Small Business Defense – User Training

There was a general belief in the security community many years ago that user training was the only way to address security issues. Then we got slammed by tons of viruses and users all over clicked on links and ran attachments, basically doing exactly what we had all told them not to do. After spending weeks cleaning up the mess, the security community had a change of heart and basically took the stance that user training was a waste of time, and that we need better technology.

Well, it’s time to change this again. The technology doesn’t work. Sure, the technology is great for general threats. It’s good to keep certain applications from running. It keeps many network-based threats at bay. It can even be used to make the organization a bit more agile without too much risk.

However, it all comes down to one thing. No technology is smarter than a person, so everything we build tends to have a process somewhere that allows a person to override the security and effectively say “do it anyway”. Sure, we limit this ability to trusted people. Your executives’ time is highly valuable, so they may have local admin rights to avoid having to wait for help desk people. Your admins may need to bypass security controls to get their jobs done. There may not be many, but, in any organization, there are generally a few “special” people that are outside of the security system.

This makes the highly vulnerable to spear phishing attacks. All an attacker has to do is identify the special people, research them on the Internet, and send them an email that gets them to run something outside of the security controls. Then it’s all over.

There is only solution to threats that bypass the entire security system, and that is to build a new security layer to intercept the threat. Sadly, given the way people have to work, there is only one place to put this security… and that’s in their brains.

Any action that a high-profile person takes is, at minimum, reviewed and considered by their brain prior to it being done. Thus, the last layer in a security architecture has to be the people themselves.

No, don’t waste your time training the average user not to click on links or run attachments. Instead, deploy technology that makes these actions impossible. But then, when the executives explain to you why they are special and why they need to be exempt, your answer should be “sure, but you need training”.

Mitigate the risk with user training. Make sure that they know that they are being specifically targeted. Train them and document the training. Revisit them regularly.

If you are in a position of writing policy, try to build a system where you can test them on their training. If they fail the tests, they lose the rights to circumvent the security technologies.

Remember, the goal is to protect the business. The business, as well as the threats themselves are embodied in these “special” people. It is your job to protect them, even from themselves.

Small Business Attack – Spear Phishing

Imagine that you own a company. You are responsible for the financial lives of hundreds of people. If you make a mistake, you may have to let some of them go or, worse, lose the entire company and put them all out of a job. This fact doesn’t really keep you up at night, but it is a valid concern, so when you receive an email that reads:

“High Priority: Subpoena issued for YourCompany in case against YourClient”

Naturally, you’re a bit concerned as you do a lot of business with YourClient, and you open the email. Inside, you see your name, your business’s name, your address and phone number and a brief explanation that there is a disagreement between two of your clients and you have personally been asked to court. Then there is a link at the bottom that reads:

“For more information and to schedule your appearance at the trial, please click here.”

You’re probably going to click, aren’t you? After all, if you don’t show up, you could personally be found to be in contempt and in either case, your business will be impacted. It would make the most sense to click the link, get all the information you need and then call your lawyer, right?

Well, bad news. You’ve been spear phished. Some attacker found your information online and constructed an email filled with completely reasonable information all in an effort to fool you into clicking on that link. Sadly, now that you have, odds are that someone on the Internet has your passwords, access to confidential documents and yours (and possibly the company’s) bank accounts. Worse, this information is in the hands of someone that knew you well enough to hand craft an attack against you, so odds are that the information is going to be used.

This is the problem with spear phishing. It’s targeted to high-profile people. Odds are that it won’t get picked up by anti-spam filters, as it is designed to look completely legitimate. It also won’t pass by the security people’s view, as there are likely people who get email so confidential that even the security people can’t see it.

So, in effect, this is a threat that bypasses all of our checks. What are we going to do about it?

Security lessons from Nature – Lichens and Cooperation

OK, I’ll admit it. I like lichens. I have for years. One summer I even cultivated a pretty orange one that grew in a railroad tie where I parked, which is not the sort of thing that wins you friends in high school. Even in the rural Midwest, lichen cultivation just doesn’t count as “farming”. I find them neat, both to look at and to consider scientifically.

