Brian Snow on Information Security in a malicious environment

Risk based security is incredibly popular in information security nowadays. However, this is not the only way. I listened to the episode 191 of the Risky Business Podcast. In that episode, Patrick Gray interviews Brian Snow, former NSA director. He provides some experience-based thoughts on probabilistic risk assesment (PRA) and proposes alternative approaches in Infosec:

About PRA:
- Useful in scenarios with benign players (e.g. when Nature is the threat agent)
- Useful when there is enough good solid statistical information in the form of distributions curves and failure rates.
- The problem comes when trying to mitigate:
a. high impact risks with very very low probability or
b. a handful of low probability events with low impact that, if all of them happen in concert, the impact is huge.
- Probabilistic risk assessment does not take malice into consideration. When malice comes into play, distribution curves do not matter.
- Attackers do not use PRA as their main methodology to select targets (I would add, they choose their targets based on their relevance - benefit to risk ratio - and potential economic or mental benefit).
- PRA works well for reliability in a benign environment.

Thinking outside PRA (e.g in product security)

Designing security:
- Economic terms help i.e. let's design a system that is cheaper to create than the effort to attack it (this takes even decades!).
- How much (money) can the attacker devote to hit us?
- Forget studying the probability of malice-based acts, get some people in your security team thinking like the opponent. Look for the malice.
- Commercial product creators are not thought to counter malice.
- Military principles e.g. simple interfaces are required when you counter malice.
- It takes time to design security (quick time to market is not possible).
- Will the product work under attack? This is a key question to answer.

Practising security
- Have an holistic attack team, at the design time, to systematically attack the product.
- 3 recommendations:
a. Make sure that you study the interactions among the different scenario dimensions and players. Pay more attention to the interactions.
b. Once you are under attack, whom can you call for help? Look for partnerships (especially intelligence sharing) in the industry arena, even among competitors (e.g. CERTS already do that).
c. Have some attack scenarios that you exercise yourself (even at design time). Think in advance and try to prepare yourself against them already at design time.

Food for thought. Enjoy and digest it!
Happy June!

Black Hat Europe 2011 Keynote by Bruce Schneier

The following lines constitute a subjective summary and/or collection of thoughts triggered by the keynote that Mr. Bruce Schneier offered at Black Hat Europe 2011. The title of the keynote was cyberwar. An exciting word that nowadays reaches TV channels, radios and newspapers around the globe.

- At war, it is always important to know who is at war and why. In the cyber world, these two w-questions usually have no answer.
- The word war is paradoxical: In real wars, media try to avoid the word. However, media use often the word war in a rhetorical manner (the war on terror, the war against poverty, etc.).
- The Internet kill switch idea opens a new threat vector i.e. what about that switch falling into wrong hands?
- Regarding targeted attacks, if a company or individual is targeted, it will eventually be compromised. No doubt. It is only a matter of time and effort.
- Even though international treaties are sometimes of doubtful effectiveness, they could bring good to the cyberspace.
- In a nutshell, the current attacks in Internet increasingly show war-related tactics, strategies and methods. Therefore the hype of the word cyberwar.

Some additional thoughts:
- Skype is not eavesdropping-friendly.
- Commercial companies deal with risk only up to the value of their business. This is the reason why States need to bear residual risks if they can affect citizens (e.g. risk born by critical infrastructures).
- Human beings fear human attackers the most, then animal attackers and finally natural threats.
- Human beings fear invisible threats much more than those visible ones (personal note: this can be the reason why nuclear energy is so much feared).

And finally, a title... "dishonest minorities", his forthcoming book!

The video of the keynote is available at Black Hat Archives Site (not always available) and also in youtube.
Happy viewing!

Enchanting... also in IT security

Intro
A new excellent guest on the Entrepreneurial Thought Leaders Lecture Series - Guy Kawasaki - I recommend viewing the video or, at least, listening to the podcast. The following paragraphs are a personal summary of the ideas presented by Mr Kawasaki. My proposal will be to have the IT security world in mind when reading this text and think how much (or less) of all this we already do (or can do)?

He presented some recommendations on how to be enchanting. He used the 10 point format so that the audience know when the presentation ends. He mentioned that normally CxOs go long and they are boring when they present. Sometimes, in security conferences, I wish the presenter could be both specific and entertaining.

Tips for the art of enchantment
First, you need to be likeable. For this, improve your smile, using the muscles that surround your eyes, and certainly the jaw muscles, dress for a tie with your audience i.e. follow their same level of elegance and have a great handshake because first impressions are important.

Second, after likeability, the next step is trustworthiness. For that, I highlight these points:
- If you can't do something, find someone who could do it for you better.
- Don't ask someone something you would not do yourself.
- Empower people to do tasks.
- Don't micromanage.
- Provide people with a high purpose.

How to enchant as a leader
Provide your people with a MAP:
- Mastery: The possibility to learn and excel on the things they do.
- Autonomy: The chance to perform tasks themselves.
- A higher purpose.

