I have too much security today

This morning, I had three tasks to complete that involved using various web sites. First, I had found an old recall on a part to my Cuisinart food processor. The recall notice cited a web page that (I assume) was such an old reference that the page has since evaporated.  Then I was trying to review the latest charges on my credit card. And finally, I wanted to pay a doctor bill online. Each of these tasks would have taken minutes to accomplish. Instead, the elapsed total time was several hours.

Now, I am not one of those Gen Z’ers that would rather text (or use the web) than talk to an actual human being in real time. Nevertheless, that was going to be how I would solve the Cuisinart Challenge. While the URL for the recall wasn’t in service, they had provided a phone number in the recall notice.

So I called the number and I was told all lines would be busy for the next five minutes and if I wanted them to call me back, just press 1, which I did. A few minutes later I got  my calll back. Once the support person took down my info, it quickly processed and a new part was promised within a few weeks. Excellent service: I think I bought that appliance probably 17 years ago.

Next, on to checking my credit card. I called the bank, they started to walk me through the process, and then we both realized that I was using a “secure” browser (Opera Air) that I remembered had some odd quirks, particularly because it blocks ads and popups. Sure enough, once I brought up Chrome, I was off to the races and able to login without any problems.

That made me think my doctor’s bill was suffering from the same condition, so I tried that in Chrome and hot diggity, problem solved and I could pay my bill just in time for lunch. So much for my morning.

Now, you might ask why am I using Opera Air? I got tired of all the popups and effluvia that I was experiencing with Chrome, and also annoying with the Googleplex in general. (Yes, I know, Opera is based on the Chrome code base, but that is just the way the modern browser worlds operate these days — with the exception of Safari and Firefox. Even Microsoft uses Chrome for Edge nowadays.)

Is there such a thing as using too much security? No. But there is a constant trade-off among security, privacy, and usability. It is a three-way tug-of-war. And the more you tug on one of the three legs, the more the other two will give way.

CSOonline: Secure web browsers for the enterprise compared: How to pick the right one

The web browser has long been the security sinkhole of enterprise infrastructure. While email is often cited as the most common entry point, malware often enters via the browser and is more difficult to prevent. Phishing, drive-by attacks, ransomware, SQL injections, man-in-the-middle (MitM), and other exploits all take advantage of the browser’s creaky user interface and huge attack surface, and the gullibility of most end users.

This is why enterprise secure browsers have finally gotten their moment. The category, which has been mostly flying under the radar for the past six years, has seen a lot of changes since I last wrote about them three years ago. Google announced its own entry into the field last year. Talon and Perception Point — who were in that post — were acquired by Palo Alto Networks and Fortinet respectively, showing how this technology has become part of a larger security context. To that end, other established security vendors have brought forth products in what Gartner is now calling the “remote browser isolation” market to complement their zero trust, secure services edge, or posture management security platforms.

I have updated my post for CSO this week and provide more recent information on how to evaluate this class of products, what are typical protective features, and describe the more than a dozen products and what they offer.

Coming f2f with a nuclear missile

Last week I happened to be on a vacation in Tucson and stopped by a rather unique museum. Those of you who are long-time readers will recognize this as a feature, not a bug (see my work on the St. Louis AquariumNSA’s museum, UX museum design, and the Lincoln presidential library). I went to the site of the last Titan Missile silo.

Titans were first created to launch a massive retaliatory strike back in the 1960s. Each missile contained a single 9 megaton warhead, perhaps the biggest bomb ever deployed. (By way of comparison, the original blast over Hiroshima was 15 kilotons.) They were designed to be launched within a minute or so after receiving the go-code. Three locations were picked, each field containing 17 silos that were essentially self-contained underground environments consisting of a dormitory, a control center and the silo itself. In the mid-1980s, all of the other silos were completely decommissioned and made inoperable.

The museum contains the last remaining silo that has a missile in it (minus propulsion and the warhead of course). If you take the tour you spend about an hour underground seeing it up close as well as witnessing a simulated launch sequence with some of the original control gear.

Now, I thought I knew a lot about nuclear missiles, but I found the experience both fascinating and chilling, especially as we seem to be talking about them more often these days. One fact that I learned is that the Titan collection would be launched entirely when the order was given: that meant that all 54 of them would be airborne at once. Whether life on Earth could survive that combined blast isn’t clear, it reminded me of the “Doomsday Machine” that was popularized in the 1960s — of course, that machine was automated. To launch each missile required two human operations to go through a sequence of authentication steps (double-keyed locks, one-time passcodes and the like) to verify things. The movies represent this sequence in spirit. In reality – at least in our simulation – is very involved with multiple steps, which makes sense.

