this can be and have been implemented in the world of computers. I go into more detail here.

Going beyond basic monitoring of the behavior of computer users, it’s possible to translate methods that are in production today for catching credit card fraud to the problem of data leaks. Basically what you do is use machine learning to model everyone’s normal behavior concerning data access. When someone does something that is not normal for them, the model immediately notices and calls software to stop them and raise an alert.

In the case of the IRS the general behavior monitoring behavior could be refined, since IRS employees work on cases that have been assigned to them. The software would look at each file a user accesses and make sure that file is relevant to a case they’re working on; if not, the software would prevent access and raise an alarm. That way an errant employee who tried to pull Warren Buffet’s tax data who wasn’t specifically assigned to the case wouldn’t be allowed to do so. And the person working on Warren Buffet’s case wouldn’t be able to access Elon Musk’s case.

It’s less likely but possible that instead of the bad guy being an employee, it was a hacker who gained access to internal systems using methods similar to the ones that resulted in financial records of 147 million Americans being stolen from Equifax in 2017. I describe that hack here.

If the internal monitoring systems I have described were in place, it would also catch a person who had gotten into the IRS by hacking – the beauty of the method is that you don’t worry about who the actor is – you just worry about what they do, just like in a library or jewelry store.

The cybersecurity problem isn’t limited to giant government bureaucracies with outdated computer systems. It’s widespread, in part because they all follow experts, standards and regulations that ignore the insider threat. I analyzed in detail the various experts who were quoted in articles published by the New York Times about the Wannacry ransomware attacks based on software that had been leaked from the NSA. I found that the experts were simply wrong about the reasons, methods and responses to the attack.

It is ironic that the same government authorities who force everyone to follow ineffective regulations they craft by the ton are spending even more money training young people in their methods. My local community college was conducting training sponsored jointly by the NSA and DHS (the Department of Homeland Security); when I looked into it I found that the experts couldn’t even build functioning, secure websites with accurate information.

I sincerely hope that the ongoing flood of illegal leaks and ransomware attacks will end soon. But so long as the current batch of bureaucrats, regulators and experts are in charge of things, we’re likely to spend ever-increasing amounts of money on cybersecurity with ever-worsening results.

Note: this was originally published at Forbes.

Gated Communities Help Us Understand the Ongoing Cyber-Security Disaster

There’s a war going on in our computers and networks. It’s a silent, invisible war. It’s fierce and continues to escalate.

The bad guys are winning. They are aggressive, hard-working, learning, inventing and focused on the goal of making money. The large army of the good guys is led by hapless, incompetent, unmotivated bureaucrats with meaningless certifications in this or that, consumed by building an audit trail showing that they’ve followed the ever-growing body of useless regulations so that when the nearly-inevitable security disaster happens, they can prove it wasn’t their fault. It’s clearly not a fair fight.

The security war isn’t like a war between nations. It’s more like a sprawling collection of gated communities infiltrated and attacked by myriad bands of criminal groups who break in, rob valuables and sometimes take hostages for ransom. The communities spend more money every year building walls that are higher and stronger and hiring ever more highly trained security people. Governments have multiple departments whose purpose is to stop the criminals directly and to help the communities better defend themselves.

Every year the money spent to prevent cyber-crime goes up, and every year the amount of illicit goods the criminals make off with goes up. The criminals are almost never caught. The problem is clearly not that the communities aren’t spending enough money. The problem is that the defenders don’t know much about computers and are going through the motions while the attackers are going for the gold, i.e. bitcoin.

Hardly anyone, including certified computer professionals with academic degrees, understands what goes on inside computers. They attempt to secure computers using ineffective methods that sound impressive but which they themselves don’t understand. They take great pains to do fancy-sounding things that sound impressive but make no difference.

I have explained the details of the massive hack of Equifax hacking by comparing Equifax security in the computer world to a car dealership’s security in the physical world. Translating invisible computer events to common sense physical things can help anyone understand what this cybersecurity war is all about. In this article I’ll attempt to explain what computer-style security would look like if it were applied to a gated community.

 

The Gated Community: Defenders and Attackers

The people who build the walls that protect the outer perimeter of the community are proud of their work. In some places they even have walls inside walls!

• If the walls were built like computer “walls” are built, you’d see that the walls are a patchwork of wall segments designed at different times by different vendors using very different materials and designs and are shipped with so many flaws that they need frequent upgrades. The people in charge of wall installation and maintenance rarely stay on top of the never-ending flow of walls patches and corrections and apply them haphazardly, if at all. The result is that all the savvy criminal has to do is jump on a vulnerability the second the manufacturer announces it and probe all the walls. It’s not hard – a large fraction of wall maintainers leave gaping holes unpatched for months or even years. Shazam! The criminal is inside the community.

The entrance to the gated community is a gate with a 24x7 guard checking the ID of everyone who enters against the list of people who are permitted to enter. The guard permits no exceptions.

• The people who live in gated communities want lots of people to come to their homes and do things for them. They call in and have the person added to the list. The service person comes to the gate, shows ID and is allowed to enter. Maybe they go to the house of the person who wanted them, but there’s no one to stop them going to other houses and doing whatever they feel like, just like a criminal who snuck through the flawed outer wall. Computer programs who “knock on the doors” of heavily guarded computers do the same thing, often with stolen ID’s.

The houses in the community are built securely, with locks on their doors and windows, so that even if a criminal manages to get inside the community, they can’t rob the house.

• In the computer world the houses and their exterior walls (servers, operating systems and applications) are built by the same kind of hodge-podge of vendors that build the exterior fences that protect the community. Houses are supplied by a variety of huge vendors using complicated methods and materials. It’s extremely rare that a house is installed without flaws – the builder will usually claim that it’s flawless, but then will come a stream of patches that need to be applied to the house with varying levels of urgency. A diligent clever criminal can go around probing houses for flaws that have yet to be discovered or repaired by the original manufacturer; a lazy criminal can just wait until the flaws are announced and probe specifically for the known flaws, confident that most homeowners won’t bother to apply the corrections.

People in the community want service workers to come to their homes when they’re out to do jobs like cleaning. It’s a huge convenience to have that guard at the gate checking ID to make sure only authorized people are let in. The guard can also loan the authorized person a spare key so they can enter the house and do the work they’ve been asked to do.

• In the computer world the criminal enters with a fake ID and gets a “key” which usually gives you permission to enter many “houses,” where you can do whatever you want – mess things up, steal things, etc. You can even change the “locks” and scramble things up (encrypt them) so badly that the house can’t be used. Imagine that the frying pan is stored under the hats in the coat closet and all the cooking knives scattered inside pieces of clothing in every room. How would you feel about cooking?

As in many high-class gated communities, mail service to the house is provided. Of course, only an authorized mail person is let in the gate in his truck that contains all the mail and packages to be delivered.

• In the computer world, homeowners aren’t careful about opening their mail, and sometimes packages they open contain invisible little criminal robots that immediately scurry out of the homeowner’s sight, pull out their cell phones and start communicating with criminal HQ. They run around the house and send out all the private information about the people who live there, including ID’s. They’re RAT’s (remote-access trojans) and result from what are called phishing attacks in email. Most homeowners aren’t able to resist opening infected emails of this kind. Sometimes the RAT’s make copies of themselves and send them to neighbors’ homes, spreading the problem.

Some security-minded people in the gated community protect themselves by installing cameras and other security devices so they’re alerted any time a person enters their house when they’re not there.

• In the computer world, tracking activities inside the house is extremely rare; detecting unusual activity and sending alerts when it’s detected is almost unheard-of. The criminal computer invader is free to take his time while sending copies of all the valuable information in the house of the gated community to criminal HQ. If the criminal feels like it, he can massively scramble the contents of the house to make it practically unusable, maybe even putting things in locked cabinets. Then he leaves a sign on the entrance door explaining to the homeowner what he’s done and demanding a ransom to return things to normal. When the ransom is paid, nearly always in untraceable bitcoin, the house often isn’t returned to normal after all. Why is anyone surprised?

The guard at the entrance gate makes sure that moving trucks that enter have been authorized by a homeowner, and that when they leave, the homeowner has approved the exit.

• In the computer world, watching what goes on inside the walls is rare. The equivalent of moving trucks can be created and endless streams of them can go through the exit of the guarded gate and no one checks.

Some homeowners are particularly concerned about the valuables inside their houses, and so they keep those valuables in an expensive, thick safe, secure from thieves.

• In the computer world, data you want to protect from being stolen is encrypted “at rest.” But just like you have to take jewelry out of the safe to wear it, you have to unencrypt data to use it. Therefore the programs in the house that make use of valuable data use a method to access the data that unencrypts it automatically after taking it from the “safe” and before giving it to the program that needs it. When the criminal software is in the house, it simply uses those same programs to access any and all data that it wants, loads massive valuable data into moving trucks and sends it out the unguarded, unwatched exit gates of the gated community. The owners frequently don’t find out about the theft until months later.

Conclusion

I’m sorry to say, things in the computer world are just as bad as I have described. Cyber-security experts and regulators do little but build up the mountains of pointless, ineffective procedures and regulations to ever-growing heights, seemingly without questioning the value of their efforts. Why should they? No one else does – their highly paid jobs are secure!

This was originally posted at Forbes.

T

The Colonial Pipeline Cyber-security Disaster in Context

There’s little new about the Colonial pipeline security disaster; nearly everything was business as usual: expensive but ineffective cyber-security systems and people; penetration and massive data stolen secretly; learning about the breach when ransomware popped up and said “pay me;” shutting everything down; taking days to recover; and the government, which is incapable of protecting itself, making solemn statements about “helping” more.

Colonial did manage to stand out from its fellow victims in a couple of ways: unlike many victims, they paid the big ransom; and their shutdown hurt millions of normal people in significant ways.

The other way Colonial stood out is remarkable: it was big news in the media for days, while the many “successful” ransomware attacks that take place each and every day on businesses, governments, schools and hospitals are rarely made public, much less make the news. Cars being unable to get gas in multiple states, even at inflated prices, may have had something to do with it...

Colonial Pipeline in Context

As usual in disasters of this kind, many important details of the attack and the response to it are closely-guarded secrets.

Let's step back and put what we do know about the disaster in context.

Ransomware has been around for a couple decades. It was usually sent to consumer emails with threats of various kinds if a ransom wasn’t paid. The ransom amount was usually under $1,000 and was paid to prepaid cards and other places. Because of the ability to trace the payment, the scam became less profitable and more dangerous for the criminals involved.

Then bitcoin came along. By 2013 exchanges appeared that enabled criminals to receive instant payments while remaining anonymous and untraceable. Why attack consumers for small amounts when you can get into a large institution and demand large amounts that you can receive instantly and anonymously anywhere on the globe? The threat evolved as well. The attacking software, after gaining entry into the target’s internal computer network, would encrypt all the data, making the organization’s computers nonfunctional until the data was unencrypted using a key known only to the criminals. The victim would be stalled in place, unable to function until the ransom was paid or the computers were otherwise restored. The use of ransomware exploded.

While the well-paid but ineffective defenders sloppily applied what they were taught in school and followed the thousands of pages of security-related regulations, the criminals evolved on multiple fronts. Ransomware evolved rapidly during 2020. The criminal attackers started to take a copy of the target’s data (exfiltrate it) before locking it up. The threat evolved to: if you don’t pay us we’ll make all your data public and you’ll be locked up.

Industry expert EMSISoft tells us: “As the year progressed, more and more groups started to exfiltrate data, using the threat of releasing the stolen information as additional leverage to extort payment. At the beginning of 2020, only the Maze group used this tactic. By the end of the year, at least 17 others had adopted it and were publishing stolen data on so-called leak sites.”

Oh, expose the data — how bad can that be? Pretty bad. “The data that was published included Protected Health Information (PHI), sensitive information related to school children, and police records related to ongoing investigations.”

What? These sound like highly regulated hospitals and government organizations, even law enforcement. Isn't the government, which creates and sometimes enforces all these cyber-security regulations able to protect itself? I guess not: “Unfortunately the barrage continued into 2020 with at least 2,254 US governments, healthcare facilities and schools being impacted. The impacted organizations included 113 federal, state and municipal governments and agencies, 560 healthcare facilities, 1,681 schools, colleges and universities.”

Colleges and universities? Aren't these the places that train all these cyber-security people and create the theory and practice they all learn and put into practice, with their fancy degrees? How is it possible that the security experts can't keep themselves secure? And just look at those numbers: more than four per day were hit and hurt!

On the other hand, it's just people's data getting exposed and ransoms being paid, right? Sadly it’s more than embarrassment: “The attacks caused significant, and sometimes life-threatening, disruption: ambulances carrying emergency patients had to be redirected, cancer treatments were delayed, lab test results were inaccessible, hospital employees were furloughed and 911 services were interrupted.”

More than an attack a day took place at healthcare facilities! Have you seen any headlines about that?

Alright, alright, this is all about governments and similar institutions. Commercial companies want to protect their profits and their reputations. They probably handle things much better — they must, because you almost never hear about them. Ummmm, maybe not; again from EMSISoft: “The private sector was hit hard too. Globally, more than 1,300 companies, many US-based, lost data including intellectual property and other sensitive information. Note, this is simply the number of companies which had data published on leak sites and takes no account of the companies which paid to prevent publication. Multiple companies in the US Defense Industrial Base sector also had data stolen, including a contractor which supports the Minuteman III nuclear missile program.”

Read that last sentence again, please. The bad guys are successful in stealing even from defense contractors. And the number above is the tip of the iceberg, because it's just the ones where someone was able to find their data for sale — it doesn't count all the ones who paid up, hushed it up, etc. Somebody did a survey to find out just how widespread the problem was in commercial businesses. Here's the bad news: “according to a study by security firm Sophos, 51 percent of all surveyed businesses were hit by ransomware in 2020.”

The iceberg is indeed huge. We're talking serious money given to criminals. From Pentest Magazine: “By the end of 2019, cybercriminals using ransomware had made off with a reported $11.5 billion in ransom payments. By the end of 2020, that number is projected to reach $20 billion.”

That's "just" the ransom money — much more money is spent recovering from the attack, even if the ransom is paid.

With all that bad stuff going on and the FBI and other agencies devoting huge resources to it, at least some of the bad guys are being caught and punished, right? No. According to EMSISoft “the effective enforcement rate for cybercrime in the US is estimated at only about 0.05%.”

In case you're not feeling math-y, let me help. This means that out of each 2,000 cybercrimes, only one is prosecuted.

Conclusion

The Colonial Pipeline event was extremely rare — not that it happened, since about half of all businesses get hit with ransomware every year — but because it made the news and was widely covered.

The reality is that, largely invisible to the public, there are gangs of criminals roving secretly and largely unchecked through our computer systems and networks stealing valuables and extorting money in huge volumes. Business and government spend increasing amounts of money with ever-growing staffs of highly educated, certified professionals to prevent the on-going pillaging. They are failing. Horribly. The vast majority of the "cures" that are batted about will definitely cause everyone involved to spend more money, and will equally certainly make little difference.

