The Security Skeptic

More Thoughts on Damage Mitigation as the New Defense

Earlier this month, Kelly Jackson-Higgins interviewed me for a Dark Reading article, Damage Mitigation as the New Defense.  Kelly also sought perspectives from Richard Bejtlich (Mandiant), Neal Creighton (CounterTack), Bruce Schneier (BT Counterpane), George Kurtz (CrowdStrike), and Tim Rains (Microsoft Trustworthy Computing). In the article, Kelly explores “security’s new reality”, which put simply is a growing fatalistic acceptance that trying to prevent attacks by well funded and determined attackers is futile and that security professionals should shift focus to early detection, rapid mitigation, and damage containment.

The interviewed parties frame out the problem space and identify security technologies that are likely to play prominent roles in the solution space, but all acknowledge that the solution space is, at the moment, incomplete and that its efficacy is unproven. The resulting column gives a good insight into how the security industry may change course or re-invent itself in “era” of the Advanced Persistent Threat.

Editors often collect far more during interviews than they use or quote. With Kelly’s permission, I’m sharing a transcript of our interview as a complement to her column:

Jackson Higgins: “First, I’d love to get your thoughts on the premise that there’s now a philosophy of accepting that ‘you’ve already been breached, so focus on minimizing the damage.’”

Piscitello: “Organizations that are only now coming to the realization that their network perimeters have been compromised are late to the game. Malware ceased being obvious and destructive years ago. The criminal application of collected/exfiltrated data is now such an enormous problem that it's impossible to avoid. The notion that our only recourse is to focus on minimizing the damage, however, troubles me. It's a concession of defeat. I think this is wrong thinking. Would we respond to oil spills by only focusing on minimizing the damage? I'd rather have us adopt a more aggressive strategy where we actively seek out, identify (and where we discover) contain threats, identify root causes, and take measures to eliminate or mitigate these.”

Jackson Higgins: “Where did the security industry/vendors go wrong that led us to this phase? Did we fail as an industry? Why or why not?”

Piscitello: “Given the evidence, it's hard to argue we haven't failed. Plenty of blame and directions to point fingers and most of that is of little benefit.  Organizations have relied too long on traditional security architectures. Unified threat management, policy enforcement points, next generation firewalls are all incarnations of securing perimeters. They are relevant, necessary, but not sufficient primarily because they are mainly static defenses and most (especially the consumer, small business) largely rely on a knowledge based on what we've seen before. We need to be more proactive in looking for anomalous behavior.”

Jackson Higgins: “Where did organizations go wrong in how they deal with security?

Piscitello: “I think organizations have been too passive, placing too much trust in the security we've implemented to notify us when something's wrong with our network. We don't do enough active monitoring and analysis. Most organizations have little insight into what traffic is flowing across their network and through their firewalls. Most organizations don't really understand what the expected traffic mix looks like for their networks: they have no baseline to gauge "healthy and secure" We need this baseline to help us identify what is anomalous/suspicious and then we need to pursue these leads.

Jackson Higgins: “What is the next phase?

Piscitello: “Saying ‘the bad guy's in’ is marketing hype, not security practice. The solution involves more than re-packaging SIEM along with other or new monitoring, analysis and automated intervention tools. These play perhaps a bigger role in the future and it’s a good thing that we’re heightening awareness of how much they are needed. But we should also admit that we want too desperately to rely on automation. Adjustments to the human side – modifying user behavior, reducing administrative error, expanding the staff that defend networks and digital assets as well as their skill sets – are as desperately needed as new tech."

Why hackers keep breaking software: Insanity, or something more?

This Twitter thread instigated an email thread with Mitja Kolsek
(CEO of ACROS Security, www.acrossecurity.com, @mkolsek).
We agreed that it is worth sharing because the conversation goes 
goes to the root of several problems that frustrate not only Mitja
 and me, but others as well. Enjoy and join the conversation:-)

Skeptic: If doing same things over & over expecting different results = insanity why do hackers keep breaking software to show vendors it's breakable?

Mitja: Breaking software is also a social experiment, not just scientific/technical.

Skeptic: I'd love to hear why you think so but not in 140 characters.

