Corona Virus, Social Distancing and The Protection of Your Intel TPM

In today’s work-at-home, socially distanced world, we’re increasingly reminded of the importance of proximity and the critical nature of physical access.  As someone who’s worked in the logical world of enterprise security for so many years, it’s easy to forget that the fastest DOS attack ever, is a hammer swung violently at your physical storage array!   And with the Corona virus on everyone’s doorstep, physical proximity has become an issue in every walk of life.  For COVID-19 it’s social distancing and the now extensively accepted elbow bump.  In software security it’s proximity to the hardware and control over physical access that underpins everything we do.    

I’m reminded of this critical dependency by the recent announcement that nearly all Intel processors have yet another critical security flaw, that is “rooted” in the ability to touch the hardware.  It now appears that anyone with machine access is able to bypass all platform security measures, including the full and unmitigated exploitation of the Trusted Platform Module (TMP).  Anyone that’s tracked the long and intricate history of cryptographic “root of trust” fully understands the magnitude and implications of this statement. 

The March 5th posting from Positive Technologies, titled “Intel x86 Root of Trust: Loss of Trust”, outlined a newly discovered critical flaw in the Intel CSME (Converged Security and Management Engine).  The Intel CSME provides the cryptographic foundation for all hardware security technologies developed by their TMP, DRM, TPM and Intel Identity Protection system. Their report states that this newly discovered vulnerability “affects the Intel CSME boot ROM on all Intel chipsets and SoCs available today other than Ice Point (Generation 10). The vulnerability allows extracting the Chipset Key and manipulating part of the hardware key and the process of its generation. However, currently it is not possible to obtain that key’s hardware component (which is hard coded in the SKS) directly. The vulnerability also sets the stage for arbitrary code execution with zero-level privileges in Intel CSME.”

The report goes on to say that “this vulnerability jeopardizes everything Intel has done to build the root of trust and lay a solid security foundation on the company’s platforms”. They further state that “The larger worry is that, because this vulnerability allows a compromise at the hardware level, it destroys the chain of trust for the platform as a whole.”. 

This latest news means that all Intel processors released in the past five years have an unpatchable vulnerability that is, once again, rooted in physical access protection.  If you’ve got physical access, you’ve got a vulnerability.  Today, in the shadow of the COV-19, just writing those words feels so old and yet so new.  Everything we thought was safe is only safe if it’s physically secured, social distanced and wrapped in the unsettling reminder that trust is transient and when lost, so very hard to regain.

Is the CISO Crazy?

There has been a lot said in the IT press lately about people burn-out in cyber security. To that point, it appears that the tenure of an average CISO continues its downward spiral, now trending towards 20 months or less. Twenty months is a crazy short time for anyone to be in such a critical business role. Most organizations need 20 months to accept the scope of the problem and fund a basic plan to move forward. There’s no way 20 months is enough time to understand business impact or enact lasting change.

The question that most boards are asking is why, why does’t that CISO stick around? Well Nominet, the UK DNS folks put out an interesting cyber report last week that may help point to an answer. They interviewed over 800 CISO’s from the USA and UK and concluded that extreme levels of stress are a prime factor. Sadly 48% of those questioned said that work stress was having a detrimental impact on their mental health. OMG, 48% and metal health in the same sentence! Even allowing for lies-damned-lies-and-statistics, that’s a crazy number that casts a troubling shadow over the future of security programs everywhere. The Nominet report seems to conclude that far too many security leaders feel the stress of being out-gunned in a unwinnable war – or as Gary Hayslip calls it a “Cyber Cold War”. And worse, most reported feeling underfunded and miss understood by their fellow executives and by their governing boards – ouch! And although Nominet only surveyed high-ranking exec’s, this problem likely crosses the security hierarchy and affects practitioners at every level. Just imagine being a threat analyst or a security tester when you are constantly under attack by a sophisticated adversary – it’s a psychological nightmare. Or take a tour of duty on a security incident response team and you’ll quickly see how totally consuming, exhausting and relentless the cyber defense and response game can be.

