EDU Are Small Cities

In a general sense, universities are small cities with the services that are provided by such localities. For example, Virginia Tech provides similar services to its community that the town of Blacksburg provides to its citizens. A cybersecurity architecture has to encompass all of these service areas. 

Some of these services include:

• Power generation – VT has its own power generation plant that provides electrical power, A/C and heating to facilities on campus. The power generation plant also provide power to some segments of the town itself.

•  Law enforcement – As many EDUs do, VT has its own campus police department with full LE authority and powers as any other state law enforcement officers (LEO).

• Dining Services – what used to be the traditional dining hall facilities has evolved to a wide variety of food choices.

• A Cultural scene – VT provides a wide variety of music, theatre, lecture, film events that open to the community as well as the general public

•  Library – this seems odd but since VT is a public institution, its library is open to anyone regardless of their affiliation with the University.

• ·Medical services – student health services, counseling services, wellness services, adult day care services are some of the traditional medical services provided

•  Athletic – from intramural, extramural sports to NCAA sanctioned sports, VT offers a wide variety of athletic events that are open to the public.

• Educational – VT is its own “school system”.

Urban universities offer the same services listed above with the exception of the power plant but they do have a facilities management program. 

 Corporations that offer a wide variety of services to their employees face the same security issues.  As you can imagine, it's a challenge to balance the security requirements of each of these service areas.

World Full of Smart Gadgets

Internet Security: A World Full of Smart Gadgets

You’ve heard everyone talk about the “Internet of Things”, “smart cars”, “smart devices or gadgets”. This is just a description of the pervasiveness of computers in our everyday lives. These devices are now being connected to the Internet and this poses challenges to personal privacy and the security of the Internet.

Figure 1. Smart gadgets in a home (image by Steve Johnson, Jeff Durham BayArea News Group)

Figure 1 shows how pervasive these gadgets can become in our lives. Every room in a house will be impacted by this Internet of Things. 

What does this have to do with Virginia Tech? Well, today’s students show up on campus with at least 4-5 devices that need to be connected to the network. These include the University required computer, their smart phone, tablet, gaming consoles like Xbox, and usually a smart device like a smart TV or radio. Each of these devices is a specialized computer and unfortunately they’re not secured by the manufacturer. For example, printers, copiers and scanners have no passwords associated with them by default. Figure 1 shows how common household devices will be able to gather personal information (schedules, preferences, health) of the occupants. These devices can transmit that information to advertisers, manufacturers. 

Recently these types of devices have been taken over by hackers and used to attack other sites. Brian Krebs, a well known journalist, was the target of an internet DDOS attack that forced his www site offline for a number of days. This was in response to a series of articles he wrote about cyber criminals being captured. They retaliated by launching a massive denial of service attack against his www site. It's believed that many of the attacking hosts were “smart” gadgets. The new IoT botnet Mirai was used to launch a historically huge attack against Brian Kreb's site (https://krebsonsecurity.com/2016/10/source-code-for-iot-botnet-mirai-released/) and is guaranteed to cause mayhem on the net.

Security experts have been warning the community about the lack of security in Internet of Things (IoT)/smart gadgets. Unfortunately, someone else heeded the warnings and took advantage of this knowledge.

Stay tuned for more.

The Internet of Cows

Glenn Fink, a security researcher at Pacific Northwest Labs, did a presentation called the “Internet of Cows” where he showed how dairy farming has become an automated, internet accessible business process. He took  the discussion one step further by saying that cows make great human surrogates in the privacy debates surrounding IoT. He showed how data from almost every single biological process of a cow (health, reproduction, location, sounds) is monitored by IoT.  Analysis of herd data allows farmers to predict the health of a cow, the optimum time for reproduction and milk production. He maintained that cows don’t object to this type of management and therefore, this is why they are well suited to study the effects of intrusive monitoring. 

It was one of those presentations that makes you go "hmmmmm". The use of "biological" Internet of Things has been well established in the animal husbandry world. As Glenn stated, we're already moving in this direction with regard to human health monitoring. The privacy implications of such monitoring should concern most  of us these days. I've always said that I don't mind external sites collecting data about me as long as a) the default is opt-out where no data is sent out b) you tell me what you're going to do with my data c) you protect my data from unauthorized access.  Obviously, this isn't the norm these days. 