Mitja: The premise that "doing same things over & over expecting different results = insanity" applies to repeatable experiments, where "same thing" actually means something very close to  "identical." E.g., physics experiments or highly simplified psychological ones.

The case with breaking software to show vendors it's breakable is far from that: not a single experiment can be convincingly repeated, not even with the same hacker and the same vendor (much less the same vulnerability). Much of the outcome depends on the mood, feelings, persuasions, ethics, culture, geography, ego and many other human/social parameters, making every try quite unique.

That said, the underlying hope of these researchers (occasionally including me)  is - among other things - that they will make a small difference in how the vendor percieves their products' security. And looking back a decade or so, there has been a difference made: without it, we probably wouldn't have SDLs, bug bounties and many vendors actually trying hard to make their products secure. (IOW, without it, security would be entirely a PR thing to them, but now it's only "mostly" that :)

But closer to your point, it arguably makes little difference if one finds and demonstrates a vulnerability in MSFT, Oracle, Adobe etc. products, as these vendors have already set their policies in stone, for better or worse.

Skeptic: Well put.

I do take issue with how we are trying to make software secure. You make the point that finding and demonstrating vulnerabilities isn't contributing to making products more secure. This goes beyond vendor policies and goes to a more fundamental problems with software in general; there's no real accountability or liability in selling software that is not secure. The same is not true in medicine or manufacturing (autos for example, and certainly every electronic device that runs software exposes a vendor to greater liability from faulty electrical problems than software). It's not merely policy, it's complete lack of incentive borne from a nearly self-regulating industry.

Mitja: Indeed. I went to the Schneier vs. Ranum discussion about software liability at RSA Conference - and Schneier (pro liability) just had better arguments for my taste. Besides, as hard as I try, I cannot think of any other way to elevate software security to the point where it would be damn hard to break it. Arguably the society may not actually need that level of security (hey, we haven't been hacked out of existence yet, so why worry?) but it is obvious that more and more critical processes are being more and more exposed to SW vulnerabilities: 10 years ago, it would not be possible to remotely attack an insulin pump or a car, 10 years from now there will probably be dozens of ways for embedded software to kill or injure you every day. And if we let that software be remotely exploitable, it won't be particularly good. Though the way things are going, that software will be 10 times larger than today, remotely accessible and with the same vuln/KLOC ratio.

OTOH, liability will likely be either avoided ("This product is not intended for use in this and that way, or any way") or passed on to developers or security reviewers - and finally to insurance companies, with the cost of insurance transferred to the buyers. I wonder if this cost will be so huge that it will suffocate the industry :/

Skeptic: I also think we have reached a point where everyone wants to break software and no one wants to write good (secure) software. Part of this is the result of hype, part glamor, and part lingering adolescence (not on everyone's part, but a great many who "profess" to hack certainly). How many conferences have speakers demonstrating cool hacks? Hundreds. Why? It's easy to show off what you accomplish, as in "look how I am remotely controlling the screen of this Android phone from my PC". How many conferences have speakers demonstrate how their software is resilient against malicious insertion of invalid input, or malicious installation of executable software? I won't say "zero" but let's agree it's a small number? Why? It's not easy to demonstrate, it's not viewed as clever. This is rather sad, don't you think? History and sports history in particular are full of examples of "great defenses". That so few people are interested in the glory of a defense, the pride of producing "safe" software, or recognizing this kind of excellence with the equivalent of a vehicle safety or medical practice excellence awards is surprising... and sad.

Mitja: I absolutely agree. Adding to the effect is the fact that one can actually *prove*insecurity (and glamorously demonstrate it on stage) while it is *not possible* (not just not-easy, like you said) to really prove security in any meaningful way. We have the notion of "secure until proven broken" engraved in our industry's DNA without reasonable expectations for that to change.

And I'm really not impressed any more with on stage live hacks, however clever the minds behind them - there's just too much of it everywhere and it's more like entertainment than security. (Although it's useful for offensive purposes.) It would be nice if SW got really hard to break some day. Then I would enjoy an occasional demonstration of a live hack.

Skeptic: This was a great thread, thanks.

I may cobble it together into a blog post, would you mind? It's the kind of discussion that ought to have more visibility than merely we two.

