Hosted by The Promise of Trustworthy Computing And

Hosted by The Promise of Trustworthy Computing And why most of corporate America will never benefit from it. Roberta Bragg

Hosted by “Trustworthy Computing is a 10 -year project, sort of like (President) Kennedy sending people to the moon. We're (only) a year into it. We want to get to a point where the end user says, I trust this technology, my privacy is protected, and it is reliable. " -- Scott Charney chief security strategist Microsoft

Hosted by “Trusted computing proposes a computer with security measures built into both the hardware and software, without the need or ability of the computer's user to implement or disable it” --Stephen J. Vaughan Nichols, Dev. Channel. org, April 17, 2003

Hosted by Trustworthy Computing Initiative l Microsoft's Next-Generation Secure Computing Base (NGSCB), formerly known as Palladium • Vaulted computer storage and CPU accessible only to TC processes • Data encrypted as it moves between computers and components • Nexxus or manager of trusted code - kernel, no thirdparty code allowed • • Use special CPU 5 hardware parts must change CPU, chipset, Input device, video output, unique identification chip

Hosted by TC Initiative l Trusted Computing Platform Alliance (TCPA), an industry group (Compaq, HP, IBM, Intel, and Microsoft, now over 190 member companies) • Special cryptographic chip. • www. tcpa. org • Version 1. 97 , July 2002?

Hosted by TC Initiative l Intel's La. Grande. l hardware-based foundation for security. l protected execution, protected memory, and protected storage. l Forecast to be in the Prescott chip design, which will succeed the Pentium 4 second half of 2003. l Shades of 1999 digital identification chip?

Hosted by Good l IBM's Think. Pad T 30 high-end laptop use an Atmel processor based on some aspects of the TCPA specification

Hosted by Good l Intel’s TPM (Trusted Platform Module) (for future Centrino chipsets) will provide a digital certificate. This could be used to authenticate the computer on a network configured to do so. Think secure wireless communications for example, using 802. 1 x.

Hosted by Bad l Intel’s Centrino chipset TPM : Could the certificate be used to identify the machine on the Internet to anyone who can? Would you know at all times where I am? (as long as I have my computer with me? )

Hosted by Good l Microsoft Work stoppage in 2002 to rewrite server 2003 code l And train programmers l Spent 100 million

Hosted by Good l Employees also treat the company's security personnel differently (Jonathan Schwartz, software design engineer for Windows Security at Microsoft) security folks were seen as "the crazy voices from off in the woods. " l "We understood what a buffer overflow was, and we would yell and scream until it got fixed, " Schwartz said. Now the security team has the opposite problem: More people point out bugs, and many are relatively minor. l CNET january 16, 2003

Hosted by Good l Created the Security Business Unit: • Responsible for § securing Windows § spearheading company-wide security efforts § developing new security products for market.

Hosted by Good l Revamped Microsoft Security Response Center (MSRC) l Greater authority to coordinate vulnerability investigations and develop fixes.

Hosted by Good l Incorporated severity ratings in security advisories and patch releases. l Goal to give admins better ability to judge patch/advisory criticality.

Hosted by Bad l Some say new severity ratings are flawed

Hosted by Good l Retrofitted XP and 2000 from knowledge learned in debugging Server 2003. l (SP 1 and SP 3, respectively). l Incorporate security patches for scores of known and publicly unknown vulnerabilities.

Hosted by Bad l Unknown vulnerabilities? • Should we know what these are?

Hosted by Good l New quality control tools for the Windows compiler l Checks code for buffer overflows l Compiler changed after first version of Server 2003 released

Hosted by Bad l Some think compiler is excuse for not writing good code

Hosted by Good l Software Update Services • Patch management service • Automatically downloads patches from Microsoft to a local server • Enterprise customer can test, approve patches before pushing them to endpoints. • • Can deploy patch servers for isolated systems Product available for free

Hosted by Good l Released Microsoft Baseline Security Analyzer, a free tool that checks Windows systems for basic security configurations.

Hosted by Good l Achieved Common Criteria security certification for Windows 2000, the first operating system to meet the standard.

Hosted by Good l Windows Server 2003! • By default multiple services turned off • By default more security settings enabled, restricted – hundreds of them

Hosted by Bad l 300 million windows users l 100 million of them still on windows 95 • Designed in 1993, release 1995 • Designed for 386, 10 s of megahertz, 16 MB RAM. • Things like strength of encryption keys are based on capabilities of machine • “In practical terms the rate of evolution of the attack moves at the speed that the computer system evolves. ” Craig Mundie, Microsoft Technology chief, idg. net, March 12, 2002

Hosted by Is that good design? “It's like saying in conventional warfare that I think I know what the bombs and bullets look like; I'll go and build a bunker. It'll have one-foot thick walls and be eight feet under the sand. Then along comes a guy with a bunker buster bomb and, boom, you're dead. Did the guy who designed the bunker do a bad job? Well, he only designed for the capability of the threat he knew. ” --Craig Mundie.