I have discussed the issues and illustrated the problems and solutions but it won't make a difference — all the power and prestige go, as usual, to people who are proven ponderous pontificators to whom the entire realm of software is invisible.

Note: This was originally published in Forbes.

 

Software Evolution: Functionality on a New Platform: Security Services

A whole book could be devoted to spelling out the “natural” emergence of features on a platform, and identifying and accounting for the minor variations from platform to platform (the emergence sequences don’t repeat exactly for a variety of reasons). However, the similarities are obvious and universal enough that anyone with longitudinal familiarity with a couple of comparable platforms would recognize them.

This is the first in a series of examples to illustrate the way that functionality that had been implemented on an older platform appears on a newer platform. All the examples illustrate the point that, even though the functionality is there for anyone to see on the older platform, working and delivering business value, it only appears at its “proper time” on the newer platform.

See this post for a general introduction with example and explanation of this peculiar pattern of software evolution.

I have mostly selected companies that most readers may not be familiar with, to demonstrate the strength of the pattern and the way it affects all participants in a market, not just the well-known, mainstream companies. Also, I know them personally, and so can tell their stories from personal knowledge, instead of just repeating things I’ve read.

Example: Securant

Old platform	IBM mainframe
Old function	Security services: ACF2, RACF
New platform	Web server
New function	Security services for Web applications were extremely basic, and focused on message encryption. Securant implemented mainframe-class user and application security. The same kind of companies that depended on mainframes for transaction processing were very attracted to Securant’s approach to Web applications.
Outcome	Terrific product and sales traction despite product inadequacies and the company’s internal problems. The company was acquired for a good price by RSA Security in 2001.

Securant was started by a couple of young programmers in their 20’s as a services business. They were hired by a large financial institution that was adding internet/web infrastructure to their IT infrastructure. Naturally, the web applications needed access to the programs and data on the mainframe systems, and those systems were protected by state of the art security systems. The financial company would have preferred to be protected by a security facility for the web just like it did for the mainframe, but none was available. So they agreed with these guys to build one.

The young programmers knew nothing about mainframes, and never bothered learning anything much about them. As far as they were concerned, mainframes were pretty useless things well on the way to becoming obsolete – why become an expert in steam engines in the 1930’s when internal combustion engines are obviously the future? So they focused completely and solely on what they knew, and built a ground-up application that met the business security needs as they understood them from the users, who were also barely familiar with what the mainframe had to offer.

Before long, the one-off services project became a very hot, rapidly growing product company. One of the many ironies in this project is that the father of one of the two founding programmers had run one of the mainframe security companies! But he had been estranged from his son for many years, and neither knew that the other was or had been involved in computer security. The father decided to come back from the retirement that had been funded by the sale of his security company, re-connected with his son, and you can imagine his amazement when he found out what that son had accomplished. The father saw the functionality he had on the mainframe, re-imagined and re-implemented for the new environment.

One of the powerful things about this pattern is that it’s like the tide or the current in a river – at the right point, it just pushes the vendors and functionality in the direction of the “flow,” and everything ends up moving in the same direction. The people involved tend to think they’re inventing things – but what they invent is pretty predictable, because they’re responding to the same kind of needs that the previous bunch of inventors were responding to.

Why the Equifax Hacking Disaster Wouldn't Happen at a Car Dealership

The 2017 Equifax data breach is in the news again because of the recent indictment of four Chinese government hackers for committing the break-in. How did they pull off such a feat? From China? As it turns out, Equifax’s defenses were so pathetic that a couple of bright nerd wise guys anywhere could have done it.

By contrast, the Equifax hacking could not possibly happen at a car dealership – unless the dealership were run by government and corporate cybersecurity experts. Understanding why that’s so tells you everything you need to know about the expertise of the experts.

The 2017 Equifax hack

First, a quick – VERY quick – review of the Equifax hack. Equifax has websites. One of them is just for people who want to dispute their credit rating. This particular site was run on a computer with software that had a serious flaw, allowing a skilled person to get past the normal consumer web pages and run other programs on the computer. The flaw had a fix that could easily have been installed, but because of a series of bungling and delays, the fix wasn’t installed for months.

The flawed software on the Equifax site was widely used. The fact of the flaw and the fix for it were publicly available. Anyone could have read about it and fired off a search for websites on which the patch correcting the flaw had not been installed. Someone found the Equifax site had the issue, exploited the flaw, and ran a couple programs without doing much else.

More than a month later, the flaw still unpatched, someone got into the Equifax server again and started “looking around.” They found an unencrypted file with names and passwords. They used the information to log in and got access to a series of databases that had Equifax customer information. For 76 days, they used the databases like any authorized user would, and issued queries that returned a great deal of customer information, which they stored in files. They encrypted the files and used standard programs to ship the files out of Equifax, presumably to themselves.

Hacking the Equifax-run car dealership

Suppose someone had tried the equivalent of the Equifax hack at a car dealership. The hacker would have physically walked in the service entrance, along with the other existing customers. The hacker knew that many doors had a security flaw in their lock that had not been fixed. The exact nature of the flaw had been publicized, and any reasonably skilled person who knew about doors and locks could exploit it. Once inside the customer service area of the dealership, the hacker looked for the “employees only” door, and quickly saw that it had not been fixed. The hacker walked up to the door, fiddled with it for a couple minutes, opened it and walked in. In a real car dealership, the employees would have immediately noticed a strange person and challenged him, politely showing him out. In the Equifax-run car dealership, the intruder is ignored.

Once in the employee section of the dealership, the hacker wanders around, poking into lots of things. Finally he walks into the finance department and wanders some more, again unchallenged. He notices a row of file cabinets against the wall, and figures there must be valuable information in there about customers and cars, with all sorts of details like names, addresses, driver’s licenses and who knows what else. But he sees the cabinets are locked. Darn! So he looks around some more and spots some keys sitting on someone’s desk. Even though it’s daytime and people are working at the desks, on the phone, etc., no one says a word when the intruder picks up the keys, walks over to the file cabinets, and tries one key after another until finding the one that works. He opens the cabinet, takes out a handful of folders, walks over to the copy machine, and makes a copy of every document in the handful of files. He then goes back to the file cabinet, returns the originals, puts the keys back on the desk, and walks out of the building the way he came, holding a big pile of copied pages in his arms. Unchallenged.

The next day, the hacker returns to the Equifax car dealership and goes through the same drill – goes into the employee-only section, then the finance department, uses the keys to open another drawer, makes copies and walks out, all without a single one of the many employees working there saying a thing. He does this day after day for 76 days.

Finally, someone notices that there’s supposed to be a guard by the employee entrance checking everyone – there always used to be one! So a guard is put there again. The guard notices that the daily visitor carrying lots of paper doesn’t look like everyone else – he’s carrying big piles of paper! The guard doesn’t stop the visitor, but reports to his boss; meanwhile, the visitor notices the guard, figures the jig is up, and stops coming.

More than a month later, the Equifax-run car dealership’s bosses finally let the word out that they had been hacked.

The Equifax breach vs. the car dealership

You already know that nothing even vaguely like the Equifax breach could have taken place in a car dealership. In the dealership, people have common sense and are dealing with physical things, while at Equifax, everything important happens on computers that are in locked rooms, with software that is invisible to nearly everyone, doing things that most experts barely understand, managed by people who have no real knowledge of software using management methods taught in business schools by professors who are ignorant of software, and following rules and regulations written by lawyers and bureaucrats. What can you expect but madness and chaos??

What went wrong at Equifax

Equifax’s cybersecurity methods followed regulations and industry-standard practices, with all required certifications. The result of these methods, when executed perfectly, is security that is worse than that of retail stores or libraries. In the end, Equifax made exactly two mistakes – but each mistake mattered because of further bungling and the failure of ordinary follow-up checks.

• The web server patch, the start of the trouble. The patch was announced on March 7, 2017.
• What they did: On March 9, administrators were told to apply the patch. They didn’t. On March 15 a scan was run that was supposed to detect unpatched systems. It didn’t work. It wasn’t run again or fixed. Result: the patch wasn’t applied until August or later.
• The bad traffic detection box. A great deal of web traffic is encrypted. Equifax had installed a box at the “edge” of their system to stop all incoming encrypted traffic, unencrypt it, make sure nothing “funny” is going on, report suspicious activity, and re-encrypt and send along each message. It’s like a traffic stop for incoming traffic.
• What they did: encryption works with keys, and keys expire periodically. The key used by the box expired 10 months before the hack started. Equifax failed to renew the key, and the traffic-stop box was set up to let all traffic through without checking unless it had a valid key. No one noticed until July 29, 2017, when the certificate was finally renewed. When the traffic stops started again, an administrator noticed suspicious activity, and sounded alarms bells.

I’m going to add this fact, just because I find it amusing: the Chief Security Officer was a music major, Susan Mauldin. She had degrees from U Georgia in music composition. Her background was scrubbed from the internet as soon as the scandal broke. Of course, you don’t need a college diploma to be excellent at software, IMHO. But in this case…

What car dealership management would do at Equifax

People who run car dealerships aren’t usually thought of as geniuses, but part of succeeding in business is protecting your customer records, and everyone involved takes care to do that and do it well. All that was required for Equifax to have avoided being hacked was to do the software equivalent of what every sensible car dealer employee would do. Obviously, such common sense is beyond the ken of the high-paid professionals and certified experts at large places like Equifax. Here are the main things that would be done if car dealer people replaced Equifax management.

• Recall/repair notice.
• The second a car dealer hears about a recall/repair issue for cars, they jump on it. Similarly, just exercising common sense, if they learn that the restricted entry system to the employees-only area has a fixable flaw, they would get it fixed immediately. No excuses. Car dealer management would have seen to it that the flaw was patched, and checked.
• Guard duty.
• At the car dealership, there is extra security around the finance department, which holds all customer data. During working hours, there is always someone alert to the door, challenging anyone entering who shouldn’t be there. Off-hours, there are deadbolts on the metal doors, along with an alarm system that has motion detectors and cameras, which gives an immediate alert on any sign of trouble. If the alarm system drops its constant, real-time communication with the monitored center, electronic alerts are sent, so the problem can be immediately fixed. The room and its data are NEVER left unprotected.
• With car dealership management, the encryption key on the traffic checker wouldn’t have been allowed to expire. Instead of setting up the traffic checker to stop checking unless it had a valid key, car management would have made it set off alarms so it could be fixed right away.
• When car dealership management learned that only incoming traffic was being checked, they would have pitched a fit. What? You’re just letting anyone waltz out with anything?? They would have installed a system to stop and check outbound data traffic before letting it out.
• Keys
• Car dealership management would never allow the file cabinet keys (user names and passwords) to be lying around for anyone to pick up.
• Employee behavior monitoring.
• Car dealership management would make sure anyone opening a file cabinet was a person authorized to do so, and that their actions were reasonable. When they found out that anyone could open a drawer and pull out and copy ALL the files in that drawer, they would have been enraged. They would have immediately put a software system in place to ring a bell and prevent anyone from taking more than a single file.
• While at Equifax the only real checks were with people as they were coming in, after which they could do anything without being checked, car dealership management and employees know that everyone has roles and acts in certain ways – and that everyone is responsible for noticing unusual behavior and questioning it. With car dealership people in charge, the software equivalent of such monitoring for “normal” behavior would have been implemented and strictly enforced, with immediate shut-down of a user if they stepped outside the bounds of their normal actions.
• Car dealership management understands that audits need to be done, and that auditors need broad access to customer files. This is the ONLY time mass access to customer files would be permitted, and ONLY under the watchful, suspicious eyes of multiple dealership managers, who would ASSURE that all files would be replaced WITHOUT BEING COPIED.

Expert recommendations for Equifax

The “experts” have had a wide-ranging set of advice for Equifax. Equifax has spent over $1.4 billion dollars making largely useless “improvements” to its security. I haven’t read ANYWHERE recommendations of the kind of changes any sensible car dealership would make, as described above.

Here are some of the leading recommendations of what Equifax should do to improve their cybersecurity:

• Change management reporting, processes and procedures.
• I love this one. It’s a commonly-recommended “cure” for cybersecurity ills.
• Encrypt all customer data
• This is a favorite, and widely recommended. It is USELESS. It would NOT have prevented the Equifax hack!! Why? Easy: once the hackers were in and were using employee user names, they just issued SQL queries against the database. If the data on the disk, the database un-encrypts the disk blocks, processes the SQL query, and returns UN-encrypted data. Otherwise, the data can’t be used!
• Encrypting data on disk is like having locked, strong metal file cabinets. But authorized people still need access. Therefore, file cabinets have drawers and keys. When you open the drawer, the data is easily accessed. Encrypting data “at rest,” as they say, protects only against the hackers who somehow get close to the cabinet and drill into it from the side or bottom. Who would do that? It’s easier to steal the keys or break the lock!
• Create more silos
• The nice-sounding theory is that breaking everything into silos would limit a break into just one silo. But far from being a solution, silos were actually part of the problem at Equifax – applying the delayed software patch required writing memos and asking multiple people to do things, when in a uniform environment, a single script could have updated everything.
• Change the reporting structure
• Because when you change who reports to whom, everything changes, right? In Equifax’s case, the Chief Security Officer reported to the Chief Legal Officer, while the Chief Information Officer reported to the CEO. “That’s the cause of the breach!” shrieked an amazing number of pundits!
• What there should probably be is two Security Officers:
• A CSRO, Chief Security Regulation Officer, who reports to the Chief Legal Officer. This person is in charge of the massive, ever-changing, lawyer-created body of regulations that are supposed to assure Security. There are severe penalties if you fail to conform to the regulations, which require loads of reports, processes, documents, etc. But they have little to do with real security.
  
• A CRSO, Chief Real Security Officer, who reports to the Chief Technology Officer. This person is in charge of making sure that real security is performed, in spite of the regulations.

Conclusion

Computer software and systems are hard to understand, a problem made worse by the fact that they’re literally invisible. You'd think that would be OK, since for example even fewer people understand quantum physics and we’re OK in physics. The trouble is, the people doing physics really do understand it, while the people doing software in general, and cybersecurity in particular, are faking it – without even suspecting, in spite of the mountain of evidence to the contrary, that they’re faking it.

The result is that government agencies, powerful consultants and weighty experts recommend more of the same medicine that created the problem, without a shred of recognition that it was their own rank stupidity that caused the problems to begin with.

For more perspective on this subject, see these posts.

Note: this post first appeared at Forbes.

Cybersecurity is Almost Impossible to Achieve -- Here's Why

As with most computer software issues, cybersecurity is badly misunderstood by the vast majority of people, including, sadly but as usual, most computer professionals. The result of this is that the vast majority of people have wrong ideas about the source and methods of security breaches and how they can be prevented. Unfortunately, sometimes these wrong ideas have major consequences.

