Re: The Vernacular of Security Narrative

From: Walter Roberson (roberson_at_ibd.nrc-cnrc.gc.ca)
Date: 01/03/05 

Date: 3 Jan 2005 16:35:22 GMT

In article <1104766160.929162.273240@c13g2000cwb.googlegroups.com>,
krasicki <krasicki@consultant.com> wrote:

:Let's talk about your assumptions. First the corporation needs to
:process millions of transactions per time frame. How many are
:encrypting everything sensitive?

For remote access? If they have that many transactions per second
then they're likely encrypting -everything-. That's what VPN
Concentrators and devices such as Cisco Secure Sockets Module
for the 650x router series are for [$US 50000 per module!]

Financial institutions already encrypt all remote transactions.
There have been a number of descriptions over the years about how
Automatic Teller Machines (ATM) work; there are both session keys
and per-device keys (which get changed periodically.)

:But access is not about location, it is about trusted individuals. And
:my concern is not that trusted individuals go rogue but that some
:combination of trust is compromised by a fellow employee who socially
:engineers their way into unauthorized access and chooses to exploit it.

:What I am suggesting is that in such a case, what additional measures
:can be applied to sensitive applications to reduce the risk of
:compromise?

DCE (Distributed Computing Environment.) It's a pain to set up the
first time, and your application has to be DCE aware, but with it
you can protect by any of a number of criteria, including location
[right down to the device], username, time, and 'view'. Information
on the LAN is encrypted (kerebos).

:The task is to increase the temporal element so that the window of
:opportunity to successfully exploit an insider's glimpse of security is
:eliminated. Let's say a password rotation happens every three months.

If we are making the assumption that this is a big business with
a lot of money at stake and a lot of transactions going on, then
unless the business is very stupid, the business isn't going to rely
on just usernames and passwords. Businesses as big as the ones
you are hinting at usually aren't -allowed- to use simple
username/password protections.

In my opinion, the greater risk is in businesses which are
large enough to handle a fair bit of money, and yet small enough
or distributed enough that the cost of implimenting real security
would put a noticable dent in their profitability. If a company
has a *net* profit of [say] $10 million per year [say on $100 million
in sales], and implimenting a real security architecture is going to
cost [say] $3 million, then they are probably not going to impliment
serious security unless the costs can be distributed over a number of
quarters. Cheaper for them to absorb the occasional half-million
dollar theft than to put in $3 million in real security... especially
if they can get insurance against theft. But for a company like a bank
or Microsoft, $3 million in security is peanuts. Similarily,
$3 million is not much for a hospital, which could be fined
a million or more dollars for not putting in sufficient security
to meet patient privacy laws. 

-- 
WW{Backus,Church,Dijkstra,Knuth,Hollerith,Turing,vonNeumann}D ?

Relevant Pages

  • -- WINDOW Log --
    ... When encrypting, be sure to specify that the output is to be ASCII, ... Users rely on your remailer for security. ... Reliable introduces several new directiveremailer directives, ...
    (sci.crypt)
  • Re: PGP scripting...
    ... > secret keys and the encrypting process' public key. ... In a private-key system either machine could be ... passphrase entry and batch processing ... security is low as each end stores keys and/or passphrases ...
    (SecProg)
  • Re: Encryption of printer files
    ... security specs. ... The problem lies in the fact that if we are so worried about encrypting the ... internal network it could fall back to the above security specs. ... risk can be limited with an encrypted session to ...
    (comp.unix.sco.misc)
  • Re: Useless File protection?
    ... In fact this is how security on a filesystem *must* work in an ... There is another way to secure your data known as EFS, Encrypting File ...
    (microsoft.public.security)
  • [NT] NTFS and PGP Interact to Expose EFS Encrypted Data
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... PGP 7.0.3 Freeware, a product of Network Associates, supports ... As explorer works it is way through the file system encrypting the ... The permissions on the temporary file are set to a very ...
    (Securiteam)