Smart Grid – Make It Secure And Compliant

Critics of Smart Grid argue that it is not secure enough to be rolled out yet. They may even paint a doomsday picture similar to ‘Die Hard 4’, with hackers breaking into the grid and controlling the nation’s power system. That kind of extreme scenario is shocking — in essence launching a denial of service (DOS) attack that can imperil critical infrastructure. This year’s Black Hat conferenceplans to showcase similar security threats that can impact smart meters and devices. NIST has put out a 270 page roadmap of Smart Grid standards and protocols that address various aspects of controls, including security. These guidelines can help utility companies, manufacturers, technology vendors, and service integrators to streamline controls when rolling out Smart Grid. However, the implementation of this approach is missing to date.   

It is very important to discuss the risks associated with deploying smart metering technology without proper security controls. Smart Grid technologies should only be implemented under a compliance mandate. The fear is that the pilots underway today are not keeping security as the top priority. These roll outs can compromise data privacy and jeopardize user information if security measures are not taken. Government guidelines can provide value here by helping to define appropriate controls and pinpoint specific measures to secure these components.

Utility companies, Smart Grid equipment suppliers, and technology vendors need to come together to solve security issues as the top priority at this early stage of technology roll outs. The Smart Grid concept is built on an IP-based network, and therefore requires a hardened approach to network security. And similar to proper network security, adopters should be focusing on security posture and policy from the ground up.

Secure Smart Grid should be built upon tiered access control architecture that includes physical, network, data, and application access control mechanisms. This is a minimum requirement that smart meters, devices, appliances, and data centers need to fulfill. Access control architectures will provide a starting point in implementing technologies that protect and control various aspects of data transaction through diverse modes of connections.

Cisco predicts that utilities will be investing in new greener data centers more than new power plants in the coming years. Therefore, these issues need to be dealt with soon, before this technology becomes pervasive.

What role will compliance standards play in securing Smart Grid?

Please Fill Out These Forms...The SEC Will See You Now

Is regulatory oversight more or less invasive than oral surgery? Sure, both are necessary sometimes. But however you feel about the current level of corporate scrutiny, it’s clearly increasing, and that means the jobs of corporate governance, risk management, and compliance professionals are going to get even tougher.

The last month has seen some dramatic news related to corporate disclosure, most notably a bill approved by the House Financial Services committee that would require public companies to explain executive and employee compensation packages, and to write rules that would prohibit any compensation that could have a substantial, negative effect on financial markets. Lawmakers expect that this bill, if approved, will be rolled up with other legislation.

In a more bizarre story, the SEC was found investigating Apple for the company’s disclosure of the nature of Steve Job’s illness. The issue is that, considering Jobs’ importance to the company strategy and vision, his health is a material concern for investors. If the SEC looks to make the rules for this type of disclosure mandatory, expect some very interesting discussions about privacy versus disclosure.

Finally, if the SEC doesn’t already have its hands full, the Commission is currently considering a mandate that corporations must practice better climate change disclosure. The language being used is a bit confusing however, in that climate risk and climate change are being used somewhat interchangeably. Climate change disclosure seems to be a confusing combination of some risks (resource scarcity or extreme weather events) and some impacts (emissions and waste). And at the risk of sounding cynical, I’m guessing the SEC won’t require the disclosure of any potential benefits that might be gained from climate change (access to better farmland, more oil reserves, longer work days, etc.). I would recommend sticking with environmental risks and environmental impacts.

These ongoing and somewhat confusing regulatory challenges will require substantially more documentation and content management. Many organizations will turn to consulting firms to stay abreast of requirements and set up better governance structures. Regulatory content providers are getting more involved as well, with plans to provide both regulatory guidance and the software platform to facilitate compliance. For example, earlier this month, Wolters Kluwer acquired GRC platform leader AXENTIS, echoing Thomson Reuters’ similar acquisition of Paisley last winter.

We are still far from seeing the same kind of market-generating legislation that we saw with SOX, but many of the vendors focusing on governance, risk, and compliance are starting to see the first signs of a healthy upturn. Stay tuned...

Posted by Chris McClean

What's In a Name? Announcing Truth in Labeling

A few days ago, my colleague Chris McClean asked the excellent question, "Is Risk Management Compatible with ERM?" I saw the headline come across my RSS reader and I thought, "Cool! I'd love to read what Chris thinks about enterprise rights management," a technology that I cover as part of my data security coverage. I'd advise you to read his post, which is excellent.

As you may know from Chris' post, the ERM Chris was referring to was actually Enterprise Risk Management, a way of estimating and managing security risks -- not Enterprise Rights Management. All of which led me to wonder, should we rename the data security category I was thinking of? I concluded that we should.