A Typical Phishing Attack

Phishing is a kind of attack on a user by a bad guy. The bad guy sends the target an email that contains something to tempt the target to click on it. Clicking on the hyperlink is like a fish biting the bait on the hook -- you're caught!

I've been the target of a slew of phishing attacks in the last couple of months. Here is a typical email I've received:

 

What a scary email! It's to me, from my company's email administrator, and I'd better do something about it!

An amazing number of recipients of such an email would have clicked on the red "Resolve Errors Now" box. I wouldn't because:

• I know that my email admin person's domain is not "team-admin.net"
• There are multiple suspicious minor grammatical errors.
• Why would the final line be a copyright?

And many other reasons.

I went to the trouble of digging a bit. I exposed the URL at the hyperlink I was supposed to click and copied it. Here is the place I would have gone had I done what the phisher intended me to do:

Yup, it's a one-time domain set up by the phisher with the information about who I was so that the right next hacking steps could be executed -- that's the string after the question mark. This is not an amateur phisher!

There are more where that came from.

The email above was hardly an isolated example. Just yesterday I received an email from someone I knew at another VC firm, asking me to click to download an important document. Half an hour later, I got a legit email from the firm's admin saying sorry, the sender's account was hacked, please don't click on the email, and if you did, you may want to change all your passwords.

Here is another I recently received, apparently from DHL instead of apparently from my email administrator:

Yes, the place they want you to click is totally bogus -- and bonus points for doing an exceptional job mimicking DHL!

Cybersecurity Experts Know all about Phishing Attacks!

Sure they do. It's on everybody's list, and they all put "solutions" in place. Solutions that don't work.

A colleague of mine has been a top tech executive in major financial institutions. He told me how none of the anti-phishing solutions work because too many valid emails end up in the "spam" folder, and/or too many phishing attacks are passed through as OK. If users know there's a phishing filter in place, they tend to assume that every email in their inbox is OK, and click away, making the problem worse.

The executive tried phishing education for users. He ran several different kinds of education, and sent test phishing emails to people as tests of the education. Net result: no form of education improved the practical willingness/ability of users to notice and avoid clicking on phish attacks. Conclusion: highly paid office workers are too stupid to be educated on this subject.

The Place of Phishing Attacks in Cybersecurity

Regardless of your familiarity with computer security, I suspect you've got the image nearly everyone has about it -- an image that is like a medieval castle with high walls and ponderous, thick gates that are heavily guarded. It's all about those evil bad guys roaming around out there, always probing for ways to get around the gate or over the wall to get inside and wreak havoc.

This is a fun image, and accurately reflects something which is part of the truth. Phishing attacks, along with insiders who have become bad guys, are an important part of the rest of the truth. While there are "solutions" to phishing, they're mostly badly-performing filters that dump loads of emails into a "spam" folder, many of which are perfectly legit. Making you manually go through it anyway. What's the point?

Phishing and bent insiders are the poor step-children of cybersecurity, always acknowledged as being part of the family, but surviving on hand-me-downs and left-overs as best they can. This in spite of the fact that they continue to be the source of the most flagrant "breaches" of security we know about! High-end retail stores and even libraries have had working solutions to this kind of problem in place and working since before computers were invented, but there's something about being a fancy-shmancy computer science cybersecurity expert that prevents such solutions from being considered.  Among other things, check out:

https://www.blackliszt.com/2017/05/computer-security-problems-solutions.html

Conclusion

The image of bad guys cackling in distant, dark rooms lit with screens, as they manage increasingly devious attacks against the walls and defenses of the innocent computer systems of the world continues to cause regulators, cybersecurity experts and the other grandees of computer administration to ignore the real threats -- the ones that work, the ones that actually lead to failures of computer security. It's hard to grasp the full extent of combined stupidity, self-satisfaction and blindness that leads the ongoing non-response to bad actors recruiting insiders to do their work for them.

 

Computer Security Breach Response Excellence

Here's what the experts do for computer security:

• Hire security experts to implement best-in-class security.
• Follow all the regulations.
• Pass all the audits.
• Spend lots of money.

Then, of course, you get breached, because in spite of doing the above, you have no idea what you're doing...

Here's how you respond:

• Get more experts to find what happened.
• Establish a carefully-thought-out strategy to recover from the breach and minimize damage to your reputation.
• Alert the public and your users about the event and your concerned, respectful response.

Then, of course, you change your website, put lots of money into attractive graphics, while making it hard for users to login or reset their passwords.

The share-your-expertise website Quora is surely in the running for best-in class when it comes to computer security; they have followed the above plan with true excellence.

The Quora Story

I got this email from Quora, of which I'm an occasional user, on December 3, 2018:

Dear David B. Black, We are writing to let you know that we recently discovered that some user data was compromised as a result of unauthorized access to our systems by a malicious third party. We are very sorry for any concern or inconvenience this may cause. We are working rapidly to investigate the situation further and take the appropriate steps to prevent such incidents in the future. What Happened On Friday we discovered that some user data was compromised by a third party who gained unauthorized access to our systems. We're still investigating the precise causes and in addition to the work being conducted by our internal security teams, we have retained a leading digital forensics and security firm to assist us. We have also notified law enforcement officials. While the investigation is still ongoing, we have already taken steps to contain the incident, and our efforts to protect our users and prevent this type of incident from happening in the future are our top priority as a company. What information was involved The following information of yours may have been compromised: Account and user information, e.g. name, email, IP, user ID, encrypted password, user account settings, personalization data Public actions and content including drafts, e.g. questions, answers, comments, blog posts, upvotes Data imported from linked networks when authorized by you, e.g. contacts, demographic information, interests, access tokens (now invalidated) Non-public actions, e.g. answer requests, downvotes, thanks Questions and answers that were written anonymously are not affected by this breach as we do not store the identities of people who post anonymous content. What we are doing While our investigation continues, we're taking additional steps to improve our security: We’re in the process of notifying users whose data has been compromised. Out of an abundance of caution, we are logging out all Quora users who may have been affected, and, if they use a password as their authentication method, we are invalidating their passwords. We believe we’ve identified the root cause and taken steps to address the issue, although our investigation is ongoing and we’ll continue to make security improvements. We will continue to work both internally and with our outside experts to gain a full understanding of what happened and take any further action as needed. What you can do We’ve included more detailed information about more specific questions you may have in our help center, which you can find here. While the passwords were encrypted (hashed with a salt that varies for each user), it is generally a best practice not to reuse the same password across multiple services, and we recommend that people change their passwords if they are doing so. Conclusion It is our responsibility to make sure things like this don’t happen, and we failed to meet that responsibility. We recognize that in order to maintain user trust, we need to work very hard to make sure this does not happen again. There’s little hope of sharing and growing the world’s knowledge if those doing so cannot feel safe and secure, and cannot trust that their information will remain private. We are continuing to work very hard to remedy the situation, and we hope over time to prove that we are worthy of your trust. The Quora Team

What a bunch of careful, responsible people, those folks at Quora are! So appropriate for a share-your-expertise site!

After this notice, I kept getting the occasional teaser email from Quora, tempting me to click and answer a question or see an answer someone else gave. For example I got this one a couple weeks before the breach:

I know, it's not click-bait for the general public, but definitely a good one for me.

Yesterday I got the first teaser I'd gotten since the breach email reproduced above. Here's the lead:

Not a killer issue, but I clicked out of mild curiosity about the answer, and also to see whether Quora was up and running normally. What I got was a lesson in how to respond to a security breach by driving your customers off. It's true, after all, that if there aren't any users, there won't be any meaningful security breaches -- problem solved!!

Here's the landing page -- a new thing in itself, because clicking on an email used to be enough to identify you.

The cute graphics are all new. I put in my password and got the box in red above, telling me I had to reset the password by responding to the email they sent. OK.

I got a typical password reset email:

I clicked on the link. I got to see even more wonderful new graphics! These guys are really trying! Then I put in my old password, because I wanted to; it's my password, I should be able to pick any one I want, unless they tell me there are rules.

Can't use my old password, huh? If you're so sensitive and caring, you could just possibly have warned me about that up front. Oh well. Here's a new one:

I put it in. It's new. They match. I click on the Reset Password button. Nothing. I change the password and click again. Nothing. Again. Nothing again.

They just don't want me, it's clear. If I were a normal user, it would have been game over. But I'm not, so I went back to the password reset email and clicked again. This time I put in a brand-new password. Then, clicking worked -- it got me to the login page, where I had to enter my email and new password yet again.

Quora has a big, fat, ugly, super-obvious, BUG in their "we're taking responsibility for this breach and hoping to win back the trust of our users" new entry door to their site, not bothering to perform super-elementary QA on one of the main pathways of the new code. Not some obscure condition. Software QA 1.01.

So just who are these geniuses at Quora? Are they the super-smart, rich, cool kids that have such a track record of excellence at other tech sites? Like Facebook and Twitter and the rest? It takes a bit of looking, but the simple answer is: yes. Super-smart. Beyond cool. Rich. And still can't get the most elementary details right!

Business as usual in software. Whether it's government, big corporation or cool young hip tech company the story is the same: getting stuff to actually, you know, old-fashioned WORK is beneath, beyond, above or whatever for whoever's involved. Not to mention make software that protects customer data.

 

The IRS Anti-fraud Contract with Equifax is Good

First there was the furor that Equifax was hacked, putting millions of confidential consumer records in criminal hands. Next there was the furor about Equifax's response. Now, our in-bred elites are outraged that the IRS would award a sole-source contract to Equifax for, of all things, anti-fraud! Outrageous! Equifax can't protect itself, and now our genius IRS awards them millions of dollars?!

Sadly, this is yet another example of pathetically ignorant people expressing outrage about a perfectly normal and sensible action by the IRS that has nothing to do with Equifax's inexcusable malfeasance in protecting consumer data.

Here's the story in a nutshell.

Equifax

Equifax is one of a handful of companies that gathers and sells information about consumers, much of it confidential. It is a public company that provides an essential service to its customers, which are predominantly credit-granting businesses. The core of their business is receiving detailed transaction data from banks, aggregating it and selling it.

The Equifax breach and follow-ons

As usual with breaches, it happened long before the company became aware of it. Also typically, the company waited a long time before making an announcement. Equifax executives added an extra unsavory twist to the events by selling stock before the breach was announced. The response of Equifax to the event, which included a bogus offer of consumer protection against identity theft, was awful. Extremely little hard-core information about the breach has been released.

With this breach, Equifax joins the ranks of large institutions, private and government, that demonstrate their inability to keep their data assets safe. This is an ongoing scandal for which there are solutions, but none that major institutions care to use. I have written extensively about this.

The IRS contract

The IRS awarded a sole-source contract to Equifax for access to confidential consumer credit data -- exactly the same kind of service that Equifax provides to most of its customers. Public figures were outraged!

If the IRS contracted with Equifax to help apply its expertise to keeping IRS data secure, the outrage might have been justified. But Equifax does not sell those services. What they sell is data, data that the buyer can use for many purposes -- often for credit-worthiness, but sometimes to help verify consumer identity. The data was valuable for this purpose before the breach, and remains valuable today.

The data that was stolen was, of course, a snapshot of what Equifax had at the time of the theft. Since then, data has continued to pour into Equifax, updating and augmenting the data it already had. By using this additional data in special ways, the IRS could improve its ability to prevent identity thieves stealing taxpayer refunds, for example. I have no idea if the IRS will be smart enough to do this (I suspect not), but in any case they need the data! Without it, the IRS will be even more vulnerable to theft and fraud than it already is.

For the Senators to castigate the IRS for buying data from Equifax shows that they don't have a clue about computers and software -- they don't care to know the difference between services and data, for example. But we already knew that.

Clueless about Technology

What this is really about is that most people, including business, government and media elites, are clueless about technology. Which doesn't stop them from pronouncing about it with great confidence. As it turns out, I wrote about before, using the IRS and e-mail to illustrate the hapless opining of public figures about Bitcoin and Blockchain.

When things go wrong, "experts" are called in, and more money is spent doing the same useless things that let the problem happen in the first place. With the side effect that everything is even slower, more error-prone and vulnerable than it is today. The current round of posturing by public figures helps nothing. Sad.

 

Government Cyber-Security tops the Oxymoron List

Some cynics keep an ordered list of the "top" oxymorons. Long-term members of the list include "business ethics," "military intelligence," "northern hospitality" and "southern efficiency." While "government efficiency" has a permanent hold in the top ten, "government cyber-security" has leaped to the top.

Cyber-security is a huge problem for large organizations in general, for deep systemic reasons, as I explain here. The US federal government is making a big effort to get ahead of the problem. By doing so, it is embarrassing itself and making things worse.

The government is engaged in a giant effort to systematize cyber-security and train professionals in how to do it. Various claims are made about salaries over $100,000 and a need for over a million qualified people. I first encountered this effort in an article about a local community college that had received certification for their program:

This sounds prestigious: both the NSA and DHS are jointly behind it! This must represent the best training there is!

So I looked into it a bit. Here is what the NSA has to say:

Here is what the DHS has to say:

I noticed a couple things:

• Each organization has its own page to describe the joint program. Of course.
• Each organization lists itself first in the description. At the NSA, the program was created by the NSA and DHS, while at the DHS, DHS is listed first. Of course.
• Each describes the programs and its goals differently. Of course.

This is bureaucracy as usual.

Then I decided to find out about the program itself, so I clicked on the link at the bottom of the NSA site. Here's what I got:

No kidding! That's why in the image above, I clipped to the top of my browser, so you could see the URL and see that I wasn't fooling around. This is exactly what I got by clicking on the NSA site shown above! Maybe it's just the NSA that's screwed up. DHS probably has a better link, since their website was updated less than two months ago. Nope! Same result!

Makes perfect sense. The NSA can't keep itself secure. We already knew this from the Edward Snowden problems, and more recently from their role in the world-wide Wannacrypt virus attack. The DHS? Even government investigators have concluded that its cybersecurity efforts are worthless. So why shouldn't their joint website fail the most elementary security test?

I dug and dug, trying to find what was actually taught, and what the cybersecurity standards and practices actually were. In particular, I was curious to find if there was any mention of the NSA's role in supplying the weaponry for the Wannacry attack by means of gross deficient internal cybersecurity. I was also curious to see what level of acknowledgement there might be of their problems.

Result: a couple hours of digging resulted in amazingly little of substance. I'll just end with an interesting comparison.

Remember the world-wide outcry about the guy being dragged off a United airplane? The CEO stepped up quickly and defended his employees. Then he took it back and abjectly apologized, and there followed a stream of discussions about how other airlines did it and specifically how United was going to change to prevent a repetition of the drag event.

Compare this to Wannacry. Not just one guy, but tens of thousands of organizations, including most of the UK's NHS -- resulting in massive patient issues, many of which were far worse than United's dragging event. Who was put on the carpet? Who apologized? Any word from the NSA about their security breach that greatly magnified the problem? Of course not! Don't be silly! This is an august government organization: no one apologizes, no one loses their job, and nothing changes. Got that?