The Nominet numbers might seem staggering to anyone looking in from the outside, but if you’ve been part of a large security program you know the pitfalls. Building and sustaining a comprehensive cyber program is as much art and psychology as it is tools and computer science. Not every leadership team or governing board of directors even knows what to ask their CSIO to deliver, let alone how to measure their success. There’s plenty off tools and methodologies out there, but are they making the job of the CSIO any less stressful? If not, pass the hammer and order me a new monitor please…

Identity Attack Vectors

My book on Identity Attack vectors is finally in print at Apress and available from Amazon here. It was fun writing this with Morey – his third book in a series. I’m glad he asked me to join him on the book, it turned out to be a really fun project and overall experience. If you know Morey, he’s a pleasure to work with and super smart guy, so I had it easy!

The book covers where and how Identity management technology (and more specifically Identity Governance and Privileged Account Management) are an attack point AND how this key security technology can be used as a significant point in prevention, detection and mitigation of attack. Chapter 7 covers a pretty decent breakdown on the Identity Governance process. It covers what IGA is and how best to approach it – soup to nuts.

We’re doing a book release webinar on February 4th and a book signing event during RSA on Thursday 27th at the Thirsty Bear at noon in San Fransisco. I’ll re-post a link for the signing event as soon as I have it.

Keeping Data Safe During The Holidays

In the midst of the holiday season and as we get ever-closer to the new year (and 2015 tax filing), it’s important to remind ourselves how to stay safe online. Just because it’s a time of giving (and hopefully receiving) fun new electronics, toys and other goodies, it doesn’t mean that those who would steal your personal information and do you harm are taking time off. Luckily, there are some easy ways to help keep your information safe and guard yourself against potential attacks.

Electronic Gifts

With all the deals going on and the potential for presents to be shiny and electronic in nature, a good number of us will probably receive a new phone, tablet, or other piece of tech in the next few weeks. But before you simply throw away or sell any of your old devices, keep in mind that most of us practically live on our devices and a lot of information naturally collects there. Pictures, GPS data, calendar events, emails, contacts… the list goes on and on. Unfortunately, though your latest cooking achievement may not be of much import to hackers, there is a real and growing market for buying used devices solely for harvesting personal information.

Whenever selling or simply detaching yourself from an electronic device, it’s incredibly important for you to perform a full factory reset. While the process varies depending on model and manufacturer, the general idea is to format the phone and erase any possibility of the retrieval of data. If it’s an old device and not worth much money, it’s much safer to simply submerge it in some water or treat it like the printer from Office Space.

Now, when it comes to setting up your shiny new device, there are a couple things to keep in mind. Use disk or device encryption whenever possible and choose a good password. This means straying from your pets and relatives’ names, birthdays, or anything else that could be easily guessed after reviewing your social profiles.

Internet Access while Traveling

During the holiday season, a good number of us will find ourselves working from home or from remote locations. While the locale may be a nice change of pace, you must consider the security of the networks to which you connect. One easy way to secure your connection to the world-at-large is through a VPN. Some companies provide this to their employees, but you can also find several commercial and free VPN services (just be sure it’s a reputable company and if you really care about data privacy check their logging policy first!). If a VPN isn’t available to you, a good alternative is to simply use your phone’s data connection. Many plans nowadays allow tethering your phone to your other devices to provide a mobile hotspot, and taking advantage of this can provide you with one of the most secure connection mechanisms available. But of course, check your rates and plan restrictions first.

On a more general note, it’s always a good idea turn off your Wi-Fi and Bluetooth when not in use. This will not only save some battery life, but it will also prevent your phone or laptop from inadvertently connecting to unknown Wi-Fi hotspots. This is particularly important with a modern smartphone: most people walk around broadcasting their current location and arbitrarily connecting to networks everywhere they go. Unfortunately, the bad guys now put out their own public Wi-Fi hotspots specifically to catch the unaware. If your device supports it, turn off the “automatically connect to networks” option, and always make your connections to a Wi-Fi hotspot a considered and deliberate action. 

