Security site to bookmark: measurablesecurity.mitre.org

Makingsecuritymeasurable is an initiative of the U.S. non-profit organisation MITRE. The site is easy to navigate. It provides links to standard-related initiatives dealing with 15 closely interrelated security elements. I recommend visiting makingsecuritymeasurable to learn about current proposals to describe and exchange security information.

This site is based on three basic ideas:

- "We can't manage what we don't measure."
- "We need to share more information to succeed in our current challenges."
- "In order to share information, we need to use a common a language, a protocol, a mechanism of exchange."

It introduces five major themes in information security:

- Quality assurance in software development and applications.
- Threat analysis.
- Vulnerability management.
- Protection against malicious code and system & network analysis.
- Incident management and reporting.

Each of these five broad specialities presents three specific areas with useful links either to their basic principles or to current implementation initiatives. Browsing through all these pages, it is evident that, more than a common language, we need several different ones, such as those dedicated to vulnerabilities:

- The type dictionary (CVE).
- The evaluation system (CWSS).
- The vulnerability-based risk management framework (CWRAF).
- Classification of typical attack patterns (CAPEC).

Similar skeletons begin to be built for threats (eg STIX), malware (MAEC), attacks (OpenIOC) and incidents (MILE, IODEF).

In summary, the information linked from the makingsecuritymeasurable site can help formalise, measure and justify proposals to improve security for our customers and to share data between different industry players. The final question would be how many of these initiatives will mature and really become a industry standard? Time will tell.

A version in Spanish of this post will be located here in this publication. Stay tuned!

Happy browsing!

Making security visible

A security rucksack for Android

To start the year, I share a non-comprehensive list of security (or just handy) related Android apps that could constitute a sensible set of preventive security measures during our daily smartphone use & enjoyment:

To check what it is going on...
- Task Manager
- Network Monitor
- Antivirus (one of the handful of them)
- DroidWall 
- Virus Total
- Advanced Task Killer
- OS Monitor
- Startup Auditor

- X Ray
 
To prevent leaks...

- LBE Privacy Guard

To prevent losses...
- Titanium Backup

To save space...
- App2SD

To save energy...
- Juice Defender

To find files... 
- ES File Explorer

To avoid adds...
- AdAway

To find the device...
- Androidlost

A useful security suite (AV, antimalware, device locator - requiring GPS - and backup)
- Lookout

And to make space (sooner or later you'll need it)
- DiskUsage 

Thanks to all those who contributed to build this list.
Would you add other security apps to this list? Let me know.

Happy phoning!

Keeping information where it should remain

Android SDK and Ubuntu

Ever tried to communicate via command line from an Ubuntu machine to an Android phone connected via the USB port?
Here I write some tips that could facilitate this experience:

- First of all, we need to install the Android SDK in our Ubuntu box. I recommend to follow the Android Developer site. From there, we can download the Android SDK. The steps to have the Android SDK up and running are basically:

Two necessary elements that we need are the ia32-libs (if we have a 64-bit machine) and Java (sun-java6-jdk).

# apt-get install ia32-libs (if your box has a 64-bit processor)
# apt-get install default-jdk (the Java development kit)

Unzip the Android SDK.
Go to the tools folder and run $./android (a graphical configuration page will appear, just press install). It will add a minimum set of packages: tools, platform-tools and at least one (the latest) platform.


Configure the udev file as mentioned in this android page.

And that's about it! To test it, connect your android device via USB and you should be able to see it typing:
# platform-tools/abd devices

- Before focusing on the Android Debug Bridge (adb) tool, a few words on two important elements:
A mechanism to flash (here we mean write to the flash memory) the filesystem in Android devices, e.g. using fastboot (a tool that run with the Android SDK) or flash_image (this last one for a very specific purpose).

Actually this flashing tool will be used to install ClockworkMod (the Rom Manager). A powerful mechanism to, among many things, install new OS, make backups and mount filesystems in Android smartphones.

- adb shell provides a command line shell in the connected device and mounted filesystem (e.g. we can cd to a folder and mv to change file names).
- adb push allows us to copy files from our Ubuntu box to the system folders in the smartphone.

In essence, a Java-based development platform with lots of development potential.