Computer Security: Problems and Solutions

Computer security problems keep piling up like dead bodies during trench warfare. Is the problem evil Russian (or Chinese or whatever) hackers? Of course! But there have always been bad guys and always will be. The real issue is, why do our corporations and government agencies steadfastly refuse to apply the known, proven methods that would prevent most of the problems?

The problem

When a jewelry store has been cleaned out, whose fault is it? Of course it’s the bad guy’s fault. But what if the people who run the store went out for lunch, left no one in the store, and left the doors and safes wide open?

If a high-end clothing store is robbed blind, whose fault is it? Of course, it’s the bad guy’s fault. But what if store management failed to install the widely used tags attached to articles of clothing that are removed when you pay for them –and ring alarms if they leave still attached to the clothes?

If a big store with lots of cash registers has a huge loss of cash stretching over many months, whose fault is it? Of course, it’s the bad guy’s fault. But what if the store failed to count the cash at the end of each shift, and paid no attention when a check-out person when from register to register during his shift, spending some time on each one?

Computers are different

Yes, computers are different than jewelry stores, clothing stores and big box stores. You may think that the computer security problem is way harder. Here’s what you might think:

Data is invisible! When someone walks out the front door with a pair of expensive sneakers, you can see the goods if you’re watching. But if someone “steals” some files, no one can see the bits pouring down the tiny wires, or flying invisibly through the air. So you can’t see the stuff going out through your doors. Surveillance cameras don’t work for data.

The thief can be remote! When a cyber-criminal does the bad deed, he could be right next door – or on the other side of the planet. He could be anywhere!

This is what most people think. So they write piles and piles of regulations that mostly call for the computer equivalent of putting big walls around your computers and call it good.

Use Computers for Computer Security

Computers are complicated. Very few people understand even a modest portion of what goes on in modern computers. So most people are clueless, and the ones who have a clue tend to learn a specialty and stick with it. The incredible complexity makes change surprisingly hard – most of the change we see is due to the unprecedented growth in the speed of the underlying hardware, not advances in software.

The vast majority of modern computer security is a rough translation of methods that have evolved in human warfare. The trouble is the bad guys have evolved and the defense remains stuck in decades-old, long-obsolete concepts.

Here's a wild thought: let's use computers for computer security! Let's have them do the computer equivalent of how security is implemented in places where we really care about it, places like jewelry stores, clothing stores and stores with cash registers. Even libraries! And, please, people, how about attending to the simple stuff, like keeping your software up to date. If software had been up to date, the recent Ransomware attack would have been nearly a non-event. And worst part of it (the worm) wouldn't have happened if the agencies in charge hadn't let it walk out the door via the Manning method (see next section).

A Big Fat Example

Chelsea (f.k.a. Bradley) Manning was convicted in 2013 of releasing nearly three quarters of a million military and diplomatic documents and was sentenced to many years in prison. How it was it possible for a low-level Army private stuck in a remote outpost in Iraq to access all these documents and make them available?

Here is a book:

... that tells you most of what you'd want to know about Ms. Manning, who was Mr. Manning at the time of her/his noteworthy actions. And how he (at the time) got away with it.

The giant security hole that Manning waltzed through to do his damage was still open years later for Edward Snowden to do what he did. The security hole is wide open today at most government and commercial computer systems. It's the same hole that doesn't exist in places where people actually care about security, places like retail stores...

By their actions, we can only conclude that the security "experts" in charge are criminally ignorant or just don't want to fix the hole.

I'm sorry to report that I've seen no evidence that the situation will change any time soon. I've had occasion to talk with some leading security experts about the subject. I can definitely report that they exist on some planet -- unfortunately it's some planet that is not planet reality.

The Ransomware Hack Attack: Lessons from the Experts

The Wannacrypt ransomware attack is in the news because it's causing havoc world-wide in major corporations and government institutions. It's a textbook lesson in a number of subjects including (but not limited to): the hopeless incompetence of major institution management in general, and IT management in particular; the worthlessness of most people said to be experts; how dead simple most cyber-security is; the rank illiteracy of otherwise highly educated journalists about computing; the incompetence of our super-spook institutions.

The authoritative New York Times

Of course, we turn to the venerable NYT to get the facts about this important story. Here's the head:

It's clear from the headline that the substance of the story is beyond the grasp of the generally super-bright Times authors (look at the bottom of the story, the author had lots of help), so we're going to have a treat: lots of experts!

First some facts

Let's start with a couple simple facts.

The software in question is "ransomware" that users are tricked into running on their computers. The software is normally an attachment to an email message that an unwitting user (being kind here) clicks on. Once it runs, the software encrypts all the files on the computer, making them unusable. It then displays a helpful announcement of what it's done and how to get your files back. Here's a sample, taken from a nice summary of the situation:

At this point, most people panic. Loads of hospitals in the UK were infected, for example, and mostly shut down.

There's more! Once installed, the software probes all the computers connected to the same network, and tries to infect them with the ransomware using an error in some deep-in-the-guts thing normal users would never encounter called SMB. This means that once a single user in an organization has fallen for the bait and gotten the software, it quickly spreads. This part of the evil software is the "worm."

Here's how the New York Times describes it:

The underlying reality -- the important facts

Here are the most important things to know about this "audacious global cyberattack."

• The ransomware spread by the usual means: emails to gullible users. To their credit, the Microsoft Windows Defender group quickly identified the problem and released an update that detects and removes it.
• Only obsolete and improperly maintained Microsoft Windows computers were affected by the worm. Loads of systems were hit in hospitals running Windows XP, which Microsoft stopped supporting years ago. Supported versions of Windows that had installed all recent patches were not hurt. The relevant patch was released months ago. It is the worm part of the malware that infects servers, which is particularly harmful.
• The bad guys are only charging $300 in Bitcoin to unlock your computer. That's a small price to pay to learn the lesson of keeping your system up to date!
• If you really don't want to pay, all you have to do is wipe your machine and restore it from a backup. And then maintain it properly. I gather from all the furor that on top of using obsolete software, the affected sites fail to follow standard backup procedures.
• The bad software itself has been publicly available for months, ever since being walked out of the NSA and published. It was only a matter of time.
• It's not exactly genius software. A clever guy managed to do a simple thing that disabled the worm aspect of it worldwide! Details here from the guy himself.

The Experts weigh in

Since my regard for experts could hardly get lower, the NY TImes article changed nothing. But perhaps some examples might be amusing.

I love this one:

The price goes up to $600 if you delay. Let's assume everyone delays but pays. That means no less than $1B/$600 = 1,666,667 sites would have paid, if the experts are right. I checked the relevant Bitcoin accounts a few minutes ago, and the total had yet to exceed $30,000. Way to go, experts!

I also love the choice given: "pay the digital ransom or lose data." Right. First of all, you're stupid because you're running obsolete software. Then, you can't restore from a backup? You deserve to lose all your data, and then your job -- remember, we're not talking about naive consumers here, we're talking about richly paid computer professionals!

Our next expert dares to be named:

Here's the part I like: "Despite people's best efforts, this vulnerability still exists..." Of course it does! Updating Windows makes the problem disappear. You can't make people update their software -- even though it's their job to maintain it!!

"...experts said that computer users in the United States had so far been less affected than others because a British cybersecurity expert inadvertently stopped the ransomware from spreading."

First, the guy who stopped the worm part was brilliant. He did what he did very much on purpose -- he just referred to what he did as something "accidental," being sleep-deprived and modest. Second, what he stopped wasn't the initial infection into a site, but the spread of the worm once it was in. There were loads of US sites infected -- the numbers are random, as you would expect from whatever email list the bad guys used, and the odds of professional users clicking on the attachment.

The Times itself attempts to explain how the clever guy managed to halt the worm aspect of the malware. Completely screwed it up. Sorry guys, maybe you should stick to quoting experts who get it wrong instead of being obviously wrong yourselves.

Then we have security experts weighing in:

"Yet security experts said the [Microsoft] software upgrade, while laudable, came too late for many of the tens of thousands of machines that were locked and whose data could be erased."

The Microsoft software upgrade was made months ago. It was not too late. It's the people responsible for the machines in question who are too late. If they let their data be erased it's on them -- either pay up, wipe and restore from backup, or slink away in shame.

As to the NSA that created and released the software in question: shame on you. You probably have yet to implement the measures that would prevent more of the same in the future.

Summary

When you read stories like this, it's natural to form a set of impressions, including:

• There are mysterious hackers out there who are really smart and really bad.
• The evil hackers can cause havoc.
• All we can do is bring in experts and try to clean things up quickly.
• Let's hope it's not worse next time.

All these are reasonable thoughts for a layperson to have, reading the published material.

The truth of the matter is closer to the following:

• The richly funded NSA develops evil software and can't keep it secure, in spite of having a budget larger than most countries.
• Opportunistic hackers comb through stuff and sometimes put together something that could make some money.
• A shocking fraction of the big government agencies and corporations fail to follow the most basic computer maintenance procedures (keeping software up to date and making backups), in spite of spending megabucks on IT, and so are vulnerable.
• The experts quoted in news stories are ignorant and/or wrong, along with the stories themselves.
• The guy who stopped the worm part of the software from working was at the opposite end of the competence spectrum from all the highly-paid executives who weren't doing their jobs.
• Most organizations will change nothing, so something very similar will happen again.

Sigh.

Security Regulations vs. Security

Maintaining the privacy of personal data is important is many industries. This aspect of computer security has received lots of attention from regulatory agencies, who have issued massive bodies of regulations that must be followed in order to achieve security. They've done it in fintech (for banks) and in healthcare, for example HIPAA. But there's a little problem: if you follow all the security regulations with absolute perfection, you can still be hacked. In many cases, following the regulations makes you less secure! Here are details.

Are you going to be secure, or are you going to adhere to the security regulations? It's a choice no one should have to make, but it's exactly the choice forced on us by supposedly well-intentioned government agencies and industry groups.

The Simple Solution

There's actually a simple solution to this problem, though it's likely that a well-known really hot place run by things with horns and tails will freeze over before it will be accepted. Why the resistance? It's simple! It's inexpensive! It's marvelously effective! It enables innovation! And most of the people currently involved in the regulatory nightmare would be out of jobs. Sound like a good reason to find fault?

I've described this amazing solution here. It's pretty simple. The regulations declare that consumer's personal information shall not be disclosed without their explicit approval to any entity, whether on purpose or as a result of error or negligence. Make the penalties severe and personal. Exactly how this is accomplished is up to you. And unleash a torrent of fast, effective security measures. Ones that work!

Why should such a radical approach be tried? Well, among other reasons, the current approach to mandating security just isn't working. Period. Here's a reminder of just how bad it was a couple years ago (and it's not getting better):

What to do while the hot place remains hot

Ok, that's a nice fantasy, but what do you do now? I'm going to be inspected for regulatory compliance, and I've got to pass! Here are the basics of a sensible approach to pass audits and achieve actual security at the same time.

Information and systems security is incredibly important. No one wants systems to be down for any reason or information to fall into unauthorized hands.

Creating systems that can evolve quickly, scale and survive systems failures, while maintaining good performance and near-perfect up time, is really hard, but is core to business success.

• Small organizations have trouble maintaining speed, flexibility and quality as they grow.
• Large organizations rarely are fast and flexible.

Achieving “basic” security (things like firewalls and access control) is easy and normal. Basic measures protect against most threats.

When you go beyond basic security, there are measures that organizations can take that are sensible, proportional to realistic threats, and supportive of the business. The measures are in the spirit of fast, flexible and high quality systems development that lead to business success.

As organizations grow, there are pressures on them to “grow up.”

• In development, organizations adopt industry-standard development processes, and see costs explode, time-lines stretch out and quality plummet. The “solutions” usually make the problem worse.
• In security, organizations call in the experts, get audited, and change lots of things in order to comply with all the lawyer-written regulations. The net result is normally an additional big tax on development (making it even slower and costlier), with dramatic reductions in the actual security of systems and information.

The painful fact is that complying with security regulations is not highly correlated with actually being secure, whether it’s keeping patient records confidential in healthcare or financial information secure in banking and commerce.

• Smart organizations can recognize this and have two efforts: one to maintain actual security, and another to achieve compliance that is “good enough” to pass any audits that may be required.
• Large organizations are more likely to have industry consultants and security specialists who see their jobs as being expert in the regulations and complying with them. This can create the illusion of security without achieving it, while placing an ever-growing burden on the business.

There are many reasons why security regulations are ineffective at achieving their goal. They include:

• Bad guys are always inventing new ways to be bad, and the regulations tend to lag far behind them.
• The regulations tend to be voluminous, detailed specifications for how to achieve security rather than plain statements of what to achieve, which would leave room for innovation and automation.
• You can have highly automated, more effective security measures than specified by the regulations and still fail to be in compliance.
• Achieving compliance tends to be so hard and costly that there is usually little appetite for supporting actual security.
• Meeting the regulations is often so burdensome that compliance in practice tends to be tardy and/or incomplete, further worsening the effectiveness of the regulatory approach.
• Many regulations are written assuming (demanding!) the obsolete, document-heavy waterfall style of software, making compliance while running fast, modern iterative development nearly impossible.
  

Truly bad things happen when you have actual security breaches, not failures of compliance. Therefore:

• Top priority should be achieving actual security, because failing to do so can seriously harm if not kill the business.
• Second priority should be running the business effectively and efficiently.
• Then should come achieving enough regulatory compliance to stay out of the news and out of serious trouble. There are ways to accomplish this.
  

Basics of Effective Security

The most important aspect of security is establishing a culture of security throughout the organization. Security is not principally a technical issue—it is a cultural one. It doesn’t matter if you use 128-bit encryption on all of your “data at rest” if your implementation associate puts a million patient records in a Dropbox or a customer service representative emails those records to someone pretending to be an employer. High "walls" don't protect against the bad insider.

As a company with a larger profile, you do need to check the boxes—for example in healthcare, having an assigned HIPAA security officer, do an annual HIPAA risk assessment, go through an SSAE-16, etc. But you should fill that role with someone who truly thinks about it from a risk-appropriate basis. This is no different from the idea that the ideal Director of QA doesn’t fundamentally think of themselves as the police; the best QA organizations are the small, highly automated ones that are highly integrated with the development team and who are equally talented.

The ideal Security Officer is someone with the intellectual flexibility and horsepower to understand and mitigate the real security issues in the organization while also being able to speak the language of the auditors. Those people do exist (although they are rare)—but they think less about how they are responsible for “policing” the organization (which quickly leads to multiple layers of dysfunction, cost, and distrust) and more about how they can work as part of the organization to mitigate issues.

[Thanks to Ed Park for this formulation!]

Security is tough, particularly when the regulations are burdensome and ineffective. The approach and realizations described here are the only ways I've found to be secure while minimizing the regulatory tax.

Let's Fix CIA Cybersecurity using Machine Learning

We all know by now that the CIA has suffered from the worst hack in history, worse than the Edward Snowden, Daniel Ellsberg, the OPM and any commercial hack you can think of. The likely response will be lots of time and money spent doing more of the useless stuff that failed last time.