Enterprise rights management, loosely defined, refers to products that allow enterprises to enforce confidentiality and need-to-know restrictions on documents. Sample products in this category include Microsoft's Rights Management Services (RMS), Liquid Machines ERM, and Adobe LiveCycle. Most of these products use the acronym ERM explicitly in their marketing materials. Needless to say, it has nothing to do with enterprise risk management. Ah, the difference four letters makes!

Here's the thing, though. The reason "my" ERM is called ERM is to distinguish it from digital rights management (DRM), a largely discredited technology used to enforce publisher's rights on consumer music and video files. The upscaling of DRM to ERM, to me, is a little silly. The acronym arose from the desire to take an arguably confusing three-letter acronym (TLA) and adapt it to enterprise use, with the results being an even more confusing TLA. And it raises questions. Whose "rights" are being enforced? The "enterprise's," sure, but what does that mean? The issue here is much closer to a privileges, entitlements, and authorization issue, not "rights." Nobody will call the lawyers because someone's "enterprise rights" were violated. Surely we can apply a little more precision to the term we use to describe technologies meant to enforce access rights on documents?

And what do you know? The authors of the Orange Book have already got a term that approximates what this whole area is: labeling. The Orange Book dates from the early 1980s and is formally known as the US Department of Defense's Trusted Computer System Evaluation Criteria. The data labeling term is used in the Common Criteria also. It's a standard term in government and intelligence circles, but not seen as often in the commercial sphere.

Here's what the Orange Book says about data labeling: "Access control labels must be associated with objects. In order to control access to information stored in a computer, according to the rules of a mandatory security policy, it must be possible to mark every object with a label that reliably identifies the object's sensitivity level (e.g., classification), and/or the modes of access accorded those subjects who may potentially access the object." Sounds just like what what ERM is doing, no?

So, here's what Forrester will do in our future coverage. The ERM (enterprise rights management) acronym will vanish, except as a "bridge" term to jog memories. In the future, we will practice "truth in labeling" and call this ERM thing data labeling. 

I will continue to read Chris' blog posts, of course, and I hope you will too. Best of all, he'll have the ERM TLA all to himself!

 

[posted by Andrew Jaquith]

Is IT Risk Management Compatible With ERM?

Every month or so, news events (attacks on government sites, massive privacy breaches, etc.) provide a ‘wake-up call’... a proof point used by vendors and practitioners alike that protecting our national and corporate information assets has never been more critical. On occasion we even see these incidents yield promises of action, for example the anticipated appointment of a US Cybersecurity Czar, which my colleague Khalid Kark discusses here. 

But in spite of these warnings, my conversations with enterprise risk and IT risk professionals still reveal many disconnects, including that IT risks are not measured consistently with other enterprise risks. In addition, many IT risk professionals do not see their biggest risks showing up on the corporate risk register.

One problem is that traditional enterprise risk management (ERM) metrics such as likelihood and impact, do not fit neatly with common IT risk metrics such as system criticality and vulnerability. Even at the Federal level, the Office of Management and Budget recommends moving from compliance-based metrics to security- and vulnerability-based metrics. This will be progress if implemented, but it’s still a long way from measuring actual risk exposure.

I have seen more progress by IT professionals using ERM methodologies in the private sector, and I’ll be highlighting some of the best examples at our Security Forum in September. Although most organizations are a long way from a fully integrated enterprise risk management program, the ability to paint a big picture of risk exposure has clear benefits. I think measuring IT risks in the same way as financial, legal, or environmental risks is ultimately the best way to demonstrate how serious they are, and is an important step in earning due consideration at the enterprise level.

Cisco’s Smart Connected Communities – Are They Securely Connected As Well?

I attended a Cisco Systems briefing early this week about its Smart Connected Communities initiative. Once again Cisco demonstrated its forward thinking by bringing together various government initiatives under the umbrella of what they call Smart Connected Communities.  A Smart Connected Community is built on IP-based infrastructure. This means that all of the critical components of a city infrastructure like utility, transportation, healthcare, commercial buildings, and emergency response systems connect via an IP-based network.

Overall, it was a good update briefing. But I was surprised to hear just how confident Cisco is that securing this networked infrastructure is a no brainier. When I asked the presenter: “Given that network infrastructure is not nearly as robust and secure in some emerging geographies, how are you planning to ramp up the backbone and make the network secure enough end-to-end to run smart services?”

