6 ms·

Shifting the Balance of Cybersecurity Risk: Security-by-Design and -Default [pdf]

76 points by dfern 4y ago

penny11k 4y ago
[flagged]
- mfer 4y ago
  [flagged]
- 40291misteryo 4y ago
  As a security advocate, I hope for a future where we can move away from systems that have been vulnerable by design such as Windows, Linux, iOS, and AWS. These systems were not initially designed with security in mind and have remained structurally vulnerable over time, despite attempts to bolt on security measures. To adequately address future security concerns, we need to design and verify a new computing stack that incorporates security principles specifically aimed at thwarting nation-state attackers like the NSA. Although some commercial systems are still being regularly targeted by nation-state or state-sponsored attackers, historical systems and certification processes such as the Orange Book Level A1, SCOMP, GEMSOS, and the Common Criteria SKPP have provided adequate validation against such attacks. Successful evaluations have included practical testing, formal specifications, and formal proofs of correctness as part of the validation process. Meaningful security against proven threats is only possible through the application of security principles that have demonstrated success against nation-state attackers, leading to a greenfield redesign of the entire computing stack. Attempting to bolt on security measures to existing systems is unlikely to provide meaningful security against current threats, given decades of failed attempts by large software companies via certification processes. It's important to note that while some systems, like Windows NT, were initially designed with security in mind, they still suffer from vulnerabilities. A potential solution to this issue may be to create specialized, limited-performance systems that complement lower-security systems instead of replacing them. Additionally, disconnecting servers from the internet remains a viable security measure as it is unlikely for hackers to physically infiltrate a network. Overall, our goal should be to develop a new computing stack with security designed, verified, and demonstrated to thwart nation-state attackers, rather than attempting to retrofit security measures onto existing vulnerable systems.
- zekrioca 4y ago
  GPT-4 sentences by design?
appleaday1 4y ago
I would take this document more seriously if they removed the Canadian government logo, I remember in early 2021 how easy it was to exfiltrate passport and other PII from the a certain Quebec gov agency agencies, because they had web apps written in ASP.Net and didn't do proper authorization/authentication measures, so anyone with basic knowledge of curl and python could easily exfiltrate mass amounts of data. People are stupid, they upload sensitive documents (passport info) and other things under the assumption that the government is competent enough to secure their stuff.
- jcrawfordor 4y ago
  One might consider that the Quebec government having such significant problems is all the more motivation for the Communications Security Establishment to drive change.
Veserv 4y ago
Hopefully one day we can get away from systems that are vulnerable by design such as Windows, Linux, iOS, AWS, etc. where security was not considered during their design process and are thus structurally doomed to perpetual vulnerability as decades of history have shown that security can not be bolted on. Only a greenfield redesign incorporating security designed, verified, and demonstrated to thwart the best efforts of nation-state attackers such as the NSA is adequate for the future. Even now we see commercial systems regularly targeted by groups identified as nation-state or state-sponsored attackers, so anything less than stopping nation-state attackers is inadequate to protect against expected and proven threats. Luckily, we have historically had systems and certification processes adequate for the task such as the Orange Book Level A1 which SCOMP and GEMSOS [1] were successfully validated against, and the Common Criteria SKPP [2] which required a NSA penetration test with no identified deficiencies that INTEGRITY-178B [3] was successfully validated against. The practical evaluations obviously being in addition to the formal specifications and formal proofs of correctness needed to demonstrate a secure design as part of the validation process. Only by the application of principles used there, which have demonstrated success against nation-state attackers, to do greenfield redesigns of the entire computing stack is meaningful security against proven threats possible. Everything else is lipstick on a pig that is attempting to bolt on security which has never once succeeded in providing meaningful security against the threats we find ourselves