Skip to main content

Best Practices

Posted by: admin 14 years, 9 months ago

There were a number of tweets yesterday about "best practices".  This took me back to Adam Shostack's post at New School on his best practice: Think.  Now I am throwing my hat in the ring with:

Improve.

This best practice was in part in reaction to the conversations about APT or Advanced Persistent Threat, or as CSOAndy says: Adaptive Persistent Threat and to some conversations around the pain being felt right now around Zeus and other malware by banks and (mostly) their corporate banking customers.  Adaptive is the correct word here.  Whatever security mechanism you put in place to protect yourself will eventually be circumvented (most likely) or defeated. 

What this means that security is always going to be additive.  You can't turn off your firewall just because today's threats go around them.  Those old threats are still out there.

It also means you should think about how you structure contracts with vendors.  I've long believed that the "permanent license" was not.  An annual license makes more sense when your goal is to keep your vendor improving their product. 

An interesting sub-practice implied is to start simple. As some of you may know, we have a partner in the corporate banking space, Online Banking Solutions.  They have embedded our software tokens  for two-factor session and mutual https authentication into their products, including M-Secure Browser, a hardened browser they have in production at a couple of banks.  At a recent joint presentation, we were asked if their USB version has "FIPS-whatever encryption".  The answer is no, but it certainly could be.  It certainly would be more secure if it did, but the current solution solves the current problem of Zeus and other MiTB attacks and traditional phishing and MITM attacks.

The problem with running on a hardware-encrypted USB drive now is that it is expensive to do and might not protect the user from the next attack.  It might be better to do transaction authentication on a separate wireless device.  Or to require two digital signatures/authentications just like checks that require two signatures.  Or maybe it will be to use a hardened USB drive with it's own hardened version of Linux and a hardened, single-site browser.  The point is not to over-spend now and plan on improving.

 

Current rating: 1

Recent Posts

Archive

2024
2022
2021
2019
2018
2017
2016
2015
2014
2013
2012
2011
2010
2009
2008

Categories

Tags

Authors

Feeds

RSS / Atom