There is a solution. It's proven, at scale and in practice. It's based on the best technology, Machine Learning. It is the reason why banks lose only little dribbles of money to evil criminals and hackers, but have never suffered substantial card losses, after decades of thousands of attempts per year! You think maybe the CIA should try it?

Security at the CIA

I have no idea how the CIA does security today. I suspect the bosses all say it's incredibly important, they spend lots of money on it and use "the best" methods.

The CIA may spend more money and use stronger words, but they're pretty much like most large organizations. They just don't know how to get security done and don't seem to care. What about government-issued security regulations? Ineffective. 

There are solutions, but no one is interested. Retails stores have implemented them. Even local libraries have implemented them.

Credit Cards

Let's drill into credit card technology, which has implemented a method of security that is proven at large scale and now uses ever-improving machine learning methods. If the CIA had used credit card security technology to protect its assets, the recent breach would not have happened.

There are hundreds of millions of active credit cards in the US, which cause the movement of trillions of dollars. There are over 30 billion transactions a year. Think of all those cards being used by tens of millions of people at millions of merchants. The fraud problem must be huge, right?

All I can say is, it's a darn good thing the CIA isn't offering credit cards. While the card system isn't perfect, losses due to fraud are well under 10 cents per $100.

First step Card security technology

The card issuers were always concerned about fraud, and as time went on and the numbers grew, the technology deployed to avoid loss evolved.

Among the earliest automated steps to avoid loss in credit cards were two simple measures: credit limits and velocity checks.

Credit limits are what they sound like: how much money you can spend (take) before the card is blocked, i.e., prevents further spending. The limit may be $500 or it may be $50,000, but there's always a limit.

Velocity checks count the frequency that a card is used. If a card is used once a day, that's pretty low frequency. If it's used twice in ten minutes, that's high frequency, and will probably block the card.

These simple measures did an amazing amount to limit fraud losses. They kept losses under 20 cents per $100 spent.

Applying first step card technology to the CIA

In computer terms, all of the assets lost by the CIA are files. Files are managed in a file system, which is a key part of an operating system. All operating systems have security of some kind, which I would hope the CIA already uses. This simply means that any user has to log in and provide security credentials before they're given access to anything.

Every operating system and file system has the ability to restrict access to files by directory. Did the CIA use this simple security measure? I don't know. Did they place files in a hierarchy of directories and carefully control who had access to which tiny subset of all the files they were working on? I don't know, but if they failed to use this existing security method, someone should go to jail.

Regardless of how existing security methods were deployed, the methods of credit limit and velocity check could be added to the file system to keep any one person from "spending too much," i.e., from accessing too many files in a way that could lead to a security breach. Obviously this simple method is not currently deployed at the CIA.

Inside the file system, after a request for a file has been made and before it is honored, there is already a security check: does this person have access to files in this directory? What's needed is straightforward. There needs to be a per-person log of all file accesses, including name and date/time of access. For each person, there should be a limit to the number of files accessed per period of time (for example per day), which is like a credit limit. In addition, there should be a velocity check, so that if a person uses half their daily quota in ten minutes, there could be a problem. When either of these checks are tripped, the user is locked out, and security people need to check and make sure the person is actually doing authorized work. If the limits are set correctly for each person's role, this will stop many problems.

Obviously, bad guys figure this out, so you add things. If you see that someone keeps accessing new files close to the daily maximum, something is wrong. You apply a different kind of velocity check, and shut them down. There are other simple extensions which cover a wide variety of bad things, and shut people down before they get many files.

This method, if applied to the CIA, would put them decades behind credit card technology, but way ahead of where they are. This method would have prevented the recent CIA breach.

Neural Network card technology

Credit limits, velocity checks and their extensions were and are effective for reducing loss. But the bad guys got smarter, and managed to game the system in spite of them.

Before long, some smart and motivated people got together and applied an older machine learning technique, neural networks, to the problem. HNC, now part of FICO, became the industry standard for fraud prevention.

The approach is basically to investigate in depth fraudsters who had been caught and train neural nets to recognize them. The neural nets worked best with a large collection of cases to work on, so an industry coalition was organized, and most of the card issuers contributed their data to HNC, which distributed well-trained models to all the participants. This resulted is tremendous improvement -- it cut the already-low fraud rate in half.

However, this particular method of machine learning, while it works well with credit cards, does not apply to cases like the CIA. Neural nets require a large number of cases to train against, which exist in the credit card world. But fortunately, the number of breaches at places like the CIA, while catastrophic, are small in number and infrequent. Therefore, the neural network method would not help the CIA.

The lastest Machine Learning card technology

Recently, some smart innovators applied more modern machine learning techniques to credit card fraud, techniques that went deeper into the card issuer's computer systems. This company, Feedzai, is posting tremendous gains in fighting fraud, without requiring data sets of existing fraud cases to train against. This new, powerful method trains against normal, lawful users' ordinary usage patterns, and detect departures from them. Because of this, it can catch first-time fraud.

Disclosure: I'm part of a VC firm that invests in Feedzai.

Applying credit card machine learning to the CIA

Feedzai-type machine learning methods are exactly what's needed at the CIA. I'm not saying they can be plugged as-is into the CIA to solve the problem. I am saying that the machine learning methods used by Feedzai to fight credit card fraud are exactly applicable to extend the "credit limit" and "velocity checks" to new levels of accuracy in protecting files in a file system.

Part of what Feedzai does is model the patterns of card usage that are typical for a kind of consumer. Apply this to the kinds of users who access files at the CIA. Some of them are designers, some are programmers, others are quality people and testers. Each of them will have a typical pattern, accessing a per-person unique set of files. Usually, they'll access the same set of files over and over, as they're working on them. Accessing a file for the first time will be rare, and usually only happen when they're working on a new project.

What if a tester, for example, suddenly starts reading files from a project they're not currently working on? What if they're reading source code files, while their normal work only involves working with executables? Alarm!! Ahh-OOOgahhh!! Shut down access of the VERY FIRST file they try to access! And that person has some 'splaining to do.

It's legitimate for a team to be assigned to a new project. Why shouldn't their actions be hand-monitored during the initial days, with every single file access logged and double-checked as being appropriate during a start-up period? Then, once a pattern has been established, the automated method can again take over.

Even a simple implementation of this kind of machine learning would have prevented the massive CIA breach. The 8,761 documents currently available on Wikileaks are just a portion of the whole. Even if the directory-level file system security were as pathetic as I suspect it was, the machine learning method would have caught anyone accessing files outside their normal work pattern, subjecting them to scrutiny and probable removal from the premises.

Conclusion

Security breaches of the most damaging kinds keep rolling in, from the most deeply secret parts of government (NSA, CIA, Army) to important commercial organizations. It's way past time that proven methods of the kind I describe here and in posts linked-to here are deployed to solve the problem.

 

Libraries are More Secure than Computers

Some people look down on libraries. They think they’re obsolete institutions from a previous age – from that inconceivably ancient age before there were computers. But the fact is, libraries do a far better job of protecting their assets – books – than the vast majority of computer systems do protecting their assets – their data and files. Perhaps the oh-so-mighty gods in charge of their Olympian computer systems could pay a visit to the land of mortals, where people use libraries, and learn a thing or two about keeping your assets secure. Given the abysmal track record large corporations and governments have protecting these assets, with no end in sight, it may be worth a brief visit to the primitive places that out-perform them by miles in terms of security.

Computer Security Problems

Does anyone doubt that computer security problems are wide-spread, deep and continuing? Does anyone (except the management in charge, of course) have any reason to believe that the problems are recognized and fixed?

Libraries

Libraries are great places. I’ve spent many happy hours in them. But they’re annoying. They won’t let you pick out the books you want and walk out with them!! They insist, absolutely insist, that you check them out. Not just in general, either – they want you to check out each and every doggone book! First, you need to surrender your personal, private information and get a library card. You have to turn the card over to the librarian with your books. Then, submit to the indignity of having the card scanned and each book scanned. Finally, with all your private information recorded, they physically stamp each book with the date it must be returned by, insultingly making the assumption that you may not return it without such a reminder. Then, and only then, can you leave with your books.

Have you ever tried walking out of a library with a stack of books, without first having checked them out? If you’ve never tried it, you may still harbor the illusion that librarians are mostly quiet, pleasant, mild-mannered people, mostly ladies, who need to be protected from the tough things in life. Anyone who’s tried to STEAL BOOKS from a library harbors no such illusion. The swift, fierce movements, commanding voice and iron resolve of the person who magically appears in front of you, blocking your way, demanding to know exactly what you think you’re doing, will quickly cure you.

 

Let's hope you've never had overdue books. The librarians know what books you have, when you left with them, when you should have returned them, and exactly how much you owe:

By contrast, the computer "librarian" has no idea what files you've even looked at, which ones you left with, and has no sense of returning or overdue. I guess we care more about those obsolete paper books than we do about files that contain confidential customer information.

Century-old Book Seller security methods

Librarians and booksellers have been concerned about security for a long time. Here's a publication that appeared for many years, this particular issue in 1905:

The Publishers' Circular and Booksellers' Record of British and ..., Volume 82

There is lots of wonderful content in this issue, but here's an article that raises the pressing issue of book theft:

 

Stealing books is serious business. The thieves go to jail, as well they should! Here is a method that booksellers use to protect their goods:

 

No one "takes" a file from a computer without help. You ask a program to do it for you. File systems have been part of computers for decades; a file system is the software that keeps track of what file is where, and handles the actual reading and writing of the file (like a book). Moreover, "logging" file systems have been around for a long time -- a logging file system is one that records each and every access to a file -- every read, every write, every update.

It's not hard how to imagine turning a file system into an automated version of the librarian's "spy hole" described more than 100 years ago. A security program reads each request for file access and compares each request against a log of who's done how much of what, and when. If someone whose work normally involves reading a customer record every few minutes suddenly requests dozens of files at a time, this is suspicious! Doesn't it make sense to immediately block their actions until someone makes sure nothing bad is going on? After all, it would be the equivalent of someone trying to walk out a library door with a wheelbarrow piled high with books that had not been checked out -- and if you tried to check them out, you can imagine the grilling you'd get from the librarian before you would be allowed to walk out the door.

Believe it or not, systems like this have been implemented. They're not hard to build. No new programming magic is required. In fact, all that's required is a sincere desire to solve the problem! A desire which appears to be lacking. Sad.

Conclusion

Think of the image of the librarian (old, dowdy, obsolete) and the computer expert (young, cool, with-it). It turns out that the contrasting images are exactly backwards when it comes to security. In spite of all the acronyms and nerdy stuff, computer security experts are simply incapable of protecting their "stuff," while librarians are way ahead of the game -- more than a hundred years ahead, for what it's worth!

 

Russia Hacks DNC, Podesta Email: Fake News

The US government has declared that the Russian government has hacked important US entities. It has retaliated against the Russian government in response. It has now issued its official report providing the evidence of hacking. 

The "evidence" is a joke. It proves nothing but the incompetence and/or duplicity of the agencies that issued it. The near-certain declaration that the Russian government was behind this and related hacks is fake news. The majority of the US press echos the fake news, supporting it with whatever is left of their credibility.

Cybersecurity background

Most large organizations have a big computer security problem. They just don't know how to get it done and don't seem to care, as repeated massive breaches have demonstrated. Government agencies are just as helpless. They issue regulations that tell corporations how to achieve security, but the regulations make things worse, and are ineffective for the government itself. There are solutions, but no one is interested.

The Hacks

The overall results of the hacks are well-known. In July, Wikileaks released 44,053 emails from officials of the DNC. In October, it released a large batch of Hillary Clinton campaign director John Podesta's email. Many important people immediately accused the Russians of performing the hack and providing the documents to Wikileaks.

The Official Evidence

The government's long-awaited official report of evidence that the Russians performed the hack was released last week by this government agency:

Here is how the report is described:

The report is 13 pages long, with a couple of linked files. The first thing that struck me was that, starting on page 5 and going to the end, the content had literally nothing to do with hacks or Russians -- it was just a list of generic nostrums about how to be cyber-secure. One has to wonder where all this supposed powerful wisdom was while the US government Office of Personnel Management (OPM) hack took place; this hack resulted in the loss of highly sensitive data on over 22 million people. People who live in glass houses...

What about the "evidence" contained on the first few pages?

I have personally dealt with computers for a long time. I've had to fix serious problems, evaluate reports of problems and recommend solutions. There is a clear pattern of good work:

• The person and group that did the work is clearly identified.
• There is some kind of narrative that describes the problem and the path of discovery that leads to the conclusion.
• Full details about the computers and software affected are provided. Is it a personal computer or a server? What version of what operating system is installed? If an application is relevant, what is the name and version of the application?
• Full details about event data are provided, for example log files.
• If there are anomalies, full details about them, included where and how they were found.
• Enough data is provided so you can double-check any conclusions that may be drawn.
• If more than one event is involved, this information is provided for each event, with all the information for example servers and operating systems clearly associated with the corresponding event.

None of this standard information was provided in the report!  Any conclusions that are drawn, given the total lack of real, professional evidence, are therefore baseless.

Details of the non-evidence

The report provides no separate information about the DNC or Podesta hacks. It says nothing about whether an email server was hacked or a client. Nothing! What the report does have is a little information with generic diagrams, a very techie listing of part of a script, and a list of IP addresses. The contents of what they provided has been competently analyzed by a security firm. Here is their summary:

Let's look at the Podesta hack for a bit.

I looked at a broad sample of the emails on Wikileaks. Podesta had a gmail account, [email protected]. While some of the emails were sent to another address, [email protected], a quick look at the source of the emails (kindly provided by Wikileaks) shows that this was set up as a forwarding address, i.e., automatically forwarded to the gmail account. The source code I examined was all typical, i.e., not faked.

No one claims Google was hacked. So it was Podesta's email account and/or the computer he used to access it. The report, of course, doesn't say. The hack could have been accomplished by any number of techniques, and certainly doesn't require sophistication.

The list of IP addresses given is completely irrelevant for this kind of hack. If the hackers got his user name and password, all they needed to do was log in -- no "attack vectors" required.

Turning to the DNC, the report implies (but doesn't state) that the DNC server was attacked. It talks about how the hacker:

which is quite impressive. How exactly did the malware "escalate privileges?" That's like saying that a lieutenant in the army suddenly became a general! By making it happen himself! It's only possible if there's a bug in the system that was hacked. Was it Microsoft Exchange? What's the bug? We'd like to know!

Going into this made me more suspicious, because the Wikileaks site lists exactly 7 senior officials whose emails were hacked. Here's what they say:

All that's needed to accomplish this is a bent insider, like a junior Edward Snowden, or some good social engineering. In other words, more of the same that worked on Podesta. Otherwise, why would the hack be limited to exactly those 7 and no more?

In other words, an examination of what was hacked leads to the strong suspicion that the "evidence" provided by the government has nothing to do with how the hacking was actually accomplished, or by whom.