faced with today despite decades of effort, billions of dollars, and endless failed attempted validations by large software companies via these same certification processes. In fact, so many, such as Microsoft and Apple, have failed that the Common Criteria standard [4] itself points out that (to paraphrase a bit) it is likely economically infeasible to retrofit an existing product line to protect against attackers with a "Moderate attack potential" as nobody has ever succeeded. [1] https://www.cse.psu.edu/~trj1/cse443-s12/docs/ch6.pdf https://www.cse.psu.edu/~trj1/cse443-s12/docs/ch6.pdf [2] https://www.commoncriteriaportal.org/files/ppfiles/pp_skpp_hr_v1.03.pdf https://www.commoncriteriaportal.org/files/ppfiles/pp_skpp_h... Page 116 [3] https://www.commoncriteriaportal.org/files/epfiles/st_vid10362-vr.pdf https://www.commoncriteriaportal.org/files/epfiles/st_vid103... [4] https://www.commoncriteriaportal.org/files/ccfiles/CCPART3V3.1R5.pdf https://www.commoncriteriaportal.org/files/ccfiles/CCPART3V3... Page 39
- faeriechangling 4y ago
alphabetatheta 4y ago
I've commonly seen companies create secure by default programs around there deploying there Infrastructure (terraform/cloudformation templating). Maybe some companies do this with packages and vulnerability management. While its commendable to try this, until an organization is pretty large very little effort will be put into making secure by default design.
whatupmiked 4y ago
"migrating to programming languages that eliminate widespread vulnerabilities." "Some examples of modern memory safe languages include C#, Rust, Ruby, Java, Go, and Swift." "Too often, backwards- compatible legacy features are included, and often enabled, in products despite causing risks to product security. Prioritize security over backwards compatibility, empowering security teams to remove insecure features even if it means causing breaking changes." "While customer input is important, the authoring agencies have observed important cases where customers have been unwilling or unable to adopt improved standards, often network protocols. It is important for the manufacturers to create meaningful incentives for customers to stay current and not allow them to remain vulnerable indefinitely." --- The fundamental challenge is that by the time a "secure default" has been universally agreed on, and implemented widely in a space, the target moves again. Meanwhile each vendor decides what is "most secure" based on what they have been able to implement. Businesses are left with the integration challenge, and maintenance burden, of operating equipment that changes underneath their feet with each upgrade/update in the name of "being more secure." Government agencies could reduce the integration and adoption window by providing implementations of the "secure defaults" that were ready-to-use in the recommended programming languages. To do this they would need to be able to incentivize and recruit personnel that were capable of doing this, and adopt methods and practices that could produce such modules in a timely manner. Do governments want to distribute implementations that are usuable by any actor? Can they produce it in a timely manner? Would industry trust the implementation if it was produced by governments? When "legacy features" are being asked for it is most likely because they have been shown to work, and integrate, well across the business. A new product may be perfectly secure, but is it usable? The last quote alludes to this, customers need to run the business to generate the revenue to afford the security.
- RadixDLT 4y ago
  lol java? mind as well pick PHP
  - Yoric 4y ago
    How so?
cracadumi 4y ago
It's time for SaaS companies to stop charging their users for MFA/SSO. Looking at you Notion and Lokalize, just to mention a couple we use..
- ocimbote 4y ago
  The commonly used term is the SSO tax. See https://sso.tax https://sso.tax
- michaelbuckbee 4y ago
  I'm really split on this. MFA -> this seems like a no-brainer to have out of the box. SSO -> if we're talking SAML and "mega corp looking to put everybody sync'd to their Active Directory" then it seems kind of reasonable. In part I think that the pain of employee onboarding/offboarding is just much more at larger corps.
sylware 4y ago
yeah, by default my ethernet cable is unplugged. Harder to do with a smart phone though.
varunjain99 4y ago
The only way you can do secure by design/default is if the customer of your service experiences a productivity gain. For example, if they can deploy infrastructure more efficiently (and securely as a byproduct). Or if they're able to get reliability out of a software library (and security as a byproduct). You have to find these win-win situations where the developers/clients are not even aware of security improvements.

