What's In a Name? Announcing Truth in Labeling

A few days ago, my colleague Chris McClean asked the excellent question, "Is Risk Management Compatible with ERM?" I saw the headline come across my RSS reader and I thought, "Cool! I'd love to read what Chris thinks about enterprise rights management," a technology that I cover as part of my data security coverage. I'd advise you to read his post, which is excellent.

As you may know from Chris' post, the ERM Chris was referring to was actually Enterprise Risk Management, a way of estimating and managing security risks -- not Enterprise Rights Management. All of which led me to wonder, should we rename the data security category I was thinking of? I concluded that we should.

Enterprise rights management, loosely defined, refers to products that allow enterprises to enforce confidentiality and need-to-know restrictions on documents. Sample products in this category include Microsoft's Rights Management Services (RMS), Liquid Machines ERM, and Adobe LiveCycle. Most of these products use the acronym ERM explicitly in their marketing materials. Needless to say, it has nothing to do with enterprise risk management. Ah, the difference four letters makes!

Here's the thing, though. The reason "my" ERM is called ERM is to distinguish it from digital rights management (DRM), a largely discredited technology used to enforce publisher's rights on consumer music and video files. The upscaling of DRM to ERM, to me, is a little silly. The acronym arose from the desire to take an arguably confusing three-letter acronym (TLA) and adapt it to enterprise use, with the results being an even more confusing TLA. And it raises questions. Whose "rights" are being enforced? The "enterprise's," sure, but what does that mean? The issue here is much closer to a privileges, entitlements, and authorization issue, not "rights." Nobody will call the lawyers because someone's "enterprise rights" were violated. Surely we can apply a little more precision to the term we use to describe technologies meant to enforce access rights on documents?

And what do you know? The authors of the Orange Book have already got a term that approximates what this whole area is: labeling. The Orange Book dates from the early 1980s and is formally known as the US Department of Defense's Trusted Computer System Evaluation Criteria. The data labeling term is used in the Common Criteria also. It's a standard term in government and intelligence circles, but not seen as often in the commercial sphere.

Here's what the Orange Book says about data labeling: "Access control labels must be associated with objects. In order to control access to information stored in a computer, according to the rules of a mandatory security policy, it must be possible to mark every object with a label that reliably identifies the object's sensitivity level (e.g., classification), and/or the modes of access accorded those subjects who may potentially access the object." Sounds just like what what ERM is doing, no?

So, here's what Forrester will do in our future coverage. The ERM (enterprise rights management) acronym will vanish, except as a "bridge" term to jog memories. In the future, we will practice "truth in labeling" and call this ERM thing data labeling. 

I will continue to read Chris' blog posts, of course, and I hope you will too. Best of all, he'll have the ERM TLA all to himself!

 

[posted by Andrew Jaquith]

Blue Coat: Creating An Economic Advantage For Users In 2009?

Last week, Blue Coat gathered analysts in New York City for its Application Delivery Network Briefing Event to showcase its newest offerings, some of which are not yet released, and give the analyst community an update on where things stand following the company’s acquisition of Packeteer, completed in June of 2008.

Long story short? The vendors’ roadmaps have merged and it seems Blue Coat is doing a solid job of integrating the visibility and deep traffic inspection messages of the PacketShaper products with its caching, optimization, and security messages. Prior to the Packeteer acquisition, while Blue Coat offered a solid secure gateway and caching story, the true level of traffic visibility and optimization it could provide was limited.

Interesting for IT Operations and Security Professionals, the two product lines remain separate, though branding will merge in the second half of 2009. This could create either a dilemma or an opportunity for Blue Coat in the current economy when companies are being forced to show faster ROI with less investment upfront. The PacketShaper/ProxySG product split means that an organization can adopt one element of the solution at a time, dialing up investment as need dictates. That said, we’d like to see a converged appliance, though the processing power such a box would require, not to mention OS rationalization across at least three product-based operating systems would be complex at best. We’ll have to see how it all plays out.