One of the reasons the Titan was decommissioned was the era of a single big bomb per missile evolved into having one rocket with multiple smaller warheads, which is what the vast majority of the world’s some 12,000 weapons look like today. Another point in Titan’s disfavor is that it doesn’t make sense to have much in the way of land-based weaponry, since they are essentially sitting ducks for the enemy to target. Most of today’s weaponry is mobile, based in subs or on planes, such as the UK or France.

But whether you count by warheads or rockets requires a lot more nuance. China, for example, has a huge stockpile, but fewer weapons that are ready to launch. And I would argue that another aspect that doesn’t get much discussion is the world’s 400-plus nuclear power plants that are scattered around 30-some countries. While these plants are doing something useful – producing electricity – they are also sitting ducks for enemy targets. Russia has specialized in this arena, sadly. About a year ago, the Chernobyl nuclear power plant was targeted by Russian drones that punched a hole in its protective roof. Some have said it was an accident, and Russia denies they fired anything, both not very credible statements.

As you might remember, the damaged reactor was encased in a huge building with several layers of steel and concrete, designed to keep the escaping radiation inside and away from humans. To my way of thinking, this was the second time a nuclear strike was used in warfare. The first was an earlier Russian missile fired at Ukraine’s nuclear power station. Why no one is making a bigger deal out of these events is curious.

After my friend and I did the Titan tour, we decided to watch Dr. Strangelove to see how accurate their depiction of nuclear warfare was. While the exact details differed, the movie has held up well over the years, and I would recommend you screen it too.

LinkedIn Live: Inside the threat hunt, turning signals into evidence

I recently moderated a live event (which has been recorded and can be accessed here, with registration), about how to do threat hunting using Corelight’s Investigator tool. My partner is Mark Overholser, who is their technical marketing engineer. Mark is an accomplished threat hunter and veteran of numerous Black Hat SOC tours of duty, so he has seen a lot of wonky circumstances go across his screens.

We talk about why being proactive is important in learning how to hone your investigations, how to use the MITRE ATT&CK foundation (shown above) and schema to hone your focus and guide your efforts.  (I wrote about the evolution of ATT&CK for CSO back in 2021 here), We also discuss how to drill down to suss out what is going on across your network. .

Corelight also has an excellent threat hunting guide that is keyed to the ATT&CK categories, with loads of suggestions to how you can leverage it to help in your hunts.

When is the cell phone age of consent?

I realize that I am not using the term precisely, but you most likely understand the meaning. You could interpret my question as asking, at what age as parents do we provide cell phones for our kids? I asked my readers to share their own experiences, and most opted to remain anonymous, so I will refer to them with descriptors to distinguish them. In addition to the age of consent, I also asked other details about their kids’ usage and what controls they used to formulate their family phone policies.

The Fortunate family has two boys that are now in college. They got their phones when they were 12. “We trusted our kids and never had a problem,” at least to their knowledge. They initially used a Verizon blocking and monitoring phone app. They never had access to their kids’ phones and “on the whole it wasn’t a problem.” That is why I call them “fortunate.”

The Strict family also has two teen-aged boys (19 and 12), both of whom sort of got their phones when they were 12. The older boy “has only an Instagram account now but rarely uses it (mostly just to see occasional friend’s posts). He has the right priorities and values, and we don’t need to stay on top of this for him at all—he limits himself.” The younger boy is why I say “sort of” because his device is a locked-down iPad, which also comes with usage limits (“we collect it at night, and he’s not allowed to get it until all homework and other responsibilities are completed”). What is more significant is that “he has learned to bypass the controls on his school Chromebook and knows where to find unblocked games — that’s a big enough headache for me frankly.” Oh, and the parents are keepers of the passwords too.

The OnRamp family has a boy and a girl that got their phones between 16 and 18 (and are now in college). “I would caution any parent who would allow a phone prior to age 16,” they said. “Our kids needed an on ramp, you can’t just lock them down and then cut them free in an instant.” This family saw the need for phones at discrete moments, such as when traveling. But having an on ramp also meant restricting social apps or with a lot of oversight or forbidding them in places such as their bedrooms, when the phones would be relegated to a charging shelf. They also recognize that they didn’t do as good a job at teaching them other worries such as doom scrolling or going down rabbit holes, because “any content consumption can be addictive.”

