Don't Use The Internet!

 The NY Times reports a cyber attack on a gas pipeline. They note:

People familiar with the investigation said the early indications were that it was a ransomware attack, and that the events had been unfolding for several days. The company has hired the private cybersecurity firm FireEye, which responded to the hacking of Sony Pictures Entertainment, energy facility breaches in the Middle East and many federal government incidents. The company appears to have brought down activity on the pipeline on Friday to prevent the hackers from inflicting more damage. But that left open the question of whether the attackers themselves now have the ability to directly turn the pipelines on or off, or trigger operations that could cause an accident.

The problem occurs when you run your control network open to your employees who are playing on the Internet. First SCADA networks should be compartmentalized. The should be secure and separate and NOT accessible via an IP network. Second, the employees terminals must only be allowed to work on the secure net and again have no access outside. It is akin to the old "Red and Black" environments in Intel networks.

But the problem is sloppy controls, policies and procedures. The network should be such that employees should be told and monitored and with one violation they must be terminated immediately. Secure nets are as secure as the people who run them. 

 

Network Security

 Back in the 1970s when I was in Washington I was closely involved in designing and deploying secure networks. Back then we worried about such things as transmission security, operating system security, database security, and end user security. Needless to say such things as described in the Falcon and the Snowman were human were the Snowden events of that period. We further enhanced the system with high grade encryption, and all combined the system works, most of the time.

My Deputy was a fellow named Eric Ackerman, former British Intel and a Wing Commander in the RAF. Eric's most famous exploit was tapping into the Soviet telephone system in Berlin, despite the CIA trying to take credit. Eric also retrieved the V2 guidance system from a crashed V2 in Norway. Eric and I would think of ways we could have our networks compromised. There were always ways, and most were the result of human negligence.

Now in the late 90s when I was building my fiber IP network from Frankfurt to Moscow to Warsaw, Athens, Prague, Vienna etc, I had conversations with some "folks" in the US and noted the gross weakness of the Internet and its variations for transporting anything. IP is an open network, open means that anyone can do nearly anything. You send a packet and you may just as well post it on a public bulletin board. 

Moreover, in today's software environment operating systems, databases, displays, neural nets, etc are amalgams of third party software. It is an unbridled pile of third party code patched together to keep the price down and get the job done. The risk is that in that reusable software are a massive number of threats. Add to that the Network Management issues which open another set of possibly lethal access to your network. Back in the 1980s a key element of Network Management was security management. However such a function is grossly compromised by this third, fourth, fifth etc party software.

The Government asked for this by the very nature of their management and procurement policies. A recent example is the terminated voting security person who was an environmental scientist as an undergrad and lawyer as a profession. Not knowing any more, one would suspect that he would be clueless on these issues.

What is needed a a few Eric Ackermans. Unfortunately, we no longer hire people like Eric.

Secure Networks

The most recent flap on intrusion into large scale public networks has evoked responses by people who appear in my opinion and in my experience to have little in any understanding of what was and what is. For example the NY Times has apparently some Librarian commenting on the recent flap. The author states:

It is time to consider whether the current regulatory setup, which allows all software vendors to externalize the costs of all defects and problems to their customers with zero liability, needs re-examination. It is also past time for the very profitable software industry, the institutions that depend on their products and the government agencies entrusted with keeping their citizens secure and their infrastructure functioning, step up and act decisively.

But take a look back forty years, to the mid seventies. We worried about Soviet intrusion into networks and at the same time we were intruding into theirs. One of my best employees had been with the Brits and managed to [penetrate East German telephone lines. It was simple, just climb through the sewers, tap the copper pairs, and hope you do not get caught.

But in a similar fashion we had three key elements. First we had secure lines. They were not shared. They were encrypted. Finally we had secure Operating Systems, Kernelized OSs. What was a KOS? Simple it was an OS with a secure outer kernel that only allowed access to the OS functions such as DB access and I/O access in a fully secure manner. However, the MS/OS is an open system allowing third party software. It is a pure kluge. At least Apple has a somewhat better system. But MS systems ate a patch quilt of ports and access points that have evolved into an uncontrollable mess. Anyone can get into them. Then add the Internet, an "open" network by design, and you have a recipe for disaster.

Thus what is the solution? Go back 40 years. Why is the NHS using the Internet! It is grossly insecure. Why do they use XP, it also is insecure. And finally, what do the people always open stuff they should not? What would one expect, just a disaster.