Conclusion

Cyber-security is incredibly important. I don't care one way or the other that the DNC and Podesta were hacked. Shame on them for not caring about security when the world is full of bad guys. But I do care that many of our most important institutions such as our government and healthcare institutions fail to take it seriously, and when they do, are incapable of getting the job done. It hurts many of us, and someday could hurt us really badly.

Apple can help fight crime while maintaining privacy

Apple can and should maintain the privacy of the information their customers have on Apple devices. But what if the owner is a criminal or terrorist, and the relevant law enforcement agency has a court-ordered warrant? Apple should bend over backwards to help the agency fight crime and terrorism. It can do this without "back doors" or any of the awful things that some people talk about.

The government

The government scares me. I don’t want them anywhere near my private information. They have way too much power. If any little thing goes wrong, someone in government can trample all over me. My fear is equal opportunity. If Republicans are in charge, some of them will be corrupt and will decide to use my private information to trample on my rights. If Democrats are in charge, same thing. And bureaucrats of whatever stripe ... I shudder. I want to be able to have my private information encrypted and secure, so that no one – including the institutions who are supposed to be keeping us safe – has access to it. PERIOD.

Sadly, the government already has whole huge piles of my private information all over the place in their files and computers. Moreover, the government appears to be incompetent at keeping private information private. The IRS has been hacked. The White House itself has been hacked. Even that biggest and baddest of security agencies, the NSA, had a massive insider breach. This is not the sort of thing that’s going to be fixed, because they don’t even have the theory of information security right, much less the practice. Details here.

On the other hand…

There are bad guys out there!

Bad guys are bad. They want to steal things. Some of them want to hurt me. They have all sorts of reasons. Some are crazy, some are sociopaths, some are evil, some are driven by a religious and/or political ideology that leads them to commit acts of violence; sometimes we call them terrorists. People in various institutions have the job of keeping law-biding people safe from the depredations of criminals, crazies and terrorists, and/or tracking them down after they’ve done one of the heinous things they are wont to do. These protectors including various branches of the military and other branches of the government, including the CIA, FBI, NSA and others. Like any normal, sane person, I want to be safe. I want someone to keep me safe from the bad guys, and when bad things happen, I want someone to track down the bad guys to prevent them from doing more bad, and to send a message to other bad guys that they probably won’t get away with whatever bad thing they have in mind.

This means…

The government needs to keep out of the private business of the citizens. We are part of a country ruled by a Constitution. There is a Bill of Rights, the fourth amendment in particular. HOWEVER: The government's job includes keeping us citizens safe while protecting our rights. Part of the job.

The people who keep us safe and dig into crimes when prevention hasn’t prevented need to be able to do their jobs. If the courts agree to issue a subpoena, they need to be able to search for evidence. Under the fourth amendment and codified in long-standing procedure, there is a process for ensuring that the privacy of law-abiding citizens is maintained, while at the same time ensuring that, with proper judicial approval, searches and seizures can be performed to maintain the safety of citizens.

Under the right circumstances and controls, sane people want government law enforcement agents to do their jobs, protect us and catch wrong-doers.

What about Apple?

Prior to iOS 8 and the current brouhaha, Apple responded as it should have to requests of this kind, thousands per year of normal requests and hundreds per year involving national security. See here for details. Suddenly they changed. Here is the choice they made.

Currently Apple has a well-deserved reputation as a criminal’s friend and supporter of terrorists. Do you think the bad guys don't pay attention? They do.

What Apple should do

Apple should become:

• the best friend of law-biding citizens who want to maintain the privacy that is their right under the Fourth Amendment, while at the same time becoming
• the scourge of criminals and terrorists.

Specifically, Apple should strengthen and grow the facility they already operate on their Cupertino campus to receive and crack the devices of criminals and others, under strict subpoena and court order control. As they do today. They can and should extend this valuable, safety-maintaining service to iOS 8 and all future hardware and software.

Would this be expensive? What if it cost, say, $20 million a year? That amounts to less than 0.01% of the CASH that Apple has on hand. It would be a rounding error at ten times the cost.

Apple could brand the center as the scourge of criminals and terrorists, and make their phones something that bad guys actively avoid using. That way, anyone who uses an iPhone is proclaiming that they’re a good guy – and they’re also proclaiming that Apple keeps their private information safe and secure, unlike (I’m sad to say) most government agencies.

Is this possible? Yes. Apple has wisely avoided denying that they are incapable of cracking a phone that is in their physical possession. Which are the only phones they should be cracking anyway. Should they give their tools to anyone else? NO WAY!

What about phones that are in the field? Could Apple remotely hack them? Of course they could! Strictly under court order, strictly from the Cupertino Bat-cave, and solely the identified phone under Warrant.

Apple's ability to crack phones under these strictly limited circumstances has NOTHING to do with creating dangerous "back doors" or somehow defeating amazing encryption. It's about hardware and the software that runs on it, both of which are entirely of Apple's design and under their control.

Apple has the opportunity to protect the privacy of its customers much more effectively than the government does, while at the same time helping law enforcement protect us against criminals and terrorists. I hope they'll step up and do the right thing.

Apple's Cancer Prevention Strategy

The CEO of Apple declared that he has joined the ranks of the nation's oncologists, and is working to prevent the government from forcing Apple to create a new form of cancer and "expose hundreds of millions of people to issues."

The CEO of Apple is anxious to prevent future "issues."

Let's look at the case of Brittney Mills,

This is an example of an "issue" that took place in April of 2015 in Baton Rouge, LA, long before the Apple CEO got worried about cancer. Here's the "issue" that Ms. Mills experienced:

Investigators still haven't been able to find who killed her and her unborn child. They've tried hard.

They went to Apple for help. Apple refused to help the police get the evidence that might lead them to the person who killed Brittney Mills and her unborn child. The local district attorney wrote to the US Senate Judiciary committee about the case:

His pleas and those of Brittney Mills' family were ignored. The case of Brittney Mills isn't the only one:

Law enforcement getting information from a dead person's cell phone is similar to getting information from their wallet: not something anyone would normally do -- but when the person is dead, the only way to proceed.

Apple's refusal to help Baton Rouge law enforcement catch the person who murdered Brittany Mills is taking place in thousands of cases all over the US:

Apple's response? An escalating war of words. A half hour's worth in ABC's "exclusive" interview with the CEO.

While declaring how important safety is, "doing this," i.e., helping get information from the cell phones of murdered pregnant women, "could expose people to incredible vulnerabilities." Does this mean the Apple CEO is concerned about future "incredible vulnerabilities" that are worse than being murdered?

And then we have the old slippery slope argument:

OOOhhhh: law enforcement might turn on the camera!! I guess the Apple CEO thinks that's worse than being a pregnant woman living alone, opening your door at night for someone you know, getting shot and dying. And not being able to find out who did it.

Now we get to what Apple is being asked by the courts to do, which is the equivalent of creating cancer:

I demonstrated in my prior post that Apple has cooperated with law enforcement in the past, and given out private information on literally tens of thousands of cases, including at least a thousand cases a year involving national security. Apple was able to provide this information because they had written for earlier releases of iOS a much stronger version of what is needed for iOS 8. Apple has written it. It wasn't cancerous before. How would it be cancerous now?

Similarly, when he claims that helping the court would "expose hundreds of millions of people to issues," he assumes this software would somehow escape from Apple's control, when the prior versions did not.

Apple does know a way to avoid the problem. And it's had years of experience over tens of thousands of cases that the method is safe and effective.

The issue is simple. Apple refused to provide the help needed to identify the murderer of Brittany Mills and her unborn child. Apple says providing that help is like unleashing a plague of cancer. I say to Apple: please unleash that cancer.

Apple's Approach to Privacy, Terrorists and Criminals

Apple is locked in a public battle with the prosecutors of the San Bernardino terrorist case about helping the FBI. Tim Cook has been in full public-relations mode asserting how this "unprecedented" request is like distributing a "master key" that will make everything on iPhones public. 

The government's request (as opposed to how it's described in the media) is reasonable; it is a simple extension to iOS 8 of part of a service that Apple already provides to government agencies for tens of thousands of Apple devices. By refusing to continue providing the service, Apple prevents local police from returning stolen iPhones to their rightful owners. Apple prevents law enforcement from solving crimes of murder, sex abuse of children, sex trafficking, robbery and other crimes. And Apple prevents the FBI from keeping us safe from terrorists.

The awful things Cook claims will happen if he complies are already enabled by horribly buggy and security-hole-ridden Apple software. Nothing the government has requested will make things worse.

Apple’s official privacy policy

What was Apple’s privacy policy before the recent war of words on the subject? The policy is clearly stated on the Apple website. There are lots of words about how Apple loves and respects it customers, and Apple is wonderful. The words lead to this conclusion:

That sounds pretty stark! No back door and no server access. Ever! That sure sounds like my information is secure, no matter what!

Apple’s actions on privacy

As it turns out, those are weasel words. Which you can find out by a little digging. All you have to do is go to their “government information requests” page. There they admit that they respond to subpoenas and search warrants. But they “limit our response to only the data law enforcement is legally entitled to for the specific investigation.” Well, maybe it’s not so bad…

Scanning down the page, in HUGE type, is this assurance that practically no one is affected by all this:

An amazingly tiny fraction of “customers” have been affected by this grudging acceptance of government coercion.

How much does that tiny, tiny fraction amount to? Being super-conservative about doing the calculation, I took the quarterly sales just of iPhones only for the last 3 years (2013 to 2015) as reported publicly by Apple. Truncating each reported result to the lower million, the total is 546 million iPhones. The real number, including iPads and going back further in time, is probably more than twice that. But the arithmetic even for that number is interesting. Using Apple’s own 0.00673% number, the total is 36,745 customers. 

That number does not include “national security” requests, which according to the same page, is more than 750 requests for the first half of 2015:

To summarize rhetoric and reality about Apple and privacy:

Rhetoric: We don’t create backdoors and “have never allowed any government to access our servers. And we never will.”

Reality: We dish out customer data as required, and do so by the tens of thousands. But we pout while we’re doing it.

What Apple really, really does

Dig a bit further, and you can download the details of what and how customer information is handled at Apple, in this document:

Here’s a bit of the table of contents:

You can see that the range and scope of information available goes way beyond anything you might imagine from scanning Apple's website pages.

The document also declares that Apple can provide an incredible amount of information from any iOS device prior to 8.0, but “will not” perform data extractions from 8.0 or later. The extraction “…can only be performed at Apple’s Cupertino, California headquarters…”

What the government wants

The government’s request is short and to the point.

They want help defeating iOS 8’s PIN brute-force avoidance mechanisms:

Here’s what they suggest an acceptable means of providing the help would be, a piece of loadable software:

They specifically request software that works for only that phone:

They don’t demand possessing the software; it’s OK if Apple physically has the device and keeps the developed software on site, without even requiring that government agents be present:

And if Apple can think of a different way to accomplish the same results, it’s OK with the court:

In summary, the court will provide Apple with the terrorist’s government-issued iPhone, and wants Apple to create software that will enable the government to do the hard work of figuring out the iPhone’s PIN code so that the government can access the data on the phone. The government is willing to let Apple do this work with the phone at Apple’s offices, with no government agents present, wants the software to work only for the iPhone in question, and does not request a copy of the software.

Tim Cook’s response

Apple hacks and gives the government the private data of tens of thousands of customers. Probably a thousand times a year for national security issues. It does this in its facilities, using software it developed for the purpose.

The feds are investigating a terrorist attack on US soil in which 14 innocent people were murdered. The phone in question wasn’t personally owned by Syed Farook; it was owned by the government agency for which he worked, and whose employees he murdered. Breaking years of Apple practice, Tim Cook refuses to help. He explains himself on the Apple website:

He declares the request “unprecedented.” Sure, if you ignore the tens of thousands of other requests Apple had no trouble satisfying.

He says the order “threatens the security of our customers.” And the possibility of future terrorist attacks doesn’t?

He says the order “has implications far beyond the legal case at hand.” Yes it does. But not the way he means it.

A little further down, he gets to the crux of the matter:

He claims he doesn’t have what the government wants. Everyone knows that, and it’s implied in the court order. But he had the equivalent for earlier versions of iOS.

He claims it’s “too dangerous to create.” While he blathers about encryption and about how Apple can’t get at your data, here he makes no claim that the software is impossible to write – and it’s not! He’s just saying he won’t create it, because he’s too moral or something, and the software would be too "dangerous." Although more powerful versions of the requested software were built by Apple for prior versions of iOS, and they somehow weren't dangerous.

He claims the request is for a “backdoor to the iPhone.” Wow. You can review the actual request above. It’s no such thing. It’s a piece of software that circumvents the iOS 8 defense against brute-force PIN-breaking. Apple gets to create the software and use it at their offices on the provided phone.

Cook goes on:

“The FBI wants us to make a new version of the iPhone operating system.” Maybe that sounds technical and accurate to someone who didn’t read the documents, but it simply isn’t true.

“In the wrong hands, this software…” How exactly is it going to get in the wrong hands, Mr. Cook? Apple employees have full and unfettered access to the source code of Apple software, including iOS. Any time one of them felt like it, they could make an unauthorized version and spirit it to some off-site server, and do all sorts of evil with it. That was true yesterday, is true today, and will remain true regardless of what happens here. The current situation doesn’t change the chances of malicious software being used for bad purposes one iota.

“…would have the potential to unlock any iPhone in someone’s physical possession.” BZZZTTT! What this software would do would be exactly and only what the government is asking for: make it possible to brute-force hack the PIN code, which has one million possible combinations for the default 6-digit PIN. For normal humans, this means you would have to:

• Acquire someone’s iPhone
• Get and load the hacking software onto it, assuming it has somehow wafted out of Apple
• Then, by hand, try 6 digit PIN codes until you got to the one that worked
• On average, this would occur after entering half the possible codes, a total of 3 million digits. This would take more than 34 days of continuous one digit per second attempts.
• Or, if you really are a super-hacker, you could automate the process. Which I won’t go into here.

Cook then gets wilder:

Yes, the software, once created, could, would and should be used on "any number of devices." Devices that were provided to Apple at their offices with proper documentation and court orders. Most of these devices, as today, would have been lost by their owners, and Apple is helping the owners identify them so they can be recovered. Many of these devices, as today, would be evidence in criminal proceedings. And hundreds of these devices per year will be related to national security issues, as they are today.

I am very concerned about the FBI being blocked from tracking and stopping terrorists before they kill. But I'm equally concerned about the "merely" criminal aspects of this. For example:

Cook has more:

Because Apple built software used by Apple on specific phones delivered with court orders to Apple facilities, the government will now be able to listen to your microphone or camera. How exactly does this leap happen?

