Securing the Internet
Over Spring break I was fortunate to receive an invitation to the exclusive CERT (Computer Emergency Response Team) 2009 Technical Symposium. The symposium was held in celebration of the twentieth anniversary of CERT but the main theme of the symposium was an examination of the internet, how the choices made just over 20 years ago have resulted in a huge security mess and what we can do about it today to avert the utter destruction of our modern way of life. I wish I was exaggerating but the internet is rapidly becoming the exclusive means for sharing and managing the world’s data. The world’s economy is following suit which heightens the need for security even more. Speakers at the symposium included Vinton Cerf (sometimes known as "The Father of the Internet"), Scott Charney (VP for Microsoft’s Trustworthy Computing Division), Lawrence Roberts (invented packet switching), Steve Crocker (invented "Request for Comments"), Paul Mockapetris (invented DNS), and many other brilliant people who have been instrumental in creating and defining the internet. Each speaker brought slightly different experiences to bear but everyone had the same message: if we don’t do something to secure the internet soon, something very, very bad will happen.
Once the internet became a public entity things changed. Slowly, the community of trust that kept everything together began to unravel. It started with news group flame wars. Shortly after viruses started showing up. There was even some direct hacking, albeit primarily by misled white hat hackers trying to help. Then on November 2, 1988 the Morris Worm was released by a researcher from MIT and within 72 hours most of DARPANET was taken offline by the resulting accidental denial-of-service attack. The community of trust that kept the internet running was permanently shattered.
CERT was created to deal with the problems that resulted from the world’s first denial-of-service attack. While CERT’s mission is noble and its function critical to dealing with all the threats faced on the internet today, CERT is not the panacea required to save the world from the ever increasing internet threats coming from all angles in the form of botnet armies, distributed denial-of-service-attacks, and targeted attacks by sophisticated hackers motivated purely by profit. The main problem is that CERT, by nature, is a reactive organization put in place to respond to emergencies as they happen.
As Vinton Cerf pointed out at the symposium, "the internet is always under attack. It’s not enough to respond to each of the different incidents as they happen. Reactivity is not enough." To save the world, we need to proactively address the security holes that were originally designed into the internet.
One of the easiest and most significant things we can do is take humans out of the security loop. It’s been proven time and again that people don’t follow instructions for securing systems. Both John Gilligan and Vinton Cerf stated that improperly configured software accounted for over 80% of attacks on the internet. Fix this problem and we’ve essentially removed 80% of cyber security threats. Fixing the way we identify ourselves online (i.e. passwords) is another easy way to take humans out of the security loop. A recurring theme from most speakers but most prominently discussed by Scott Charney was redefining identity online. There are solutions that can work now to solve each of these problems.
It turns out that fixing the improper configuration problem is easy but it’s going to be a difficult sell. The basic idea is that a computer or device has to start with a good configuration and then control mechanisms have to be put in place to prevent the configuration from getting hosed. Some vendors such as Apple, Tivo, and Blackberry are already doing a great job at keeping their device configurations under control. The trade-off for security is going to be freedom (modifiability if you prefer quality attributes). In exchange for a usable, safe, and enjoyable internet experience that even your grandmother can handle you have to give up the ability to tweak anything you want in the system. If iPod, iPhone, Tivo, and Blackberry sales are any indicator, people are willing to exchange freedom for something that just works.
Is it really fair to compare devices such as phones and PDAs with full blown computers? Absolutely. The key phrase is "Internet Enabled Device." An iPhone or Tivo can be hijacked and recruited into a botnet army just as easily as a standard desktop PC. If even only 1% of the more than 4 billion mobile phones in use throughout the world were compromised, that would make 40 million bots ready to unleash mountains of spam and unending DDoS attacks. The only reason this doesn’t happen is because mobile devices are effectively locked down to prevent such compromises from occurring.
With regards to passwords, I hate to say it but I think the Department of Defense is actually on the right track. Every DoD employee and contractor is issued what is known as a Common Access Card (CAC), an ID card attached to a digital identification certificate issued by a third party authority that has verified that the person to whom the certificate was issued is indeed that person. Both Vinton Cerf and Scott Charney were very clear that online identity can only be solved by combining something you know, usually a password, with something you have, a physical thing. This something you have could be a digital identification certificate issued by an authority.