Hosted by Good l Released free security guide for Windows Server 2003 now available; 200+ pages • http: //go. microsoft. com/fwlink/? Link. Id=14845 l Windows 2000 Security Operations Guide (and other prescriptive guidance documents) • http: //msdn. microsoft. com/practices/ l Almost 300 page free document “Threats and Countermeasures: Security Settings in Windows Server 2003 and Windows XP” l All accompanied by tools, templates and auxiliary documents.

Hosted by Good l Attentions of security researchers turned to other systems than Microsoft, found flaws and published them too l BSD l SSL l Sendmail l Cisco l More…

Hosted by Good l Many of these flaws are fixed now too

Hosted by Bad l We learned that some vendors are not so eager to fix flaw l Some companies acted as if the problem was not there’s and have been less than forthcoming

Hosted by Good l More announcements of ‘security awareness, security training’ positions and programs in companies

Hosted by Bad l Lots of out of work security managers

Hosted by Bad l This was posted to a public forum last month: l “I broke into a bank kiosk” • I changed the URI on the browser • Firewall prompted for a password • I clicked cancel • It then connected me to the external location and let me browse • I found a location of the corporate internal home page

Hosted by Good

Hosted by Bad

Hosted by Good

Hosted by Good l Cooperation between industry and government : sharing info on vulnerabilities, risks, attacks so that large scale attacks on infrastructure can hopefully be avoided, or identified early and thus the impact is minimal • Infragaurd • Information Sharing and Analysis Center (ISACs) § For example, one for public utilities

Hosted by Good l Infra. Gard chapters - over 5000 members. I l the most extensive government-private sector partnership for infrastructure protection in the world l FBI provides to Infra. Gard members free of charge. l shares information about cyber intrusions and vulnerabilities through the formation of local Infra. Gard chapters and public Web. Sites, an alert and incident reporting network, local chapter activities, and a help desk. l secure electronic communications capability to all Infra. Gard members

Hosted by Good l The NIPC initiated the establishment of an Information Sharing and Analysis Center (ISAC) Support and Development Unit, whose mission is to enhance private sector cooperation and trust, resulting in two-way sharing of information and increased security for the nation's critical infrastructures. l representing energy, telecommunications, information technology, banking and finance, emergency law enforcement, emergency fire services, water supply, food, and chemical sectors (and other)

Hosted by Bad l If someone reveals a vulnerability, or cooperates by providing info that is no guarantee that anyone will fix it. Whose responsible for the fallout? l Will you get sued?

Hosted by Good l More companies are doing their own security initiatives or at least talking about security; • http: //www. macromedia. com/devnet/security/arti cles/mmsecurity. html • • http: //www. cisco. com/security/ dozens more

Hosted by Bad l Some sites hard to find security contact information l Some sites hard to find security vulnerability information l Security lipservice != security

Hosted by Good l Book on Secure programming • Michael Howard and David Le. Blanc • Writing Secure Code l Adaptation for college course • Leeds University first to offer l (sharing the lessons learned)

Hosted by Bad l Using automatic update to media player to add ‘adds’ l I shouldn’t have to pay for being able to correct flaws to your software

Hosted by Why most of Corporate America will never benefit from it.

Hosted by Some part of it will not be liked l So the whole thing won’t be adopted

Hosted by It will be too restrictive l I can’t control my own system, do what I want

Hosted by Fear l They’ll track me on the web • Security chip uniquely identifies computer • Who can identify the chip? l I can’t run what I want l Its’ going to break my systems

Hosted by Incompetence l Not implemented properly so seen as not secure

Hosted by Legacy systems l Can’t get rid of my thousands of applications l Can’t get rid of old hardware l 300 million windows users l 100 million of them still on windows 95

Hosted by Misunderstanding l Double negatives in Microsoft Security options l Multiple security recommendations even within Microsoft

Hosted by Expense l To develop • New hardware must be developed l To implement • Attitudes of users , management, IT must change • New hardware software much be purchased • New skills must be learned l To maintain

Hosted by Wrong Design Decision? l Shouldn’t put into hardware what we don’t understand. l Building security into the processor? We can’t deicide what security is? l Otherwise we are doomed to failure. l Very hard to change.

Hosted by Confused with DCMA l Some see as a prescription from the Motion Picture Association of America, record companies and the like l Seen as safer for copyright holders, less so for users and privacy

Hosted by Counter movements l Cable company Super DMCA. l Outlaws use of firewall other security efforts. l Passed, or similar bill passed in handful of states, under consideration in many others.