The presenter agreed that we need to strengthen the network backbone and provide sufficient bandwidth and robustness to run smart services.  However, I was astonished to hear that he thought security is not as much of an issue. In his opinion Cisco is well versed in providing a secure infrastructure and they have implemented security in diverse environments like the financial, retail, and government sector.

Unfortunately, I’m not sure I share Cisco’s confidence. If security is that easy to implement then why are so many companies incurring heavy fines when they regularly fail compliance mandates. Day in and day out, why do so many companies worry about business and partner access as they expand their global operations? Why are utility companies light years away from being secure, as evidenced by their meters and power distribution systems that are prone to security breaches? In the smart connected environment, healthcare, financial institutes, retail, utility, and transportation companies will need to comply with industry-specific compliance requirements as well as broader government regulations to make the puzzle even more complex. Walking the path to this smart connected infrastructure comes with a magnified set of challenges for CIOs and CISOs. Among many things they will have to manage thousands of IP endpoints connected on the smart backbone.  At the same time, B2B security will become imperative as they would interact with many non-conventional partners that they’ve never dealt with in the past.

My take? Security should be at the top of the list when building these smart connected communities. We haven’t solved this challenge by a long shot. In fact, I fear it can prove to be the Achilles Heel when integrating disparate components together.   

I’m interested in your thoughts. What role will security play in Smart Connected Communities? Is Cisco right, we’ve already got it all figured out?

[posted by Usman Sindhu]

Cybersecurity Czar – Where art Thou?

Bill Brenner at CSO recently wrote an interesting piece highlighting the urgency of having a cybersecurity leader. Although I do not agree with him that the simple DDOS attacks on government Websites could have been prevented by having a Cybersecurity Czar, I do agree with him that we need a cybersecurity leader – now!  

We all rejoiced when President Obama ordered a 60 day cybersecurity review shortly after taking office. We were all excited when, on May 29th, a report summarizing the findings of the cybersecurity review was released and the president declared cybersecurity as a national security priority for his administration, and a personal goal for him. The President promised to appoint a cybersecurity coordinator (Cybersecurity Czar) and assured that the new official will have regular access to the Oval Office. Many of us (security pundits) were ecstatic and  offered suggestions and praise. We were all a little disappointed that he did not name the new “coordinator” that day, but we were assured that the appointment would be announced soon. It has been more than sixweeks since that announcement – and there is no appointment in sight. Obviously there is no shortage of rumors on whom the next Cyber Czar will be or why the President hasn’t named one .

We understand that things move slowly in government and that the President has a lot of other pressing issues that he needs to deal with, but here are five reasons that the appointment of a Cybersecurity Czar (coordinator) is a matter that requires urgent attention:

1. There is a lot of money being spent on cybersecurity everyday – with no comprehensive strategy. Not only are individual agencies spending millions of dollars on cybersecurity but a highly classified, multiyear, multibillion-dollar project, approved by the Bush Administration called CNCI -- or "Cyber Initiative" – had a budget of $30 billion. This initiative was implemented with the goal to secure government, commercial and critical infrastructure computer systems against foreign and domestic intruders. We are talking big bucks here. Would you as a CISO let your business areas spend on security initiatives as they please without any coordination, communication or strategy?  
2. Critical infrastructure needs immediate help. Our critical infrastructure needs help. It is antiquated, prone to viruses and worms, and people doing stupid things ultimately leading to costly disruptions in service. Add to this the potential threats associated with foreign government hackers (Electricity Grid in U.S. Penetrated By Spies) and you’ve got an urgent matter on your hands. Other critical infrastructure breaches (FAA says info on 45,000 workers stolen in data breach) and commercial data losses (Hackers Breach Heartland Payment credit card system) brings no consolation.
3. FISMA has utterly failed at securing government infrastructure. We have all come to realize that FISMA has done little to improve the security of government systems, and created an additional layer of processes and a healthy revenue stream for beltline consulting companies. The Cybersecurity Czar needs to take over the responsibility of ensuring FISMA 2.0 is in line with the current realities on the ground and is able to change the focus from “compliance” to security.  
4. Capture the momentum and excitement. I have never seen such optimism and excitement in the security industry for a government initiative. Security experts and the industry at large is offering to help in whatever capacity they can to improve the nation’s cybersecurity posture. We need to seize the opportunity and come up with a defined strategy (not high level goals and objectives) and strong leadership that can channel this energy into positive action.
5. Perception is almost as important as reality. Many people hailed Mr. Obama’s speech on May 27^thas a strong warning to our adversaries that we are serious about security. The recommendations from the cybersecurity review were also heralded as the right first step. But nothing has happened since. We don’t have a plan, any specifics on how those recommendations will be implemented nor a Cybsersecurity Coordinator. By not following it up with action, what message are we sending? We need to at least be perceived as taking security seriously.

