RITA

 

Image from Pixabay

Recently, RITA came into my life. She just fluttered in during a risk analysis, and I listened with fascination to what a colleague had to say about her (thank you Henk!). Later I Googled her and was impressed by her engaging personality. Her image is a bit less flattering, but I still prefer to judge RITA on her character rather than her appearance.

RITA is an acronym that stands for Reliable Internetwork Troubleshooting Agent. It's an April Fool's joke from 1998, presented as an RFC. That abbreviation stands for Request for Comments. An RFC is literally a request to comment on something. That ‘something’ are protocols and other documents that describe the operation of the internet. Ultimately, an RFC becomes a standard, but strangely enough it’s still called an RFC.

RFC 2321 describes “usage of Nondeterministic Troubleshooting and Diagnostic Methodologies as applied to today’s complex nondeterministic networks and environments”. The difficult word, which appears twice in the previous sentence, means that outcomes are variable even when the conditions are the same. I put aside the common assumption among laymen that computers always produce the same output in identical situations - especially with identical input - at the very beginning of my career. At the time, I was responsible for the COBOL software that took care of the nightly processing of income tax data. One evening an operator (hello Oscar!) called me because the processing had stalled. I told him to just restart the processing. Never heard anything about it again.

RITA is charmingly simple, and the way she makes her diagnosis is equally so. Moreover, the outcome is easy to understand because it is binary: it is right or wrong, there is no in between. RITA's primary area of use is hardware and software, but I think RITA can also be successfully used in countless other environments, even outside IT.

RITA is a rubber chicken with a length of 51.25 cm (20 3/16”) and its operation is very simple. You place it on the device to be analyzed or, in the case of software, on a still packaged copy of the software, or if necessary on a printout of the source code (that old COBOL software of mine was easily a decimetre (4”) thick). And here’s the punchline: if RITA flies away, then the object to be analyzed is error-free. If, on the other hand, RITA remains down, then something is wrong. You get the idea: rubber chickens don't fly – unless they're thrown, of course.

Moral of the story: hardware and software always contain errors, because they are incredibly complex. And, I always add, some of those errors have bad consequences for the security of the object, and possibly even for the security of the wider environment in which it is active (a hacked baby monitor is not only annoying because the hacker is in your home, but also because the device can be misused in a DDoS attack on an organization on the other side of the world).

In our risk analyses, we always ask how vulnerable a particular object is to errors in software, broken down into self-built and purchased software. Vulnerability is determined by the measures you have taken to address a threat. The application of the DTAP model is invariably mentioned as a measure: the development, testing, acceptance and finally running of the software in production takes place in separate environments, the intention being that an error will come to light in one of these phases. Attack & penetration testing is often used to determine whether an attacker can gain access to the object. And vulnerability scanning regularly checks whether a product contains known vulnerabilities. What remains after all this good work are the mistakes that have still been overlooked. And believe me: RITA will never take to the skies. The only question is who will discover a risky error first: a crook or an honest person.

 

And in the big bad world...

This section contains a selection of news articles I came across in the past week. Because the original version of this blog post is aimed at readers in the Netherlands, it contains some links to articles in Dutch. Where no language is indicated, the article is in English.

• Laxity is a factor that few take into account.
• Signal now protects your privacy even better.
• cloud computing is sucking in government. [DUTCH]
• This American newspaper article predicts a positive effect on the US of a ruling by the European Court of Human Rights.
• there is still something to be gained in the high ranks of the Luftwaffe in the field of security awareness. [DUTCH]
• the US government is leaning toward banning ransom payments.
• Ivanti 's problems keep the NSA busy.
• the NSA also gives tips about security in the cloud.
• the beer supply will not be in danger for the time being.
• the man in the middle takes off in your Tesla.
• sometimes the opponent is in your own organization.
• many Dutch passports are for sale on the dark web. [DUTCH]

 

 

Protecting the universe

 

Image from Pixabay

It's not a fair fight. A hacker only needs to find one tiny hole to break into a system, while we have to protect the entire universe. If the hacker manages to find a system where the latest security patch is missing and he can exploit this vulnerability, he is in. We have so many systems that run so much software that there is always a vulnerability somewhere. It's not fair. I have thrown this lamentation at my audience during countless presentations.