By the way, some additional Android tips:

- Remember a previous Android related post!
- Android 1.x has a very simple file system structure compared to Android 2.x. There will be times when we first have to update to an image of Android 2.x with enough space in each of its partitions before even being able to install ClockworkMod.
- If you receive the following message: ADB: error: insufficient permissions for device then try with these commands as mentioned here:
./adb kill-server
./adb start-server
Now you should be able to run commands like:
./adb devices
./adb shell

- Sometimes you need to install an official image before daring making something with a pre-cooked rom. The way to install official Android images is slightly different and pointed out in this forum: You need to extract the zip file in your computer. Afterwards, copy the entire "dload" folder (resulting out of the decompressing action) into the root folder of the smartphone's SD card.


- Surprise, surprise... Changing an Android firmware could mean that the MAC address of the device changes ;-)!

For those who run out of internal memory, please have a read at the next 4 recommendations:

- If you re-partition the external SD-card, e.g. to make use of apps like Link2sd, after booting with the newly partitioned card, unmount and mount the card (via the android OS) to have access to the apps that were previously installed on the sdcard.

- Regarding re-partitioning an SDcard, my 2 humble cents, 50% space FAT32 and 50%ext2. This leaves the phone ready to use Link2sd.

- The use of App2SD before Link2sd is not recommendable. You would need to re-move the SD'ed apps to the phone memory to be able to use Link2sd, as it says in their FAQ. Link2SD moves not only the .apk file but data, cache and libs (which is a better deal).

- About using Link2sd to move (in Link2SD terms, that is "a link") system apps (like Keyboard, Google Play Store, etc.), just avoid it. 

And finally, remember to use ClockworkMod to create a backup of your phone (and copy the content of your SD cards) right before and after changes.

With all this soup of tools and commands, two security related reflections:
- Android market share could suffer from such a big OS versioning dispersion.
- The Android SDK is a great tool for developers... and hackers ;-)

Happy flashing!

Android or iOS, who will ring the bell?

Secure IT Up! Cyber-Insurance Due Diligence

In my first infosec book, "itsecuriteers", published in 2010, revealed how to create an Information Security team that enables business objectives. "Secure it up!", my second book, provides qualitative and quantitative insights that justify why the adoption of Information Security measures brings benefits to organisations and facilitates cyber-insurance due diligence processes.

In the world we live in, risk management and information risk management are complex fields under continuous development. If you need to justify why applying security to your organisation will provide value to your customers or you are involved in cyber-insurance due diligence engagements, "Secure it up!" helps you with a statistically sound quantitative study and a set of reputable literature references.

As I write at the beginning of the book, "now it is when information security can change the business". In a nutshell, here is why:

Three ingredients:

• The presence of a committed layer of management setting risk objectives and appetite.
• The development of a strong Information Security practice as part of a holistic Enterprise and Operational Risk Management function.
• The alignment of Enterprise Risk Management with the business strategy.

Will provide three benefits in your business:

• Increased stakeholder value.
• New business opportunities.
• Better governance.

Here you are two introductory comments both from academia and the business world:

"The recommendations in this book are simple but effective: managers will find them of practical relevance and easy to communicate.  They are based on sound empirical research which makes them go beyond consultancy speak." 

Jean-Noel Ezingeard,  Dean and Professor of Processes and Systems Management
at Kingston University, London.

"Secure it up combines a comprehensive analysis of existing literature and the results of surveys of subject matter experts to make the argument for combining Enterprise Risk Management (ERM) with information security practices."

Richard Stiennon,  Chief Research Analyst at IT-Harvest, Author of "Surviving Cyberwar","Cyber Defense: Countering Targeted Attacks", Blogger at forbes.com, Michigan.

Happy reading!
Happy 2013!

Linux commands hodgepodge (I)

This post is an unusual one. The reader will not find a line of thought in it but rather a collection of command lines and telegraphic recommendations for some configuration files in the Linux (more specifically, Ubuntu) Universe.

Happy command line experience!