Cyber Security

In the recent complaints about invasion of cyber networks, the DNC and Burlington Power, we see in all cases human failures on the party attacked. Whether it is use of personal or entity computers to access what should not be accessed, like web sites, images, attachments, it is generally the blatant carelessness and/or stupidity on the part of those invaded.

Cyber security has a multiplicity of ways to block intruders and even more so to attempt to overcome the incompetence of the users. We briefly review some of them.

1. Encryption

Encrypting messages is straightforward. There are a multiplicity of relatively secure means to achieve this. All this does is take what is created and allow it to be opened and used only by whom it was intended. It does not mean however that the receiver cannot then take it and let it become open due to their incompetence. Even if it is of printed form it can be reproduced and sent onwards.

2. Authentication

Authentication is the process of making certain that the entity seeking access is both authorized and who they say they are. Over the decades I have examined a multiplicity of authentication systems. All have some issues but many present viable necessities.

There are many authentication options now available, especially biometric ones. Many have evolved from the intelligence sector and can be readily applied in commercial applications. These authentication mechanisms can be used on both transmit and receive so that encrypted files require a high level of authentication. However, like all of these issues, the device which opens the file, after being authenticated may not be secure! It can be an endless chasing of the tail.

3. Outbound Control

Sending messages from a secure location to another secure location requires that the data being sent and its destination is authorized. One means of doing this is to employ a DPI, deep packet inspection, where not only are P addresses checked but packets are fully inspected. That means that an approach to send packets to some acceptable address via a tunneling mechanism, then sent elsewhere, could be determined. Also examining the type of data being sent and profiling it to IP address can also be accomplished and determine if data is being improperly downloaded.

In addition means to determine lists of insecure or threat IP addresses or even more complexly profiles of outbound traffic that meet threat profiles. Namely traffic that may be sending files which should not normally be sent to locations that may not be acceptable. This would mean an intelligent DPI process.

4. Inbound Control

This is the process of monitoring where traffic is coming from is critical. One can also use DPI here as a means to assess not only where the traffic is from, but what the traffic is. Messages have profiles and they should be used to throttle access.

5. Usage Monitoring

The key question is often; what is being used on the network? Thus, monitoring what applications are being used is essential. This may be complex but as with others it can be accomplished.

6. User Monitoring

Users have profiles. They have jobs that requires certain behavior at certain times. They type in a certain manner. Back in the days of Morse code one could identify a distant operator by their key usage patterns. The same can be done by keyboard, mouse, and other I/O interfaces. When they change then one must immediately suspect something and remediate.

7. Usage Flagging

Usage profiles can be developed. Metrics describing users can be developed and once a usage profile is aberrant then immediate remediation is necessary.

8. Network Segregation

In the later 1980s the ARPA Net was split into a commercial and military net. The result purportedly was a separate and non-connected set of IP networks. In the late 1990s when I deployed my Central and Eastern European nets I did so over independent private fiber links. One could have a secure and isolated network.

9. Private Networking

A key element in security is separating the network. Network segregation is the ultimate in that construct but a less costly and somewhat effective method is private networking. Take the power grid as an example. Any power company who controls their networks via some IP methodology should do so only on a separate secure private network. Lease circuits, block any outside access, and separate all facilities so that the control backbone is NOT a part of any public access. Any company utilizing the public side of the Internet for control of critical assets is asking for a disaster to occur.

10. Secure Operating Systems

Many of the concerns are from the outside in. However back in the 1970s there was a major concern from the inside out. Namely having a secure operating system. Who wrote the OS, what is hidden inside the chips, the file manager. Remember the chips come from a potential adversary. The OS may have bits and pieces from generations of old code.

Furthermore, this issue of security demands a secure platform in toto. Namely, having the right person, decrypt the secure data on what would be an insecure platform defeats the purpose. This is the classic issue of Red and Black environments. This is an old paradigm where everything secure was held within a protected environment with no communication between it and the outside world. However, this is quite difficult to achieve in current day operations. Namely, people all too often want to use their own computers or devices and it is at this point that security can and is often breached. It can be a secure person in a secure environment but with an insecure terminal.

11. Paper Trails

In the old days, we had paper. The paper was numbered, it was kept in a secure environment, and there was theoretically no means to copy it. Yet good spies would find a way to compromise the situation. But paper had its worth. A security check of a safe at random times allowed for some semblance of security. However, under the right circumstances one could photo the document if surveillance was inadequate. This could be mitigated by having multiple individuals in at the same time. However, that also could be compromised. Yet paper did eliminate a multiplicity of risks that electronic access presents.