According to Wikipedia (at least, as I write this), a lichen is a “composite organism consisting of a symbiotic association of a fungus (the mycobiont) with a photosynthetic partner (the photobiont or phycobiont), usually either a green alga (commonly Trebouxia) or cyanobacterium (commonly Nostoc).” Isn’t that fascinating?

You see, the fungus and the algae work together and even though they are separate, they function as one organism. The algae (or cyanobacterium, which is a different essay altogether) provides energy from the sun, as it can photosynthesize and the fungus cannot. The two lifeforms then exchange nutrients and grow together. (This is really glossing some things over. If you’re truly interested, get the book Lichens of North America, it goes into much more detail.)

The thing is, each party provides something that the other one needs, and as a unit, they are successful in ways that they would not be separate. You’ve all heard this analogy before, so I won’t bore you with it. Instead, I’ll go one level deeper.

Did you know that the fungus eats the algae? That’s how this “nutrient exchange” thing works. As a team, the composite organism succeeds because, even though the dominant partner (the fungus) literally consumes the subservient partner (the algae), it works because the algae grows faster than the fungus can eat it. It works for the algae because it can compete in places it otherwise wouldn’t have. The fungus provides a level of protection.

Which gets to the point. There are a lot of uneven partnerships in the business world. There are a lot of small companies, especially in the VAR space, that enter into partnerships with the big players. There’s a lot of talk about how the small companies don’t really gain much from it, but they have to keep paying these “partnership fees” in order to compete against the other small companies. However, that’s not exactly it. The “partnership fees” keep the even smaller companies and startups from directly competing against you. The partnership may provide a lot of resources that you don’t really need… but so does the fungus in a lichen.

See, the algae grows faster than the fungus. The small company is more agile than the big one. Profit margins can be higher, the work can be more flexible. However, it is very difficult to grow beyond the partnership, as the very things that make the partnership successful also constrain the growth of the small business outside of the brand of the large company. In short, so long as the large company can consume your output (clients), it can continue to protect you and provide you with room to grow.

So, just like in the wild, success has to be measured in terms of the joint organism, not as one alone.

Mythic Monday – The Bunyip

Most folks in my culture don’t know much about the bunyip. That is, unless they saw Dot and the Kangroo as an impressionable youth, in which case they had nightmares for years… but I digress.

According to aboriginal legend, the bunyip lives in lakes and emerges at night to devour animals or people nearby. Like many monsters of this type, people were warned to avoid the rousing the wrath of the bunyip, or they would be eaten alive. In short, if you left it alone, it would leave you alone.

The thing, though, is that the lake has a bunyip in it. You all know it. You may be able to fool yourself into a false sense of safety, but you all know that to retain that false sense of safety, there are things that you must do (or not do). In the case of the bunyip, it’s a simple matter of not going out at night and not going near water. (The rules are different in the Dreamtime, but this blog doesn’t dive into the minutia of mythology (much)).

These days, most Western people disregard such monster stories. Our lives are such that we don’t need to invent such stories to explain away unknowns. When people vanish from our lives, they are much more likely to get hit by a car or die of old age then they are to mysteriously vanish in the night. This doesn’t mean, however, that we don’t make up stories. Quite the contrary, we make them up all the time, in exactly the same way.

How many times have you felt like your computer follows a strange set of rules? Maybe there is an incantation you go through to make something start (The desktop icon doesn’t work, so you click the start menu, navigate to programs, go to “Microsoft”, click on “Word”, cross your fingers and hope it starts). Maybe there are things that you do differently in your life (Don’t use that computer to access the Internet, it’s too slow, use the laptop from work instead.) Maybe you just warn others away from that particular system.

Maybe there’s a monster in your PC.

In the security field, we assign all sorts of names to these monsters: virus, worm, trojan, rootkit, backdoor, etc. We do this because, as monster hunters, it helps us to know what sort of creature we may be facing. It makes it easier to communicate tracking and hunting techniques. And sadly, just as in the stories, the monsters often win. Just when we think we have them figured out they turn out to have friends or be aligned with a trickster of some sort, then they come after us in force. It can be quite demoralizing.

However, we’re the experts, if we are so often stymied, what can you possibly do to protect yourself?

