Security for the Paranoid

Quote:

---

Is it time to worry when security professionals consider you too paranoid?

---

http://www.securityfocus.com/columnists/320

Quote:

---

Are extreme security measures acting on false threats that don't really exist? Some consider some of my security strategies a bit extreme. I call it meticulous precaution. Sure, the threat might not be real. No one may ever actually want what you have on your PC. But does that really matter? Does the threat have to be real to warrant strong security?

---

Meticulous precaution, I like it.

Haha that was a great read, thanks. But when you're a security professional don't you kind of "have to be" a bit on the paranoid side? It's those guys that are proactive to security issues that survive and catch less flack than the guys that are running around like a chicken with their heads cut off when one of the unpatched webservers got hacked because someone forgot to change a default password. I do like how he practices what he preaches but he kind of went a bit far (IMO) when he said he uses Terrafly just to see what others can see of him as well as having his PC turned around at all times just to see if there's a keylogger. I think he's watched The Net one too many times. ;)

I read the posts before I read the article and I thought, "yup it's good to be paranoid when dealing with security issues".

I read the article and thought, "ooh, he gone a bit far".

I got my current job on the back of a presentation I did, one big point of which was security has to be balanced against usability.
There is a lot more to Infosec then pure defensive security. I think this chap has forgotton the CIA triad. Confidentiality, Integrity and Availability.

This guy certainly has established the first 2 but if the information is so difficult to get to that it is nearly unusable then he has failed in providing Availability.
If I put my Pc in a bricked up room with no power or data cables and bury it under concrete the data is very safe and secure but FA use to me.

If he forced all the users in my office to follow what he does I think he'd have an unfortunate accident by the end of week 1.

I wonder if he wraps his kids in tinfoil before they go to school.

Quote:

---

I don't just throw out shredded documents; I spread the shredded bits into my garden to use as mulch.

---

Gee, he thinks he is paranoid and he dosen't incinerate them first?

Quote:

---

It takes five passwords to boot up my laptop and check my e-mail. One of those passwords is over 50 characters long.

---

This is the only thing I think is overly excesive, i would replace some of those passwords with biometrics or tokens.

Everything else he mentioned, I wish I had the time and money to do on my home network.

Paranoia and Obsessive-Compulsive disorder are both prerequisites for an IT Security Administrator these days. You never know who's going to hit you, or when, or how, but you know they're after you... Is there such thing as TOO paranoid when it comes to computer security? Never! If I had my way we'd all lock the bloody boxes up in a closet, forever with their switches in the OFF position, and revert to pencil and paper - the only system truly secure from cracking is one that's never put online. Barring that impossibility, we must be the voice of paranoia to our company while finding the happy medium which allows work to take place.

"No Mr. CEO, you aren't exempt from our IT policies. You may leave your dna sample and retinal scan at the door like the rest of us."

I liked the "I use a password that is 50 characters long", think about how long that would take to crack.....

It would depend on what the password was. I hate typing in my passwords and they are not even close to that legth, he probably spends 10 minutes just logging on his computers.

Quote:

---

I require my kids to use at least 14 character passwords on our home network and I'm considering issuing them smart cards. [...] I don't just throw out shredded documents; I spread the shredded bits into my garden to use as mulch

---

Um yea the 14 char passwords thats ok but shreding documents and using them as mulch thats just a bit much.

We have cross cut shredders at work, and its funny when people yell at you for not FOLDING the paper first so it gets cut up even more....

Quote:

---

Originally posted here by kr5kernel
We have cross cut shredders at work, and its funny when people yell at you for not FOLDING the paper first so it gets cut up even more....

---

Eh? Would that even work? Each part of the paper still only passed throught he shredder once.

The pattern of the cuts would be more random, think back to when you made snow flakes out of paper. This is to through off the silly fool that tries to tape the confetti back together apparently.

If anyone has the time to go through an entire bag of "dust" and just find the pieces that belong to one sheet of paper, much less put them back together... Wow..

I think its sorta like DES. We all know DES can be broken, but in general the theory is that it will take you longer to be broken than the validity of the data, i.e. DES is broken in say 4 hours, so you would change keys every 4 hours or something of the sort. It would take you... months to put one sheet back together, all to find out.. it was a print out of a print test page.