For security and risk professionals, being able to create alliances with the IT OPS folks may allow exiting Blue Coat proxy customers expand their deployments beyond web content filtering and caching. The fact that the Mach 5 wan optimization features are built into ProxySG’s base OS means that both Security and OPS may be able to leverage the same hardware in these economic times. For companies just now looking at web proxy and wan op solutions, Blue Coat may have serendipitously timed the market just right.

We’re looking to the future to see whether Blue Coat moves more aggressively to offer virtual products aimed at networking infrastructure vendors that are looking to virtualize more services on fewer pieces of hardware – no word on this yet. Such a strategy, paired with a cloud-based offering, where companies can pay by the drink, especially for optimization services, would truly differentiate Blue Coat, who has seen its product line - already working to gain traction around the idea of an application delivery network, as a departure from pure WAN optimization, in the wake of other players in the market such as F5, Cisco and Citrix - gain competition from the recent Riverbed-Mazu acquisition.

By Chris Silva and John Kindervag

Check out Chris' research

Check out John's research

Last week, Blue Coat gathered analysts in New York City for its Application Delivery Network Briefing Event to showcase its newest offerings, some of which are not yet released, and give the analyst community an update on where things stand following the company’s acquisition of Packeteer, completed in June of 2008.

Long story short? The vendors’ roadmaps have merged and it seems Blue Coat is doing a solid job of integrating the visibility and deep traffic inspection messages of the PacketShaper products with its caching, optimization, and security messages. Prior to the Packeteer acquisition, while Blue Coat offered a solid secure gateway and caching story, the true level of traffic visibility and optimization it could provide was limited.

Interesting for IT Operations and Security Professionals, the two product lines remain separate, though branding will merge in the second half of 2009. This could create either a dilemma or an opportunity for Blue Coat in the current economy when companies are being forced to show faster ROI with less investment upfront. The PacketShaper/ProxySG product split means that an organization can adopt one element of the solution at a time, dialing up investment as need dictates. That said, we’d like to see a converged appliance, though the processing power such a box would require, not to mention OS rationalization across at least three product-based operating systems would be complex at best. We’ll have to see how it all plays out.

For security and risk professionals, being able to create alliances with the IT OPS folks may allow exiting Blue Coat proxy customers expand their deployments beyond web content filtering and caching. The fact that the Mach 5 wan optimization features are built into ProxySG’s base OS means that both Security and OPS may be able to leverage the same hardware in these economic times. For companies just now looking at web proxy and wan op solutions, Blue Coat may have serendipitously timed the market just right.

We’re looking to the future to see whether Blue Coat moves more aggressively to offer virtual products aimed at networking infrastructure vendors that are looking to virtualize more services on fewer pieces of hardware – no word on this yet. Such a strategy, paired with a cloud-based offering, where companies can pay by the drink, especially for optimization services, would truly differentiate Blue Coat, who has seen its product line - already working to gain traction around the idea of an application delivery network, as a departure from pure WAN optimization, in the wake of other players in the market such as F5, Cisco and Citrix - gain competition from the recent Riverbed-Mazu acquisition.

By Chris Silva and John Kindervag

Check out Chris' research

Check out John's research

Another Microsoft critical out-of-band security patch

As the day draws to a close on December 16, 2008, Microsoft issued an advance out-of-band security advisory, #961051, and an emergency patch to follow the next day.

The vulnerability behind this advisory is a critical remote-code-execution vulnerability within Internet Explorer (IE). All currently supported versions of IE are affected. The vulnerability is related to an invalid pointer used in the data binding element within IE’s code base. This vulnerability allows remote execution of arbitrary code. If a vulnerable browser visits a malicious Web site, this Web site can instruct the browser to execute arbitrary code with the same privilege as the user itself.

 

Microsoft first became aware of this vulnerability when anonymous reports of the vulnerability surfaced on a Chinese Web site. On Tuesday, December 9^th, Microsoft’s response center saw an increasing number of attacks utilizing this vulnerability. This prompted Microsoft’s taking the extraordinary action of issuing an out-of-band security advisory and an emergency patch for IE.

