Corona Virus, Social Distancing and The Protection of Your Intel TPM

In today’s work-at-home, socially distanced world, we’re increasingly reminded of the importance of proximity and the critical nature of physical access.  As someone who’s worked in the logical world of enterprise security for so many years, it’s easy to forget that the fastest DOS attack ever, is a hammer swung violently at your physical storage array!   And with the Corona virus on everyone’s doorstep, physical proximity has become an issue in every walk of life.  For COVID-19 it’s social distancing and the now extensively accepted elbow bump.  In software security it’s proximity to the hardware and control over physical access that underpins everything we do.    

I’m reminded of this critical dependency by the recent announcement that nearly all Intel processors have yet another critical security flaw, that is “rooted” in the ability to touch the hardware.  It now appears that anyone with machine access is able to bypass all platform security measures, including the full and unmitigated exploitation of the Trusted Platform Module (TMP).  Anyone that’s tracked the long and intricate history of cryptographic “root of trust” fully understands the magnitude and implications of this statement. 

The March 5th posting from Positive Technologies, titled “Intel x86 Root of Trust: Loss of Trust”, outlined a newly discovered critical flaw in the Intel CSME (Converged Security and Management Engine).  The Intel CSME provides the cryptographic foundation for all hardware security technologies developed by their TMP, DRM, TPM and Intel Identity Protection system. Their report states that this newly discovered vulnerability “affects the Intel CSME boot ROM on all Intel chipsets and SoCs available today other than Ice Point (Generation 10). The vulnerability allows extracting the Chipset Key and manipulating part of the hardware key and the process of its generation. However, currently it is not possible to obtain that key’s hardware component (which is hard coded in the SKS) directly. The vulnerability also sets the stage for arbitrary code execution with zero-level privileges in Intel CSME.”

The report goes on to say that “this vulnerability jeopardizes everything Intel has done to build the root of trust and lay a solid security foundation on the company’s platforms”. They further state that “The larger worry is that, because this vulnerability allows a compromise at the hardware level, it destroys the chain of trust for the platform as a whole.”. 

This latest news means that all Intel processors released in the past five years have an unpatchable vulnerability that is, once again, rooted in physical access protection.  If you’ve got physical access, you’ve got a vulnerability.  Today, in the shadow of the COV-19, just writing those words feels so old and yet so new.  Everything we thought was safe is only safe if it’s physically secured, social distanced and wrapped in the unsettling reminder that trust is transient and when lost, so very hard to regain.

Is the CISO Crazy?

There has been a lot said in the IT press lately about people burn-out in cyber security. To that point, it appears that the tenure of an average CISO continues its downward spiral, now trending towards 20 months or less. Twenty months is a crazy short time for anyone to be in such a critical business role. Most organizations need 20 months to accept the scope of the problem and fund a basic plan to move forward. There’s no way 20 months is enough time to understand business impact or enact lasting change.

The question that most boards are asking is why, why does’t that CISO stick around? Well Nominet, the UK DNS folks put out an interesting cyber report last week that may help point to an answer. They interviewed over 800 CISO’s from the USA and UK and concluded that extreme levels of stress are a prime factor. Sadly 48% of those questioned said that work stress was having a detrimental impact on their mental health. OMG, 48% and metal health in the same sentence! Even allowing for lies-damned-lies-and-statistics, that’s a crazy number that casts a troubling shadow over the future of security programs everywhere. The Nominet report seems to conclude that far too many security leaders feel the stress of being out-gunned in a unwinnable war – or as Gary Hayslip calls it a “Cyber Cold War”. And worse, most reported feeling underfunded and miss understood by their fellow executives and by their governing boards – ouch! And although Nominet only surveyed high-ranking exec’s, this problem likely crosses the security hierarchy and affects practitioners at every level. Just imagine being a threat analyst or a security tester when you are constantly under attack by a sophisticated adversary – it’s a psychological nightmare. Or take a tour of duty on a security incident response team and you’ll quickly see how totally consuming, exhausting and relentless the cyber defense and response game can be.

The Nominet numbers might seem staggering to anyone looking in from the outside, but if you’ve been part of a large security program you know the pitfalls. Building and sustaining a comprehensive cyber program is as much art and psychology as it is tools and computer science. Not every leadership team or governing board of directors even knows what to ask their CSIO to deliver, let alone how to measure their success. There’s plenty off tools and methodologies out there, but are they making the job of the CSIO any less stressful? If not, pass the hammer and order me a new monitor please…

The Cold Decade

John and I saw in the New Year from the rooftop of the Haveli. The rest of the crew stayed late to enjoy the RickshawRun party madness. We made another campfire on the roof and watched the stars get knocked out by the fireworks. A pretty cool place to end the decade it has to be said. Sometimes the internet pays back, as I was able to connect live (or near live) with the people I love that are now so far away.