While it would be awesome to issue CACs to every citizen in the United States, perhaps attached to their driver’s licenses as Charney suggested, a staged success approach is possible. PayPal has taken the initiative with a hardware device called Security Key. Security Key is small enough to fit on a keychain and it generates a secret token (in this case a string of numbers) every thirty seconds. When you purchase through PayPal you enter your username, password, and the token shown on the device. Even if you accidentally gave this information to a phishing website, the token will be worthless after 30 seconds protecting your online wallet from fraud.
Though Vinton Cerf didn't know the first thing about what I was talking about when I asked him about it, I see a lot of potential with OpenId. OpenId is a protocol that provides something akin to a universal password that you can use to access thousands of websites and, with a little more work, could solve the identification problem across the internet. First, OpenId providers would need to take on the role of verifying user’s real life identities and connecting the physical identity with the digital identity. Second, OpenId providers have to offer some kind of physical verification when logging in, the something you have. This could be in the form of a CAC, something biometric like a fingerprint reader, or even something as simple as PayPal’s Security Key. In my opinion, OpenId is poised to become the third-party identification authority the world needs.
By the end of the second day of the symposium I was left with more questions than answers and I am completely convinced that there will be a cyber security failure of a magnitude we have not yet seen in the near future. I’m not suggesting that everyone start stocking canned goods in the cellar, but now is the time to proactively start working for change. For as much flack as Microsoft has taken over the years, they seem to be on the forefront of effecting change both in terms of technology and public policy. It’s difficult to know where to start, but Microsoft’s Trustworthy Computing resources are both comprehensive and practical. The knowledge to fix the problems seems to be out there, the trick is motivating the world to change.
First, a little history
Security was never considered when the internet was originally conceived. I guess that’s not entirely accurate, security was considered but quickly dismissed in favor of "the smallest set of tools that would give us the largest set of possibilities for the future," according to Mockapetris. Considering the original operating environment, the closed ARPANET/DARPANET, it makes sense that security was traded in favor of other quality attributes such as performance, reliability, and modifiability. In the early 1980s, hosts numbered in the hundreds and there was an established and respected community of trust among the fraternity of hosts.Once the internet became a public entity things changed. Slowly, the community of trust that kept everything together began to unravel. It started with news group flame wars. Shortly after viruses started showing up. There was even some direct hacking, albeit primarily by misled white hat hackers trying to help. Then on November 2, 1988 the Morris Worm was released by a researcher from MIT and within 72 hours most of DARPANET was taken offline by the resulting accidental denial-of-service attack. The community of trust that kept the internet running was permanently shattered.
CERT was created to deal with the problems that resulted from the world’s first denial-of-service attack. While CERT’s mission is noble and its function critical to dealing with all the threats faced on the internet today, CERT is not the panacea required to save the world from the ever increasing internet threats coming from all angles in the form of botnet armies, distributed denial-of-service-attacks, and targeted attacks by sophisticated hackers motivated purely by profit. The main problem is that CERT, by nature, is a reactive organization put in place to respond to emergencies as they happen.
As Vinton Cerf pointed out at the symposium, "the internet is always under attack. It’s not enough to respond to each of the different incidents as they happen. Reactivity is not enough." To save the world, we need to proactively address the security holes that were originally designed into the internet.
Short Term Solutions
Fixing the internet is an architectural problem. It’s impossible to focus on a single layer of the protocol stack to make the internet more secure. Each layer has different kinds of vulnerabilities and each layer can be exploited using different methods to achieve the same ends. Unfortunately, replacing the entire protocol stack is difficult, thanks in a large part to how successful the internet has been. But there are several short term strategies we can begin working toward today that work within the constraints of the current system.One of the easiest and most significant things we can do is take humans out of the security loop. It’s been proven time and again that people don’t follow instructions for securing systems. Both John Gilligan and Vinton Cerf stated that improperly configured software accounted for over 80% of attacks on the internet. Fix this problem and we’ve essentially removed 80% of cyber security threats. Fixing the way we identify ourselves online (i.e. passwords) is another easy way to take humans out of the security loop. A recurring theme from most speakers but most prominently discussed by Scott Charney was redefining identity online. There are solutions that can work now to solve each of these problems.