Mitja:  Fire away, just allow me to review it if you plan on quoting me :)

 

 

A Behavioral Analysis Unit assessment of a APT unsub

The US Federal Bureau of Investigation's National Center for Analysis of Violent Crime (NCAVC) has four Behavioral Analysis Units:

• Unit 1 deals with counterterrorism, threat assessment;
• Unit 2 handles crimes against adults; 
• Unit 3 investigates crimes against children; and 
• Unit 4 manages the Violent Criminal Apprehension Program-ViCAP.

An APT Unsub Profile

If the FBI were to create an APT behavior analysis Unit (5) dedicated to assessing APT actors, and on the extraordinarily small chance that the writers of Criminal Minds were to run out of horrible, real world crimes to base scripts on, the story writers just might profile "the APT unsub" as follows:

The APT unsub is a sponsored actor. We believe his sponsor is a nation state. He has ample funding and technology at his disposal. While not necessarily the author of malicious software, we believe he has knowledge of and access to executable code that exploits common vulnerabilities. 

He combines or modifies malicious software to penetrate network defenses, compromise hosts, monitor activity or exfiltrate information. The APT unsub's activities can persist without detection for long periods of time. He targets military, commercial, government, or critical infrastructure facilities and networks. The APT unsub deliberately seeks out and collects information that can offer a military, commercial, or similarly highly valued advantage for his sponsor.

Photo by PopCultureGeek

He is patient and meticulous, willing to sift through and correlate information fromsurveillance conducted across many hosts over long periods of time.

 The APT unsub studies targets carefully before acting. He is skilled at disguising his intent. Through social engineering initiated via electronic mail, the unsub manipulates individuals within a targeted organization or agency by instilling such fear or uncertainty that the individual acts in haste and in so doing, introduces an infection that is designe to spread across the infected indvidual's network. Malicious code operating on the infected computers are remotely controlled and directed by the unsub to look for information of interest to the unsub's sponsors. This is not a single attack but an occupation.

Unit 5 would next explain what the investigating parties should look for as they pursue the unsub.

Photo by Christophe Verdier

Look for unusual traffic patterns on your networks. Client computers that usually generate "request traffic" outbound may begin to generate "response traffic", typically of much larger volume and most likely encrypted. Devices on your network may receive login requests from unauthorized systems. New application traffic and executing processes associated with remote control protocols may appear in event logs on your client computers. Your client computers may begin to resolve domain names using resolvers that are unfamiliar or unauthorized. Remember. You're looking for new or different activity: any network or host operating behavior that is "never before seen" should be carefully examined for possible malicious intent.

Lastly, Unit 5 might act in the interest of public safety by attempting to inform the public.

While we are taking measures to identify and apprehend the perpetrators, we advise the public to become familiar with the APT unsub and the threat he poses. Most importantly be vigilant in monitoring for signs of this threat. We are circulating a handout that summarizes what we've discussed here. The handout recommends measures you should implement to mitigate the threat this unsub poses.

The handout would look remarkably similar to Mitigation Guidelines for Advanced Persistent Threats.

SOPA: a great example of failing to know your enemy...or your friends

Proponents of SOPA want Congress to believe that DNS filtering will strike a death blow to online piracy. They argue that preventing the domain names that criminals use for infringing sites from resolving to Internet addresses will prevent criminals from distributing copyrighted material or selling knockoff versions of "brand" goods. The premise is false.

Photo by LesHoward

Know Your Enemy

If we have learned nothing else about electronic crime in the past decade, we do know one thing for certain. Online criminals adapt.

When an attack, stealth, or evasion technique ceases to be effective, online criminals try something different. A recent article at Dark Reading reports that security consultants and government agencies are tracking a dozen groups responsible for advanced persistent threats. What these parties have learned about one group in particular provides a wonderful teaching moment for SOPA proponents. 

APT actors identified as the Comment Crew uses HTML comments (information for web developers that is not use by a browser to render a page) to remotely control infected computers that form its botnet. An obvious countermeasure here is to strip comments from web traffic. This will disrupt communications, the botnet will be contained, and additional measures will be taken to dismantle it. 