76 points by dfern 4y ago

penny11k 4y ago

[flagged]

mfer 4y ago
[flagged]
40291misteryo 4y ago
As a security advocate, I hope for a future where we can move away from systems that have been vulnerable by design such as Windows, Linux, iOS, and AWS. These systems were not initially designed with security in mind and have remained structurally vulnerable over time, despite attempts to bolt on security measures. To adequately address future security concerns, we need to design and verify a new computing stack that incorporates security principles specifically aimed at thwarting nation-state attackers like the NSA. Although some commercial systems are still being regularly targeted by nation-state or state-sponsored attackers, historical systems and certification processes such as the Orange Book Level A1, SCOMP, GEMSOS, and the Common Criteria SKPP have provided adequate validation against such attacks. Successful evaluations have included practical testing, formal specifications, and formal proofs of correctness as part of the validation process. Meaningful security against proven threats is only possible through the application of security principles that have demonstrated success against nation-state attackers, leading to a greenfield redesign of the entire computing stack. Attempting to bolt on security measures to existing systems is unlikely to provide meaningful security against current threats, given decades of failed attempts by large software companies via certification processes. It's important to note that while some systems, like Windows NT, were initially designed with security in mind, they still suffer from vulnerabilities. A potential solution to this issue may be to create specialized, limited-performance systems that complement lower-security systems instead of replacing them. Additionally, disconnecting servers from the internet remains a viable security measure as it is unlikely for hackers to physically infiltrate a network. Overall, our goal should be to develop a new computing stack with security designed, verified, and demonstrated to thwart nation-state attackers, rather than attempting to retrofit security measures onto existing vulnerable systems.
zekrioca 4y ago
GPT-4 sentences by design?

appleaday1 4y ago

I would take this document more seriously if they removed the Canadian government logo, I remember in early 2021 how easy it was to exfiltrate passport and other PII from the a certain Quebec gov agency agencies, because they had web apps written in ASP.Net and didn't do proper authorization/authentication measures, so anyone with basic knowledge of curl and python could easily exfiltrate mass amounts of data. People are stupid, they upload sensitive documents (passport info) and other things under the assumption that the government is competent enough to secure their stuff.

jcrawfordor 4y ago
One might consider that the Quebec government having such significant problems is all the more motivation for the Communications Security Establishment to drive change.

Veserv 4y ago

Hopefully one day we can get away from systems that are vulnerable by design such as Windows, Linux, iOS, AWS, etc. where security was not considered during their design process and are thus structurally doomed to perpetual vulnerability as decades of history have shown that security can not be bolted on. Only a greenfield redesign incorporating security designed, verified, and demonstrated to thwart the best efforts of nation-state attackers such as the NSA is adequate for the future. Even now we see commercial systems regularly targeted by groups identified as nation-state or state-sponsored attackers, so anything less than stopping nation-state attackers is inadequate to protect against expected and proven threats. Luckily, we have historically had systems and certification processes adequate for the task such as the Orange Book Level A1 which SCOMP and GEMSOS [1] were successfully validated against, and the Common Criteria SKPP [2] which required a NSA penetration test with no identified deficiencies that INTEGRITY-178B [3] was successfully validated against. The practical evaluations obviously being in addition to the formal specifications and formal proofs of correctness needed to demonstrate a secure design as part of the validation process. Only by the application of principles used there, which have demonstrated success against nation-state attackers, to do greenfield redesigns of the entire computing stack is meaningful security against proven threats possible. Everything else is lipstick on a pig that is attempting to bolt on security which has never once succeeded in providing meaningful security against the threats we find ourselves faced with today despite decades of effort, billions of dollars, and endless failed attempted validations by large software companies via these same certification processes. In fact, so many, such as Microsoft and Apple, have failed that the Common Criteria standard [4] itself points out that (to paraphrase a bit) it is likely economically infeasible to retrofit an existing product line to protect against attackers with a "Moderate attack potential" as nobody has ever succeeded. [1] https://www.cse.psu.edu/~trj1/cse443-s12/docs/ch6.pdf https://www.cse.psu.edu/~trj1/cse443-s12/docs/ch6.pdf [2] https://www.commoncriteriaportal.org/files/ppfiles/pp_skpp_hr_v1.03.pdf https://www.commoncriteriaportal.org/files/ppfiles/pp_skpp_h... Page 116 [3] https://www.commoncriteriaportal.org/files/epfiles/st_vid10362-vr.pdf https://www.commoncriteriaportal.org/files/epfiles/st_vid103... [4] https://www.commoncriteriaportal.org/files/ccfiles/CCPART3V3.1R5.pdf https://www.commoncriteriaportal.org/files/ccfiles/CCPART3V3... Page 39