After what felt like a cold morning in a meat locker, we spent the rest of a hazy crazy day on the Rickshaw Run lot pimping out the rides. We “attached” all the extended luxury rolling travel items we’d spent 24 hours collecting. We attached bottle holders and seat covers, and stuck foam to the bars and casings of the ride. With maybe two full days of cold northern road to cover before we get far enough south of the cold front, we had drop sides made to keep out whatever cheap India foe-leather can handle. Pimped out or puckered up, we all then headed out onto the roads of India for the test ride and appertiser before the main course starts tomorrow. Are we really ready? Maybe. Are we going regardless? Absolutely.

Thar Desert Camping

The crew just staggered in from the desert, back to the comfort of the hotel after a crazy night out in the dunes.

We took a “safari” with a short one hour camel ride – the dromerdary was not really high on anyone’s must do list so we went short on that. This was a lot more boys camping that fancy tents and tourist “gypsy dancers”.

And you can’t beat a hand cooked japatti, and some dall over an open fire. We tried Boogly for the first time – I can’t reliably describe it as it’s a cross between a fried savoy snack and a crunchy pasta noodle. Huddled around the fire eating off the production line was quite something. The chicken tika pieces were to die for. Just knockout camp chow for what turned out to be the coldest day in a century.

This was by far not the most comfortable night ever, but the stars were just amazing and the long night took on an challenge rating. The blankets weighed 20-odd pounds – really; the sand was as hard as board – which was odd, why not soft and grainy; and the wind blew cold, cold late in the night as the weather closed in. A warm start turned into cold finish as Northern India broke through a century-old cold weather record. Past midnight it was almost wet outside – but not frozen. Five coffin-like pods curled up in a row, really feeling the weight and the warmth of what feel like a mattres.

And now, from the warmth of my hotel bed, with the prospect of a cold night out there I think I might stay in bed with my socks on. As maybe a 1000 booming new years bahangra parties get ready to spark all over the city I might just stay in for new years. It’s dam comfetable and warm inside a 15th century fortress, wrapped up in bed with a cup of hot chia…

Morning glory

There’s something magical about being up before the crowd, particularly here in India. Life kicks off at a more sober pace before the dogs, horns and people take to the streets. The rooftops are empty, the streets washed clean and a hazy sun struggles to raise its head above yesterday’s output.

And as the sun rises over the great fort of Jaiselmer the early morning sounds reflect how things must have been. The sound of quiet. Just the cooing of a pigeon and the sound of the first street cart being pushed into place ready for the onslaught. It takes about an hour; by 8am she’s awake. The haze clears (just a little), the motors start, the horns blow (who the **** are you honking at dude, the street is empty) and so it begins again.

The Best Laid Plans

Having arrived safely in Jaiselmer in the far north west of India, we’ve moved into our digs at the Desert Haveli house inside the old fort. The guest house is a 450 year old merchant mansion from the time before time. We spent our first day here walking the markets and collecting goods. Everyone is a little jet-lagged and dazed but picking up fast.

Tomorrow we meet our Rickshaws and start planning our journey. You can track our possible track on Google maps here.

We’ll most likely start out heading for Jodphur and the magnificent fort there, then head south for Pune as fast as our little wheels will take us. The plan is to make the Sailpoint office in Pune on Wednesday 8th. After several passenger rides in local Rickshaws we’re all starting to wonder just how crazy this journey might actually be (gulp).

And so it begins…

Today begins an epic journey. From Austin to Delhi, Delhi to Jaiselmer, Jaiselmer to the rest of the Indian sub continent and Sri Lanka beyond. My climbing training (thank you Allen) tells me I’ve doubtlessly over packed. I’m in less that 40 ltrs in size and at less than 20 lbs in weight. We shall see. I am traveling with a micro yoga mat and the self-promise that I’ll practice every morning in an attempt to save my back from Rickshaw L4/L5 Armageddon 🙂

Identity Attack Vectors

My book on Identity Attack vectors is finally in print at Apress and available from Amazon here. It was fun writing this with Morey – his third book in a series. I’m glad he asked me to join him on the book, it turned out to be a really fun project and overall experience. If you know Morey, he’s a pleasure to work with and super smart guy, so I had it easy!

The book covers where and how Identity management technology (and more specifically Identity Governance and Privileged Account Management) are an attack point AND how this key security technology can be used as a significant point in prevention, detection and mitigation of attack. Chapter 7 covers a pretty decent breakdown on the Identity Governance process. It covers what IGA is and how best to approach it – soup to nuts.

We’re doing a book release webinar on February 4th and a book signing event during RSA on Thursday 27th at the Thirsty Bear at noon in San Fransisco. I’ll re-post a link for the signing event as soon as I have it.