- To open a X session via ssh
$ ssh -X -p xxxx usernameh@ipaddressorname

- Enable networking in Linux
# route add -net 192.168.x.y netmask 255.255.255.0 gw 192.168.a.b dev eth0

- How to quickly install sshd
# apt-get install openssh-server

- Sshd to start at boot time in Debian flavours
# update-rc.d ssh defaults

- Sshd not to start at boot time in Debian flavours
# update-rc.d ssh remove

- Where to configure sshd?
# gedit (or vi) (or pico) /etc/ssh/sshd_config

- And there, some configuration settings are

X11Forwarding yes
Port xxxx
PermitRootLogin no
LogLevel VERBOSE

- How to start the sshd service
# service ssh start (or the old way /etc/init.d/ssh start)

- How to stop the ssh service
# service ssh stop (or the old way /etc/init.d/ssh stop)

- Networking to start at boot time in Debian flavours
# update-rc.d networking defaults

- Networking not to start at boot time in Debian flavours
# update-rc.d networking remove

- How to tunnel via ssh
$ ssh -p xxxx -L aaaa:localhost:bbbb username@ipaddressorname
bbbb is the local port
aaaa is the remote port

- How to disable the firestarter firewall at startup time
mv /init.d/firestarter /init.d/firestarter.old (to change the name)

- How to recover gnome GUI in the latest Ubuntu versions
# apt-get install gnome-session-fallback

- How to copy from a hard disk to an external memory storage
dd if=/dev/sda2 of=/media/externalstoragename/backupfilename.dd bs=64k conv=notrunc,noerror

- How to delete a USB memory storage
sudo dd if=/dev/zero of=/dev/sdb bs=64k

- How to install grub
# grub-install devicename

- In case there is a need to open a firewall in win7
netsh firewall set portopening protocol=TCP port=xxx name=ruleportxxx mode=ENABLE profile=All

- How to copy a file via ssh
$scp -P xxxx /source/file user@remotehost:/destination/file

- Copying files over ssh using dd (directories need to exist)
$ dd if=./yourlocalfiletocopy | ssh -p xxxx username@fqdn dd of=/path/filename



- Copying files over ssh using dd (directories need to exist) -alternative way
$ dd if=./filetotransfer | ssh username@fqdn dd "of=/destinationpath/filename"

- Copying files from the ssh server to local using dd via ssh (directories need to exist)
$ ssh -p xxxx username@fqdn 'dd if=/pathtofileinsshserver/filename' | dd of=./pathtolocaldestination/filename

- How to install 7z crypto compressing solution
# apt-get install p7zip

- How to compress a file or directory
$ 7z a destinationfile.7z ./folderorfiletocompress

- How to decompress (no full path)
$ 7z e compressedfile.7z

- How to decompress (full path)
$ 7z x compressedfile.7z

- How to compress a file or directory using a password and in volumes
$ 7z a -p -v1g destinationfile.7z ./folderorfiletocompress

- How to stop a machine via ssh (if you are using lightdm, shutdown will not power the machine off)
# poweroff --verbose

- How to reboot a machine via ssh
# reboot --verbose

- ssh login without a password
Good summary here

- How to see real time the iptables logs in linux
# /sbin/iptables -L

- How to see whether the firestarter FW is running
# /etc/init.d/firestarter status

- How to see whether iptables is running
$ lsmod | grep iptable

- How to lock the Ubuntu box using the keyboard
CTRL + Alt + L

- Where are authentication related logs in linux?
$ less (or pico) /var/log/auth.log

- If there is a need to check previous zipped logs
# gzip -d syslog.2.gz

- Executing a terminal server that is not linked to a user in Ubuntu
# x11vnc  -safer -localhost -nopw -once -auth /var/run/lightdm/root/:0 -noxrecord -bg -rfbport xxxx

- Executing a terminal server that is not linked to a user in Ubuntu (a more verbose one)
# /usr/bin/x11vnc -safer-auth /var/run/lightdm/root/:0 -noxrecord -noxfixes -noxdamage -forever (or once) -bg -rfbport xxxx -o /tmp/x11vnc.log

- Executing a terminal server that is linked to a user session
$ x11vnc -safer -localhost -nopw -once -display :0

- Typical rc.local file for paranoid ones
ifconfig eth0 192.168.xxx.xxx netmask 255.255.255.0
route add default gw 192.168.y.y eth0
arp -s 192.168.y.y 00:router:mac:address
/etc/init.d/ddclient start
rfkill block bluetooth
rfkill block wifi
rfkill block wwan

- If you are encrypting the home drive and using keys in ssh to log in...
place the .authorised_keys file outside the crypto zone as you can read here
... in addition to that, add these 2 lines to the .profile file to speed up decryption at log-in time:
ecryptfs-mount-private
cd /home/username

- Who is in the system
$ who

- Who logged in last
$ last -a