He uses 3 firewalls to access the internet? Well unless he is segmenting users from internal networks then that is a complete waste. In fact he later says he only accesses the internet from a PC with NO access to his internal network. So it is definitely a waste since it only takes one to compomise even if you have 100. bUY HEY If you are protecting and segmenting super sensitive data, I don't think he goes too far at all. In fact I have some PCs installed backwards as well. ;) But hey a 14 character password is just as good as one that is 50. It will still take a super super long time to crack... unless it's 1234567891011121314151617181920212223242526272829303132333435363738394041424344454647484950

Just because I'm paranoid doesn't mean they aren't out to get me.....

Security is the balance between Security and usability.

The amount of security required is directly proportional to the potential loss incurred.

Security precautions/mechanisms should be appropriate for the assets they protect.

etc. etc. etc......

Quote:

---

Is there such thing as TOO paranoid when it comes to computer security? Never!

---

Yes. There is. When passwords become too hard to remember, users simply write them down. If the doors lock all the smokers out, they stick a rock in the frame. One can easily become too paranoid with computer security, just as one can become too paranoid with physical security. I don't hire armed guards to protect my house. A simple deadbolt is enough for me. Now, if I had documents proving who really killed JFK inside, I might hire armed guards.

The security measures used must be balanced against the value of the information you are trying to protect.

He can sucure his home network up the ying yang all he wants. He might have a hard time selling this level of security to the bean counters though. Nobody's going to spend that kind of money to secure a webserver with no critical information on it.

There also becomes a point where policies become unenforceable (i.e. spreading shredded documents as mulch). Employees would simply stop shredding documents. Policies like this need to be easy enough to follow and enforce, yet strong enough to make a difference. Finding that point effectively is what separates the professionals from the wannabes.

No rubber gloves to keep his finger prints secure and retinas not secured in an off-site location. Sloppy. Sloppy. ;)

Beside the fact: who wants to put poisonous inks and chemicals in their Mulch??????? Newspaper is ok because they are vegetable dyes but bills and laser ink? ACK.

[stupid, scary, off-topic factoid] Speaking of Newspapers.... The markers they sell on the open market nowadays to detect counterfeit bills.... on a regular bill they mark yellow, on plain paper they mark black... black being indicative of counterfeit bills. Why do they mark yellow on newspaper? Try one and see for yourself.[/stupid, scary, off-topic factoid]

Quote:

---

Originally posted here by Tiger Shark
Just because I'm paranoid doesn't mean they aren't out to get me.....

Security is the balance between Security and usability.

The amount of security required is directly proportional to the potential loss incurred.

Security precautions/mechanisms should be appropriate for the assets they protect.

etc. etc. etc......

---

Thank you! I'm glad someone brought this up. It's one thing to take all these measures at my workplace to protect company and client data, it's a whole 'nother thing to take these (extreme) measures at home to protect ????????

I mean, seriously, 14 character passwords so that your 8 year old can log on and play Clifford the Big Red Dog, or visit www.disneytoons.com?? Do you also implant RFID tags in your kids earlobes so that you can know where they are at all times (hmm maybe thats not a bad idea)?

Security precautions SHOULD be appropriate for the assets they protect. At home, having a hardware/software firewall, strong passwords, and using common sense best practices is all you need to do. If I get hacked at home, I can simply re-load one of my ghost images. If you have sensitive data on your home computer, by all means protect it...I choose to keep as little sensitive data in permanent storage as possible. As an aside, I'm more worried about the security on few online sites I've made purchases from that have my CC number.

I don't know who this guy is, but he must be superman. I have a hard enough time FINDING time to take care of all the security measure I need to on a given day at work, let alone having to come home, read the logs of my triple firewall along with remembering my 118559 character password and giving a blood and feces sample in order to log on and check my email.

lol, his passwords probably arent that complex, just a favourite quote written in 1337 or another algorithm

My mates think im paranoid, but their not security pro's, im not as secure as i want to be, but i got 17char md5 passwords, but i also got the tables to break 1-8 char lower alpha numberic symbol 14, it cracked my old pwds...