Blocking HTML comments will be effective against Comment Crew, but for how long? History suggests that the answer is "not long at all". Does anyone seriously believe that the Comment Crew will throw their hands up in dismay and abandon their criminal or state sponsored activities?  The Comment Crew will employ a different means to communicate with its bots; specifically, they'll find a way to bypass or evade the countermeasures deployed against them.  

An important aside here is that stripping HTML comments is a good example of a proportional measure. Organizations or ISPs will voluntarily implement the HTML comment filtering countermeasure at their own site. They will enforce it within the boundaries of their own administrative domain, and will try not to harm or interfere with the daily operations of other networks in the process. Blocking the domain names of every web site that hosts HTML containing comments is not proportional. It overreaches, the results are unpredictable, and there is a high probability of disruption of desired and intended operations or collateral damage.

An unintended consequence of implementing Draconian filters when a more granular solution would suffice is that not only will criminal actors seek a way to evade such measures but legitimate users will do so as well. In Mandates Can't Alter the Facts, Paul Vixie explains that users will evade mandated filtering by using any of "dozens if not thousands of off-shore Domain Name servers they can switch to with the click of a mouse." Paul's claim is corroborated by a recent Cisco 2011 Security Report that 7 of 10 employees admit to violating IT policies in order to access the Internet. We live in a world where the prevailing attitude is that Internet access is a basic human right, US citizens will no doubt scoff the law. 

[ED: With nearly perfect timing for my article, an Addon for Mozilla Firefox - DNS Evasion to Stop Oppressive Policy in America (DeSOPA) - is now available. "When turned on, DeSopa intercepts URLs, sends the base URL to three offshore DNS services via HTTP, makes a best effort to check that two of them are equivalent, caches the IP for the browser session, redirects to the equivalent URL using the IP, and substitutes out the domain name in the source code with the IP address for future requests."]

Comment Crew is one of dozens I could cite to illustrate that SOPA proponents neither understand nor respect their adversaries. SOPA presupposes that criminals, faced with a DNS filtering shock and awe campaign, will fold tents and leave the Internet. Good luck with this.

Friend or Foe?

Sadly, SOPA proponents neither know nor respect their friends nor do they distinguish friend from foe. Individuals who oppose SOPA are portrayed as "pro-piracy", insensitive to the harm and loss musicians suffer, and other equally ludicrous characterizations. 

Does anyone seriously think that the best Internet and security minds in the world have never considered broad brush filtering of domain names as a measure to stop online piracy? We have, and we concluded long ago that this measure will not work, is not scalable or enforceable, and not without consequences. Despite this, SOPA proponents argue something along the lines of "despite the warnings and criticisms you've offered regarding DNS filtering we still want to add the considerable weight of federal legislation and force everyone to use it because doing this is better than doing nothing." In doing so, these proponents dismiss and disrespect the members of the technical community that work daily to defeat all forms of online criminal activity. Ironically, some of these members are employed by the very organizations most vocal in supporting SOPA, and they are probably collaborating with security and law enforcement to takedown a piracy site as you read this article. 

How to manage passwords with some, little, or no effort

One of the most important password use guidelines is to never use the same password for multiple logins. To practice this rule you must remember potentially dozens of passwords for sites you routinely visit. Few people can remember large numbers of password, though, so let's consider several ways that you can manage passwords. 

"Remember me"

A common practice for Internet users is to use whatever method web sites offer to help you remember the password you create when you next visit the site, such as a cookie. A cookie is a set of information about a user that a web site leaves on your computer. The web site reads this information when you next visit the site. When you choose Remember me or the equivalent at a web site during a login attempt, you give the site permission to save your identity and password in a cookie.

This option is ubiquitous and convenient; in fact, it's such a common practice that people actually write and publish scripts to force browsers to store passwords even for sites that prohibit it.

While convenient, this choice has certain risks and unknowns. Cookie characteristics like persistence and quality of encryption vary from site to site. Certain cookie implementations are vulnerable to theft by malware (e.g.,  ZeuS), poisoning, and session hijacking attacks . Since you can't be certain how every site deploys cookies, it's worthwhile to learn how sites you visit use them. If you are a convenience seeker, however, this is probably *not* something you are likely to do. 

 And frankly, you can do better.

"One password to remember them all..."