 

So far, the attacks Microsoft has seen are for IE 7 only. They reported that approximately 0.2% of Windows users may have been affected by these attacks. Microsoft has issued emergency patches for all supported versions of IE and all languages.

 

What should you do about it? As a consumer, if you have automatic Windows Update turned on, you should receive the patch automatically. If not, we recommend that you enable automatic updates from the control panel. As an organization, many already have automated procedures to install vendor patches. This is, however, a critical patch which must be attended to immediately.

 

What is Microsoft doing to avoid similar vulnerabilities in the future: Microsoft is saying that the particular nature of this vulnerability made it difficult to be detected by automated tools. As such, their SDL process failed to catch it. However, as we understand it, Microsoft’s SDL process goes beyond the use of automated tools. Why threat modeling, code reviews, and extensive testing did not catch this critical vulnerability is not an easy question to answer, and we are eagerly awaiting more information from Microsoft.

What is "clickjacking" and should you be concerned about it?

I am at the first national OWASP conference in New York this week, giving a talk on Web 2.0, consumerization, and application security. There is much discussion at the conference about "clickjacking," partially because the researchers weren’t given permission to do an open session, which of course further fanned the interest.

Earlier today, CERT issued a statement on clickjacking, warning that multiple browsers, including IE, Firefox, Safari, Opera, and Chrome, are all vulnerable to the attack.

So what is clickjacking? The exact technical details of this attack and the associated vulnerabilities are a bit fuzzy at this point. But essentially, clickjacking constitutes an attack that inserts itself in the middle of a user’s interaction with a Web page through clicking buttons. Whenever a user clicks on a button in a Web page, the infected browser can get the user to perform any arbitrary click-related function, including redirecting the browser to a third-party site, replacing the legitimate “onclick” function with a different function, etc. This attack is different from the traditional code-inject attacks that overlay invisible iFrame on top of Web pages, because this attack does not require the compromise of server-side code. The browser alone can wreak havoc.

How serious is the clickjacking vulnerability? The researchers reported that the vulnerability does affect all popular browsers, which means it will affect a huge population of users.

How soon can we expect a fix? The answer is "don’t know" at this point. It is obvious that the vulnerability has something to do with the browser code that handles user input and the javascripts that perform the "onclick" function. As such, Microsoft, Mozilla, and Apple are reportedly working on the fix, which was partially the reason that the researchers weren’t able to talk about the flaw openly at OWASP.

What should you do in the meantime? The only answer available today is using Firefox with the NoScript option. NoScript allows you to turn off javascripts at the browser level. User be warned: it will negatively affect your browsing experience; many sites will appear broken. But it is, for now, the most effective measure against someone who might exploit this vulnerability.

Lessons learned from the massive SQL injection attacks against legacy Microsoft ASP apps

I am sure many of you are aware of the recent massive-scale SQL injection attacks targeting Microsoft ASP applications running on IIS. The latest report has the number of attacked sites at 500,000. The press makes it sound like there is a new vulnerability in IIS or ASP. This cannot be further from the truth. The reality is the attacks are targeting Web applications where user input validation is not done (this is one of the fundamental security programming techniques). When a Web application does not validate its form input, it is opening itself up to code injection attacks including SQL injection. Today, the security industry is doing a decent job of communicating the importance of input validation. But you'll still find many legacy Web applications that have these flaws. And this is exactly what happened here: the attackers (well, they are organized) are using Google to find old ASP pages that take user input, and are systematically going after these pages to perform SQL injection attacks.

If you have legacy Web applications, the best thing you can do is use HP's Scrawlr, a lightweight Web crawling and SQL injection detection tool to detect your vulnerabilities. You can download Scrawlr here:

https://download.spidynamics.com/products/scrawlr/.

We'll be back with another edition of how important application security is to business today. Stay tuned.

CIOs Entitlement Management Worries

While I was looking through current offerings in Entitlement Management (EM), I was struck with the questions that will likely be the next logical thoughts in the CIO’s mind after they are sold on the obvious ROI of an EM solution.

