<![CDATA[[SecurityRatty] tag: dummies]]> http://securityratty.com/tag/dummies Wed, 07 Nov 2007 18:52:53 +0000 iRatty Engine http://blogs.law.harvard.edu/tech/rss <![CDATA[CHECKLISTS ARE NOT FOR DUMMIES, BUT THEY SURE ARE DUMB!]]> http://securityratty.com/article/a4d082b5e73846a16a60945cf10205ef http://securityratty.com/article/a4d082b5e73846a16a60945cf10205ef My friend Mark Curphey writes an article “Checklists are Not For Dummies, Dummy“  which looks at the use of checklists and how they are important for quality and the reduction of variance.  I think it’s important in this day and age of “Security Through Diligence” to take a look at what checklists can and cannot do, because Mark makes an important point - reminding us that there is a time and place for everything under the sun, even the much maligned checklists.  Before we get into this, let’s discuss some terminology, because I’ll be using these terms to make some distinction:

  • State of Nature. State of Nature just means what the current state is.  There are two ISSA Journals on my desk right now - State of Nature statement.
  • State of Knowledge:  Analysis derived from examination of State of Nature.  “One of these ISSA Journals has an article co-authored Donn Parker on ROI.  I’ve read it, and it makes some statements he regards as truth.  Looking at those, well, I know that risk is quantifiable, best practices have significant issues, and there are many, many other statements of authority in the article that I can refute on evidence.” - Analysis or State of Knowledge.
  • State of Wisdom:  Synthesis from the analysis.  The “So” moment.  “So since there are many statements of authority made in the article that I can refute on evidence, I should be open but skeptical about whether the conclusions of this article are likely to have much value to me in my quest to understand the value of risk reducing investments.”  What I’ve synthesized from the quality of the article - State of Wisdom.

(Just a clue for our readers, anytime you read someone talk about risk and mention the term “actuarial” - be skeptical about the conclusions they have you draw from the statement using that word. 9 times out of 10 what I’ve read after someone says actuarial is made as authoritative but shows a level of ignorance on the subject.  If you really want to mess with them - say “Really! Well, tell me how you feel about the use of non-parametric Bayesian Methods” and wait… )

MMMMM-MMMMMMM CHECKLISTS!

So what about Checklists?  They’re worth discussing because we’re swamped by them!  Heck, we’ve got people in love with the idea of checklists of checklists and claiming GRC nirvana is not in the checklist itself, but in the mapping of checklists.

Here ya go:  Checklists have one of two uses -

First they can give us a path to accomplish something.  I make a checklist every morning I call a “Todo List”.   Useful Checklists could be as Curphey mentions - steps for operating machinery or performing a certain task (heck, scientific method could be said to be a checklist of steps in analysis).  Checklists are useful in this way because, well, we’re fallible, absent minded, and novices.  They serve to reduce some level of variability in a process.

Second, they can help us develop a State of Nature.  PCI or the ISO are very nice checklists that, once you’re done, certifies that you have the existence of a certain amount of control.  Again, this serves to reduce some level of variability, comparing you to a “best practice”.

And so…..

They are both useful in each use - as long as the limitations therein are understood!   And that’s where we get into trouble.  Too many times we believe that checklists are a State of Knowledge.  Checklists allow for some limited analysis, just like the use of ordinal numbers to describe “risk” - they only serve to identify some level of variability, nothing more.

But outside of that they usually offer us no analytical function at all, they cannot provide a State of Knowledge and therefore, more succinctly, Checklists are dumb.

As slightly paranoid, skeptical and jaded risk management professionals, we know this to be true.  A PCI compliant company may or may not be at all “secure” or “risk-free” or even “risk-reduced”.  That’s an aspect of analysis that the checklist is some prior information for, but not nearly all the information we need for an analysis of risk or even a statement about the ability to control or resist.  We know an ISO certified organization did what they claim they do enough to at least fool an auditor once, but cannot arrive at any other State of Knowledge without more effort.

Make no mistake, the checklists we commonly deal with provide a very, very limited State of Knowledge.  Only analysis (with rigor and testing) will provide that.  And note that a State of Wisdom (what we’re really after, after all) is predicated on a strong State of Knowledge.

WHAT ARE YOU MANAGING TOWARDS, REDUX
So if checklists only provide a State of Nature, and are incapable of really giving us Knowledge or Wisdom - then let me encourage you to think about the amount of time you spend just getting a certain State of Nature and the relative return on that investment vs. the amount of time you spend in analysis and synthesis.  Is your time best spent mapping checklist to checklist - or is it better spent developing the analytics that allow us to synthesize wisdom?