The classic exception to this is in the tale of the Falcon and the Snowman, the story of the son of an FBI agent working in a secure facility at TRW who managed to feed the Russians massive amounts of data. The reason, just sloppy security controls.

12. Real Time Security Audits

Security audits were and still are essential. Trust goes just so far. When establishing a security policy and protocol one must further be certain people understand their responsibilities, that they are checked on meeting them and that there are substantial and immediate consequences for failure. Collusion with the auditors represents a risk, but it would require substantial efforts.

13. Real Time Network Monitoring

Networks should be monitored. Monitored for use, users, usage. Who is sending and receiving what and when and from/to whom. Profiles count and looking at the network as a totality is critical. Furthermore, there must be some sequestering of the network. The old aphorism, "Don't use pay toilets" reflects the fact that various infections can be obtained from truly open environments. If anyone, and especially unknowable actors can access the same facilities as the secure users, there is no security.

14 Training and Punishing People

Ultimately security of any type depends on people. As someone once said to me; "Trust no one, not even your father!". Brutal but all too often true. The tales of the Communists from Cambridge, Burgess et al, is a tale of assuming the "good old boys" or "one of us" means something. People range from stupid, to arrogant, to incompetent, to downright evil. They do not wear signs telling us what one or combinations they present. We all too often have to assume the worst. Trust is the basis of betrayal.

Security, Privacy and Data Gathering

Back in 1977 I went to an IEEE meeting at Cornell where there was a big flap by NSA and others over the release of the Rivest et al crypto schemes. At the time I had the opportunity to watch over some Eastern Europeans who were in DC but in Ithaca, there they were. Surprise, no.

Out of those meetings came a way to combine the then crypto scheme approved by NIST and the new RSA scheme. Namely one could use DES as a shared key system but use RSA to send the keys in a secure manner and then cycle through various DES keys using RSA. Works fairly well and even then was doable whereas today it is dirt cheap.

The second issue was authentication. Namely the problem of assuring from whom the message came from. Today we use certificates but then and I assume still now we use complex systems as we had developed then. Our application in the late 70 was the deployment of sensors using seismometers to check for Soviet nuclear testing. We wanted to have authenticated data and not Soviet spoofs.

Today we look for patterns as to who is talking to whom. Assuming people do not try to confuse others then this may be possible over big data systems. However for a couple of decades now we have seen the development of anonymizers. Now MIT researchers announced their latest scheme.

They state:

If an adversary has infiltrated the server, however, he or she can see which users are accessing which memory addresses. If Charlie’s message is routed to one address, but both Alice’s and Bob’s messages are routed to another, the adversary, again, knows who’s been talking. So instead of using a single server, Vuvuzela uses three. Corresponding to the three servers, every message sent through the system is wrapped in three layers of encryption. The first server peels off the first layer of encryption before passing messages on to the second server. But it also randomly permutes their order. So if, for example, Alice’s message arrived at the first server before Bob’s, and Bob’s arrived before Charlie’s, the first server will pass them to the second in the order Bob, Alice, Charlie, or Charlie, Bob, Alice, or the like. The second server peels off the second layer of encryption and permutes the message order yet again. Only the third server sees which messages are bound for which memory addresses. But even if it’s been infiltrated, and even if the adversary observed the order in which the messages arrived at the first server, he or she can’t tell whose message ended up where. The adversary does, however, know that two users whose messages reached the first server within some window of time have been talking. And even that is more information than Vuvuzela’s designers want to give away.

Namely they flush everything they have across the net and confuse any adversary. Cute, but I suspect this is but one of many such schemes. Hiding in plain sight, hiding in noise, etc all follow a similar path.

Thus the questions which this poses are:

1.  In encryption, any junior engineer could implement an AES/RSA system which would be quite difficult to break. In fact a "whack a mole" feature one could argue would make it unbreakable. In fact such a system would be outside the transmission path, and thus one could care less about iPhone encryption, you do not rely upon it.

2. Authentication is critical. If two adversaries desire to speak then they must be certain as to whom each is. This is an authentication problem and one cannot expect to use Certificates here. Yet there also a large collections of options.

3. Patterning is the means of looking at data flows and trying to see what they infer as to the actions of parties. Systems like the one above demonstrate that the complexity of this can be increased exponentially. In fact it can be made almost fool proof.

Thus the screams and moans as to making all systems open is just that; scream and moans. Any adversary already has a wealth of tools, many most likely funded by Government contracts and in the public literature.

Remember 1977! When RSA came out you could guess who was in the audience. Today, different faces but same result.