cryptogram

Terrorism in the U.S. Since 9/11

noreply@blogger.com (Originative) — Sat, 8 Oct 2011 15:39:00 -0700

John Mueller and his students analyze the 33 cases of attempted Islamic extremist terrorism in the U.S. since 9/11. So few of them are actually real, and so many of them were created or otherwise facilitated by law enforcement.

The death toll of all these is fourteen: thirteen at Ft. Hood and one in Little Rock. I think it's fair to add to this the 2002 incident at Los Angeles Airport where a lone gunman killed two people at the El Al ticket counter, so that's sixteen deaths in the U.S. to terrorism in the past ten years.

Given the credible estimate that we've spent $1 trillion on anti-terrorism security (this does not include our many foreign wars), that's $62.5 billion per life lost. Is there any other risk that we are even remotely as crazy about?

Note that everyone who died was shot with a gun. No Islamic extremist has been able to successfully detonate a bomb in the U.S. in the past ten years, not even a Molotov cocktail. (In the U.K. there has only been one successful terrorist bombing in the last ten years; the 2005 London Underground attacks.) And almost all of the 33 incidents (34 if you add LAX) have been lone actors, with no ties to al Qaeda.

Looking over the incidents, some of them would make pretty good movie plots. The point of my "movie-plot threat" phrase is not that terrorist attacks are never like that, but that concentrating defensive resources against them is pointless because 1) there are too many of them and 2) it is too easy for the terrorists to change tactics or targets.

I remember the government fear mongering after 9/11. How there were hundreds of sleeper cells in the U.S. How terrorism would become the new normal unless we implemented all sorts of Draconian security measures. You'd think that -- if this were even remotely true -- we would have seen more attempted terrorism in the U.S. over the past decade.

And I think arguments like "the government has secretly stopped lots of plots" don't hold any water. Just look at the list, and remember how the Bush administration would hype even the most tenuous terrorist incident. Stoking fear was the policy. If the government stopped any other plots, they would have made as much of a big deal of them as they did of these 33 incidents.

Mueller's work:
http://polisci.osu.edu/faculty/jmueller/since.html

$1 trillion spent on terrorism security.
http://www.amazon.com/exec/obidos/ASIN/0199795762/counterpane/

To justify the current U.S. spending on homeland security -- not including our various official and unofficial wars -- we'd have to foil 1,667 Times Square-style plots per year.

http://www.slate.com/id/2303169

Here's data on terrorist incidents from 1970 to 2004.
http://www.schneier.com/blog/archives/2007/06/terrorism_stati.html

And here's Nate Silver with data showing that the 1970s and 1980s were more dangerous with respect to airplane terrorism than the 2000s.
http://www.schneier.com/blog/archives/2010/01/nate_silver_on.html

According to the State Department's recent report, fifteen American private citizens died in terrorist attacks in 2010: thirteen in Afghanistan and one each in Iraq and Uganda. Worldwide, 13,186 people died from terrorism in 2010. These numbers pale even in comparison to things that aren't very risky.
http://www.state.gov/documents/organization/170479.pdf

Look at Table 3 on page 16 of this document. The risk of dying in the U.S. from terrorism is substantially less than the risk of drowning in your bathtub, the risk of a home appliance killing you, or the risk of dying in an accident caused by a deer. Remember that more people die every month in automobile crashes than died in 9/11.
http://polisci.osu.edu/faculty/jmueller/ISA10.PDF

In my blog post, I accidentally typed "lives saved" when I meant to type "lives lost." I've corrected that above. We generally have a regulatory safety goal of $1-$10M per life saved. In order for the $100B we have spent per year on counterterrorism to be worth it, it would need to have saved 10,000 lives per year.
http://scienceblogs.com/stoat/2011/08/schneier_confuses_life_with_de.php
or http://tinyurl.com/3ljpx2d

$1-$10M per life saved:
http://polisci.osu.edu/faculty/jmueller/STEWJTS.PDF

Anonymous vs. HBGary

noreply@blogger.com (Originative) — Mon, 21 Mar 2011 01:12:00 -0700

One of the effects of writing a book is that I don't have the time to devote to other writing. So while I've been wanting to write about Anonymous vs. HBGary, I don't think I will have time. Here's an excellent series of posts on the topic from ArsTechnica.

