NSA Contractor Edward Snowden Leaked Secrets - A Classic Example of Cyber Security Risks Posed by Trusted Insiders

Folks,

Edward Snowden needs no introduction, and I'm not about to opine on his actions.  What I would like to share my 2 cents on is the nature of this "security incident", and what government and business organizations worldwide can learn from it.



A Trusted Insider

This incident was a classic case of "unauthorized information disclosure" by "a trusted insider" with unrestricted access.

In this case, the "insider" seemingly had virtually "unrestricted" access to information, and the nature of information he accessed and divulged was so highly "sensitive" that the impact of its disclosure was colossal enough to cause a national government and a clandestine agency, potentially substantial harm, and embarrassment.


Risks to Cyber Security from Trusted Insiders

Unlike a traditional cyber security incident, involving an attack from an outsider, such a security incident is much harder, but not impossible, to protect against, because it involves a "trusted insider."

The threat of a security compromise from an insider always exists. However, few organizations take it seriously, perhaps because they perceive the "likelihood" of it to be low, or because they "perceive" the damage to being usually manageable, in that your average insider does not have administrative access and thus the extent of confidential information to which they could obtain access is usually limited.

However, in situations, wherein a highly trusted IT/Systems Administrator is involved, the damage can be substantial, as was the case here, because such admins almost always have unrestricted access to virtually the entire IT infrastructure, and are trusted with the great responsibility of safeguarding the organization's information assets.

So, when a highly trusted administrator turns malicious, there is very little you can do to stop him/her from inflicting substantial damage to the organization. That is because he/she can access, tamper, divulge and destroy virtually any organizational information asset he/she likes at will.

For example, should an accountant at a defense company leak the earnings numbers before their scheduled disclosure time, the impact would be limited to legal fall outs, but should a systems administrator leak the entire set of confidential blue-prints of the next supersonic plane the company was working on, such a breach could effectively put the company out of business.

This is why it is of paramount importance to ensure that organizations minimize the number of highly trusted administrators to an ABSOLUTE bare minimum. The importance of this elemental cyber security measure cannot be over-stated.

A Trusted Administrator

I know a thing or two about this, because I authored Microsoft's 400-page official white paper on delegating administration in Active Directory deployments, which deals with this very subject i.e. how to minimize the number of highly privileged administrative personnel to a minimum by delegating administrative authority based on the principle of least privilege.

Just one more thing. The method/system that NSA (and 20K+ organizations worldwide) would most likely have to use to find out who has what administrative powers in their IT infrastructures is protected by a patent, that I happen to be assigned.

(But I digress.)


Managing Risk Posed by Trusted Insiders with Unrestricted Administrative Access

The risk posed by a privileged trusted insider can almost never be completely eliminated because you will always have at least ONE person who will need to have (/ be able to obtain) unrestricted administrative access across the organization's IT infrastructure.

 

However, in most cases, the "likelihood" of this risk being materialized can be substantially minimized by reducing the number of highly privileged administrators, and by ensuring (to the extent possible) that those who do possess such unrestricted access are highly trustworthy and understand the serious implications of the misuse of their unrestricted administrative power.

Practically speaking though, if I were to share with you just how dismal the state of excessive administrative access entitlements is in most business and government organizations worldwide, you might fall out of your chair!

For instance, you'd be surprised if I told you just how many companies out there have 100s of Domain Admin accounts. In fact, in one company we came across, over 700 individuals had the ability to reset the password of the CEO's account, and login as the CEO on-demand within seconds. The only thing more scary is that no one including the CEO or these 700 admins knew about this. (Interestingly, one of their employees used Gold Finger Mini to figure this out in 30 seconds.)

(Anyway, I digress again, so back to the point at hand...)


What Can Organizations Do To Minimize The Risk Posed by A Malicious Trusted Insider?

The #1 thing organizations can do to minimize this risk is to understand and acknowledge just how serious and damaging a single such security incident can be for the organization.  (ONE such incident is all it takes to inflict substantial damage.)