Hopefully, as more "fitness" IoT devices enter the market, people will start to demand their health info be safeguarded as much as possible.  More on this later....

I'm Back

Yes, it's been a while since I've posted something here. It's been a busy, crazy year. Here are some of the things we've been doing here at VA Tech. I'll be posting some blog entries with more details on each of the items. Consider this entry to be a "headlines" blog.

1. Stacy Kaye from Silverbull.co interviewed me about being a CISO. Her article can be found here
http://www.silverbull.co/a-day-in-the-life-of-a-ciso-virginia-tech/
I will warn you that the picture in the article is my official VT photo and doesn't reflect my usual attire :-)

2. MT6D - Moving Target IPv6 Defense. A series of research projects based on Matt Dunlop and Stephen Groat's research involving dynamic address switching as a defense against DDOS attacks in IPv6. Their original research has spun off a number of secondary MT6D research. Pretty neat and exciting stuff they did. Think radio frequency hopping but instead of hopping frequencies, we hop IPv6 addresses

3. Continuous Monitoring Update - an update on our evergoing continuous monitoring project

So keep in touch for more blogs coming up here and at http://www.securitycurrent.com/en/writers/randy-marchany

Monitor First - The Origin

As you know, I've been a proponent of Continuous Monitoring (CM) not to be confused with the  Federal  Government's CDM (Continuous Diagnostic Mitigation) program.  We've always assumed intruders are in our network so we've been looking for these intruders by monitoring outbound traffic.

I'm reposting another blog by grecs which is posted at the NovaInfoSec blog. Grecs' blog on the origins of "Monitor first" is a great article on how this concept took hold. So, here's the full blog article by Grec posted on 6/25/2015.

---------------
"Monitor First - The Origins" by grecs posted 6/25/2015

Late last year @taosecurity wrote an article that questioned spending resources on a “pen test and fix” cycle rather than monitoring for intruders that may already be in your networks. The last sentence of the post not only emphasized his theme well but also alluded to an article written by Bruce Schneier that originally stressed “monitoring first.”

I still believe that the two best words ever uttered by Bruce Schneier were “monitor first,” and I worry that organizations like those in this article are patching holes while intruders maneuver around them within the compromised network.

I searched around a bit for this statement and found a copy in an old edition of Cryptogram from way back in 2001. You can find the original article here but the first few paragraphs alone make the case of monitoring first.

You have a safe in a dilapidated building, and you need to secure it. What’s the first thing you do? Inventory the safe? Assess the security of the building? Install better locks on the doors and bars on the windows? Probably not. The first thing you do, as quickly as possible, is alarm the safe. Once the safe is being monitored, you can then afford the time and attention needed to inventory the stock, analyze the environment, and improve the security. Without monitoring, you’re vulnerable until your security is perfect. If you monitor first, you’re immediately more secure.
Network security has this backwards. Companies see monitoring as something to do after they have their security products in place. First they develop a security policy. Then they do a vulnerability analysis. Then they install a firewall, and maybe an intrusion detection system. And finally they think about monitoring. Rationally, this makes no sense.
Monitoring should be the first step in any network security plan. It’s something that a network administrator can do today to provide immediate value. Policy analysis and vulnerability assessments take time, and don’t actually improve a network’s security until they’re acted upon. Installing security products improves security, but only if they are installed correctly and in the right places. How does a CIO know what products to install, and whether they are actually working — in the actual corporate environment, not as they worked in the lab? The only way he can know is to monitor. Monitoring ensures that security products are working properly.

Monitoring first is just common sense. This practice not only allows organizations to find the threats lurking in their networks sooner but it also permits them to establish baseline metrics from which they can measure improvements in their security posture as further investments are made. And per Schneier “monitoring” does not even necessarily mean going out a buying anything initially. Start simple with logs and other data you already have (e.g., from DNS, servers, proxies, and network devices) and grow out from there.
--------

I encourage you to read both @taosecurity and Bruce Schneier's articles list in the above post.