In cyberspace, the balance of power is on the side of the attacker. Attacking a network is *much* easier than defending a network. That may change eventually -- there might someday be the cyberspace equivalent of trench warfare, where the defender has the natural advantage -- but not anytime soon.

http://arstechnica.com/tech-policy/news/2011/02/anonymous-to-security-firm-working-with-fbi-youve-angered-the-hive.ars

This is a really good piece by Paul Roberts on Anonymous vs. HBGary: not the tactics or the politics, but what HBGary demonstrates about the IT security industry.

http://threatpost.com/en_us/blogs/rsa-2011-winning-war-losing-our-soul-022211

Stephen Colbert on HBGary:

http://www.colbertnation.com/the-colbert-report-videos/375428/february-24-2011/corporate-hacker-tries-to-take-down-wikileaks

Another article:

http://www.h-online.com/security/features/Anonymous-makes-a-laughing-stock-of-HBGary-1198176.html

New Versions of SHA-512

noreply@blogger.com (Originative) — Thu, 17 Mar 2011 06:03:00 -0700

NIST has just defined two new versions of SHA-512. They're SHA-512/224 and SHA-512/256: 224- and 256-bit truncations of SHA-512 with a new IV. They've done this because SHA-512 is faster than SHA-256 on 64-bit CPUs, so these new SHA variants will be faster.

This is a good thing, and exactly what we did in the design of Skein. We defined different outputs for the same state size, because it makes sense to decouple the internal workings of the hash function from the output size.

http://csrc.nist.gov/publications/drafts/fips180-4/FRN_Draft-FIPS180-4.pdf

OpenVAS - 4 Released‏

noreply@blogger.com (Originative) — Thu, 17 Mar 2011 06:00:00 -0700

The OpenVAS community is proud to announce the availability of OpenVAS-4,the next generation of the Open Vulnerability Assessment System. Though only eight months since OpenVAS 3.1, the new release represents the biggest step forward ever in the history of OpenVAS.

The most significant new features are a Report Format Plugin Framework, a Master-Slave mode and an improved Scanner. The extended OpenVAS Management Protocol (OMP) 2.0 of OpenVAS Manager makes several new features consistently available to all of its clients (Web, Desktop, CLI).

This is the first release that is directly accompanied with installation packages for over 20 platforms, several installation quick guides, a tool to check proper setup and, last but not least a virtual appliance.

OpenVAS-4 covers the following OpenVAS modules: Libraries 4.0, Scanner 3.2, Manager 2.0, Administrator 1.1, GSA 2.0, GSD 1.1 and CLI 1.1. At the OpenVAS developer conference #3, July 7-9 in Osnabrück, Germany, the feature set for OpenVAS-5 will take shape.

Availability

Source Code downloads are directly available from OpenVAS homepage: http://www.openvas.org
Binary installation packages: http://www.openvas.org/install-packages.html
Virtual Appliance: http://www.openvas.org/vm.htm

New features and changes

New: Report Format plugin framework. All previous reporting features were converted to plugins. The XML representation of a report is now the base for any plugin and thus consistency of reports is gained.

Report Format Plugins can be set active so that they appear in the selection lists. Selections can consider content types so that for example only the plugins with content type "text" are offered as email body.

It is possible to use parameters for the plugins so the user can adjust the behaviour of the Report Format to the individual preferences or needs.

A verification method allows to distribute signatures for valid plugins via the NVT Feed.