The first step is to stop hiding in your huts cowering from the night. If your computer is making you change your behavior, there’s a problem. Maybe it’s broken, maybe the app is poorly written, or maybe there’s a monster in there. The thing is, if you let your computer control you, you’ll never know if there’s a monster in the lake or if it’s just a floating log.

The second step, and one that would help us all a lot, is to start locking the lakes. Simply put, if you live in a world with monsters (as we do), it’s kind of stupid to invite them in. If you’re not running an antimalware system of some sort, you’re leaving your system open to be colonized by monsters. Similarly, if you visit other lakes that are likely to be infested with monsters, they just might follow you home. Practically, this means avoiding porn and gambling sites.

Lastly, if you think there may be a monster lurking around, you might want to consider calling in an expert monster hunter. We may not be as cool as the people in the movies, but we’ve got a fighting chance at getting rid of them. And after all, it’s better than being eaten in the night.

Security lessons from Nature – Eyespots

Now, butterflies aren’t generally considered to be terrifying. Nor, unless you were chased by one as a small child, are peacocks. And, though five of the six ends of a tiger are pointy, the tail is also generally viewed to be fairly innocuous.

Interestingly, all of these generally harmless examples protect themselves through the use of eye spots. Butterflies often have them on their wings, so when they are fully unfolded, they resemble a face. Peacocks have them all over their tails, so when they are fully spread out, they resemble the eyes of many creatures. The white spots on the back of a tiger’s ears resemble eyes as well.

The theory in all of these cases is that an attacker will think they are being observed and halt an attack. It may only cause a brief pause, but that might be just enough for the eyespotted animal to get away.

The security lesson here is twofold.

First of all, it’s a generally good idea to let an attacker think you’re paying closer attention to them than you are. That way the attacker is more likely to move on to a victim that would be a little bit easier to take on. Perhaps one that is paying a bit less attention. Practically, the technique only works when it takes fewer resources to mount a pseudo-defense than it does to to mount an actual one. This is one of the reasons that fake surveillance cameras are popular. If there are 10 cameras in a place, it’s a lot cheaper for 8 of them to be fake, so long as an attacker doesn’t know which ones are which. It would not make sense to create a fake IDS system that detects security incidents and fakes a response, as it would take just as much work to fake a response as it would to make a real one.

The second lesson is that you have to pay some attention. After all, attackers aren’t stupid. If they figure out that the butterfly with the weird eyes isn’t really watching, the butterfly will be lunch if it doesn’t fly away soon. A distraction technique, be they eyespots or fake cameras are only good so long as the real eyes and real cameras are being used.

How you can you fake out your attackers?

Mythic Monday – The Sphinx

“Which creature in the morning goes on four legs, at mid-day on two, and in the evening upon three, and the more legs it has, the weaker it be?”

That was the riddle asked by the Sphinx, a creature sent to Thebes to by Hera (or Ares). When the riddle was answered incorrectly, the Sphinx would strangle and devour the challenger. This went on for a while until Oedipus, who answered “man” and explained that the “time of day” was a metaphor for “time of life” and that the question refers to the stages of life: baby crawling, man walking, old man with a cane. After this, the Sphinx (being unable to come up with another clever riddle) promptly killed herself.

Today’s myth is fairly transparently about password security. The Sphinx made three basic errors that we can learn from:

Question/Answer Pairs

We’ve all seen the “security question” prompts. They often ask about pets or parental surnames. Sometimes they ask about special anniversaries. In any event, if you are moderately findable online, a quick search of genealogy databases or photo-sharing sites can turn up answers to such questions. To combat this, you can either hide all information relating to you, search it out online and remove it, visit public libraries and burn all the public records and brain-wipe all your friends… or you can answer the question nonsensically. Just because the field says “mother’s maiden name”, doesn’t mean that you have to put that in there. Maybe put in your favorite fruit instead.

Suppose the answer to the Sphinx’s riddle wasn’t “Man”, but was “Kiwi”? Sure, the myth wouldn’t make much sense, and Oedipus would have become dinner rather than king, but the riddle would have much less guessable.