With his kids, the chain is only as strong as its weakest link. If one of children wanted to follow in his daddies footsteps, and tries to hack, the amount of trojans built into skiddie programs is amazing. If his son's computer was comprimised, then its only one more step to his computer.

I agree with everything he says, i enjoy going to sleep at night knowing that even i cant break into my own computer if i needed to. People call me paranoid, then the next day question me about security issues. My fathers computer has increased security, along with the rest of my families. I enjoy going to sleep at night knowing that it'll take more than a skiddie to break into our systems....

But dont get me wrong, most people have fears about spiders or snakes or ghosts, i fear key loggers and 0-days... Im in a bad mood all day if someone else tells me about the latest 0-day before i find out. I think 'if that guy wasnt my friend, he couldve broken in, and all my work would be for nothing'

Hmmmm,

Last time I checked you could get all keyboard upper and lower case rainbow tables up to 14 characters for $800. So you should look for something a bit over 14. Given that this stuff is exponential, the fact that those rainbow tables are 60Gb would suggest that maybe 20 characters is quite paranoid enough.

I think that Tiger~ has mentioned this in at least one other thread, throw in a few ASCII off keyboard characters and you really up the ante.

Quote:

---

I don't just throw out shredded documents; I spread the shredded bits into my garden to use as mulch.

---

No!, no!, no!..........................he needs one of those big bins like my wife has. You chuck in your kitchen vegetable waste, non-glossy paper (preferably shredded) and garden waste (not grass cuttings) and three million earthworms turn them into worm p1$$ and $h1t (coire). You sort it out every now and then and use the coire as compost and the p1$$ you dilute 1:10 with water to make an excellent organic fertiliser.

Anything else goes in the huge green composter. Both for $37 the pair from our local council, worms included. :D

Quote:

---

Speaking of Newspapers.... The markers they sell on the open market nowadays to detect counterfeit bills.... on a regular bill they mark yellow, on plain paper they mark black... black being indicative of counterfeit bills. Why do they mark yellow on newspaper? Try one and see for yourself

---

Bleach?

Quote:

---

Last time I checked you could get all keyboard upper and lower case rainbow tables up to 14 characters for $800. So you should look for something a bit over 14. Given that this stuff is exponential, the fact that those rainbow tables are 60Gb would suggest that maybe 20 characters is quite paranoid enough.

---

For LanManager hash's probably, because its actually 2 7 char passwords, old school (win9x days) method of encryption, still used for interpolarity IF your password can be encrypted with it (ie, all lower case, no symbols? and no more than 14 chars)... but this guy would HAVE to have LM hash's disabled, its stupid to leave them enabled on a all windows 2000+ network...

But for hashs such as md5 and NTLM/v2 (new school windows hash), 14 characters would either mean MASSIVE tables, or MASSIVE calculation time. its impractical, atm, to generate those tables, let alone the time it would take, even distributed efforts render these tables completely inpractical

Hi Double//Cut

It is with the greatest of pleasure that an old fart like me can suggest that you are behind the times :D

Rainbow tables will crack long passwords in a short space of time. As I said for 14 characters you are looking at 60Gig, just for the tables. This is not 7 x 7.............you can be sure that the law enforcement and security agencies have them up to 128 characters and better.

I am no expert, but how I believe that how they work is to use very large computers or a large number of smaller ones to pre-compute the solutions. Obviously this takes months, or many years by single computer standards. Then all you have to do is straight comparisons.

The end result tables are not impracticable...............believe me!

Please check it out, it is really quite frightening :eek:

Fortunately well beyond the means of your average scum skiddie :)

Quote:

---

Security is the balance between Security and usability.

---

I don't completely agree with this... I think it can be more accurately stated as a balance between security and cost. (since decreased usability increases cost)

This leads me to the idiocy of the original link... I'd venture that he is spending more on security than the value of what he is protecting. End result is that he loses more being secure than having no security at all.