- Any company needs first to trust their people (employees, customers) and then they will trust the company.
- There are 2 kinds of people, eaters and bakers, the first ones see situations as zero sum games, the bakers see ways to get bigger and more pies for everyone.
- If you would like to enchant, then default to yes, think how you can help that person.

How to enchant with your products
Your products need to be DICEE:
- deep
- intelligent
- complete
- elegant
- empowering

- Your message need to be short sweet and "swallowable".
- Important point, present in many thought leaders today, tell a story, why did you start your company, your plan, your adventure?

- Before failing, consider you have failed and conduct a pre-mortem analysis, that way everyone around a product can speak freely and with less emotional load.
- Plant many seeds to obtain your critical mass.
- Use simple and understandable features, salient points, to sell your product.
- Discover who are the influencers? Most of the times, the influencers are not the executives. Executives are very high in the ladder. The air is thinner high in the ladder. Thin air is not good for intelligence.
- Forget the use of money with your customers, it brings complexity and lack of veracity.
- Sharing and glory, people don't do it for money

Invoke reciprocation
More than answering a "thank you" with a "you are welcome", tell them "I know you would do the same thing for me". This way, you tell them that you have class and ...that they owe you. 

Enchanting up
Do what managers tell you to do, create a quick prototype, take little time to come back to show them if you are on the right track and, show them problems early, and preferably, propose a way forward.

Final thoughts
- in every presentation, customise the intro with local photos, sell your dream when you speak, use 10 slides for 20 minutes and 30 points font.
- Eliminate complexity.
- Answer within 24 hours.
- Use social networking, don't leave it only for when you have spare time.

Do you enchant while doing your job in IT security?
Happy enchantment!

Jack Dorsey: Running a business idea - applicable to IT security?

What does this post have to do with security? Well, we will soon see it. Stanford University's entrepreneurship corner is one of those reasons why Internet is, even just for this, a great invention. From your screen at home or from our smartphone or mp3 player, we have access to lectures given my current entrepreneurs.

One of the latest lectures is the one given by Jack Dorsey, creator of  twitter and square. I took note of some learning points, maybe subjective, out of his talk.

They are brilliant points to consider when creating a start-up within the IT security world. Do not forget them!

• "Instrument" your company from day 1. The first thing he did in square (and not in twitter) is writing an admin control panel for their servers.
• Be a story teller. You need to inspire your team and your customers with a story, your idea.
• In the company, you act as the editor, composing the stories.
• The team you build is not permanent, different players will need to enter and exit according to their profiles, the current story and the "required edition".
• Internal communication: Everyone in the company will have the same priorities.
• External communication: You communicate with the product, your product is "your story for your customers".
• Money in the bank: The company needs it, firstly from investors and secondly, and more critical, from revenue.
• Limit the number of details. Those details that stay need to be perfect.
• A last sentence from his side:"expect the unexpected and, whenever possible, be the unexpected".

If you see value in these points, then listen to the entire podcast or watch the lecture.

Happy listening!

ps Thanks to the Stanford's Entrepreneurial Thought Leaders Seminar crew!

Social-engineer.org crew interviews communication expert Joe Navarro

The episode number 14 of the Social Engineer podcast features an interview with the author and expert in non-verbal communications, Joe Navarro. This is a post with learning points extracted from listening to his interview.

Disclaimer: These lines do not substitute the listening of the interview. The statements mentioned are close to literal or slightly summarised or just a subjective interpretation. Kudos to the social-engineer.org crew!

Minute 17: Inmigrants in a country using a different language than their mother tongue need to be sensitive to body language and observe carefully.

Minute 18: Babies mimic gestures since their third week of life.

Minute 19: Babies with eleven months look for mood clues coming from their mothers.

Minute 20: Blue is a smoothing colour. Blue is predominant on TV.

Minute 22: When we see something beautiful, our pupils dilate. When we see something ugly, ours pupils contract. Our limbic system controls this.

Minute 31: A good observer focuses not only on the face but on the entire body. It is more difficult to lie when there is space among our fingers and we show our thumb.

Minute 36 and 37: People talking while looking at the same direction are more relaxed than people talking facing each other. Facing people create tension when talking.

Minute 41: You can calm someone down just by exhaling in front of them (they will mirror you).

Minute 47: A biographer of Kennedy mentioned that you can get anyone anywhere anywhen talk to you, you just have to tell them that you treasure their opinion.

Minute 55: The meaning of words: People in their fifties like to talk about problems, people in their thirties talk about issues. People like to talk with people like them.

Minute 66: When performing social engineering, assess whether the person does look comfortable to you.

Minute 66: In the US, the amount of time one should look someone else at their eyes is 1.8 seconds.

Minute 68: Arch your eyebrows when you greet someone. When arching the eyebrows, we burn sugar. We only burn sugar when we care. Babies respond to this action already when they are a week's old.

Minute 70: If you show space between your fingers, you are confident of what you are saying.

Minute 72: Some tips on using body language with your children.

Happy interview listening!