Do you agree that we need a Cybersecurity Czar in the first place? What kind of skill-set do we need in a Cybersecurity Czar? Who do you think will be Mr. Obama’s pick? As always, I’d value your feedback, comments, and thoughts.   

[posted by Khalid Kark]

Securing Google's Chrome OS

Today, I received an e-mail from eWeek's Brian Prince asking about how Google might make good on its promise to make their upcoming Chrome OS more secure than the operating systems we know and love. Here's my long reply to him, lightly edited.

Google is starting from a clean sheet of paper, so they have a lot of freedom to design the OS the way they want. From a security perspective, Google has a lot of options, ranging from evolutionary to radical.

 

On the more evolutionary side of things, Google could have chosen to make an OS that looks and acts a lot like today's operating systems, with a windowing system, local file storage, multi-threaded processes, a Web browser, and locally installed applications written in native code. Windows, GNU/Linux, and OS X are all like that. The difference is that Google would seek to do some or all of these aspects more securely. For example, they could implement something like SELinux, a package that adds mandatory access control to Linux. This would allow the OS to sandbox malicious processes so they don't infect the rest of the system. The browser, too, could be done better. Safe bets of what Chrome OS will include are a browser with multi-process tab support (like the Chrome browser), which isolates each browser window process, and is therefore more secure than other browsers.

 

At the extreme end of what Google might do is the iPhone model, circa version 1.0 of the OS. That is, the OS is a totally sealed box with no third-party app support. All "apps" are Web apps, with a trusted bootloader that verifies software integrity of core OS files at time of bootup. The first iPhone OS was really like a toaster: there wasn't anything to mess with, so the users couldn't get themselves in trouble. Apple later added native app support in iPhone OS 2.0, which required new apps to be digitally signed. This is something Google could do also if third-party native apps were supported.

 

My personal hunch is that Chrome OS will be closer to a toaster. The applications it will run will be primarily, if not exclusively, Web applications like GMail, Google Docs, and Picasa. That means the primary application they will need to secure will be the Chrome browser, which they have demonstrated an ability to do already. For those cases where the browser needs to run a native code plugin, they will use the Google Native Client APIs. The research I've read on NaCl is quite encouraging; it runs native code, but the code is "verified" beforehand so that it can't do naughty things, or at least is less likely to. For an overview of the goals and security posture of NaCl, see this excellent, prescient Matasano post: http://www.matasano.com/log/1674/the-security-implications-of-google-native-client/

 

Next, if we make the assumption that Google wants things to live in the cloud, we can probably assume that there won't be a user-accessible file system. That, plus the desire to lock down the operating system, suggests that all file storage will be in the cloud. For the core OS, I consider it likely that the OS itself will have a trusted bootloader that verifies the integrity of the OS at bootup. The trusted bootloader, combined with a MokaFive-style auto-wiper, could ensure that the OS is always "clean" at bootup, and that the user files stay separate from the operating system. For those of you with long memories, the idea of a trusted OS isn't new. Indeed, Microsoft Research implemented process isolation and trusted bootloading in its experimental Singularity OS in 2005. What's new is that Google will actually try to commercialize it.

In summary, if I were king, I'd make the "OS" as we know it a lot thinner and compact, without support for 3rd party applications, and cloud-based storage. Combine that with process isolation, mandatory access control, trusted bootloader and a primarily browser-based user interaction model, and you'd see an OS that is indeed a lot more secure.

And the results are in... The Forrester Enterprise GRC Platform Wave 2009

The launch of any new research report is exciting, but I’m especially happy to see the publication of the The Forrester Wave™: Enterprise Governance, Risk, And Compliance Platforms, Q3 2009.

The evaluation speaks for itself. Forrester goes through great pains to assure a fair, detailed process that looks into the strengths and weaknesses customers care about most — and this Wave is no exception. But considering the amount of time and effort we spent putting this report together, I wanted to provide some additional thoughts on what I learned during the process:

• Wave research is very rewarding. Among best practices, trends, and other reports, the Wave research is probably the most enjoyable for me and beneficial to our corporate customers. In a relatively short time period, I sat through hours and hours and hours of product demos (really, it’s not as bad as you think), debated with vendors about market dynamics, and analyzed massive amounts of customer reference data. During the evaluation process, I was also working on several vendor selection projects with Forrester customers. Since the Wave criteria are based on buyer demands, the research I was doing was very applicable to my customer engagements as well.