Short Answer

You know how irritating it is to have to have a password that is “at least 8 characters”? Well, the reason is that there are people that can try all sorts of different words until they get in. It’s as if someone in power (like, say, Oedipus) were sending numerous peasants to the Sphinx with random answers. It would have gone something like this:

Sphinx: “Which creature in the morning goes on four legs, at mid-day on two, and in the evening upon three, and the more legs it has, the weaker it be?”
Peasant 1: Umm, (checks list) an apple!
Sphinx: Nope. (strangle) (eat)
Peasant 2: How about an eagle?
Sphinx: Nope. (strangle) (eat)
Peasant 3: (looks about warilly) man?
Sphinx: Close, but we just changed the answer in the previous section. (strangle) (OM NOM NOM NOM)
Peasant 4: (reads the previous section). Kiwi!
Sphinx: Drat! (strangles self and throws body over cliff)
Peasant 4: Yay! I win.
Oedipus: (strangles peasant 4) (looks around warilly) Yay! I win.

So, the Sphinx manages to survive a bit longer, but is still undone because the answer is short and guessable. Let’s protect against that by changing the answer from “Kiwi” to “My favorite of all the fruits is the kiwi… the fruit that needs a shave!” That’d be a lot harder to guess. Hard enough the Oedipus might even run out of peasants before he gets to it.

Only One Question

Ah, but what if you have an exceptionally smart guesser. Suppose they know something about the person choosing the password. Even incredibly long passphrases have to be remembered, so odds are that a little bit of social engineering can be of use. If we fully embrace anachronisms and have a Sphinx that is a Star Wars fan, odds are that the pass phrase would appear on the list of 30 Most Memorable ‘Star Wars’ Quotes. Similarly, if the Sphinx were known to enjoy Shakespeare, 200+ Famous Bardisms might be a good place to start. The point here is to pre-load the disposable peasants with likely answers, so that Oedipus can hit upon it while there is still a peasant to kill and claim the credit.

A clever Sphinx can protect herself by coming up with multiple riddles. In the security field, we’d call this multi-factor authentication, which we shorten to “know/have/are”. To extend our horribly-mistreated metaphor, the Sphinx would be highly secure if she:

Something you know:
- Q: “Which creature in the morning goes on four legs, at mid-day on two, and in the evening upon three, and the more legs it has, the weaker it be?”
- A: “My favorite of all the fruits is the kiwi… the fruit that needs a shave!”
Something you have:
- Q: “Do you have the key that unlocks this super special box that I borrowed from Pandora?
- A: (peasant offers a herring that has been painted plaid)
  - Remember, the answer should be nonsensical and nontrivial. A plaid herring covers both requirements in most instances. Besides, it’s generally best to leave Pandora’s box closed.
Something you are:
- Q: “How do I know that you are truly you?”
- A: (peasant shows the Sphinx that birthmark that Oedipus painted on his arm)
  - It’s very difficult to forge the “something you are” check, but it can be done if the verification technology is flawed, be it a fingerprint scanner that doesn’t check body temperature or a stupid Sphinx.

Thus, the only person that could get past the Sphinx would be someone that managed to prove their identity three different ways, which makes it extremely likely that the person allowed is the one authorized… or someone that has privileged information as to which questions will be asked and which answers are expected. So, make sure that your questions and answers are reasonably secure, but also make sure that you don’t let anyone else know that they are. Secrets are only good so long as they are kept secret.

That’s why the Sphinx had to kill herself, you know.

The Red River Zoo Needs Your Help

I know that many of you only read this blog for the security and business information. However, I have hopes that you enjoy the Tuesday natural history musings, and in that vein, I want to make you aware of the situation going on in Fargo, ND. This is a bit more personal that most of my other postings, but I hope that you’ll understand the reasons why this post has little to nothing to do about I.T. or security.

Some of you may have heard about the massive flooding in Fargo, ND. Well, for the moment, the Red River Zoo is safe, but many of the homes and businesses in Fargo are not. To help out, the zoo is accepting people’s exotic pets so that they can be cared for while the rest of Fargo flees. It’s a small zoo, but a good one. Some of you may recall the photos I’ve taken there.