When my cousins had teen girls, they got their first phones both at age 12 (they are now 19 and 21). They had access to their AppleIDs and PIN codes so they could monitor which apps they had, and also banned phones at their dining table and collected them at night.

One reader has four daughters from 4 to 10 years old, call them the Home School family. He said, “I can’t imagine ever giving them cell phones, and believe strongly in parent/child attachment.”

Several readers were pretty vocal about not allowing cell phones in the classroom. Of course, that places the responsibility on each teacher to detect usage, which can be an issue. But then this is just another part of their responsibilities.Many years ago, I taught a high school networking class for 10 boys. The class was done in a hard-wired network lab (wifi hadn’t yet become popular or available in the school). When a student was giving me problems, I would unplug their computer. That public shaming seemed to work for me — and the related peer pressure for them as well.

Others suggested buying phones without any internet data plans or GPS-enabled watches, such as from Mint Mobile, Gabb.com, Bark.us or Tello.com. These vendors have a wide range of products and Gabb has an impressive amount of content that can help you pick out the right piece of tech for your kids.

However, like any blocking or protective tech, these solutions may create additional problems. The Contract family used the Bark.us app and did help out in one situation, but he grew tired of its frequent and buggy updates, and discontinued its use last year. They also made their kids sign a multi-page cellphone agreement, which he has agreed I can share with you here. This might work for you, but I think many of you would find this level of pseudo-legality a bit much. Another source worth exploring is Delaney Ruston’s blog (she has interviewed many families for her documentary films about family tech use), and this post goes into great detail about how to formulate your family’s phone policies.

Another reader, we’ll call him Childless Man, says that “if I had had a cell phone when I was 12 to 15, I would have gotten myself in lots of trouble. I can’t be the only kid who’s libido was running overdrive!”

Finally, there is the Watch family, with two daughters 8 and 11. So named, because they have focused on getting watches rather than phones, at least initially. “The Apple watch is great, because when it is not paired to a phone it cannot access any apps.” They also manually add contacts to the watch so they can control who their girls communicate with, and are the keepers of the passwords too. “The watch is restricted to contact with mom&dad only after 8:30pm and is also on “school mode” during the day. Our kids’ schools are also complete black holes of cell service.”

I originally thought about this topic in terms of kid’s social network usage, but as I was corresponding with you all I see that I haven’t really understood the breadth and depth of the issue. Yes, we can try to block TikTok, Facebook, and Instagram. But what about YouTube, Discord, and playing online games? And kids are clever at getting around app blockers, as I mentioned with the Strict family earlier. I probably will have more to say about this topic and welcome your input as always.

So what can you glean from these examples? There is no perfect solution, and the important thing is to match your level of expertise (many of the families cited here are from parents who are computing professionals) and also the kind of kids you have and how they develop and what tech their peers are using. (To that end Ruston pointed me to the Waituntil8th.org, which promotes parents to act together to wait until eight grade before giving their kids phones.) That shows that your policies and restrictions will of course change as your kids grow up. Thanks to all of you who answered my query, and if you want to share your own experiences, feel free to comment here or send me a private message.

CSOonline: CASB buyer’s guide

Since I began examining cloud access security brokers in 2018, a lot has happened. CASBs sit between an organization’s endpoints and cloud resources, acting as a gateway that monitors everything that goes in or out, providing visibility into what users are doing in the cloud, enforcing access control policies, and looking out for security threats.

Some vendors have begun incorporating additional features into core CASB functionality, such as data loss prevention (DLP), secure web gateway (SWG), cloud security posture management (CSPM), and user and entity behavior analytics (UEBA). Other CASB vendors have been purchased by main-line security vendors have purchased CASB solutions: Oracle (Palerra), IBM (Gravitant), Microsoft (Adallom), Forcepoint (Skyfence), Proofpoint (FireLayers), Symantec (Skycure) and McAfee (Skyhigh Networks). The market has matured, although this is a matter of degree since even the longest-running vendors have only been selling products for a few years. It has also evolved to the point where many analysts feel CASB will be just as important in the near future just as firewalls once were back in the day when PCs were being bought by the truckloads.

There are three deployment modes: forward proxy, reverse proxy and API-based. Most experts say that API-based CASBs provide better functionality, but organizations need to make sure that the vendor’s list of application programming interface (API) connections matches up with the organization’s inventory of cloud apps.