Tax Season

Last May, the IRS suffered a large-scale data breach, and in the resulting forensics analysis it was found that there were not only direct attacks on the IRS systems themselves but also social engineering attacks on individual taxpayers. This means that while you should always be on the lookout for unsolicited calls from anyone asking for personal information, you need to be especially cautious during the upcoming tax season. These calls may ask to “confirm” personal info such as social security numbers and addresses, and usually will end up asking for tax filing fees to be paid via credit or debit card.

Also be on the lookout for phishing emails posed as e-file confirmations. Just like you would under normal circumstances, don’t respond to links in these emails or call the phone numbers provided. Contact the IRS using their publicly published contact methods if you have any concerns. If you’ve ever been the victim of identity theft or if your personal info has been leaked in a data breach, you may also be at increased risk of having a false tax return filed in your name. If your information has been exposed (you can check using, keep an eye out for any suspicious activity in this area.

Hopefully these tips can help to make sure your holiday season goes off without a hitch… at least where your online security is concerned.

The Long Tail Of Enterprise Passwords

The National Institute of Standards and Technology (NIST) is once again considering the death and eradication of the traditional password. NIST’s senior standards and technology advisor Paul Grassi recently stated that the agency is debating updating the password usage requirements set forth in NIST guide 800-63 to recommend stopping the use of passwords in both government and private enterprise systems.

Grassi notes that a driving factor for the shift is that passwords are becoming increasingly vulnerable to attack. Poor end-user password practices and weak administrative system policies continue to make password-authenticated systems the subject of brute-force attacks.

But the question remains, is a world without passwords truly an achievable goal?

The simple answer – in a perfect world – is yes. What would be ideal is for every app, website and SaaS vendor to subscribe to a common standard of strong authentication and/or federation which would eventually make passwords obsolete.

However, given the current enterprise landscape (even into the near future), I’d caution executives not to hold their breath. The world we live in is imperfect, and legacy vendors are slow (if ever) to adopt standards around authentication. In addition, newer applications, including SaaS and mobile, are more focused on delivering functionality than on delivering secure solutions.

Another challenge is the lack of a common, non-password-based standard. It’s one thing to support initiatives to make passwords a thing of the past, but it would be wise to also pragmatically recognize that for the vast majority of enterprise systems, passwords remain a reality with which we must cope. With the presence of this current paradigm, enhanced password management and governance are of paramount importance.

We continue to hear that password management is a pain point for most organizations and ultimately, their end users. With the right tools in place, organizations can enforce enhanced practices including: robust password policies like password strength, complexity and expiration, and easy to use end-user password management tools. With these capabilities in place, organizations can ensure that all users have more secure passwords across all applications – reducing the risk of a data breach

TLS Santa Clause

Let's Encrypt

On December 3rd the public beta starts for Let’s Encrypt.  When it does, I’ll be the first on the list for a free digital certificate and (hopefully) this site will become HTTPS only.  The EFF kicked off this effort last year, and the fruit is ready to eat for the December holidays.

Anyone that’s administered a web domain with TLS knows that the process of obtaining a digital certificate to HTTPS secure your site is 100% manual and somewhat costly.  That’s basically the reason why blogs and public content like this site is not encrypted . Let’s Encrypt provides a simple protocol that automates most if not all of the process.  It lets you obtain a browser-trusted certificate, sets it up on your web server, keeps track of when it’s going to expire, and automatically renews it for you.  It also handles revocation should that ever becomes necessary.

BUT the best bit of all is that the certificates it provides are 100% FREE!  So no reason not to encrypt EVERYTHING.  It fully supports certificate transparency and so provides a truly enterprise-class HTTPS solution even for the web hobbyist like me 🙂

Next Generation Identity & Access Management


I recently recorded a webinar on putting IAM at the center of security.  It covers how the seven core tenets of successful IAM help create a “governance-based approach to IAM and how this helps.  The recording is available on youtube here.