New default Report Format: TXT for simple text.
New default Report Format: LaTeX for LaTeX source.
New sample Report Format: Simple Bar Chart. Demonstrates how to use Gnuplot for graphical reports.
New sample Report Format: Simple Topo Plot. Demonstrates how to use Graphviz for graphical reports.
New sample Report Format: Simple Pie Chart. Demonstrates how to use PyChart for graphical reports.
New sample Report Format: Simple Map Plot. Demonstrates how to use MapServer and GDAL for graphical reports.
New sample Report Format: Sourcefire Host Input. Demonstrates that Report Formats can be used to build connectors.
New: Master-Slave mode. Any OpenVAS Manager can use one or many other OpenVAS Manager as slave to run scans. The whole scan task is transferred to the slave, results are continuously reported to the Master during scan process. After the scan is finished all data is removed from the slave.The master can also retrieve system reports from the slave and thus can collect the performance overview for all configured slaves.
New Escalator: HTTP GET. This allows for example to access text message (SMS) gateways or ticket management systems.
Extended Escalator: For email escalation it is now possible to select from configured Report Formats to be included in the email body.
Agents: A verification method was added. This allows to distribute signatures for valid agents via the NVT Feed.
Credentials: Can now be edited. This allows to change the login name or password without the need to create a new scan configuration.
Credentials: Auto-generated installer packages are now created on the fly. If the generators are improved, it is now easy to create an updated package for already existing credentials.
Targets: Credentials for SMB and SSH are now distinguished.
Targets: Various opportunities have been added to specify and combine IP ranges and ports.
Tasks: The task overview is delivered much faster now.
Reports: The report filtering is much faster now.
Performance: A fall-back performance report delivers some base data if no other tool is configured.
Web interface: Changed login mechanism from HTTP BasicAuth to session based authentication.
Scan behaviour: By default now only ports are scanned that are specified as part of the target.
No binary NVTs: The remaining binary NVTs are turned into built-in functionality. Binary plugins are (finally) no more supported by OpenVAS.
Network scan NVTs: Network-wide initial scans now posible.
Scan performance increased: Lower memory footprint (~10% more concurrent scans possible)
Scan Feature for VHosts: Preferences allow to specify VHosts.
Scanner: Command line options "--dump-cfg" and "--gen-config" are removed.
Scanner: Configuration file "openvassd.conf" not mandatory anymore.
Helper tool openvas-mkcert: New switches and does not create openvassd.conf.
OpenVAS is now compliant with the Filesystem Hierarchy Standard (FHS 2.3).
Consolidated default ports: Manager listens on 9390, Scanner on 9391, GSA on 9392 and Administrator on 9393.
OpenVAS build environment now consistently uses cmake and pkgconfig across all modules.
Compile-time hardening flags are now enabled by default across all modules.
All applications now consistently deliver output of --version compliant with the GNU Coding Standard.
OMP self-documentation: Part of the Managers' XML-based communication protocol OMP 2.0 is to deliver the full specification and documentation of the protocol itself (command "HELP"). It can be retrieved as XML-, RNC- or HTML representation. See here for online documentation: http://www.openvas.org/omp-2-0.html
OAP self-documentation: Part of the Administrators' XML-based communication protocol OAP 1.0 is to deliver the full specification and documentation of the protocol itself (command "HELP"). It can be retrieved as XML-, RNC- or HTML representation. See here for online documentation: http://www.openvas.org/oap-1-0.html
Extended Language Support: Dekstop client GSD now supports english, german and french.

Compatibility and migration

The OpenVAS NVT Feed will be extended with tests that take advantage of the network scan feature but fully keeps the behaviour for previous releases.Also the replacement methods for the former binary NVTs are compatible across OpenVAS 2 through 4.
The OpenVAS Manager has a migration option for updating an OpenVAS Manager 1.0 SQL database. But there is no support to downgrade the database back to 1.0.
Migration from OpenVAS 2.x/3.x: Several default file locations changed for the new OpenVAS Scanner. Installing OpenVAS-4 "ontop" of an older release will likely cause trouble because the old, and now only optional "openvassd.conf" forces wrong paths. Delete or move away that file before starting with OpenVAS-4.
OpenVAS Scanner communication protocol (OTP) remains compatible with the previous release, so the latest release of the old OpenVAS-Client still works.

Scareware: How Crime Pays

noreply@blogger.com (Originative) — Sat, 26 Feb 2011 01:53:00 -0800

Scareware is fraudulent software that uses deceptive advertising to trick users into believing they're infected with some variety of malware, then convinces them to pay money to protect themselves. The infection isn't real, and the software they buy is fake, too. It's all a scam.

One scareware operator sold "more than 1 million software products" at "$39.95 or more," and now has to pay $8.2 million to settle a Federal Trade Commission complaint.

Seems to me that $40 per customer, minus $8.20 to pay off the FTC, is still a pretty good revenue model. Their operating costs can't be very high, since the software doesn't actually do anything. Yes, a court ordered them to close down their business, but certainly there are other creative entrepreneurs that can recognize a business opportunity when they see it.

http://www.pcworld.com/businesscenter/article/217987alleged_scareware_vendors_to_pay_82_million_to_ftc.html

Bioencryption

noreply@blogger.com (Originative) — Sun, 20 Feb 2011 21:09:00 -0800

A group of students at the Chinese University in Hong Kong have figured out how to store data in bacteria. The article talks about how secure it is, and the students even coined the term "bioencryption," but I don't see any encryption. It's just storage.