faeriechangling 4y ago

alphabetatheta 4y ago

I've commonly seen companies create secure by default programs around there deploying there Infrastructure (terraform/cloudformation templating). Maybe some companies do this with packages and vulnerability management. While its commendable to try this, until an organization is pretty large very little effort will be put into making secure by default design.

whatupmiked 4y ago

"migrating to programming languages that eliminate widespread vulnerabilities." "Some examples of modern memory safe languages include C#, Rust, Ruby, Java, Go, and Swift." "Too often, backwards- compatible legacy features are included, and often enabled, in products despite causing risks to product security. Prioritize security over backwards compatibility, empowering security teams to remove insecure features even if it means causing breaking changes." "While customer input is important, the authoring agencies have observed important cases where customers have been unwilling or unable to adopt improved standards, often network protocols. It is important for the manufacturers to create meaningful incentives for customers to stay current and not allow them to remain vulnerable indefinitely." --- The fundamental challenge is that by the time a "secure default" has been universally agreed on, and implemented widely in a space, the target moves again. Meanwhile each vendor decides what is "most secure" based on what they have been able to implement. Businesses are left with the integration challenge, and maintenance burden, of operating equipment that changes underneath their feet with each upgrade/update in the name of "being more secure." Government agencies could reduce the integration and adoption window by providing implementations of the "secure defaults" that were ready-to-use in the recommended programming languages. To do this they would need to be able to incentivize and recruit personnel that were capable of doing this, and adopt methods and practices that could produce such modules in a timely manner. Do governments want to distribute implementations that are usuable by any actor? Can they produce it in a timely manner? Would industry trust the implementation if it was produced by governments? When "legacy features" are being asked for it is most likely because they have been shown to work, and integrate, well across the business. A new product may be perfectly secure, but is it usable? The last quote alludes to this, customers need to run the business to generate the revenue to afford the security.

RadixDLT 4y ago
lol java? mind as well pick PHP
- Yoric 4y ago
  How so?

cracadumi 4y ago

It's time for SaaS companies to stop charging their users for MFA/SSO. Looking at you Notion and Lokalize, just to mention a couple we use..

ocimbote 4y ago
The commonly used term is the SSO tax. See https://sso.tax https://sso.tax
michaelbuckbee 4y ago
I'm really split on this. MFA -> this seems like a no-brainer to have out of the box. SSO -> if we're talking SAML and "mega corp looking to put everybody sync'd to their Active Directory" then it seems kind of reasonable. In part I think that the pain of employee onboarding/offboarding is just much more at larger corps.

sylware 4y ago

yeah, by default my ethernet cable is unplugged. Harder to do with a smart phone though.

varunjain99 4y ago

The only way you can do secure by design/default is if the customer of your service experiences a productivity gain. For example, if they can deploy infrastructure more efficiently (and securely as a byproduct). Or if they're able to get reliability out of a software library (and security as a byproduct). You have to find these win-win situations where the developers/clients are not even aware of security improvements.