Rather than rely on cookies, consider securely storing the passwords for your many logins using a secure personal data or password manager. These best among these store all your passwords or personal data securely using strong encryption methods. Typically, the only password you must remember when you choose this alternative is the password you create that "opens" your encrypted passwords file. 

When you visit a site that challenges you for a password that you've stored, launch the password manager, and it will prompt you for the location of your encrypted file, and then prompt you for your "master" password. Keep your USB safe. Scan it routinely for malware (especially if you choose not to disable write access!). Many password managers are available. Consider trying the oft-recommended 1Password, KeePassX or MacOS Keychain services. Certain password managers are available for several devices and operating systems. By choosing one of these you will be able to use a familiar software, UI, and a common passwords file. If this is too much work, you can choose to not try to remember passwords at all, but instead make use of password reset features. I call this alternative...

Create a Password Manager Thumb Drive? Consider having your password manager create your encrypted passwords file on a removable drive rather than on your PC/Macintosh hard drive and install the software on the drive. You'll then be able to use the password manager on multiple systems.   Prepare the USB drive as follows. Securely erase and reformat (1, 2) a removable drive so that you begin with a data and malware free drive. Disable write access on the drive (3, 4 for Windows, 5 for Mac OS)  Finally, install the software on the hard drive, create a strong password (my article) for access to your passwords file, and enter your passwords. As a final step, back up the file(s) on a second removable media and store this backup copy in a safe location. Note: If you need to add passwords to the file, you can enable write access for this purpose then write-protect the drive when you are done. The same articles that explain how to disable write access explain how to toggle from read only to read/write. Warning! If you have a history of losing USB drives, however, you do risk that whomever obtains your drive may attempt to decrypt your password files using decryption or password cracking tools. You run this same risk, of course, if you lose your laptop.

Set, forget, reset: The Poor Man's One Time Password

When you first visit a site, create a strong password. Other than having to remember this string long enough to confirm the password you compose, don't bother to remember it at all. When you next visit the site, use the Forgot your password? feature, wait for the site to send reset instructions to the email you provided when you created your account, and then follow the instructions to create a new password.

This method emulates a one-time password system. Note that for many sites, you may not even have to remember your account ID. Before you dive headlong into this "free at last" strategy, recognize that there are some risks to relying entirely on this method. The site may change its password recovery practice. You may change or (by changing employers or email providers) lose access to an email address. Your email account might be hijacked. Thus, while set, forget and reset is not a bad strategy for sites you visit infrequently it is probably not the best choice for important sites such as your bank, or sites you frequently visit.

Closing Remarks

We all have far too much information to manage or remember. By adopting some form of password management, you not only prune what you need to remember, but you'll better protect yourself against impersonation.

How much activity on the Internet is truly consensual?

A tweet from LondonCyber, presumably the official account for the London Conference on Cyberspace, attributes Roger Wilkins, Secretary General, Attorney General’s Department, Government of Australia with asserting that most activity on the internet is consensual.

At times, it does seem that Internet users are little more than an enormous population rushing about applying for or declining invitations to clubs, voluntarily. It's more, of course, and SG Wilkins no doubt made additional comments not conveyed in the tweet. 

I wish that SG Wilkins had made use of the superlative to describe other aspects of Internet activity that are decidedly non-consensual; for example,

• Most user or behavior tracking is non-consensual. It's hard to claim tracking is consensual when there is no notice of tracking and no consent granted. 
• Most transport and delivery of unsolicited commercial email is non-consensual. No ISP I know has a clause permitting transmission of spam in its terms of service/acceptable use.
• Most malicious registrations are non-consensual. Again, registrars generally don't invite criminals or miscreants to register and misuse domain names.
• Most infections resulting from drive-by malware downloads are non-consensual. You can arue that Harry gets what he deserves when he surfs indiscriminately for p0rn but it's not likely he was seeking or consented to have his computer pwned and botted.

SG Wilkins' assertion is, statistically speaking, true. His analogy, "it [the Internet] is like a club. if you don't like it, don't join it" is an intriguing observation. Consider:

• Most users consent (expressly or implicitly) to disclosure of their personal data, opinions, photos, and more when they "join" social networks. 
• Most users consent to whatever terms of service a social network imposes for the sake of membership.
• Most users consent to any terms of service to obtain a free service or membership. 