In another article, one of the researchers claims: "Bacteria can't be hacked."

Why can't bacteria be hacked? If the storage system is attached to a network, it's just as vulnerable as anything else attached to a network. And if it's disconnected from any network, then it's just as secure as anything else disconnected from a network. The problem the U.S. diplomats had was authorized access to the WikiLeaks cables by someone who decided to leak them. No cryptography helps against that.

There is cryptography in the project: "In addition we have created an encryption module with the R64 Shufflon-Specific Recombinase to further secure the information."

If the group is smart, this will be some conventional cryptography algorithm used to encrypt the data before it is stored on the bacteria.

In any case, this is fascinating and interesting work. I just don't see any new form of encryption, or anything inherently unhackable.

The project:
The project:
http://2010.igem.org/Team:Hong_Kong-CUHK

Domodedovo Airport Bombing

noreply@blogger.com (Originative) — Wed, 16 Feb 2011 19:44:00 -0800

I haven't written anything about the suicide bombing at Moscow's Domodedovo Airport because I didn't think there was anything to say. The bomber was outside the security checkpoint, in the area where family and friends wait for arriving passengers. From a security perspective, the bombing had nothing to do with airport security. He could have just as easily been in a movie theater, stadium, shopping mall, market, or anywhere else lots of people are crowded together with limited exits. The large death and injury toll indicates the bomber chose his location well.

I've often written that security measures that are only effective if the implementers guess the plot correctly are largely wastes of money -- at best they would have forced this bomber to choose another target -- and that our best security investments are intelligence, investigation, and emergency response. This latest terrorist attack underscores that even more. "Critics say" that the TSA couldn't have detected this sort of attack. Of course; the TSA can't be everywhere. And that's precisely the point.

Many reporters asked me about the likely U.S. reaction. I don't know; it could range from "Moscow is a long way off and that doesn't concern us" to "Oh my god we're all going to die!" The worry, of course, is that we will need to "do something," even though there is no "something" that should be done.I was interviewed by the Esquire politics blog about this. I'm not terribly happy with the interview; I was rushed and sloppy on the phone.

Me on terrorism security,

http://www.schneier.com/essay-292.html

"Critics say":

http://abcnews.go.com/Blotter/tsa-detect-moscow-style-attack-critics/story?id=12752581

or http://tinyurl.com/6esrgxl

My Esquire interview:

http://www.esquire.com/blogs/politics/moscow-airport-bruce-schneier-5022769

or http://tinyurl.com/45fea6q

Societal Security

noreply@blogger.com (Originative) — Wed, 16 Feb 2011 19:42:00 -0800

Humans have a natural propensity to trust non-kin, even strangers. We do it so often, so naturally, that we don't even realize how remarkable it is. But except for a few simplistic counterexamples, it's unique among life on this planet. Because we are intelligently calculating and value reciprocity (that is, fairness), we know that humans will be honest and nice: not for any immediate personal gain, but because that's how they are. We also know that doesn't work perfectly; most people will be dishonest some of the time, and some people will be dishonest most of the time. How does society -- the honest majority -- prevent the dishonest minority from taking over, or ruining society for everyone? How is the dishonest minority kept in check? The answer is security -- in particular, something I'm calling societal security.

I want to divide security into two types. The first is individual security. It's basic. It's direct. It's what normally comes to mind when we think of security. It's cops vs. robbers, terrorists vs. the TSA, Internet worms vs. firewalls. And this sort of security is as old as life itself or -- more precisely -- as old as predation. And humans have brought an incredible level of sophistication to individual security.

Societal security is different. At the tactical level, it also involves attacks, countermeasures, and entire security systems. But instead of A vs. B, or even Group A vs. Group B, it's Group A vs. members of Group A. It's security for individuals within a group from members of that group. It's how Group A protects itself from the dishonest minority within Group A. And it's where security really gets interesting.

There are many types -- I might try to estimate the number someday -- of societal security systems that enforce our trust of non-kin. They're things like laws prohibiting murder, taxes, traffic laws, pollution control laws, religious intolerance, Mafia codes of silence, and moral codes. They enable us to build a society that the dishonest minority can't exploit and destroy. Originally, these security systems were informal. But as society got more complex, the systems became more formalized, and eventually were embedded into technologies.