In additional, the comprehensive and transparent nature of the Wave methodology helps to justify all of the scores and analysis. That means that if a customer (or former colleague) has a question about any of the results, they are able to see exactly what criteria I used and why I scored each vendor the way I did (and then of course they can proceed to agree or disagree as they see fit).

• It’s impossible to include everything. The GRC landscape is vast. For every vendor that appeared in the Wave, there were probably at least two more that wanted to be included. Some were not invited because they didn’t meet all of the participation criteria, while others were invited but declined to participate because they couldn’t meet our required information requests and/or deadlines. The vendors evaluated here, however, have demonstrated strong customer successes and ability to meet the market demands we see from the hundreds of GRC inquiries and advisories we do every year.

One thing you may not be able to tell from the graphic alone is how each vendor is trending relative to their market position. Yes, the vendors that have stayed on top of the Leaders category have had to work very hard to maintain that position. However, it’s often other vendors that are showing the most innovation and progress. In fact, I spend quite a bit of time discussing this in the Wave report as well as a podcast I recently recorded.

• GRC buyers and implementation are more mature. While this will come out more in upcoming reports, GRC buyers and users are more sophisticated than ever. Current budget constraints may require implementations to start very small, but more and more, organizations are seeing long-term value of comprehensive GRC that spans across compliance, risk, audit, IT, and other departments.

Software firms have responded appropriately, which means they can't be easily segmented by which vendors target risk management professionals or which target compliance professionals... the best ones are addressing all relevant users. With that in mind, I chose not to segment out separate Wave graphics for Governance users, Risk users, and Compliance users. If we are truly set on the unique value GRC brings by combining these functions, we should focus on solutions that address each of their needs simultaneously.

For customers that are looking for solutions that skew to specific areas of GRC, I would recommend using our Wave model to adjust the score weightings to meet your unique needs. Are you more interested in products that can help automate your control testing? Do you care more about training and awareness capabilities? You can adjust the weightings of these criteria as you see fit, and then see which vendors rise to the top of your own custom Wave.

I wanted to thank all of the vendors that participated and the teams that spent time gathering the necessary information for our evaluation. For those that did not participate, rest assured... we still get a lot of customer inquiries asking for details about vendors that are not in the Wave. And so it is of course my intention to keep up to date with all vendors in the GRC market.

For GRC buyers, there are of course questions that you have that could not be fully covered in this report. I encourage you to look through the details of our evaluation, and feel free to set up an inquiry to discuss any other issues in more detail.

[posted by Chris McClean]

NAC Can Play An Important Role In Securing The Nation's Critical Infrastructure

I came across an interesting article discussing how the U.S. Department of State has recently shown interest in adopting network access control (NAC) tools that perform pre-admission access control. The intent is driving the development of standards that help organizations secure their network from malicious hacker attempts. There is a mounting concern that the nation's critical infrastructure — ranging from the electricity grid to banking systems to defense contractors — is far from being secure. To this end, the SANS (SysAdmin, Audit, Network, Security) Institute has worked with security professionals both inside and outside of government agencies to develop the Consensus Audit Guidelines. There are 20 controls in this program to tackle cybersecurity issues. NAC is identified to help with “Critical Control 12: Malware Defenses.”

 

NAC helps organizations create or leverage existing security policies by enforcing them at the various layers of the network. The most common use case for NAC is to enforce policies for keeping endpoints up-to-date; this includes patch management and system configuration. However, this is a pretty rudimentary use case. NAC is much more valuable when applied to the automation of various security, asset management, and access control policies. That’s why NAC is such a good fit in many cybersecurity initiatives. Specifically, it can help: 1) develop a secure B2B environment; 2) build a secure Smart Grid; and 3) streamline government and industry compliance mandates like FISMA, NERC, PCI DSS, and HIPAA.

  

We predict NAC tools will play an important role in end-to-end access control lifecycle management. The majority of cybersecurity initiatives require an ongoing management of user identity tied to specific users’ devices and applications. But there will need to be some enhancements beyond today’s standard NAC deployment. The industry needs to build out support for the TNC IF-MAP standards. Doing so will make sure NAC plays a critical component in building out: 1) IAM-based solutions to provide role-based access control; and 2) next generation SOC initiatives that leverage SIM to monitor assets and devices for vulnerabilities and threats.

 

The U.S. Department of State’s interest in implementing Consensus Audit Guidelines in conjunction with NAC is encouraging, but at the same time it's important not to pigeonhole NAC’s functions to commodity features like pre/post admission, remediation, and policy enforcement. Organizations should look at the bigger picture and specifically how NAC can help streamline security operations by automating and performing recursive security tasks.

Can NAC help the federal government to streamline controls for cybersceurity initiative?