The fact is, Apple software was, is and will be chock full of security holes and other problems. Here is Apple's own list of the dozens of security problems that were fixed in iOS 7. After fixing all those problems, iOS should be secure, right? Apple then found more bugs, refused to fix them in user's devices, and instead released iOS 8 with no less than 53 additional fixes to security flaws. So how did iOS 8 go, with all those fixes? Not so well, according to Wired:

Finally, Tim Cook once more:

Apple products have been buggy and filled with security holes in every release. It's riddled with back doors, side doors and bottom doors, all because of Apple's ineptness. It's not getting better. Mr. Cook wants us to fear that the mean government will force us to walk around without privacy. Well, we already are! And it's Apple software that's responsible! Extending Apple's existing practice to iOS 8 will not create a new situation -- it will maintain Apple's historic cooperation with the legitimate law enforcement operations of government, protecting us from terrorists and criminals.

What is this really about?

I wish I knew. But it's hard not to think of money and market positioning. There is a large portion of the public that thinks that Wall Street and Big Corporations are evil. Meanwhile, Apple makes products that are used by millions of people who think this way. Apple wants to market itself as being for the 99% of people.

But it has a problem. It's one of the richest, most valuable corporations in the world. It charges top dollar for its products, which are entirely made in cheap-labor countries. It plays games to avoid paying taxes. It's bigger and richer than Wall Street! It's even richer than the US Treasury:

It's quite reasonable to imagine that Tim Cook is following in the Steve Jobs tradition of marketing magic to divert its customers from looking at the numbers. Numbers that show that Apple is a corporate behemoth whose sales are slowing, whose new product initiatives have failed, and is desperate to bolster its brand and hold onto customer trust (and revenue) it does not deserve.

What Baseball can teach us about OPM, Anthem and other Cyber-Thefts

In baseball, teams play against each other. Each half inning, one team does its best to attack the other and score, while the other does its best to stop them. The teams are similarly staffed, and they alternate playing offense and defense. In computer security, teams also play against each other. The "home" team always plays defense, while the "away" team comes to town and tries to score against their hosts.

Tiny, often remote "visiting teams" in cyber-war score massive victories against huge, well-funded organizations like OPM and Anthem. These are rarely quick "hit and run" attacks -- they are more often months-long penetrations, during which massive amount of information gold is marched out of the "well-guarded walls" of the clueless behemoth. What's worse, most people don't seem to care -- imagine if a single gold bar were secreted out of Fort Knox: heads would roll! How can this happen? Why does no one seem to care?

Baseball and Cyber-war

First and foremost, baseball is visible. We can see it and understand it. Loads of fans come to stadiums to watch it.
Cyberwar? It's largely invisible. It's as though the stadiums were empty.

In baseball, we can actually see the team at bat competing against the defenders.
It's pretty exciting! For the vast majority of people, there is no equivalent in cyber-war.

The fans and managers understand the game; those closest to it have normally played it. They have strong opinions, for example, about the defensive shift maneuver, which is sometimes used against a pull hitter. Even if you've never heard of it, a simple diagram makes it easy to understand.
In cyber-war there are also strong opinions, but the way most managers think about cyber-defense is simply inappropriate and ineffective. Not only is there no defensive shift, there is a complete lack of awareness when the enemy has been inside your walls for weeks, ransacking away. Because no one understands what's going on, including those in charge, the ineffective methods continue to be standard practice, even when there are better approaches available. Retail stores, who actually care about loss prevention, generally have better theft prevention measures.

Above all, there's this. The people who play baseball care about it.
So do the people who watch baseball. Cyber-war is way more than a game, but people just don't take it seriously. They don't even give the passion to it that they give to games! The individual computer users don't know or care, and neither do the managers.

Conclusion

Nothing will change in Cyber-war until we understand it, start caring about it and apply methods that work. In a fight between the smart and motivated against the clueless and unmotivated, the outcome is preordained.

Systemic Issues Behind the Cyber-Security Disasters at OPM, Citi, Anthem, etc.

Our personal data is stored in the computers at large corporations and government organizations. We now have abundant proof that these large organizations are incapable of protecting our data. This is not a string of bad luck that will soon pass. These large organizations never had good security -- they just weren't being attacked. Unfortunately, the security flaws are a direct outcome of the dysfunctional technical and management practices that lead to large-organization IT failures across the spectrum.

Recent Security Disasters

The security disaster at the government Office of Personnel Management (OPM) has been in the news recently. Here is a summary, and here is a timeline. OPM knew all about security, and tried its darndest to be secure, spending over $4.5 Billion dollars on a system to prevent breaches, including a recent $218 million upgrade on the security system known as Einstein. All for naught. 

In the private sector, there was the breach at Anthem, preceded by a string of security disasters at major banks and retailers involving tens of millions of consumer records.

The Response to the Attacks

We're seeing the usual responses to the problems.

First and foremost, try to avoid letting anyone know there's a problem.

Second, try to draw attention to all the attacks that were thwarted. The OPM is actually bragging about all the attacks they defend against! That's like, when the bank has been totally cleaned out, bragging about how many attempts had been thwarted.

Finally, talk about how much you care, offer completely counter-productive services to consumers, and spend even more money on the stuff that didn't, doesn't and won't work. Ignore the fact that the incentives are all wrong, that in fact no one cares.

No one is losing their job. No significant changes are being made. No one is running around like their hair's on fire. Ho-hum, it's business as usual.

Systemic Issues are behind the Disasters

Security in large organizations is broken. But that's just a side effect of the fact that IT in large organizations is broken. Not in detail -- in principle. When the foundation of a building is made out of jello instead of concrete, you don't fix it by adding more jello, trying a new flavor of jello, or getting everyone to walk slowly and carefully. You replace it with reinforced concrete -- pronto! When the foundations are the wrong kind of stuff, making new foundations out of jello will never help. Even if it's jello that costs billions of dollars.

The Systemic Issues

This is a subject that is long and deep. All the problems come down to two simple core thoughts: (1) computers are just like all the other things to which management techniques are applied, so standard-issue "good management" will solve any problems; and (2) computer security is just like all the other computer issues, and can be managed using the same standard techniques.

Wrong and wrong.

Computers and software in general are radically different than anything else we encounter in our normal lives, and evolve more quickly by orders of magnitude than anything else in human experience. Managing a software building project as though it were a home building project leads to results that are, at best, 10X worse than optimal methods, and at worst, complete disaster.

Computer security in particular is not just another issue to be managed using standard techniques, which in any case yield horrible results. In computer security, we're dealing with smart and motivated attackers who are at war with us, and naturally use the latest "weapons" in a rapidly evolving arsenal. While our attackers are at war with us, we plod along at a peace-time pace, scheduling security issues like just the other items in prioritized lists. When the armed gang breaks through the back door of the warehouse, we eventually discover the break-in and schedule a response for sometime in the next couple of months. By the time we've installed new alarms, the gangs are already on their third generation of tools for defeating them.

Computers are different than the other things we manage

Computers evolve at a pace that is completely unprecedented in human experience.

Most of the things that managers do to manage computers is modeled on what they do for everything else, and make things worse.

Computers are incredibly complex! But somehow, we imagine that people with no actual experience with computers can manage them, when we would never let someone who never saw a baseball game manage a team, or someone who never wrote an article manage writers.

The vendors of hardware, software and services have evolved to provide incredibly expensive, ineffective products and services that are packaged to make top managers feel great.

Computer security requires war-time actions, not peace-time ones

Translating from physical security, managers insist that security is about walls, guards and kevlar vests. The bad guys are out there, our job is to keep them out. Wrong. The vast majority of security breaches result from either conscious or unknowing cooperation of insiders. Including OPM.

The bad guys are at war with us. By the time we've figured out that we've been robbed, the bad guys are long gone. By the time we're just wrapping up the requirements documents for our response, the bad guys have cleaned us out again.

Once we finally deploy our best defense, the art of war has advanced and our defenses are useless, just like the Maginot Line in World War I.

Conclusion

We all know that the definition of insanity is repeating the same actions and expecting different results. In that sense, the approach that large organizations, private and public, take to computer security is insane. All the people in charge propose is doing what they've always done, only somehow harder and better. The alternative approach, while radically different from the current one, is simple, clear and actionable. The people in charge actively resist it today. They've got to embrace it if there is to be any chance at all of improvement in cyber-security.

Internet Driver's Licenses Needed for Users

We give kids sex education. We give them driver education, and require a driver test and license before driving. But we let any fool onto the internet to wreak whatever havoc they can on themselves and others without a second thought. It's time for a change!

Education for Meaningful Use

Education on the basics of how the internet and associated technologies work and how to control, respond to and interpret what you see is totally neglected. There are no significant efforts that I know of to make people educated consumers of this important, ubiquitous service that is so widely used. But there is a more important issue...

Education for Safety

By far the most important subject for internet education is safety. Maintaining internet safety has some similarities to general safety, but is different in important ways.

Internet "driving" safety

The most important aspect of safety while driving is avoiding driving while impaired in any way, and paying sharp attention to the road and other vehicles at all times. Driving while impaired by drugs or alcohol or while engaged in texting or talking
are recognized factors.

So imagine how hazardous internet driving must be when people don't even know how to read the road signs (the URL's) and can't tell that they've wandered onto a road constructed by criminals specifically for the purpose of enabling them to steal your car, drive it to your bank and take out a big withdrawal! But that's exactly what it is! Here's an example of a more brazen attack (image from a good guy, Yoo Security), demanding that you send the money yourself:
Unfortunately, there are criminals out there who have grown far beyond simple smash-and-grab operations. These sophisticated criminals with a long-term view trick you to "drive" onto their criminally-constructed "road" for the sole purpose of making your car an instrument for stealing from other people or organizations. They can make your computer into a zombie to participate in botnets. It can serve that purpose for minutes or years without your awareness. Is the problem big? You betcha. There are more computers that have been hi-jacked into botnets (maybe yours!) than most people are aware of:

Sometimes, of course, the criminals are stupid, greedy or malicious -- I guess those are the drop-outs from the "criminals should be good citizens" certification program. So your hi-jacked device could slow to a crawl, do weird things, look over your shoulder as you type until they get the information needed to drain your bank account or max out your credit card, or even (just because it's fun!) wipe out your machine while leaving some cute "it was me! Have a nice life!" Message on your screen.

Internet E-mail fraud

How often do you get a letter purporting to be from your bank asking you to send them a letter containing your account number just so they can verify that everything's OK? If you got one, do you think you'd respond as requested? Apparently you're not alone -- criminals are the supreme capitalists, and abandon efforts that are unprofitable before long.

But how about letters on the internet, i.e., e-mail? Along with everyone I know, I get an amazing number of criminal solicitations, ranging from the laughable (at least to me) to the amazingly credible every day. Data-driven capitalists that they are, the only explanation for the persistence of these efforts is that more than enough of them work to cover the costs and trouble of running the schemes, certainly more than getting a legal job. I've seen fewer solicitations from Nigeria lately, but the slack has been taken up by Libya.

Here's one of the new breed from Libya:

Here is a somewhat more plausible one from a place that really could be your bank:

Conclusion

Uneducated internet users cause billions of dollars of harm to themselves and others every year. You think this would result in outcry by those users and people who know them for education. You might think this might merit a bit of attention from the institutions who so assiduously and expensively educate, authorize, license and otherwise keep us on the straight and narrow. When I'm in Central Park in New York, there are rangers watching my every move; they set me straight when I ride my bike where I'm not supposed to, or walk in one of the ever-changing restricted areas. The conclusion is obvious: every move I make in the Park is more worthy of watchful restriction by people in uniforms than the millions of actions on the internet that seem, at least to me, far more destructive. I must be missing something.

How to Achieve Cybersecurity: Motivation

The problem is big. It's getting bigger. Here's one summary of what's been happening:

What's the problem here? Is it really so hard to achieve cybersecurity?

I suggest that the issue is clear and simple: the people in charge of keeping your information safe are not motivated to keep it safe. The consequences to them personally of failing to keep it safe are minimal, and so they simply don't take the trouble to do it.

Motivation and consequences

Whether we like it or not, people are motivated on the positive side by rewards, and on the negative side by punishments. If you see people acting in a certain way, you ask, what is the incentive that is encouraging that behavior? The incentive could be positive (you get something good) or negative (something bad that used to happen when you did that thing no longer happens). A great deal of human behavior can be explained by personal incentives: rewards and punishments.

Incentives in Cybersecurity

So what happens to people in the companies when one of these big data thefts happen? Are the front-line drudges punished but the executives given a free pass? Do the people where the buck supposedly stops lose their jobs but the worker bees who were just executing according to a bad plan let off lightly? Answer: there's some bad publicity, but no one loses their job, no one's pay is docked, nothing!

If no one at the companies even went through the motions of trying to keep your data secure, the publicity might be bad. But that's what regulations are for -- CYA. The company claims it was following all the regulations that are supposed to keep data secure. So how is it their fault if, in spite of all their excellent, by-the-book efforts, the data walked out the door anyway? Case closed. The company and all its employees, from top to bottom, are off the hook!

Incentives and Motivations

When a company loses money and market share, the CEO is likely to lose his job. When a person in accounting delivers bad data, they're likely to lose their job. When a department does really well, the people in charge are frequently given bonuses or promotions. They get better jobs and make more money. In most industries, sales people are incentivized by commissions -- if they sell more, they make more money. It's everywhere. To encourage good behavior, reward it. To discourage bad behavior, punish it.

Everyone says they're concerned about protecting your data. They use as evidence the fact that they conform to all relevant regulations and spend lots of money on security. So if, in spite of all this, the data is lost, it can't possibly be their fault!

Does that mean the regulations themselves are bad or ineffective? No one is claiming that (except for me and a few other voices in the wilderness), but think about this: when has any regulator lost anything because they were doing a bad job at regulating? The very notion boggles the mind!

Bottom line: they have no incentive to protect your data! We know this because, when people are properly motivated to get a job done, they somehow find a way to get it done. The fact that they are unmotivated and have bad theories practically guarantees failure.

Conclusion

Lack of motivation.

No incentives.

Ineffective regulations.

Therefore, cyberthefts will continue unabated until this changes. Q.E.D.

Methods for Effective CyberSecurity

The methods for achieving effective cybersecurity for a large class of applications are simple and obvious, but almost never implemented. If the methods were implemented, they would prevent the kind of massive, high-profile data loss that has been increasingly in the news. The methods make common sense to most normal people – but as we all know, computer “experts” are anything but normal. The industry needs to get it together, stop spending massive amounts of money on futile efforts to secure consumer data, and start implementing common-sense measures that work!

The current approaches to CyberSecurity are fundamentally flawed

That’s why they don’t work! It’s like if you’re playing pool, missing a lot of your shots, and spend lots of effort gesturing, jumping and grunting as your shot fails to achieve its objective – do you think your problem is not jumping vigorously enough or grunting loud enough? That’s what most enterprise responses to cyber-insecurity amount to. Increasing the money spent on things that don’t work won’t suddenly make them start working.