James Madison famously wrote: "If men were angels, no government would be necessary." Government is just the beginning of what wouldn't be necessary. Currency, that paper stuff that's deliberately made hard to counterfeit, wouldn't be necessary, as people could just keep track of how much money they had. Angels never cheat, so nothing more would be required. Door locks, and any barrier that isn't designed to protect against accidents, wouldn't be necessary, since angels never go where they're not supposed to go. Police forces wouldn't be necessary.
Armies: I suppose that's debatable. Would angels -- not the fallen ones -- ever go to war against one another? I'd like to think they would be able to resolve their differences peacefully. If people were angels, every security measure that isn't designed to be effective against accident, animals, forgetfulness, or legitimate differences between scrupulously honest angels could be dispensed with.

Security isn't just a tax on the honest; it's a very expensive tax on the honest. It's the most expensive tax we pay, regardless of the country we live in. If people were angels, just think of the savings! It wasn't always like this. Security -- especially societal security -- used to be cheap. It used to be an incidental cost of society.

In a primitive society, informal systems are generally good enough. When you're living in a small community, and objects are both scarce and hard to make, it's pretty easy to deal with the problem of theft. If Alice loses a bowl, and at the same time, Bob shows up with an identical bowl, everyone knows Bob stole it from Alice, and the community can then punish Bob as it sees fit. But as communities get larger, as social ties weaken and anonymity increases, this informal system of theft prevention -- detection and punishment leading to deterrence -- fails.
As communities get more technological and as the things people might want to steal get more interchangeable and harder to identify, it also fails. In short, as our ancestors made the move from small family groups to larger groups of unrelated families, and then to a modern form of society, the informal societal security systems started failing and more formal systems had to be invented to take their place. We needed to put license plates on cars and audit people's tax returns.

We had no choice. Anything larger than a very primitive society couldn't exist without societal security.I'm writing a book about societal security. I will discuss human psychology: how we make security trade-offs, why we routinely trust
non-kin (an evolutionary puzzle, to be sure), how the majority of us are honest, and that a minority of us are dishonest. That dishonest minority are the free riders of societal systems, and security is how we protect society from them. I will model the fundamental trade-off of societal security -- individual self-interest vs. societal group interest -- as a group prisoner's dilemma problem, and use that metaphor to examine the basic mechanics of societal security. A lot falls out of this: free riders, the Tragedy of the Commons, the subjectivity of both morals and risk trade-offs.

Using this model, I will explore the security systems that protect -- and fail to protect -- market economics, corporations and other organizations, and a variety of national systems. I think there's a lot we can learn about security by applying the prisoner's dilemma model, and I've only recently started. Finally, I want to discuss modern changes to our millennia-old systems of societal security. The
Information Age has changed a number of paradigms, and it's not clear that our old security systems are working properly now or will work in the future. I've got a lot of work to do yet, and the final book might look nothing like this short outline. That sort of thing happens.

Tentative title: The Dishonest Minority: Security and its Role in Modern Society. I've written several books on the how of security. This book is about the why of security.

I expect to finish my first draft before Summer. Throughout 2011, expect to see bits from the book here. They might not make sense as a coherent whole at first -- especially because I don't write books in strict order -- but by the time the book is published, it'll all be part of a coherent and (hopefully) compelling narrative.

And if I write fewer extended blog posts and essays in the coming year,
you'll know why.

WiMAX Security Issues and Threats

noreply@blogger.com (Originative) — Thu, 20 Jan 2011 05:42:00 -0800

If the goal of the 802.16 standards technology is to provide for a wireless broadband carrier network, then you can bet that security is no joke. In order to compete at all with existing broadband cable or DSL providers, the resulting WiMAX network must be at least as secure.

The IEEE and the WiMAX Forum are painfully aware of the lack of security provided for in the early development of the 802.11 WiFi standard, and have taken measures to ensure that WiMAX incorporates a robust security environment as its minimum.

It can be said today that the committee has succeeded in setting a standard of security comparable to the cable networks. WiMAX security supports both DES3 and AES encryption standards, and requires a dedicated security processor be present on base stations. End to end authentication is provided for using PKM-AES, a transport layer security method using public key encryption, adopted from the DOCSIS BPI+ protocol.

Still, there are two questions that need to be asked about WiMAX security:

Is it enough? That depends on who you are talking to.
What do we have to fear? (Besides fear itself)

WiMAX Security Threats

WiMAX is a network that is based on the Internet Protocol, and wireless or not, it is subject to the vulnerabilities of any IP network. A denial of service (DOS) attack by a malicious hacker can cripple any network, and precautions such as vigilant intrusion detection must be taken by IT professionals.
Certain applications like VoIP come with their own vulnerabilities. VoIP security threats can take the form of eavesdropping, session hijacking, SPIT, and spoofing of IP addresses, each of which must be guarded against.