AMAZE AND CONFUSE YOUR FRIENDS AUDITORS
Let me finish by encouraging you to have a frank discussion with those who perform your audit function.  You must really pin them down if they are out to give you any analysis at all - and when/if they do provide analysis - press them on what rigor they use to create a State of Nature, and then the means by which they create a State of Knowledge (that belief statement based on the State of Nature they see).

]]> Wed, 11 Jun 2008 09:51:33 +0000 checklists article checklists article mmmmm-mmmmmmm checklists nice checklists provide analysis provide nature nature statement CHECKLISTS ARE NOT FOR DUMMIES, BUT THEY SURE ARE DUMB! <![CDATA[Checklists Are Not For Dummies, Dummy!]]> http://securityratty.com/article/8637b66ebd15fbf4c4934a6848c64a4a http://securityratty.com/article/8637b66ebd15fbf4c4934a6848c64a4a Sat, 24 May 2008 07:50:10 +0000 pre-take-off checklist air traffic control checklist slide owasp conference checklists friend story week Checklists Are Not For Dummies, Dummy! <![CDATA[Oklahoma Department of Corrections SQL exposure]]> http://securityratty.com/article/9bb93a53d8f0419e8990e2f3fe251df8 http://securityratty.com/article/9bb93a53d8f0419e8990e2f3fe251df8 Security Breach

Date Reported:
4/15/08

Organization:
State of Oklahoma

Contractor/Consultant/Branch:
Department of Corrections

Victims:
"Oklahoma residents"

Number Affected:
10,597

Types of Data:
Names, addresses, and social security numbers

Breach Description:
"Residents of Oklahoma State have reportedly been hit this week with the bad news that tens of thousands of their names, social security numbers and allied data were effectively available on the Web for around three years."

Reference URL:
The Daily WTF
ComputerWeekly
The Register
SecurityProPortal

Report Credit:
Alex Papadimoulis, The Daily WTF

Response:
From the online sources cited above:

Residents of Oklahoma State have reportedly been hit this week with the bad news that tens of thousands of their names, social security numbers and allied data were effectively available on the Web for around three years.

One of the cardinal rules of computer programming is to never trust your input. This holds especially true when your input comes from users, and even more so when it comes from the anonymous, general public. Apparently, the developers at Oklahoma’s Department of Corrections slept through that day in computer science class, and even managed to skip all of Common Sense 101.

The result of this negligently bad coding has some rather serious consequences: the names, addresses, and social security numbers of tens of thousands of Oklahoma residents were made available to the general public for a period of at least three years.

Up until yesterday, April 13 2008, anyone with a web browser and the knowledge from Chapter One of SQL For Dummies could have easily accessed - and possibly, changed - any data within the DOC’s databases.

It took me all of a minute to figure out how to download 10,597 records - SSNs and all - from their website

Not only did Oklahoma make avaiable the SSN of those types of offenders, but that of every type of offender in their system. It was all accessible through an innocent looking link on both the SVOR and Offender search pages

Shortly after discovering this problem (thanks to reader AJ, who hesitantly pointed it out), I spent the following day working my way up the DOC's call tree. Eventually, I found my way to George Floyd and explained how bad of an idea it was to to have a SQL query as a parameter.

Fortunately, he didn't accuse me of hacking their site. In fact, he seemed appreciative and promised to pass the details along to their developers.

The following day, both the SVOR and Offender Search were taken down "for routine maintenance".

However, when the sites came back up, I noticed that that the "print-friendly page" still had a SQL query in the URL. Putting the "social_security_number" in, however, no longer displayed social security numbers.

It took me all of ten seconds to figure out a way around their fix.

I used "Social_security_number" instead of "social_security_number".

Their brilliant developers plugged this pothole with a pebble by doing nothing more than a case-sensisitve search/replace of "social_security_number" with "doc_number". Clearly, they had no idea why it was so bad to let any SELECT anything from their databases.

I emailed George again, this time explaining the problem much more clearly

That, apparently, did the trick. Soon thereafter, the sites underwent "routine maintenance" and the "roster pages" were no more.

Commentary:
I highly suggest that people read the source article.  Alex does an excellent job of describing the problem and his commentary is priceless.

Past Breaches:
Unknown

]]> Mon, 21 Apr 2008 07:23:45 +0000 social security oklahoma sql residents oklahoma residents bad bad news department sql query Oklahoma Department of Corrections SQL exposure <![CDATA[Oklahoma Data Leak]]> http://securityratty.com/article/5710dbfc5162eab653886f112748546a http://securityratty.com/article/5710dbfc5162eab653886f112748546a Usually I don't bother blogging about these, but this one is particularly bad. Anyone with with basic SQL knowledge could have registered anyone he wanted as a sex offender.