Rickshaw Run 2020

Imagine yourself and 4 friends in two single donkey powered rolling tin cans, desperately trying to traverse India…

Well, I’ve committed to help drive two auto rickshaws across the Indian sub-continent from Jaisalmer in the far north to Kochi is the far south. This unsupported run of over 2,600 kms must be completed within 14 days. There is no set route, no back-up and no way of knowing if we’re going to make it. The only certainty is we will get lost, we will get stuck and we probably will break down!

At the time, this seemed like a sensible way to raise funds and awareness for Athletics for Kids and Cool Earth – now I’m not so sure ☺  But thanks to SailPoint and our other corporate sponsors, we are well on our way to meeting our fund-raising goals, so we’re going for it!  You can help, by contributing to the cause or by simply following along here or on the SailPoint blog page – I’ll be sending in regular updates as we traverse the country.

There’s a PDF flyer with the proposed journey and information on our selected benefiting charities available here and (giving links below).  If you’re based at the SailPoint Pune office, we’re planning to stop by – hopefully Wednesday the 8th of January – fingers crossed we make it on time and stay on three (yes that’s three) wheels!

Cool Earth –

Athletics for Kids:

Keeping Data Safe During The Holidays

In the midst of the holiday season and as we get ever-closer to the new year (and 2015 tax filing), it’s important to remind ourselves how to stay safe online. Just because it’s a time of giving (and hopefully receiving) fun new electronics, toys and other goodies, it doesn’t mean that those who would steal your personal information and do you harm are taking time off. Luckily, there are some easy ways to help keep your information safe and guard yourself against potential attacks.

Electronic Gifts

With all the deals going on and the potential for presents to be shiny and electronic in nature, a good number of us will probably receive a new phone, tablet, or other piece of tech in the next few weeks. But before you simply throw away or sell any of your old devices, keep in mind that most of us practically live on our devices and a lot of information naturally collects there. Pictures, GPS data, calendar events, emails, contacts… the list goes on and on. Unfortunately, though your latest cooking achievement may not be of much import to hackers, there is a real and growing market for buying used devices solely for harvesting personal information.

Whenever selling or simply detaching yourself from an electronic device, it’s incredibly important for you to perform a full factory reset. While the process varies depending on model and manufacturer, the general idea is to format the phone and erase any possibility of the retrieval of data. If it’s an old device and not worth much money, it’s much safer to simply submerge it in some water or treat it like the printer from Office Space.

Now, when it comes to setting up your shiny new device, there are a couple things to keep in mind. Use disk or device encryption whenever possible and choose a good password. This means straying from your pets and relatives’ names, birthdays, or anything else that could be easily guessed after reviewing your social profiles.

Internet Access while Traveling

During the holiday season, a good number of us will find ourselves working from home or from remote locations. While the locale may be a nice change of pace, you must consider the security of the networks to which you connect. One easy way to secure your connection to the world-at-large is through a VPN. Some companies provide this to their employees, but you can also find several commercial and free VPN services (just be sure it’s a reputable company and if you really care about data privacy check their logging policy first!). If a VPN isn’t available to you, a good alternative is to simply use your phone’s data connection. Many plans nowadays allow tethering your phone to your other devices to provide a mobile hotspot, and taking advantage of this can provide you with one of the most secure connection mechanisms available. But of course, check your rates and plan restrictions first.

On a more general note, it’s always a good idea turn off your Wi-Fi and Bluetooth when not in use. This will not only save some battery life, but it will also prevent your phone or laptop from inadvertently connecting to unknown Wi-Fi hotspots. This is particularly important with a modern smartphone: most people walk around broadcasting their current location and arbitrarily connecting to networks everywhere they go. Unfortunately, the bad guys now put out their own public Wi-Fi hotspots specifically to catch the unaware. If your device supports it, turn off the “automatically connect to networks” option, and always make your connections to a Wi-Fi hotspot a considered and deliberate action. 

Tax Season

Last May, the IRS suffered a large-scale data breach, and in the resulting forensics analysis it was found that there were not only direct attacks on the IRS systems themselves but also social engineering attacks on individual taxpayers. This means that while you should always be on the lookout for unsolicited calls from anyone asking for personal information, you need to be especially cautious during the upcoming tax season. These calls may ask to “confirm” personal info such as social security numbers and addresses, and usually will end up asking for tax filing fees to be paid via credit or debit card.

Also be on the lookout for phishing emails posed as e-file confirmations. Just like you would under normal circumstances, don’t respond to links in these emails or call the phone numbers provided. Contact the IRS using their publicly published contact methods if you have any concerns. If you’ve ever been the victim of identity theft or if your personal info has been leaked in a data breach, you may also be at increased risk of having a false tax return filed in your name. If your information has been exposed (you can check using, keep an eye out for any suspicious activity in this area.

Hopefully these tips can help to make sure your holiday season goes off without a hitch… at least where your online security is concerned.