It’s a long 50 minutes with the Q&A on the end, AND it’s a pretty technical look at what makes up a next generation IAM solution, BUT  if you’re into what we all do, I think it’s well worth a listen…

The things I taught my mother about passwords

While speaking at an industry event in DC last month I made a comment that “even my mother now understood the concepts of password entropy”  because I had made the point of calling her in England to explain them.   In recalling that conversation with my mother, I wanted to share the three things I told her she needed to do to securely use passwords on the internet.

My mum is a spritely 70 year old who lives in the UK.  We stay in very good touch via Skype and email.  She loves her iPad for the web and chatting to me, and especially likes the fact that she  download and store endless amounts of Ukulele sheet music.  Yes, my mother is one of “those”.  The Ukulele Reformers.  They’re like a cult; one that smiles a lot and puts on a gig at the drop of a hat whenever they can all stand together.

So our conversation that day had been about why she needed to be more diligent with passwords on the internet.  To make things easier to remember, I gave her three basic best practices that would help keep her passwords safe.  I wanted to share that advice here.

My first was that “long is strong”

I explained that, unfortunately, the longer and more complex the password the safer it will be.  Twelve characters should be thought of as an absolute  minimum.  Avoid using dictionary words unless as part of a complex passphrase, and add special and mixed case characters wherever you can.  She immediately said “so how do I remember my password then”?  I explained a couple of simple mental models that can help, like using the first characters of a memorable phrase.  The example I used was “Mary had a little lamb its fleece was white as snow 987654” would then become a password of “MhallifwwaS98754”.  I explained how this created what we called “password entropy”, basically complexity, that made it hard for the bad guys to guess her password.

I also told her that writing down long passwords was better than using short ones just so she could remember them.  Ironically if you’ve been in the security space for a while, you’ll recall how “the yellow password sticky note” was the cartoon joke of the late 90’s!  Odd how things change but stay the same isn’t it?

My second was to “be unique”

To make things harder for the bad guys, the best thing she could do was to use unique passwords at every site.  Again her reply was “so how do I remember them all?”.  Again I said writing them down and keeping that list safe was ok, but explained that putting sites into mental groups (by value or name or something else) she could have fewer passwords and share them that way.  I also explained that she could easily add something about the individual site to the middle or end of her “high entropy password” to create something unique for each site.  So, for instance, her Google password would then become MhalGOOGLEifwwaS98754.

Fortunately there are, of course, good commercial tools and solutions that make this overall process much easier.  As for me, I am lucky enough to have SailPoint’s IdentityNow solution to help capture, store and replay my complex passwords.  Fortunately her US based tech support team (that would be me, by the way), was subsequently able to set her up with a consumer password management solution (she’s now a Lastpass user) so she had that benefit too.

My third was to “watch the road”

Basically this was to always be aware of where she was on the internet and to take specific note of anything and anybody that asked her to “login” or provide any of her “secrets” and personal information. Again her US tech support associate did have to show her how to setup strong, multi-factor authentication where it was available on her favorite sites.  She does now understand the importance of HTTPS and what to do if there’s not a “little lock in the URL bar” – so she’s in much better shape than most.

On a slightly broader security note…

I should also point out that her US based tech support team, (again that would be me), had previously talked her through installing a browser-based web filter / adblocker (I’m a big fan of UBlock Origin) – so she had some degree of content protection.  Plus we had, awhile back, had our “the birds and the bees of the internet” conversation – I distinctly remember telling her to “trust no one”.  I recall she was a little disappointed by that statement.  She said she was surprised that “you computer types hadn’t worked this security thing out yet!”.  About all I could say was “Yes, I wish that too…”.

She was a little annoyed, but not for long.  After all it was already time to hang up Skype and take her iPad song-book and Ukulele to a local gig.