The basics

No matter what methods we use, if we continue to deploy large numbers of security guards who are nearing retirement against small, smart, fast-moving ninja bad guys, we’ll lose. If we continue fighting the last war, we’ll lose. If we continue to think that this game is all about how high and thick the walls of the castle are, we’ll lose.

New approaches, new methods

They’re not really new – like most good ideas, they’ve been thoroughly proven in other domains. We know they work. It’s a matter of adapting them so they apply to our computer systems.

A lot of smart computer people have worked on the security problem for a long time. The issue isn’t something abstruse like better encryption algorithms. It’s simple!

First, realize that anybody who walks in the door could be a bad guy.

Second, monitor and track the valuable stuff that you don’t want walking out the door.

Both of which, believe it or not, we fail to do today inside computer systems!

How retailers do it

Retailers with lots of low-value goods like grocery stores have store monitors and checkout areas. Anyone could be a thief, so people are assigned to monitor actions accordingly. Some goods may be valuable and easy to hide, like razor blades. Those are often displayed, but require a store employee with a key to let you get them.

Clothing stores frequently have security tags on every single item. The tags are removed using a special tool during the check-out process. If you try to walk out of the store with an item that is still tagged, alarms ring and security people grab you.

Stores with very high value goods like jewelry stores have locked cases, and a heavily human approach to security. Basically, at least one person watches each customer (and sales person!) with jewels at all times. They are disciplined to manage the number of items that are outside a locked case carefully. While the guards watch the customers (i.e., the potential thieves), what they really do is watch the jewelry. They track each item until it’s been bought or safely returned to its case.

The retail approach to securing valuable items is clear: using whatever combination of automated and human means that make sense, track every valuable item, and assure that when the item goes out the door, it has been cleared to go out with the person it’s going out with.

Applying Cybersecurity methods to retail

What would retail look like if we used the kind of methods used by computer experts?

First, every store would be surrounded by thick, high walls. No display windows! There would be strictly controlled ways of getting in – think TSA security at an airport. Further imagine that the world was awash with fake and stolen ID’s, so that while getting in the store legitimately is odious, for a skilled bad guy, not too hard.

Now imagine that once you’re in, there is no one watching the goods, there are no security tags on the clothes, no security cameras and no guards. You can grab a string of shopping carts, pile them high with goods, and wind slowly through the aisles. At check-out – well there is no check-out! You’ve been thoroughly vetted on the way in, after all, so you must be OK. When you’re done “shopping,” you can just leave! With your mountains of goods!

Of course, most visitors to this imaginary store are legitimate. They put up with the horrible entrance gauntlet because all stores have something like it. They get what they need and somehow arrange with the store to pay for it. There’s nothing to stop thousands of bad-guy visitors from walking out with thousands or millions items each, or millions of visitors to walk out with normal-sized shopping carts. Whatever works.

You might think I’m exaggerating. I wish I were.

Applying Retail methods to Cybersecurity

It’s a bit more technical and less visual to see how retail methods can be applied to computer systems, but the basic concepts are clear. While current cybersecurity focuses on perimeter defense (like TSA security for stores), the retail approach would be a bit looser. After all, if the bad guys get in but can’t get away with anything valuable, they haven’t accomplished much, have they? How proud is a bank robber who’s broken into the safe but can’t leave with the dough? How fruitful is his career of crime if, every time he passes the demand note to the teller, she just smiles and says “next customer, please?”

Applying the retail method to computers requires a completely new approach to tracking what visitors do when they’re inside the computer. While tracking their actions is important, what really needs to be done is track the “goods,” the valuable data items. The retail approach would differ according to the value of the items. If they’re like clothing, each item would be checked on the way out to make sure it’s authorized to leave. If they’re like jewels (for example, personal information), each item is watched like a hawk the moment it’s “picked up” by a “customer” (program). Does the customer have a couple of jewels? That could be OK, but we’re more alert. Does the customer have ten or more? Quietly circle the customer, watch the doors, and make sure there’s no escape.

The method needs to be extended to apply to the unique circumstances of the computer. Computer bad guys can easily assemble thousands of confederates to do their bidding. The bad guys can dress and act however the boss wants them to. However, they are unlikely to act just like normal shoppers. But I don’t want to take this too far in a blog post – we’re coming up to the edge of methods I’d rather not disclose.

Conclusion

Computer systems, corporate and government, will continue to be breached at an alarming rate, which is of course much higher than is publicly disclosed. More money will be spent and people hired. More standards will be set, regulations promulgated and enforced. As should be obvious by now, most of the money will be wasted, most of the people will accomplish nothing, and the regulations will increase costs while making things worse. Unless something changes.

The problem of cybersecurity can be solved. But it can only be solved if: we acknowledge we’re at war and act accordingly; we apply within the guts of our systems common-sense methods whose principles are clear, obvious and proven in other domains; and we start acting as though we actually want to solve the problem, as opposed to the current strategy of denial, cover-up and blame-shifting.

My Anthem Account was Hacked

I get my health insurance through Anthem. Corporate Anthem was hacked, and the company has made a mess of their customer relations after the hacking, as I've described from receiving their "help." I now see evidence that my personal information was accessed, and Anthem has never told me.

Anthem and HIPAA

Anthem is really committed to HIPAA. Here's how they explain it on their website.

It's clear from this that Anthem is very committed to privacy and security. Both! Here's some of what they say about privacy.

And here's some of what they say about security.

Anthem clearly had all the bases covered. Except they didn't. What's mind-blowing to me is that, in spite of all the security-privacy-lah-de-dah, someone walked off with the personal information of tens of millions of customers -- and no alarm even went off! The breach was actually discovered by an alert grunt in the trenches.

Hacking David Black

Anthem has communicated to its members that they would let them know when they discovered whether any particular member was among those who had been hacked. I haven't heard a thing from them. But I now know that it's likely that my information was stolen.

I went into the standard Anthem consumer portal a little while ago.

I poked around a little, and discovered this little bombshell:

In other words, "I" had logged in at quarter after one in the morning on Saturday, Jan 31, 2015. However, I personally wasn't logged into Anthem at that time. I was asleep.

The Good News

There's good news here! I already knew that Anthem either didn't know whether I'd been hacked or had decided to not tell me, so no change there. My opinion of Anthem was already subzero, so it didn't get noticeably lower. Furthermore, in spite of all this, Anthem executive management will continue to rake in millions, and they're pretty sure that profits won't be harmed:

What a relief!

Conclusion

Nothing new here. Big corporations comply with all the burdensome regulations, and tens of millions of private records somehow get stolen. The result: lots of face-saving talk that does no one any good, and increased competition-stifling regulation that does nothing to solve the problem. Nothing to see here, people ... move along...

 

The Anthem of Cyber-Insecurity

I'm hoping that people will start writing songs about cyber-insecurity, and that a good one will emerge that will be acclaimed as the "Anthem of Cyber-Insecurity." It will be sung quietly by groups of computer users who hold hands as they hear the details of yet another massive computer breach. While singing, some of the much-abused users will be silently praying that their "protectors" get bombed by Facebook friend requests by identity-thieved replicas of themselves, while others will pray for the end of "help" that isn't.

The Anthem Attack

I'm one of those praying users, because I'm a member of Anthem, the company that "lost" the personal information of "tens of millions" of its members sometime in 2014; they're not sure how many, whose records were "lost," or when it happened. Here's a personalized communication I received from Anthem:

Anthem has made a priority of communicating with its customers about the attack. When you're in the glare of publicity like this, I'm sure great care has gone into each statement on the case. That's probably why I have received more than one missive with the same date that spins things in different ways. For example, the Feb 13 note above refers simply to "cyberattackers" who "tried to get" private information, raising the possibility that their efforts were foiled by the valiant workers at Anthem.

Check out the identically-dated but substantially different Feb 13 note below.

In this second attempt, Anthem tells us about "cyber attackers" (now two words instead of one) who executed a "sophisticated attack," and "obtained personal information" "relating to" their customers. I guess it was successful? But maybe not, because the behavior of these guys isn't a felony, it's merely "suspicious activity" that "may have occurred." Furthermore, they carefully state that the personal information wasn't the customer's actual personal information, but merely "related to" said personal information. Hmmm....

What "May Have Been" Lost

So what information may have been lost during this incident that may have occurred at some unknown time? A fair amount.

Again, what's clear is that Anthem isn't clear. The information "accessed" (wasn't it stolen?) "may have included names, ..." But maybe not, we are led to believe. If the information that may have been accessed may have included my Social Security number, why isn't it possible that all sorts of other information was also accessed? We are supposed to be reassured that "there is no evidence at this time" that this actually took place -- a nearly ideal way of phrasing something that is supposed to sound like reassurance, but provides full CYA.

Anthem Provides Protection

Anthem has a whole website set up to let its members know what's going on, and to let customers know how they can get protection against the possible unauthorized access of their personal information.

Here's what Anthem will do: they'll pay a third party to help you out.

If you get in trouble, you can call the service, and they'll help you out. Meanwhile, your personal information may be in the hands of people who were unauthorized to access it. If they are the kind of people who will do "unauthorized" things, who knows what perfidy they'll stoop to?

Anthem's Additional Protection

The basic service you get isn't protection at all, as they make clear. Nonetheless, "For additional protection..." -- on top of the non-protection they already provide -- you can sign up for more. What exactly is this more? Quite a bit! Here's some of it:

Wow, and all for free! Let's sign up!

So you enter your e-mail, and get a code, go to the website, enter the code, and finally get to register for protection.

What happens next? Here's the page:

Wow, this is amazing!

I have a chance to enter into a website a good fraction of the private, personal information entrusted to a giant insurance company which, while under their stewardship, "may have been accessed" by "unauthorized" entities.

The security geniuses who kept my information secure want me to give it again to a company that they endorse as being wonderful security experts. Anthem was just terrific at keeping my information secure -- it goes without saying that their endorsement of the security of this partner they've just picked is rock-solid.

These guys are bureaucrats. Read this about bureaucratic security cred. And for more, this.

Summary

Anthem's revenues are greater than $60 Billion. They can afford to keep customer data secure.

Anthem's executives are paid enough to do their jobs well. Last year, the CEO made over $16 million and the CFO over $7 million.

And yet...

It took a guy at the bottom rung of the ladder to pay attention and notice something was wrong; had he not cared, the outflow of personal data would still be going on, as it had been for an indeterminate amount of time before the alert employee's observation.

No system or procedure established by the rich, giant entity had anything to do with noticing the breach, much less preventing it.

Everything about what they've done since exhibits the same lack of attention to detail and I-don't-care attitude that made the breach possible. What they mostly seem to want is to dash off letters riddled with errors and assurances, focused above all on their public image.

Their offer of "protection" is a cruel joke, exposing the gullible who accept the offer to further dissemination of their private information.

Conclusion

I'm waiting for that anthem as I sit, holding hands in a circle with my fellow users, thinking dark thoughts. And I'm as likely to enter my personal data into the Anthem authorized "protection" service as I am to publish it on this blog.

Cyber-Insecurity and the Maginot Line

The French built the famous Maginot Line after WW I as the perfect defense against another German attack. We all know how that worked out; it became the textbook example of “fighting the last war.” With computers, the speed of evolution is literally hundreds of times faster than with armaments. That’s partly why in cyber warfare, the vast majority of money and effort is spent fighting the last war, which partly explains why we are so cyber-insecure and why it’s so important to get way smarter about cybersecurity than we are.

The Maginot Line

According to the history books, the French (among others) “won” World War I. The French certainly thought so. The French generals definitely thought so.

The French decided that they wanted “learn the lessons” of the war, and apply them to preparing for the next war with the Germans.

They knew that the technology of war evolves. They were well aware that, once they recovered from their post-war deprivations, the Germans would continue to advance the weapons of war. They were confident that heavily armored vehicles (tanks) would evolve from their nascent status during the “Great War.” To make a long story short, after considerable deliberation, they designed and built the Maginot Line as the ultimate defense against German attack.

The name Maginot “Line” implies that the Maginot whatever was line-like in nature. The reality is richer and more interesting. As this diagram indicates,
it was a rich complex of systems, stretching more than 10 miles from the border posts to the back.

Here, for example, is an element in the Maginot line.
Things like this would contain machine guns and/or anti-tank guns.

It was built over about 10 years, from 1930 to 1940, and was extolled as a “work of genius” by military experts.

The Maginot Line at War

The Germans attacked on May 10, 1940. By May 21, the Germans had the Allied armies trapped by the sea on the northern coast of France. German forces arrived at an undefended Paris on June 14, and forced the French into an armistice on June 22. France, victors in World War I and creators of that work of genius, the Maginot Line, fell in about six weeks.

How did it happen? In retrospect, it’s pretty simple: the Germans read the French script for how the war was to be played, and refused to play the part written for them. Their tanks simply by-passed the invincible Line, and the French planes were inferior in design and number to the German planes.
Even though the English fed them details of German operations obtained by breaking the Enigma code, French inferiority was so great that they still lost!

And how could the French possibly have won when the Germans had generals who looked like this?

Looking back on the Maginot Line

It’s hard to find a better example of “fighting the last war” than the Maginot Line. But surely everyone learned the lessons of how bad it is to fight the last war, right? Nope. That’s one of the reasons why the Maginot Line serves so well as a metaphor, going well beyond its role in history. It serves as an oft-ignored beacon for what you should not do.

The Maginot Line and Cyber Insecurity

We can make ourselves feel comfortable by calling it cyber-security, but the reality is that anyone involved with computers is somehow involved in cyber-warfare, whether as a civilian (most people, the “users”) or as a professional. Most computer professionals like to think they have civilian jobs in the computer industry, but the fact is, they’re involved in cyber-warfare no less than the people who transport military supplies to the soldiers are involved in warfare. Everything they do makes a contribution to either winning the war or losing it.

How’s the cyber-warfare going? How do most wars go when the leaders refuse to acknowledge they’re at war? Yup, that well. We act in every way like we're at peace, and insist on peacetime software development methods, while on the other side, hosts of bad guys fully acknowledge they're at war, and it's a war they intend to win.

The leaders of our computer systems insist that they’re doing everything they can to maintain cyber-security. Their words are often backed by money. It’s not unusual for 10% of a company’s IT budget to be spent on cyber-security. Unfortunately, the vast majority of the money and the efforts go to building the computer version of Maginot Lines, systems that the people in charge are convinced are brilliant, but which are in fact generations behind the bad guys who are constantly attacking them.

There is a natural tendency to fight the last war, no matter what you’re doing or where you work. Many people are aware of this tendency and try to avoid it, just as the people who built the Maginot Line tried to avoid it. They genuinely tried their best to take into account the advances that would take place, and plan for that future state. But the Germans were more advanced than the French planned for, and more clever.

So what do you think would take place in a field where the rate of advance of the technology is greater than in any other domain of human experience? If it’s hard for people in domains in which patterns and practices advance slowly, how hard is it in a domain which advances hundreds of times more quickly than anything in history?

That, in a nutshell, is why the vast majority of the billions of dollars spent on cyber-security has the net effect of wasting money and making us cyber-insecure.