Paranoia does not make for good security, just a good waste of resources and time.

cheers,

catch

Um... Does anyone else find it ironic that he runs Windows on at least some of his machines? :confused: Whether or not it's Microsoft's fault, isn't Windows one of the most exploited OS's today? (Granted, a very part of this is that more idiots use Windows than other OS's, but still there's some exploits that are hard to block and that would bypass his three firewalls without patches . i.e. image buffer overflow attacks.) I'm not saying that other OS's are perfect, but if he could halve the possibility of getting exploited by switching from Windows, and if he's so "highly secure" then why doesn't he do it?

- Xierox

*sigh* I can't believe I read that fools asinine comments. Good thing he didn't get into his cryptography escapades.

However senator I will give you a profile.

Five foot ten, weakly built, about 180 pounds. Hair brown, eyes pale black. He displays symptoms of an obsessive-compulsive pedophile, which he tries so desperately hard to shed. His heart begins to race when his ISP calls. He becomes engulfed with irrational fear when the DNS resolves slowly. He launches boot-nuke at the ring of a doorbell. He files his fingertips, like nightrider. He checks photos in his wife and kids em@ils for steganography inserts. He's quite the niggler when it comes to his family and their I-surfing. He dropped a lot of acid in college. He'd be about 35 now. He said he lived in Philadelphia but may have lied. That's all I can remember now.

So what should he run? XTS-400 desktops, maybe with a HYDRA webserver, SMG mail server, and perhaps a Boeing network controller?

NT is as good or better than any other COTS general purpose operating system, with regard to security and aussrance.

cheers,

catch

catch

Quote:

---

This leads me to the idiocy of the original link... I'd venture that he is spending more on security than the value of what he is protecting. End result is that he loses more being secure than having no security at all.

---

The only justification that I can see would be as an academic exercise or a test project?

As I know that you are aware that in the defence industry, classified stuff is on a secure network with no internet link.

If I were voting I would give the guy:



::hide-beh ::hide-beh ::hide-beh

Don't want to step on any toes here, but I was always under the impression that NT has been formally validated to handle data above unclassified. But they can’t have a link to the internet at the same time? Makes sense, but I'm curious about this. I guess different standards in different countries with different labels etc....

Quote:

---

Originally posted here by !mitationRust
Don't want to step on any toes here, but I was always under the impression that NT has been formally validated to handle data above unclassified. But they can’t have a link to the internet at the same time? Makes sense, but I'm curious about this. I guess different standards in different countries with different labels etc....

---

Hmm, I didn't know this. Perhaps I was unecessarily critical on my above post?

- Xierox

NT is a single level system, so this means that it can be used to deal with any level of data classification, but only that level.

So if it has been labeled a secret system. It can only have data (objects) and users (subjects) labeled as secret. This is inclusive of all system components.

Essentially this means that the system access must be controlled by a multi-level secure (MLS) processor if you want this machine to access data of different levels. To say it is verified to deal with classified data is rather misleading, although it does have an assurance rating of 2 under the TCSEC so it is good enough for secure environments. (Linux in all thus far evaluated manners would only score an assurance rating of 1, though Linux has only been evaluated against ISO-15408 and not the TCSEC.)

cheers,

catch

Quote:

---

since decreased usability increases cost

---

I think the opposite could be true. Decreasing usability simplifies the system. It requires less code, less time testing, less support because there are less options, etc. However decreasing usability could decrease demand therefore making the OS more expensive from a volume standpoint.

Quote:

---

Usability: The effectiveness, efficiency, and satisfaction with which users can achieve tasks in a particular environment of a product. High usability means a system is: easy to learn and remember; efficient, visually pleasing and fun to use; and quick to recover from errors.

---

- dictionary.com

You are speaking of design simplicity, not usability.

cheers,

catch

I would argue design complexity and usability are proportional. Regarless of what dictionary.com has to say. Less complex systems would be inherently less usable and systems "quick to recover from errors" would be more complex and therefore more costly.

Quote:

---

I would argue design complexity and usability are proportional. Regarless of what dictionary.com has to say. Less complex systems would be inherently less usable and systems "quick to recover from errors" would be more complex and therefore more costly.

---

I'm not sure what you are on about... which system is more usable, a Mac or a Cray? Now, which system is more complicated?

The same can be said for many things... tax law for example... would a simpler law be more usable? Which recovers from errors more easily, simple modular code or complicated spaghetti code?

cheers,

catch