A Rouge Base Station in a WiMAX network will impersonate a legitimate base through spoofing, and can hijack sessions and gain access to sensitive information.

Most of these attacks are not new, but variations on old themes that security professionals, appliance, and software developers have long been in the business of dealing with. As WiMAX is an emerging technology, wide spread hacking has not really occurred, but the opportunity is there, and the WiMAX service provider should know it, and prepare.

Locking Down WiMAX

Whether or not a WiMAX network is secure enough, as mentioned before, depends on who you are asking. Different people and organizations require different levels of security. The 802.16 standards are basically that, a standard from which to start from. It is incumbent upon device manufacturers to build on the base security standards, and on the carrier network to offer the appropriate level of security for the appropriate cost.

For example, a carrier may offer a CPE (wireless modem) to the residential consumer that is a no frills device, suitable for residential access. The standards are there, comparable to a cable network, and the consumer is well protected at an affordable price. However, that same CPE would not be suitable for a health care provider, where conforming to the stringent HIPPA regulations is a must. In this case the carrier would offer a more expensive CPE with a premium feature set to allow for more robust security requirements. Both the residential consumer and the health care provider are using the same network, albeit at different costs, each with the appropriate level of security. Not unlike putting a firewall between the modem and the network.

Hardware vendors may clamor that WiMAX is not secure and that there product will give you a higher level of protection. This is a good thing in that it promotes competition, leads to robust technological development, and in the end, lower prices for consumers.

User Location Via XSS

noreply@blogger.com (Originative) — Tue, 18 Jan 2011 20:21:00 -0800

Samy Kamkar, in an incredibly interesting session at Black Hat titled "How I Met Your Girlfriend," highlighted new types attacks executed from the Web. An interesting hack he demonstrated, was the ability to extract extremely accurate geo-location information from a Web browser, while not using any IP geo-location data.

Kamkar, by convincing the victim to visit his malicious Web site, used remote JavaScript and AJAX to acquire a routers MAC address. When the unsuspecting user visited his malicious Web site, JavaScript remotely scanned for the type of router used, accessed the routers MAC address and sent it directly to him. From there, he was able to utilize Google Street View data to determine the location of a router – in his case, accurate within 30 feet.

Kamkar, author of an XSS worm that hit MySpace and generated over 1mm friends for him in less than 24 hours, demonstrates this hack in the video below.

Whole Disk Encryption

noreply@blogger.com (Originative) — Mon, 17 Jan 2011 22:16:00 -0800

Whole disk encryption is a process in which every bit of data that is on a disk is encrypted using either software or hardware. This is meant to ensure that there is no unauthorized attempts at accessing the data being stored. Typically, a whole disk encryption means that most everything on the disk is encrypted including the software that does the encryption. However, the master boot record (MBR) must be left unencrypted. This means that part of the disk is unsecured. However, there are types of hardware-based whole disk encryption that make it possible for the entire boot disk, including the MBR, to be encrypted. This guarantees maximum security.

Benefits of Whole Disk Encryption

The typical question that comes up when discussing encryption is whether to go with file/folder encryption or to go with the whole disk encryption. There are a series of benefits that explain why whole disk encryption is the route to go.

Nearly everything gets encrypted. This includes the swap space and temporary files that can reveal very important data that one might not want revealed. People don't think to manually encrypt these files.
There is no need to manually encrypt files. The individual does not have to show discretion as to which files should be encrypted. Everything gets encrypted.
Data destruction is immediate. Destroying the key makes the data that is contained completely useless.
There is support for the pre-boot authentication which serves as an extension of the BIOS.

Security Concerns

The primary issue with a whole disk encryption is that, despite the fact the entire drive is encrypted, the operating system still needs to save the key to access the drive. Without the key, the computer has no access to that disk. The typical vulnerability for a whole disk encryption is from a cold boot attack. What this attack relies on is the fact that it can take individual data bits up to several minutes to degrade after the power has been removed. That means that the contents of memory can be dumped by cold-booting the machine before the memory has degraded. If the memory has degraded, though, the cold-booting is not successful.