This zoo is special. It’s fairly young and has a very small staff. Yet, they have managed to:

Breed Russian Red Tree Squirrels (See the blog)

Raise Pallas’ Cats

Breed Sichuan Takins (See the blog)

Raise Red Pandas

Along with many many others. (See the blogs for the porcupines and wolves.)

But here’s the thing. Unlike some of the larger zoos out there, this zoo is funded entirely with donations, and have managed to do one heck of job without using public funds. During and immediately after a disaster like what is impacting Fargo, the monies that are available tend to dry up. At the same time, we have a zoo that operates on a skeleton staff bending over backwards to save people’s pets. They need money to pay for the new animals and to keep things going until things start to get better.

I’ve made a quick PayPal account for them. I know that many of you are focusing efforts on things like:

These are all worthy causes, and I’m not asking you to take anything away from them. All I ask is that if you have a spare $5, $10 or $20, can you toss it towards the Red River Zoo to help feed some animals.

I’m going to let this run for a few weeks, sweeping the account every Friday. I’ll send them a check for whatever is there to help them operate during the crisis. When it’s all done, I’ll close the PayPal account. There will be no auction and not a lot of bugging. All I’m asking is:

If you can afford to drop a few dollars, please do so.
If you can direct people to this post, so that others can drop a few dollars in the account, please do so.

The donation button is here:

If you prefer to send a check, you may do so to:

Flood Contributions
The Red River Zoo
4220 21st Ave SW
Fargo, ND 58104

If you have any questions, please leave a comment.

Thank you.

Small Business Defense – Detect, Avoid, Leverage Business Relationships

If you’re dealing with a DDOS attack, I’m afraid that I haven’t much good news for you. Once it’s started, it may be a bit late to try to deal with it. Odds are, you’re best off just waiting it out. Failing that, you can try to change IP addresses on your external systems, however, that technique is less effective than it was and requires the assistance of your ISP.

No, the right way to handle this sort of attack is long before it starts.

These sorts of attacks tend to start a bit slowly, and can be recognized by a ramping up of traffic. However, in order to detect it, you have to first know what legitimate traffic looks like. Thus, for months before the attack, you have to be watching what’s coming in. You should know what “normal” looks like, so you can detect “abnormal”. Not only will this help you differentiate an attack from simply outgrowing your resources, but it will also help you identify how you are using your resources so you don’t waste your money.

Bear in mind that most Internet connections can only carry so much, and if your employees are using it watching YouTube videos, that leaves less for legitimate customers. The first rule is to know what you have and how it’s being used. To reference Tuesday’s post, you need to know how many rats are normal, so you know when you’re about to have too many of them.

Then, you can move on to attack avoidance. There are systems out there that are specifically designed to handle DDOS attacks, but let’s assume that you don’t want to pay for that. One quick solution is to use a set of proxies. These can be servers or network devices in a proxy configuration. The way these work is to simply receive connections and then balance them to the back-end server. Here, you can set up rules to drop illegitimate traffic to reduce what goes through to your server to a manageable amount. There are many technical ways to do this, and none of them are perfect… however, you don’t need perfect. You just need to drop enough traffic to get things working again. (In other words, you don’t need to stop all the rats, you just need to make sure that there’s enough grain for you and your family to eat.)

However, this solution only works assuming that the attack is somewhat small in scope. If the amount of traffic is overwhelming and your connection itself can’t handle it, having a set of proxies won’t help you much. You’ll need to call your ISP. This is why it’s good to have a good business relationship with your ISP. You should know the names and numbers of who you need to call, and you’ll need them to be technically competent. Ideally, you should be able to call them up, and say “I think I’m having a DDOS attack, can you block all traffic from Asia” (assuming that you don’t do business in Asia, of course :). This is like asking for international help in the face of a massive influx of rats.

The huge ISPs tend to have the technical skill, but lack the personal relationship. The really small ISPs will bend over backwards to help you, but may not know how. I suggest going for the middle of the road approach. Interview prospective ISPs and ask how they would handle this sort of situation. Ask if they can give you an emergency number that would always have a live person answering, 24×7. The good ones will, though they might charge you when you call after hours. This is well worth it.