Much of Internet activity is indeed consensual. Much is not. Think of the different impact SG Wilkins' tweet might have had if he'd said much of the activity on the Internet is consensual but uninformed. 

Is a separate highly secure Internet needed?

According to a Yahoo! News article, an FBI official has suggested that "one way to protect critical utility and financial systems would be to set up a separate, highly secure Internet." FBI executive assistant director Shawn Henry refines this notion by explaining that security threats against critical infrastructure cannot be solved by throwing more technology at the problem and adds that eliminating anonymity  is also an important consideration. Gen. Keith Alexander, director of the National Security Agency weighs in, calling for Pentagon and Intelligence agencies to improve security. Alexander adds that "when a computer network is infected, someone should be able to disconnect it".

Photo source

A colleague on a security mailing list stimulated a lively discussion by asking whether it's possible to build such a network, tempting the list members with that all-powerful aphrodisiac - unlimited funding - and the equally compelling incentive, "and your life depends on solving the problem." My answer (somewhat refined from my post) is  Not with current, commercially available technology, software and user behavior.

The Myth of Unlimited Resources Even with limitless funding, and even if you were to start from scratch, adopting all the trusted computing and networking paradigms we have considered in various forums over the years, I am still skeptical that you would accomplish what you seek.  While commercial vendors and government approved contractors may cringe at the thought of turning down the challenge of exhausting limitless funding, Henry is correct when he says "We can't tech our way out of the cyberthreat". But suggesting that rooting out anonymity and insisting on having the ability to decouple burning cars from the train are essentially "tech" responses. Limiteless funding is a siren's call. By combining this with a missive as visceral as  "your life depends on finding a solution", you may rally the troops but you are very likely to fail because you have omitted a fundamental consideration

Photo by spikenzie

We can't secure the human OS

We have very little knowledge for how to secure the human OS. Until you can secure the human OS, you cannot expect to dramatically reduce the threat landscape.

The solution to  scuring the human OS doesn't involve carving out separate secure networks - and there would eventually be many, not just one. For example, you could significantly reduce the likelihood of falling victim to a compromise of your online banking if you were to use a live (bootable) CD, enable a network adapter, launch a browser, and only connect to your bank. For some banks, you'd even be challenged to establish your machine ID each session. Some folks would be happy to do this (I do...) but the solution does not scale to large populations of impatient users.

Be certain you can secure the human OS and that you take that security model to scale or you are simply reinventing the wheel.

Cracking daddy's iPad

Simple passwords are mere child's play.

Avoid default and popular passwords.

Compose and use strong passwords.

There are only three true Internet privacy threats

What do Top Ten lists of Internet Privacy Threats have in common with US FBI Ten Most Wanted lists? Both attempt to keep the public aware of current, most egregious offenders. While these forms of warnings are helpful, they are limited in at least two ways.

Top Ten lists call attention to a small number of suspicious or bad actors. This may be effective in the case of fugitives or terrorists, but it is dangerously misleading for Internet threats, where privacy abuses are as prevalent among small time actors as any online presence that is visible enough to make the top ten. Simply put, when you tell Internet users “here are the folks to worry about”, you risk having them fail to consider the thousands of online presences where collection, misuse or mishandling of personal information is as much of a threat if not more so.

More importantly, Top Ten lists set users up to micro-manage privacy threats. Such lists distract Internet users from considering the meta-issue. They list the privacy concerns for social networks, mobile operators, subscription portals, emerchants and clouds. They explain in some detail how to opt-out, filter, restrict access, etc. This has the unintended consequence of convincing Internet users that protecting personal information involves a unique effort for each site they visit. The scaling properties of this kind of solution are poor for automation, and worse for the Human OS.

Teaching Internet users how to mitigate threats at a micro-level is useful. Offering Internet users first principles regarding privacy threats is essential.

Let's look at these more closely:

Private sector

Any non-government, commercial, not for profit, free or for fee site operator that posts or collects any information that is personal or sensitive in nature is a potential privacy threat. Only some of the private sector collects location, behavioral, or personal identifying information for the purpose of influencing or tracking you in some manner. 