Hardware vs. Software

Typically, it is better to have a hardware-based whole disk encryption than a software-based whole disk encryption. The reason for this is because the hardware-based is faster. Since it is built right into the hardware, it can immediately encrypt without having to access the software. More importantly, since there is no access of software, there is typically no overhead for the hard disk drive or the CPU which is beneficial when discussing efficiency.

Stuxnet How It Infects PLCs

noreply@blogger.com (Originative) — Sun, 16 Jan 2011 19:39:00 -0800

A demonstration how W32.Stuxnet can compromise a Programmable Logic Controller (PLC), resulting in unintended consequences for the machines connected to it.

Security in 2020

noreply@blogger.com (Originative) — Sun, 16 Jan 2011 10:12:00 -0800

There's really no such thing as security in the abstract. Security can only be defined in relation to something else. You're secure from something or against something. In the next 10 years, the traditional definition of IT security -- that it protects you from hackers, criminals, and other bad guys -- will undergo a radical shift. Instead of protecting you from the bad guys, it will increasingly protect businesses and their business models from you.

Ten years ago, the big conceptual change in IT security was *deperimeterization*. A wordlike grouping of 18 letters with both a prefix and a suffix, it has to be the ugliest word our industry invented. The concept, though -- the dissolution of the strict boundaries between the internal and external network -- was both real and important.

There's more deperimeterization today than there ever was. Customer and partner access, guest access, outsourced e-mail, VPNs; to the extent there is an organizational network boundary, it's so full of holes that it's sometimes easier to pretend it isn't there. The most important change, though, is conceptual. We used to think of a network as a fortress, with the good guys on the inside and the bad guys on the outside, and walls and gates and guards to ensure that only the good guys got inside. Modern networks are more like cities, dynamic and
complex entities with many different boundaries within them. The access, authorization, and trust relationships are even more complicated.

Today, two other conceptual changes matter. The first is *consumerization*. Another ponderous invented word, it's the idea that consumers get the cool new gadgets first, and demand to do their work on them. Employees already have their laptops configured just the way they like them, and they don't want another one just for getting through the corporate VPN. They're already reading their mail on their BlackBerrys or iPads. They already have a home computer, and it's cooler than the
standard issue IT department machine. Network administrators are increasingly losing control over clients.

This trend will only increase. Consumer devices will become trendier, cheaper, and more integrated; and younger people are already used to using their own stuff on their school networks. It's a recapitulation of the PC revolution. The centralized computer center concept was shaken by people buying PCs to run VisiCalc; now it's iPads and Android smart phones.

The second conceptual change comes from cloud computing: our increasing tendency to store our data elsewhere. Call it *decentralization*: our email, photos, books, music, and documents are stored somewhere, and accessible to us through our consumer devices. The younger you are, the more you expect to get your digital stuff on the closest screen available. This is an important trend, because it signals the end of the hardware and operating system battles we've all lived with. Windows vs. Mac doesn't matter when all you need is a web browser. Computers become temporary; user backup becomes irrelevant. It's all out there somewhere -- and users are increasingly losing control over their data.

During the next 10 years, three new conceptual changes will emerge, two of which we can already see the beginnings of. The first I'll call *deconcentration*. The general-purpose computer is dying and being replaced by special-purpose devices. Some of them, like the iPhone, seem general purpose but are strictly controlled by their providers. Others, like Internet-enabled game machines or digital cameras, are truly special purpose. In 10 years, most computers will be small, specialized, and ubiquitous.

Even on what are ostensibly general-purpose devices, we're seeing more special-purpose applications. Sure, you could use the iPhone's web browser to access the *New York Times* website, but it's much easier to use the NYT's special iPhone app. As computers become smaller and cheaper, this trend will only continue. It'll be easier to use special-purpose hardware and software. And companies, wanting more control over their users' experience, will push this trend.

The second is *decustomerization* -- now I get to invent the really ugly words -- the idea that we get more of our IT functionality without any business relationship. We're all part of this trend: every search engine gives away its services in exchange for the ability to advertise. It's not just Google and Bing; most webmail and social networking sites offer free basic service in exchange for advertising, possibly with premium services for money. Most websites, even useful ones that take the place of client software, are free; they are either run altruistically or to facilitate advertising.

