Stephen Mori iSOA Security Adviser
Since this is my first post to the ISOA Group blog, a few words
of introduction are in order. First of
all, thanks to Bryon and Cheryl for inviting me to join iSOA Group as their new
Security Adviser; I will be helping to articulate the development of iSOA
Group’s security practice.
My brief and abbreviated history spans forty years in various
technology roles: systems analyst,
coder/developer, software designer, consultant, systems architect and security
engineering and management culminating in the role as Autodesk’s first CISO
(retired 2012). Since my retirement I
have continued with a few judiciously selected consulting gigs. Retirement hasn’t allowed me much time for gainful
employment.
I look forward to being a regular contributor to this blog;
exploring what are hopefully topical issues across security, privacy and
trust. A particular interest of mine is
cyber-trust. There I’ve used “cyber”,
now I’ll actively seek to avoid over-using it since others are handling
that. No small part of that interest is
how we, as security professionals, bring the same sort of innovation to
defending our company and critical assets as the bad guys bring to uncovering
new ways of threatening us and our vital information assets.
But, first a look back to set the stage for future entries. It is 1970 and Willis Ware, early computer
scientist and security pioneer, delivers a commissioned report to the Advanced
Research Projects Agency - predecessor to DARPA. Known as the “
Ware Report”, officially titled
“Security Controls for Computer Systems: Report of the Defense Science Board
Task Force on Computer Security”, the report was only recently declassified by
the DOD. Why spend time looking at a 46
year old resource? Simply because it
remains a resource and it helps me make my point about the need for innovation,
while respecting history.
The report charter was to deal with the risks associated with the
rapid growth of “multi-access, resource sharing computer systems”. Rapid being relative, the authors could not
have envisioned today’s democratized Internet, hyper-connected world of social
media, computers in the form of watches, tablets, smartphones, let alone IoT
enabled appliances; and, of course, virtual servers, Amazon Web Services (AWS),
Docker, et al. That charter remains
valid in a world where factors are more connected - many factors faster than
real-world 1970.
“Providing satisfactory security controls in a computer system is
in itself a system design problem.” Did
Mr. Ware anticipate Agile development methodology, DevOps, and proliferating
App Stores?
“A combination of hardware, software, communication, physical,
personnel and administrative-procedural safeguards is required for
comprehensive security.” Defense-in-Depth, anyone? Implied in the statement are
IDS/IPS, Next Gen firewalls, vulnerability management software, SIEM,
multi-factor authentication, security awareness, policy and technical controls.
What of Advanced Persistent Threats, intentional and accidental
internal threat actors, and (Distributed) Denial of Services? Systems ought to be “...acceptably resistant
to external attack, accidental disclosures, internal subversion and denial of
use to legitimate users.” Effectively, this covers anything connected to the
Internet with open access to the Web, e-mail, text.
Finally, the report outlined what arguably remains the most
common system vulnerabilities:
accidental destruction of data by a system failure, user or
administrative error, active attacks that exploit weaknesses in user credentials,
or deliberate or accidental flaws in software, “unauthorized entry
points...created by a system programmer who wishes to provide a means for
bypassing internal security controls...”.
All of which evoke directory attacks, credentials/identity theft, and back doors.
The “Ware Report” pretty much covers the CISO’s world.
So that is my bit of context setting. Future entries will hearken back to these
legacy security issues, but with an updated perspective and current
terminology. My first thought upon reading
summaries of the “Ware Report” is the greatest progress we’ve made has been in
creating new acronyms. We need to endeavor
to get just as good at developing innovative responses to these classic and
evolving threats as we are at simplifying technical jargon.