Do you know MythBusters , the often spectacular show with Jamie Hyneman and Adam Savage, which aired on the Discovery Channel? Last Wednesday I felt like I was in a special episode of it, when Etay Maor gave a keynote at ISACA's Risk Event entitled “Busting cyber security myths”. The very first myth, which he busted, was exactly what is stated in the paragraph above. Ouch.

He used the MITRE ATT&CK matrix to make his point (I’m sorry, but the MITRE Corporation thinks you should write “attack” that way). That matrix is fourteen columns wide, and the last one lists the types of impact an attack can have: data manipulation and destruction, data encryption (ransomware) and denial of service, to name a few. And all other columns list things an attacker can do to achieve the desired impact. It starts in the first column with all kinds of reconnaissance, followed by finding the necessary resources, gaining access and then all kinds of steps aimed at owning the intended system. Each column is a kind of drop-down menu. Not that an attacker will use this matrix to determine how to proceed - this matrix focuses on analysts, who can gain a better understanding of an attack.

To make his point, Etay Maor has mapped REvil ransomware to the MITRE ATT&CK matrix. That was actually quite easy, because that ransomware has already been completely dissected on the MITRE website; Maor only had to colour the corresponding boxes in the matrix. This resulted in no less than fourteen red squares in seven different columns. Many of those boxes contain sub-items. The last column, with the impact, contains another four red boxes. So the maker of REvil had to do a lot more than find just one hole. The complete table of activities for REvil is forty rows long. By the way, REvil is not just ransomware, but ransomware-as-a-service (RaaS). This means that REvil is a service that can be hired by others. Yes people, the underworld has service providers, too.

Back to the allegedly unfair fight. My starting point was a ratio of one to infinity – one hole compared to the entire universe. Maor's example brings the ratio to forty to infinity. I still think that it is unfairly distributed, although I now look at it in a more nuanced way.

The question is: what do you do about it? How do you protect the universe, or more specifically: the cyber universe? It starts with security by design, including security from the outset in the design of your application and your infrastructure. Because if the design of a new car is already completely finished and you only then find out that it still needs brakes, then you’re looking at a quite difficult – and expensive – job. Later on in the process, during the realization, it is important to maintain that security mindset. This is where craftsmanship comes into play. The brake lines must be properly connected and testing for leaks is always a good idea. And once the product is running, it is important to maintain it properly (in the car analogy you take that for granted). That includes understanding that hardware and software by definition contain errors, and that some of those errors not only can be harmful to the security of the product itself, but also can have an impact on other products. You must keep looking for this as long as the product is in use, and any defects found must be remedied in a timely manner. Before someone else finds them and uses them unfairly.

On Thursday 24 November, a special will be published on the occasion of Check-your-passwords-day. That week’s regular Security (b)log is cancelled.

 

And in the big bad world…

This section contains a selection of news articles I came across in the past week. Because the original version of this blog post is aimed at readers in the Netherlands, it contains some links to articles in Dutch. Where no language is indicated, the article is in English.

• the Digital Trust Center has already warned many companies about vulnerabilities. [DUTCH]
• Google pays hundreds of millions of dollars for collecting location data.
• you can, of course, also hack a satellite, says this head of space security.
• You shouldn’t hide your security cameras.
• Meta employees have hijacked Facebook and Instragram user accounts. [DUTCH]
• maybe there is Russian software in your phone. [DUTCH]
• the government should better describe the privacy risks of using US cloud storage services. [DUTCH]
• the number of reports of WhatsApp fraud is falling. [DUTCH]
• Here's how to get back money lost due to WhatsApp fraud. [DUTCH]
• the football world cup harms your privacy. [DUTCH]
• a hospital employee accessed almost a hundred patient files illicitly. [DUTCH]