Executive Management

Specifically, what is needed is for executive management to require and demand the enactment of adequate security risk management measures aimed at reducing the number of insiders who have unrestricted access to the IT infrastructure i.e. Domain Admins, Enterprise Admins and the like, i.e. folks whose job titles read "Infrastructure Consultant" etc.

Without executive support, this problem can almost never be adequately addressed.

Executive support is necessary because without it, the organization's IT group may not be able to drive the changes necessary to accomplish the reduction in the number of administrative accounts.

The #2 thing that organizations can do once executive support is in place, is to assign a high-priority IT project aimed at identifying the list of all individuals who have unrestricted or widespread access across their IT infrastructure.

Administrative Access Audit

This list should then be vetted out to understand the business requirements that drive/necessitate the provisioning of such unrestricted access for the identified individuals.

The vetting process must involve an analysis of why each of the identified individuals currently possess and require unrestricted administrative/system-wide access, and for each case wherein such access is not actually required, actionable steps must be identified to reduce/revoke such unrestricted administrative access, such that individuals only possess the least amount of access they need to fulfill their responsibilities.

The #3 thing organizations can do, is enact the steps identified in #2 above to minimize unrestricted administrative access to a bare minimum, by leveraging delegation of administrative responsibilities based on the principle of least privilege.

In other words, administrative access should be locked down based on the principle of least privilege.


Maintaining Security Post Initial Risk Reduction

It is not sufficient to minimize the number of privileged account holders, and then forget about it, because, unchecked, business requirements will invariably cause this number to get out of control again.

Thus it is imperative that all subsequent access provisioning requests be fulfilled in adherence to the principle of least privilege. This takes effort and time, but it is the harder right.

Also, to maintain security, on an ongoing basis, organizations should also periodically audit administrative access to ensure that the number of folks with unlimited /unrestricted system-wide access (as well as delegated access) is in line with what is expected, approved and authorized (i.e. not in violation of established business policy.)

It is also important to institute additional protection and monitoring measures to protect all accounts that have all-powerful administrative / unrestricted / system-wide access. In addition, it is equally important to establish policies that clearly state the ramfications of abuse of administrative power, and to communicate them to all powerful administrators. This deterrence measure is necessary.

If organizations enact just these 3 simple measures listed above, they could substantially reduce their attack surface, and thus reduce the likelihood of a successful "security breach" by a trusted insider.

For instance, you could use these measures to reduce the number of individuals who have unlimited administrative access from say 400, down to 40. Now, 40 is still 36 too many, but it is 360 less than the existing and unacceptable level of 400. (The number 400 is arbitrary, albeit representative of many large organizations, and primarily used to make the point.)


Time's Up

Given additional time, I could elaborate further, and provide additional and detailed guidance, but for now my 10 minutes are almost up, so this will have to be it.

My apologies if my 2c above is not proof-read by an editorial staff. Given my role at Paramount Defenses, I only have a few minutes each month to spend on "blogging", so this will have to be it.

Best,
Sanjay.

PS: There's no dearth of commercially motivated advice out there that seems to suggest the deployment of certain access management solutions in such situations. I'll add just this much - no software solution "in and by itself" can reduce this risk as much as the single fundamental step of actually reducing the number of individuals who possess unrestricted privileges can, because you cannot protect a system from the administrator of the system, because the administrator is, by definition, a part of the system's TCB (Trusted Computing Base.)

PS2: Here's something to think about in light of Mr Snowden's actions - http://www.sanjaytandon.com/integrity.html

Just 10 Simple, Elemental Questions Impacting > A $ Trillion of Wealth

Folks,

This year, I'm going to ask just 10 simple, elemental questions related to Cyber Security in general and Active Directory Security in particular, that will go a long way in protecting over a $ trillion of wealth.

I'm going to ask these questions to the 1600+ members of our global community spanning 100+ countries worldwide.