One of the cardinal rules of computer programming is to never trust your input. This holds especially true when your input comes from users, and even more so when it comes from the anonymous, general public. Apparently, the developers at Oklahoma’s Department of Corrections slept through that day in computer science class, and even managed to skip all of Common Sense 101. You see, not only did they trust anonymous user input on their public-facing website, but they blindly executed it and displayed whatever came back.

The result of this negligently bad coding has some rather serious consequences: the names, addresses, and social security numbers of tens of thousands of Oklahoma residents were made available to the general public for a period of at least three years. Up until yesterday, April 13 2008, anyone with a web browser and the knowledge from Chapter One of SQL For Dummies could have easily accessed ­ and possibly, changed ­ any data within the DOC’s databases. It took me all of a minute to figure out how to download 10,597 records ­ SSNs and all ­ from their website.

]]> Fri, 18 Apr 2008 02:16:51 +0000 knowledge basic sql knowledge computer science class sql computer negligently bad bad website input Oklahoma Data Leak <![CDATA[Who's the real dummy?]]> http://securityratty.com/article/45af6b36f3a4194aef78c38b705ab6e3 http://securityratty.com/article/45af6b36f3a4194aef78c38b705ab6e3 Fri, 28 Mar 2008 09:00:10 +0000 year-old kid armed person responsible real criminal dummies book sensitive information story job computers school Who's the real dummy? <![CDATA[Blue Box #70: 2-yr Anniversary show, VoIP security vulnerabilities, Vonage, Comcast, phishing, listener comments and much, much more... ]]> http://securityratty.com/article/000fe05beb7be31948ee3c35b723296d http://securityratty.com/article/000fe05beb7be31948ee3c35b723296d

Synopsis:Blue Box #70: 2-yr Anniversary show, VoIP security vulnerabilities, Vonage, Comcast, phishing, listener comments and much, much more...

Welcome to Blue Box: The VoIP Security Podcast #70, a 51-minute podcast  from Dan York and Jonathan Zar covering VoIP security news, comments and opinions.   

Download the show here (MP3, 21MB) or subscribe to the RSS feed to download the show automatically. 

You may also listen to this podcast right now:

NOTE: This show was recorded on October 25, 2007.

Show Content:

Comments, suggestions and feedback are welcome either as replies to this post  or via e-mail to blueboxpodcast@gmail.com.  Audio comments sent as attached MP3 files are definitely welcome and will be played in future shows.  You may also call the listener comment line at either +1-206-350-7280 or via SIP to 'bluebox@voipuser.org' to leave a comment there. 

Thank you for listening and please do let us know what you think of the show.

]]> Wed, 07 Nov 2007 19:52:27 +0000 voip security voip security vulnerabilities voip security news voip voip security podcast consumer voip vulnerabilities sans voip security sans Blue Box #70: 2-yr Anniversary show, VoIP security vulnerabilities, Vonage, Comcast, phishing, listener comments and much, much more... <![CDATA[Blue Box #70: 2-yr Anniversary show, VoIP security vulnerabilities, Vonage, Comcast, phishing, listener comments and much, much more... ]]> http://securityratty.com/article/360cbdf1f4dc8de6bb655273a0eaf2a5 http://securityratty.com/article/360cbdf1f4dc8de6bb655273a0eaf2a5

Synopsis:Blue Box #70: 2-yr Anniversary show, VoIP security vulnerabilities, Vonage, Comcast, phishing, listener comments and much, much more...

Welcome to Blue Box: The VoIP Security Podcast #70, a 51-minute podcast  from Dan York and Jonathan Zar covering VoIP security news, comments and opinions.   

Download the show here (MP3, 21MB) or subscribe to the RSS feed to download the show automatically. 

You may also listen to this podcast right now:

NOTE: This show was recorded on October 25, 2007.

Show Content:

Comments, suggestions and feedback are welcome either as replies to this post  or via e-mail to blueboxpodcast@gmail.com.  Audio comments sent as attached MP3 files are definitely welcome and will be played in future shows.  You may also call the listener comment line at either +1-206-350-7280 or via SIP to 'bluebox@voipuser.org' to leave a comment there. 

Thank you for listening and please do let us know what you think of the show.

]]> Wed, 07 Nov 2007 18:52:53 +0000 voip security voip security vulnerabilities voip security news voip voip security podcast consumer voip vulnerabilities sans voip security sans Blue Box #70: 2-yr Anniversary show, VoIP security vulnerabilities, Vonage, Comcast, phishing, listener comments and much, much more...