Solve a Security Problem Instead By Ivan Ristic 1 / 35 Stop - PowerPoint PPT Presentation

Stop complaining and solve a security problem instead Stop complaining and… Solve a Security Problem Instead By Ivan Ristic 1 / 35

Stop complaining and solve a security problem instead uilder 1) ModSecurity I am a compulsive b I am a compulsiv e builder (open source web application firewall), 2) Apache Security (O’Reilly, 2005), 3) SSL Labs (research and assessment platform), 4) ModSecurity Handbook (Feisty Duck, 2010) 2 / 33 2 / 33 2 / 35

Stop complaining and solve a security problem instead Message for today Software is 3 / 33 3 / 33 universally insecure, and we are not doing enough to make things right. 3 / 35

Stop complaining and solve a security problem instead Morris Morris Worm orm In November 1998, the first computer worm infected about 10% of the Internet 4 / 33 4 / 33 (about 6,000 servers). e worm was written by Robert T. Morris. (e worm source code is available from www.foo.be/docs-free/morris-worm/.) 4 / 35

Stop complaining and solve a security problem instead e Morris Worm spread using password cracking , server 5 / 33 5 / 33 misconfiguration , buffer overflows , and remote code execution . 5 / 35

Stop complaining and solve a security problem instead Same as today, eh? We haven’t seen 6 / 33 6 / 33 an improvement in computer security in the 22 years since the first worm. 6 / 35

Stop complaining and solve a security problem instead In fact, the situation has become much 7 / 33 7 / 33 worse because of the wide adoption of computers and the Internet. 7 / 35

Stop complaining and solve a security problem instead Why? Four reasons: 1) ignorance , 2) convenience , 8 / 33 8 / 33 3) economics , and 4) no single point of control , but ultimately because security is not important to us . 8 / 35

Stop complaining and solve a security problem instead 9 / 33 9 / 33 Software is a market for lemons . 9 / 35

Stop complaining and solve a security problem instead George A. Akerlof e Market for “Lemons”: 10 / 33 10 / 33 Quality Uncertainty and the Market Mechanism 10 / 35

Stop complaining and solve a security problem instead “[…] the presence of people who wish 11 / 33 11 / 33 to pawn bad wares as good wares tends to drive out the legitimate business ”. 11 / 35

Stop complaining and solve a security problem instead Security comes from making sensible decisions, thinking things trough, 12 / 33 12 / 33 taking your time… It is boring and it doesn’t make anyone rich . 12 / 35

Stop complaining and solve a security problem instead Open source projects just want to succeed, companies want to make 13 / 33 13 / 33 profit, people want to get things done. Security is standing in everyone’s way. 13 / 35

Stop complaining and solve a security problem instead Only one solution long-term: make the 14 / 33 14 / 33 parties involved accountable for the quality. But we are probably not ready yet. 14 / 35

Stop complaining and solve a security problem instead Self-certi Self-certifi fication cation Could help us focus on those who really should be liable. 15 / 33 15 / 33 ( e Software Facts label taken from Jeff Williams’s talk at AppSec Europe 2005. ) 15 / 35

Stop complaining and solve a security problem instead How to… really fix security issues Design platforms, libraries, and 16 / 33 16 / 33 components in such a way that vulnerabilities cannot exist. en use them. 16 / 35

Stop complaining and solve a security problem instead Start small Do one thing, no 17 / 33 17 / 33 matter how small. Repeat. 17 / 35

Stop complaining and solve a security problem instead Kaizen Philosophy of 18 / 33 18 / 33 continuous improvement. 18 / 35

Stop complaining and solve a security problem instead Kaizen Continuous small 19 / 33 19 / 33 improvements will yield large compound improvement over time . 19 / 35

Stop complaining and solve a security problem instead Start small In your current 20 / 33 20 / 33 project, make all new work secure. 20 / 35

Stop complaining and solve a security problem instead Start small In your next project, 21 / 33 21 / 33 replace as many insecure components and practices as possible. 21 / 35

Stop complaining and solve a security problem instead Start small ink about how to 22 / 33 22 / 33 solve a known security problem. ink some more next week. Help solve it. 22 / 35

Stop complaining and solve a security problem instead Start small Reach out and inspire 23 / 33 23 / 33 someone else to do start small. 23 / 35

Stop complaining and solve a security problem instead Start small Find an influential 24 / 33 24 / 33 person. Inspire her. 24 / 35

Stop complaining and solve a security problem instead Start small Become an influential person. Join a popular open source 25 / 33 25 / 33 project, or an important company. Change the world. 25 / 35

Stop complaining and solve a security problem instead Summary What we can do: 1) change ourselves, 2) contribute to 26 / 33 26 / 33 the body of knowledge, 3) inspire others, and 4) make a difference. 26 / 35

Stop complaining and solve a security problem instead Example We need to transition to 27 / 33 27 / 33 a world without plain-text protocols. How? Start by fixing SSL. 27 / 35

Stop complaining and solve a security problem instead Example: Fixing SSL (1) Perf erformance ormance 1) Improve protocols to address latency 28 / 33 28 / 33 issues, 2) major sites support improvements, 3) one browser gets a performance edge, 4) o ther browsers follow. Google is already doing this, and we should help them. 28 / 35

Stop complaining and solve a security problem instead Example: Fixing SSL (2) No support f No supp ort for modern or modern TLS features TLS features 1) Realise that 29 / 33 29 / 33 the underlying libraries are lacking, 2) understand why, 3) fund development, and 4) continue funding development . 29 / 35

Stop complaining and solve a security problem instead Example: Fixing SSL (3) Bad con Bad confi figuration guration 1) Raise awareness (but that won’t 30 / 33 30 / 33 work) , 2) target library developers to drop obsolete features, 3) target vendors to ship with secure defaults 30 / 35

Stop complaining and solve a security problem instead Example: Fixing SSL (4) Virtual SSL hosting Virtual SSL hosting 1) Realise that we won’t get virtual SSL hosting until Windows XP is retired, 2) put pressure on 31 / 33 31 / 33 Microsoft to change their mind, 3) find one person at Microsoft who can change things. 31 / 35

Stop complaining and solve a security problem instead Example: Fixing SSL (5) Certi Certifi ficate authority trust issues cate authority trust issues 1) Wait for a wide 32 / 33 32 / 33 adoption of DNSSEC, 2) put certificates into DNS, and 3) improve browser user interfaces. 32 / 35

Stop complaining and solve a security problem instead Example: Fixing SSL (6) Plain-te Plain-text supp xt support issues ort issues 1) Use SRV records to enable sites to opt-out from supporting HTTP, then 33 / 33 33 / 33 2) support SRV records in web browsers, and 3) use Strict Transport Security in the meantime. 33 / 35

Stop complaining and solve a security problem instead Message for today Do one 34 / 33 34 / 33 thing, no matter how small. Repeat. 34 / 35

Stop complaining and solve a security problem instead Thank y ou! The slides will be available for download from http://blog.iv http://blog.ivanristic.com anristic.com 35 / 35