In this updated story for CSOonline, I talk about what are these products, why enterprises are motivated to purchase and deploy them,  what features you should look for that are appropriate for your network. what are your decision points in the purchase process, and links to many of the major CASB vendors.

Book review: Infidelity Rules by Joelle Babula

This debut novel centers around the life and loves of Quinn, a sommelier for a trendy DC restaurant and a serial home-wrecker who likes to date married men. The dates are initially filled with passion that eventually cools as the men decide to end their affairs, or their marriages. The pairing of wine with relationship woes is a powerful narrative device as we are introduced to Quinn’s world, her female friends and family, and her coworkers. I found myself drawn in almost immediately to the plot and people, and the author does a great job of presenting both sides of Quinn’s latest dalliance with Marcus, who sweeps her off her feet until she meets up with his wife and hears her point of view of their relationship. The characters are well-drawn, the situations and circumstances feel very realistic, and the underlying humor and pathos makes for a compelling read, for readers of all genders. Highly recommended. Buy on Amazon here.

Startup survival guide: keep it simple and small

I have known Vesa Suomalainen for many decades, going back to the days where he ran several teams for Microsoft during their go-go years. He and several compatriots left the company around the turn of the century and eventually built another software company called
Webscorer in 2011. (I wrote an article about his startup then for ReadWrite, which amazingly is still online here.
At that time, I called his vision “anti-Microsoft.” It was a successful philosophy. I recently caught up with him to expand on some of the things he learned from running various software startups. “We wanted to stay small and we have the same exact team as we did in 2011. No deaths, no arguments, no retirements. Just as planned,” he said. It is almost as if everyone learned how little they liked the BigCo mentality and have purposely tried to make things small.

Here are some other lessons he has learned over the years to keep to this vision:

  • Don’t be optimistic. Plan that you will struggle initially, and this way you won’t end up diluting all (or even much) of your startup capital. It is always better not to take any outside money and pay everything on your own dime.
  • Set your sights lower. You don’t want to conquer the world, just make a small adjustment over time. Vesa talks about having an excellent niche product that is highly profitable rather than shooting for the stars and failing and losing your entire company.
  • Know what not to do. Learning from your mistakes is just as important as success. Vesa’s failure taught him more about what not to do with his present venture. Watching a startup destroy itself was a very potent teacher. Speaking of which, he said that “There are lots of ways to fail, but only one way to succeed.” Sounds like something Yoda might say to young Luke.
  • Don’t make too many promises that you can’t keep. Understand scope creep and keep it under control. Eliminate buttons, reduce functionality, and keep things simple. Resist the temptation to make your product more complex at every turn.
  • Don’t be greedy, share your equity with your key founding members. Even if it is a small percentage, you want to retain your key developers and engineering talent. Nothing says loving more than some points of equity. This means being flexible and fair to your employees (we have no fixed office hours and no vacation or sick leave policies), and give everyone some responsibility with that equity. It also reduces the number of team meetings — we get by with one weekly online session.
  • Keep your costs down. Everyone works remotely, so there is no office expense. They also don’t have any accountant, corporate lawyer, or a bookkeeper, so they do their own taxes and resist “lawyering up.”
  • Ignore your competitors, listen to your customers.  Competitors come and go, hopefully your customers remain. Having happy customers is the best marketing strategy, and having viral marketing helps keep marketing costs down.
  • Product quality is key.  Focus on performance, scalability, usability, availability are core features.Take each and every bug report and feature request seriously, and then provide quick, free and competent support. They use Google Firebase to get automatic crash reports for example.

How not to repurpose an old laptop

For the past six or so years, I have had an HP Elitebook laptop that I have carted around the world a few times, upgraded it a few times eventually to Windows 11 — amazingly, Microsoft still supports the thing. (It runs an Intel i7 and hads 16GB of RAM, so it is a pretty solid machine even now).

But it was showing signs of age (aren’t we all?): the sound, which used built-in B&O speakers, was no longer working and a few other quirks with the bundled HP security software that I was tired of dealing with.

Perhaps you are in a similar situation, or your business is in a similar situation. Read on, and learn from my many mistakes. Even though I have been working with PCs since the mid-1980s, there is still a lot I can learn.