A $ trillion may sound like a big number, but it isn't really that big, becaue big and small are all relative. If you take into account the fact that Active Directory Security impacts over 85% of organizations worlwide, a $ trillion's not too much. These questions impact the security of over 20,000 organizations worldwide from the United States Government to Goldman Sachs, and from Google to Cisco.

For those interested in being privy to these questions, you're welcome to join our global Active Directory Professionals Group.

Thanks,
Sanjay

The WikiLeaks Security Incident – A Warning and a Wake-Up Call to Organizations Worldwide

Folks,

We’ve all heard of the infamous WikiLeaks incident by now.

There is THE incident, and then there are opinions dime-a-dozen on the incident. There is also the frequent use of the word “cyber-war” by journalists in reference to childish DDOS attacks.

It is not my intention to offer just another opinion, like perhaps Mr.Bruce Schneier, who in his own words "doesn't really have much to say about it", but (I think nonetheless) felt the need to do chime in.

As some of you may know, virtually the entire U.S government, from the Department of Defense (DOD) to the U.S. Congress, runs on Microsoft's Windows Server platform, powered by Active Directory, which is at the very foundation of their security.

As former Microsoft Program Manager for Active Directory Security, I do actually have much to say about it, but in the interest of time, shall keep it brief, and share it with you in the form of an information security practioner’s perspective on the incident.

So, if I may, here's my 2c on this incident -

It is public knowledge that at the heart of the WikiLeaks incident is the leak of United States Diplomatic Cables, wherein the whistle-blower website WikiLeaks started to publish classified documents of detailed correspondence between the U.S. State Department and its diplomatic missions around the world.

The leak has since been characterized as being a threat to national security of many a nation and even condemned as an attack on not just the U.S. but all governments. (Also, as mentioned previously, since then, this has been the topic of substantial media coverage and there have been numerous articles written by as many journalists on the subject, each entitled to their opinion.)

However, if one were to objectively view the incident from an IT security perspective, I believe that there are two distinctly separate incidents involved here –

1. Unauthorized Disclosure of Information by an Insider – At the core of the incident is the act, by an insider, of obtaining access to, and subsequently disclosing, to an outsider, over 250,000 U.S. government documents (which constitute the property of the United States government) including over 130,000 unclassified documents, about 100,000 documents classified as "confidential" and about 15,000 documents classified as “secret”.
    
2. Information Dissemination by an Outsider – Then there is the act, by a party external to the U.S. government i.e. WikiLeaks, involving the dissemination of this information, i.e. making these documents indiscriminately and globally accessible to all on the Internet. Whether this was done with or without regard to the impact that doing so could have on impacted entities (i.e. the United States government, and the individuals, embassies and governments of whom there is a mention in these documents) is really immaterial.

As to the former i.e. unauthorized disclosure by an insider, at its essence, this was the most elemental form of a security incident, in which a trusted insider who had access to a confidential organizational IT asset (or in this, a vast set thereof) willfully violated organizational security policy by disclosing this (set of) organizational IT asset(s) to one or more parties external to the organization. The only thing that made this security incident so serious was the fact the value of the IT assets whose confidentiality was compromised was so high that it could potentially have had a real impact on national security and international relations.

As to the latter i.e. information dissemination by an outsider, that was an incident in which an entity chose to disseminate potentially sensitive information (in this case, these documents) delivered to them, indiscriminately by publishing them online. As to the legality of this action by this outsider, while White House Press Secretary Robert Gibbs recently said that "…the stealing of classified information and its dissemination is a crime,” I for one am not going to opine on the legality of the dissemination of such information, as that is something for a court of law to decide.

From a security perspective, IMHO the damage was done the moment these IT assets (i.e. these documents) crossed the proverbial organizational boundary (i.e. were disclosed to an external party), because from that point on, these documents were out in the open, and could easily have been silently sold to the highest bidder, or delivered to a long list of entities who could substantially gain or profit from them, whether they be international terrorists, rogue regimes, crime syndicates and so on.