In the end, you will have built an infrastructure that is resistant enough and built a business relationship that is flexible enough. The only way to be 100% protected against this sort of attack is to have more resources than the rest of the Internet combined, and that’s just not going to happen. This sort of preparation is fairly cheap, and worth a lot if you need to leverage it.

In the end, it’s cheap insurance.

Small Business Attack – Denial of Service

You get the call from your front-line people. Your web site is down and customers are complaining. You call your web folks and they can’t even get to the server. Then, your front-line people call you again and report that the entire Internet connection is down. You call your ISP, and they tell you that your line is up, but you’re getting a lot of traffic.

Their solution? Buy more bandwidth.

In fact, if you buy right now, you might even have it in a few weeks.

What has happened is a distributed denial of service attack. In this attack, the attackers leverage hundreds of thousands of machines and send traffic to a target. In this case, to your server. As it starts, people start to have problems with the web server. Pages will load erratically, customers will experience slowness and the server may start to reboot itself or lock up entirely. However, it doesn’t stop there. The attackers often don’t know when they’re successful, and the traffic just keeps coming. Soon, your Internet connection will fill up and stop responding. If you’re hosting offsite, the line usage may spike and drive you into over-utilization charges. Thus, in addition to losing potential sales for every minute you’re down, you may also be charged for the experience.

So, it sucks to be you, but what does the attacker gain? In the old days (you know, when the hills only went up), this was done out of spite. Someone had taken offense at something you or your company had done, and their solution was to make your life miserable. These days, it’s different.

These days, the attacker may be a competitor or someone hired by a competitor. They may be starting a campaign and want you out of the picture during the process. They may be trying to take one of your biggest clients and want to show that you’re unreliable. It may be a criminal organization using such an attack to hide a second, more subtle attack. It may be an employee that simply wants a day off.

In any of these cases, what are you going to do about it?

Security Lessons from Nature – Rats, Bamboo and Surprises

There are some plants that bloom several times a year, some that bloom every year and some that bloom every few years. However, there are also a few types of plants that bloom every few decades. This is generally viewed as a fairly big deal, and botanists get all excited and talk to bored people at parties^* for hours on end about how special and wonderful it was, and how happy they are to have finally seen such a thing. Unless you’re a botanist, you probably wouldn’t care much.

^* At least, at the sorts of parties that over-excitable botanists get invited to.

That is, unless you happened to live in Asia and the plant happened to be bamboo. Unlike the American century plant, of which individual members bloom every few decades and then die, bamboo has learned to do synchronized blooming. Now, as scary as it is when a bunch of people start synchronizing their swimming, it’s far worse when bamboo does it.

Granted, it’s not the bamboo so much as the rats.

When the bamboo blooms, it pollinates and then produces fruits and seeds. Suddenly, there’s a lot of food around and rats appear to devour all the bamboo fruits. In the process they, of course, tend to make more rats. So, for the course of a year or two, there are more and more bamboo fruits which result in more and more rats. This is all well and good until the bamboo suddenly all wise up and think “Wait a minute, what are we doing here? Rats are eating us!” and promptly go back to being placid grasses.

This leaves hundreds of rats, thousands of rats, millions and billions and trillions of rats… and no lovely little bamboo fruits to eat. Being more intelligent than the bamboo (and lacking the “hey, let’s all be grass again” gene), the rats promptly turn around and start eating everything else that they can.

In Mizoram, a state of India, this means eating the people’s crops. It means that the farmers who, for a generation or more have been easily able to feed their families and export enough to make a reasonable living are suddenly transformed into fighters that must defend their livelihood against a rampaging horde of rats. And really, there’s not a lot they can do about it. A farmer may take on a rat and win, but one farmer versus one thousand rats is much less of a sure thing.

Similarly, you may be able to defend your business against an attacker or two, but when those few attackers suddenly become a coordinated attack from thousands to millions of computers, you’re pretty much not going to win.

Distributed Denial Of Service (DDOS) attacks mostly target larger companies, but as bot nets become more affordable, the likelihood of an attack targeting you goes up. We’ll look at this in more detail tomorrow.

For now, just consider the problem facing the farmers Mizoram, and think that we don’t even know what diseases these rats might be carrying.