Which organization should own the centralized Entitlement Management in the company? The first ideas will revolve around either Security Administration or Application Development. For a company, which has already implemented enterprise or Web single sign on (SSO), Security Administration would be the logical place to own Entitlement Management. For companies without an existing SSO system, the logical area could be Application Owners. Or would it? Entitlement management (EM) can and will be deployed in a standalone environment for only centralizing the entitlement management of a portal. But the greatest benefit of EM will be reaped where it integrates tightly with provisioning, job roles, access management, and SSO. Role-based entitlement management combines the benefits of provisioning with centralized EM. This thought process circles back again to Security Administration taking the lead in ownership of the EM solution. Obviously, even more than traditional Access and Identity Management, EM will require deep coordination between Security Administration and various business units and a well defined process for managing identities.

How will I integrate the EM framework with a global corporate GRC engine. As with any policy decision points (SSO, EM, provisioning), policies should not only be transparent and easily manageable, but they need to tie into and be cohesive with the company’s global governance, risk, and compliance (GRC) framework. Web services for checking back to the corporate GRC repository is a great start here, but a “policy feeder” would be ideal -- this could automate integration with higher level GRC policies. ERP system segregation of duty policies also need to be enforced in a centralized EM system which controls other, non-ERP applications.

How will I make peace with warring factions of my security organization and application development organization?  Authorization features of the application need to be moved into a centralized entitlement management system.The above is not an easy process though. Overcoming application owners’ resistance against moving authentication decisions to a centralized access control product policy is something that all CISOs are keenly aware of during implementation of even a simple Web SSO project. But this is still a small task when you compare it with moving entitlement management out of applications. Why? Two reasons: legacy code and siloed ownership of applications. Applications tend to mix business logic, security, and presentation. Externalized application authorization requires a rigorous application code review and untangling of legacy spaghetti code responsible for in-house application authorization decisions. Needless to say that owners of old, legacy, applications may not even have the understanding of source code level understanding required to undertake such a review process. Siloed LOB application ownership needs to maintain an ongoing relationship with the organization that owns the Entitlement Management product and nurture not only SSO, but EM integration points.

How will I integrate my access request helpdesk system with EM? For business users, the most visible element of the EM system will be creating and approving application entitlement request tickets. Thus entitlement management processes need to be integrated into the bigger framework and workflow of managing identities.

As with any other project with a sizeable cross-cut through organizational politics, in order to answer the above challenges, the identity management steering committee will have to put EM regularly on their agenda.

HP Acquires SPI Dynamics

HP accounced on June 19th that it would acquire SPI Dynamics, a provider of security testing technology. The announcement came on the heels of the Watchfire acquisition by IBM. These two acquisitions highlighted the industry's increasing interest in application security. HP's Mercury with SPI's WebInspect makes a very compelling offering for comprehensive software testing (performance, functionality, and security). Similar results should ensue for the Watchfire acquisition. It is great to see that application security is finally getting the attention that it deserves. With the two platform providers, HP and IBM, taking on security testing tools, we should see more market uptake on application security measures, which is exciting for those of us in the security space.

While talking to reporters yesterday about the acquisitions, I made a statement: "SPI Dynamics and Watchfire are leading vendors in the space of security testing. Watchfire may have a slightly higher market share, but Mercury+SPI makes a more compelling offering." The statement came out in the form of "Forrester Analyst Wang said: 'Watchfire is the top security testing company, and SPI Dynamics is No 2.'" This really is not what I meant, because I have never ranked these companies in terms of capabilities, features, and revenues, for that matter. Although I do not control how stories are written in the press, I take responsbility in making a loose statement that could be misconstrued as analysis. So I apologize for that. I certainly never meant to indicate that SPI Dynamics is the #2 security testing company.

But even with this press mishap, I am very excited to see the large platform providers take in the application security vendors, because this ensures that the application testing tools will have a more mainstream audience and a longer shelf life. I think there will be more consolidation in this industry segment where smaller point solution providers will join forces with large security or IT management vendors.

Chenxi Wang, Ph.D., Principal Analyst, Forrester Research