Public sector

Any government agency that collects or publishes any information that is personal or sensitive in nature is a potential privacy threat. Government agencies may be more tightly regulated with respect to collection, storage, and sharing of personal data; however, regulations vary across governments and certain agencies within governments may have considerably more license to access personal data than others.

You

You are ultimately responsible for containment or leakage of data. Consider the following as a first principle for protecting your personal data: 

Whether private and public sector actors, it’s important to recognize that (i)  each stores personal data you disclose, (ii) you have little insight into how competently they protect your personal data, and irrespective of what filters or restrictions you may apply through some user interface, (iii) you don’t always know exactly how and with whom they share your data, and (iv) policies change.

Set aside the public outrage and clamor for better privacy controls, more transparency and accountability. These are important issues, but they won't help you on a day by day basis.  Apply this principle each time you have a choice to share or disclose anything you consider personal or sensitive. Using the best information available, judge whether you are truly comfortable how a site measures up to (i)-(iv). You won't achieve perfect privacy but you may have fewer moments of regret or embarrassment, and you may avoid falling victim to online predators.

If the best choice seems to be to not share or disclose, it probably is...

What's missing from security awareness programs? Human awareness

The central theme for many security awareness month articles is "Awareness programs are failures", quickly followed by a rally cry, "We need to change them." This is too vague an objective.

Think Differently

Lance Spitzner of Honeynets Project fame thinks we need to think differently if we truly hope to create effective programs. I agree. But there's more than merely  thinking differently to consider. We need to stop thinking in a vacuum.

Lance claims "To have an impact and secure the HumanOS, we have to start thinking differently about awareness and education." What I conclude from this comment and shared with Lance is that we need to admit that as security and technology professionals, we are ill equipped to develop effective security awareness programs without help from others. 

Our orientation to security awareness is shaped by what we know  about threats, risks, and exploits and the techniques and technology we can use to mitigate them. Security success often relies on knowing our enemy. We study their methods, means and motives. We track their behavior.

Know Your Friends

We know more about our enemies than our friends. This is our collective blind spot. Imagining that the people for whom we design security awareness programs have the same vested interest in, fascination with, or time to "be secure" is pure folly, hubris or both.  Our enemies, however, study our friends (our users): studying how users behave, observing how quickly user interactions with devices become rote, and teasig out what makes users act without thinking form the foundation of social engineering. 

Expand the Talent Pool

Success at raising security awareness rests on knowing our friends. We don't study  the HumanOS that the average Internet user boots up when he wakes as much as we study criminals or miscreants. Fortunately, others do. 

Sociologists study social activity. Psychologists study human behavior. Collectively, they study most of the critical functions of the HumanOS. Why are we not engaging experts in these fields to help raise security awareness? 

If we want to experiment with a psycho-social-technological approach to security awareness, perhaps we can start with social engineering. Social engineering is arguably the most widely used tool in the criminal tool kit. Social engineers have a distinct advantage on the ecrime playing field. They draw upon decades of exhibited Internet behavior and millennia of successful acts of fraud or deception. Often, with almost trivially simple technology they are able to steal, defraud, coerce, or impersonate with almost a free hand.

Security professionals know how criminals victimize users.  We offer "day late, dollar short" awareness programs of the form "here's how phishers steal your credentials, so don't fall for this kind of scam". This approach is as successful as telling people "eat fewer calories than you burn and you'll lose weight". Both are well-intentioned but ineffective because they unrealistically assume that the fix is obvious and changing behavior is easy.

Change Behavior not Software

Effective weight loss programs involve education, coaching, counseling or activites that are less oriented to helping individuals to manage anxiety, frustration, urges, or other reasons that cause them to make poor diet choices.

Weight loss programs aren't designed exclusively by physicians or scientists who study nutrition, and neither should security awareness programs be designed by experts who study social engineering or ecriminal activity. The same is true for healthcare awareness programs and month long campaigns. Breast cancer and heart disease awareness are noteworthy and effective examples. These effectively incorporate sociological and psychological considerations into awareness program designs. If we are unwilling to adopt similar orientations and strategies, we may continue to fail to make awareness programs effective.