It turns out that fixing the improper configuration problem is easy but it’s going to be a difficult sell. The basic idea is that a computer or device has to start with a good configuration and then control mechanisms have to be put in place to prevent the configuration from getting hosed. Some vendors such as Apple, Tivo, and Blackberry are already doing a great job at keeping their device configurations under control. The trade-off for security is going to be freedom (modifiability if you prefer quality attributes). In exchange for a usable, safe, and enjoyable internet experience that even your grandmother can handle you have to give up the ability to tweak anything you want in the system. If iPod, iPhone, Tivo, and Blackberry sales are any indicator, people are willing to exchange freedom for something that just works.
Is it really fair to compare devices such as phones and PDAs with full blown computers? Absolutely. The key phrase is "Internet Enabled Device." An iPhone or Tivo can be hijacked and recruited into a botnet army just as easily as a standard desktop PC. If even only 1% of the more than 4 billion mobile phones in use throughout the world were compromised, that would make 40 million bots ready to unleash mountains of spam and unending DDoS attacks. The only reason this doesn’t happen is because mobile devices are effectively locked down to prevent such compromises from occurring.
With regards to passwords, I hate to say it but I think the Department of Defense is actually on the right track. Every DoD employee and contractor is issued what is known as a Common Access Card (CAC), an ID card attached to a digital identification certificate issued by a third party authority that has verified that the person to whom the certificate was issued is indeed that person. Both Vinton Cerf and Scott Charney were very clear that online identity can only be solved by combining something you know, usually a password, with something you have, a physical thing. This something you have could be a digital identification certificate issued by an authority.
While it would be awesome to issue CACs to every citizen in the United States, perhaps attached to their driver’s licenses as Charney suggested, a staged success approach is possible. PayPal has taken the initiative with a hardware device called Security Key. Security Key is small enough to fit on a keychain and it generates a secret token (in this case a string of numbers) every thirty seconds. When you purchase through PayPal you enter your username, password, and the token shown on the device. Even if you accidentally gave this information to a phishing website, the token will be worthless after 30 seconds protecting your online wallet from fraud.
Though Vinton Cerf didn't know the first thing about what I was talking about when I asked him about it, I see a lot of potential with OpenId. OpenId is a protocol that provides something akin to a universal password that you can use to access thousands of websites and, with a little more work, could solve the identification problem across the internet. First, OpenId providers would need to take on the role of verifying user’s real life identities and connecting the physical identity with the digital identity. Second, OpenId providers have to offer some kind of physical verification when logging in, the something you have. This could be in the form of a CAC, something biometric like a fingerprint reader, or even something as simple as PayPal’s Security Key. In my opinion, OpenId is poised to become the third-party identification authority the world needs.
The Next Step
Another big theme at the symposium was trying to come up with a plan of action for moving forward, for fixing these problems. Most speakers agreed that it would be unfortunate if it took a Pearl Harbor-like event to be the catalyst that motivated people to action. Given the sophistication of attacks and the amount of value on the internet, the magnitude of damages could bring the United States, and in turn the world thanks to the global economy, to its knees. The most frustrating part is that we know about the problems and I think there are a lot of smart people who know how to technically solve the problems.By the end of the second day of the symposium I was left with more questions than answers and I am completely convinced that there will be a cyber security failure of a magnitude we have not yet seen in the near future. I’m not suggesting that everyone start stocking canned goods in the cellar, but now is the time to proactively start working for change. For as much flack as Microsoft has taken over the years, they seem to be on the forefront of effecting change both in terms of technology and public policy. It’s difficult to know where to start, but Microsoft’s Trustworthy Computing resources are both comprehensive and practical. The knowledge to fix the problems seems to be out there, the trick is motivating the world to change.
Comments
Post a Comment