What pushed me from “thinking about getting a replacement” to action was this security warning about this aging fax modem driver file ltmdm64.sys that could cause problems. I thought — ok, I am a security expert, let’s see if I have this file on my laptop. A quick search using File Manager brought up nothing, but then I realized that FM doesn’t tell you about system-level files. I rooted around some more and saw it eventually lurking in some dark Windows directory, but of course I couldn’t rename it or delete it. And this is a feature, not a bug, because the last thing I would want would be to have some malware get ahold of that directory and cause even more damage.

Enough already. But before I buy something new, I wanted to see if I could repurpose my laptop and install a less complicated OS that I could manage. Easy, I thought: Almost all of my use is through browser-based tools. And since I run my email through Google’s servers, I figured to start first with ChromeOSFlex. Unlike other OS’s, you don’t download an .iso image file and then use that to make a bootable USB drive. Instead, you have to go to the Chromebook Recovery Utility’s download page and download and prepare the bootable image that way. This utility is a browser extension. That should have been a warning sign.

There are two ways you can refresh your PC with a new OS: run the “live boot” from the USB drive, which means nothing gets put on your hard drive (in case something goes wrong) or to do a fresh install, in which case you destroy the (in my case) Windows files and start anew. Being a careful person, I choose door #1 and did the live boot.

Now, I have all sorts of security things on my Google account, including a Yubico hardware key, passkeys, an account password that is a complex string of numbers, letters and symbols (more on that in a moment). I also had one must-have browser extension — the Zoho Vault password manager. I thought having a Google OS would be a good thing. I was wrong.

The problem with ChromeOS is that it is not quite an OS — it is really Android that has been heavily modified and stripped down. You’ll see why in a moment.

Within short order I got a working system, the Zoho stuff worked just fine and I was ready to throw caution to the winds and do the great big wipeout and install ChromeOSFlex for real. Got everything flowing just fine, or so I thought. Then I shut down my machine for the night. Big mistake, as I found out the next day.

The problem is when ChromeOS boots up, it doesn’t quite know your keyboard driver. So the password that you type in doesn’t quite match. It didn’t help matters that my password contained a series of ones and zeros and the letter O and L. It wasn’t easy to figure this all out.

So Google kept saying I had entered a bad password. I eventually figured out when it is initially booting up, it doesn’t recognize my passkey, or my Yubico key. I don’t know why. And Google has made running ChromeOS that requires a boot password, so I was kinda stuck.

Now I had A Project. Over the past week, I have downloaded all sorts of Linux-flavored OSs. All had issues, until I downloaded Mint Linux. Twice — for some reason, the download didn’t take the first time around. I needed a ISO writer called balenaEtcher to create a bootable USB drive from my Mac. Eventually, I got things working, although I would have liked for Zoho to support an Opera browser extension on Linux, but they don’t have one, so now I am using Firefox for my web browser the moment.

What works:  have sound once again, and my Yubico key and passkeys work just fine.

What doesn’t quite work: the control of the fonts inside the browser, or at least I haven’t figured out where that particular control is.

Lesson #1: Don’t do the complete wipeout until you have rebooted your old laptop a few times.

Lesson #2: If you have a critical software component (in my case, the password manager), make sure it supports your OS and browser version. This is why you try out the live boot option.

Lesson #3: Make sure your OS will run on your particular chipset, particularly if it isn’t a 64-bit Intel CPU. Read the fine print.

Lesson #4: If you have hardware keys or other USB things that you want supported, particularly test them on the live boot before committing to the total wipeout.

Lesson #5: Know your tools. ISO boots are a strange sub-culture. Make sure you have a sufficiently large USB thumb drive that can contain the boot image. Make sure you find a program that will create a bootable USB from your downloaded ISO file.

 

 

 

CSOonline: CSPM Buyer’s guide

(originally posted 6/21)

Every week brings another report of someone leaving an unsecured online storage container filled with sensitive customer data. Thanks to an increasing number of unintentional cloud configuration mistakes and an increasing importance of cloud infrastructure, we need tools that can find and fix these unintentional errors. That is where cloud security posture management (CSPM) tools come into play. These combine threat intelligence, detection, and remediation that work across complex collections of cloud-based applications. You can see a few of them above.

Vendors have been incorporating CSPM functions into their overall CNAPP or SSE platforms, including CrowdStrike, Palo Alto Networks, Wiz, Zscaler and Tenable. This means that the modern standalone CSPM tool has all but disappeared. In my latest revision on the category for CSOonline, I  mention some of the issues involving purchase decisions and mention three vendors that are still selling these tools.