Soon it will be hardware. In 1999, Internet startup FreePC tried to make money by giving away computers in exchange for the ability to monitor users' surfing and purchasing habits. The company failed, but computers have only gotten cheaper since then. It won't be long before giving away netbooks in exchange for advertising will be a viable business. Or giving away digital cameras. Already there are companies that give away long-distance minutes in exchange for advertising. Free cell phones aren't far off. Of course, not all IT hardware will be free. Some of the new cool hardware will cost too much to be free, and there will always be a need for concentrated computing power close to the user -- game systems are an obvious example -- but those will be the exception. Where the hardware costs too much to just give away, however, we'll see free or highly subsidized hardware in exchange for locked-in service; that's already the way cell phones are sold.

This is important because it destroys what's left of the normal business relationship between IT companies and their users. We're not Google's customers; we're Google's product that they sell to their customers. It's a three-way relationship: us, the IT service provider, and the advertiser or data buyer. And as these noncustomer IT relationships proliferate, we'll see more IT companies treating us as products. If I buy a Dell computer, then I'm obviously a Dell customer; but if I get a Dell computer for free in exchange for access to my life, it's much less obvious whom I'm entering a business relationship with. Facebook's continual ratcheting down of user privacy in order to satisfy its actual customers -- the advertisers -- and enhance its revenue is just a hint of what's to come.

The third conceptual change I've termed *depersonization*: computing that removes the user, either partially or entirely. Expect to see more software agents: programs that do things on your behalf, such as prioritize your email based on your observed preferences or send you personalized sales announcements based on your past behavior. The "people who liked this also liked" feature on many retail websites is just the beginning. A website that alerts you if a plane ticket to your favorite destination drops below a certain price is simplistic but useful, and some sites already offer this functionality. Ten years won't be enough time to solve the serious artificial intelligence problems required to fully realize intelligent agents, but the agents of that time will be both sophisticated and commonplace, and they'll need less direct input from you.

Similarly, connecting objects to the Internet will soon be cheap enough to be viable. There's already considerable research into Internet-enabled medical devices, smart power grids that communicate with smart phones, and networked automobiles. Nike sneakers can already communicate with your iPhone. Your phone already tells the network where you are. Internet-enabled appliances are already in limited use, but soon they will be the norm. Businesses will acquire smart HVAC units, smart elevators, and smart inventory systems. And, as short-range communications -- like RFID and Bluetooth -- become cheaper, everything becomes smart.

The "Internet of things" won't need you to communicate. The smart appliances in your smart home will talk directly to the power company. Your smart car will talk to road sensors and, eventually, other cars. Your clothes will talk to your dry cleaner. Your phone will talk to vending machines; they already do in some countries. The ramifications of this are hard to imagine; it's likely to be weirder and less orderly than the contemporary press describes it. But certainly smart objects will be talking about you, and you probably won't have much control over what they're saying.

One old trend: deperimeterization. Two current trends: consumerization and decentralization. Three future trends: deconcentration, decustomerization, and depersonization. That's IT in 2020 -- it's not under your control, it's doing things without your knowledge and consent, and it's not necessarily acting in your best interests. And this is how things will be when they're working as they're intended to work; I haven't even started talking about the bad guys yet.

That's because IT security in 2020 will be less about protecting you from traditional bad guys, and more about protecting corporate business models from you. Deperimeterization assumes everyone is untrusted until proven otherwise. Consumerization requires networks to assume all user devices are untrustworthy until proven otherwise. Decentralization and deconcentration won't work if you're able to hack the devices to run unauthorized software or access unauthorized data. Decustomerization won't be viable unless you're unable to bypass the ads, or whatever the vendor uses to monetize you. And depersonization requires the autonomous devices to be, well, autonomous.

In 2020 -- 10 years from now -- Moore's Law predicts that computers will be 100 times more powerful. That'll change things in ways we can't know, but we do know that human nature never changes. Cory Doctorow rightly pointed out that all complex ecosystems have parasites. Society's traditional parasites are criminals, but a broader definition makes more sense here. As we users lose control of those systems and IT providers gain control for their own purposes, the definition of "parasite" will shift. Whether they're criminals trying to drain your bank account, movie watchers trying to bypass whatever copy protection studios are using to protect their profits, or Facebook users trying to use the service without giving up their privacy or being forced to watch ads, parasites will continue to try to take advantage of IT systems. They'll exist, just as they always have existed, and -- like today -- security is going to have a hard time keeping up with them.

Welcome to the future. Companies will use technical security measures, backed up by legal security measures, to protect their business models. And unless you're a model user, the parasite will be you.