In fact, one has to wonder if it could have possibly been be far more damaging if these documents were stolen and sold to say, an international terrorist organization, and the fact they were stolen and now in the hands of a terrorist organization, would never to have come to light.

At the end of the day, this unfortunately was a serious failure to adequately protect the confidentiality of what it largely considered classified U.S. government information, and it does raise many security valid questions.

For instance, if the U.S. government does have a least-privilege access (LPA) security model in place, how come three million individuals had access to these sensitive documents? Or for that matter, did three million individuals really have a business need to have access to these sensitive documents? If so, one has to further wonder as to how this access was ultimately enforced? In fact, many questions come to mind, and I’m certain many such questions will undoubtedly be raised during their own internal investigations.

If I may digress for a moment...

It is worth mentioning that when it comes to access enforcement, there is unfortunately almost always a disconnect between the intended security policy and the implemented security policy, primarily because implementation involves specification of access control intent in computer systems, and that can get very complicated and difficult to manage, and rather quickly so.

For instance, numerous aspects, such as the lack of a single point of administrative control, arcane nesting of security groups, administrative churn over time, and the specification of access controls at various levels (e.g. file, folder, server, trust etc.) all have a direct impact on the effective resultant access on an IT asset, and consequently on the ability of an organization to effectively maintain and control access to their IT assets.

Consider for instance the set of access controls involved in protecting a set of documents residing on a file server joined to the Active Directory. As you may know, there are multiple access control points wherein security must be specified. For instance, there is the access control list (ACL) on each individual document. Then there are ACLs on the folder(s) containing these documents, and ACLs on the share itself. In addition, there is the list of individuals who are authorized network access to this domain joined computer and then there the domain security groups that are used to provision access at each of these access control points.

On a related note, one critical yet often overlooked aspect of security today is the need to (accurately) assess and review the identities of all individuals who can influence (modify) the memberships of the very security groups used to control access to organizational IT assets.

For instance, while it is important to review the membership of a security group being used to control access to a specific IT asset, it is equally important to determine and review exactly who all can modify the membership of that security group as well, because, ultimately, whoever has this ability could instantly change the membership of the group, and consequently obtain or facilitate access to every document/IT asset being protected by that group. (This is one such critical area where our innovative Gold Finger access assessment solution for Active Directory helps organizations instantly and automatically make these determinations.)

The bottom line is that the specification and enforcement of authorization intent is neither easy nor straight-forward, and many a time, this one simple root of complexity can make it difficult to attain or maintain least-privileged access, particularly in large IT infrastructures. As a result, quite often, one or more IT resources could easily end up being inadequately protected and vulnerable to compromise.

But I digress.

All said and done, the WikiLeaks incident is a warning and wake-up call to organizations worldwide – IT security today is mission-critical to business, and it must be a top business priority, because, as we have clearly seen in this case, it only takes ONE such security incident to have a substantial impact on business.

After all, if you think about it, this was very much akin to an employee at a Fortune 100 business organization taking a set of confidential business documents, such as a set of confidential product blue-prints, and disclosing them to an outsider. The only thing that makes the release of these cables more sensational is the nature of information they contained, the unauthorized disclosure of which, substantially impacted a broad and larger set of issues and entities.

Today IT security has become paramount to organizational security and business continuity and at Paramount Defenses Inc, we know this first-hand (; today our solutions and services help secure and defend the very foundation of IT security at over 4000 organizations in over 70 countries around the world.)

In days and weeks to follow, I intend to shed light on numerous specific and highly pertinent IT security issues and challenges that directly impact organizational security worldwide.

Thanks,

Sanjay

PS: It would also be nice to see the media stop referring to these kiddish DDOS attacks as cyber-war. These DDOS attacks are so primitive in nature that any half-serious IT security enthusiast should be able to code one up in a few hours. I doubt these journalists have any idea as just how much damage a real DDOS attack on a mission-critical component, such as the Active Directory, could actually do. For that matter, I doubt they even know what the Active Directory is, let alone why it is so important.