• Open Scripting Architecture—Privilege elevation bug when loading plugins.
• CarbonCore—A stack overflow in handling long file names. Potential code execution.
• CoreGraphics—2 bugs, both code execution, one for malicious graphics the other for malicious PDFs.
• Data Detectors Engine—Engine may crash when parsing maliciously crafted content.
• Disk Utility—A local user may obtain System privileges.
• OpenLDAP—An ASN parsing bug can lead to a crash.
• OpenSSL—A range checking error from last September (Red Hat patched it in 2 weeks) can lead to remote code execution.
• PHP—5 different bugs, the worst of which can lead to remote code execution.
• QuickLook—A maliciously-crafted Microsoft Office file can cause QuickLooks to crash or allow remote code execution.
• rsync—Path validation errors, which were also reported in 2007, are resolved.

• Open Scripting Architecture—Privilege elevation bug when loading plug-ins.
• CarbonCore—A stack overflow in handling long file names. Potential code execution.
• CoreGraphics—Two bugs, both code execution, one for malicious graphics, the other for malicious PDFs.
• Data Detectors Engine—Engine may crash when parsing maliciously crafted content.
• Disk Utility—A local user may obtain System privileges.
• OpenLDAP—An ASN parsing bug can lead to a crash.
• OpenSSL—A range checking error from last September (Red Hat patched it in two weeks) can lead to remote code execution.
• PHP—Five different bugs, the worst of which can lead to remote code execution.
• QuickLook—A maliciously crafted Microsoft Office file can cause QuickLooks to crash or allow remote code execution.
• rsync—Path validation errors, which were also reported in 2007, are resolved.

• History of the marathon and Pheidippides
• Discussion of the race length and how it was changes so that the Queen could watch the finish
• World records and what our chances are for making one today
• Graphics of the race course showing the key hills and the “sprint to the finish”
• Talk about the womens’ marathon including Joan Benoit and Kathrine Switzer
• Description of energy depletion and “The Wall”
• Stats as the leaders hit the finsh line
• Shots of “back-of-the-pack” runners and the race against yourself

Well, I now present to you the formula for FISMA Report Cards:

• Paragraph about how agencies are failing to secure their data, the report card says so
• History and trending of the report card
• Discussion on changing FISMA
• Quote from Karen Evans
• Quote from Alan Paller about how FISMA is a failure and checklist-driven security
• Wondering when the government will get their act together

Have a read of Dancho’s response to the FISMA Report Card.  Pretty typical writing formula that you’ll see from journalists.  I won’t even comment on the “FISMA compliance” title.  Oh wait, I just did.  =)

Some myths about FISMA in particular that I need to dispell right now:

1. FISMA is a report card:  It’s a law, the grades are just an awareness campaign.  In fact, the whole series of NIST Special Publications are just implementation techniques–they are guidance after all.  Usually the media and bloggers talk about what FISMA measures and um, well, it doesn’t measure anything, it just requires that agencies have security programs based on a short list of criteria such as security planning, contingency planning, and security testing.  It just goes back to the adage that nobody really knows what FISMA is.
2. FISMA needs to be changed:  As a law, FISMA is exactly where it needs to be.  Yes, Congress does have talks about modifying FISMA, but not much has come of it because what they eventually discover after much debate and sword-waving is that FISMA is the way to write the law about security, the problem is with the execution at all levels–OMB, GAO, and the agencies–and typically across organizational boundaries and competing master agendas.
3. There is a viable alternative framework:  Dancho points out this framework in his post which is really an auditors’ plugin to the existing NIST Framework for FISMA.  Thing is, nobody has a viable alternative framework because it’s still going to be the same people with the same training executing in the same environment.

Urban Cell-Phone Fire Myth photo by richardmasoner.  This myth is dispelled at snopes.com.

Way back last year I wrote a blog post about indicator species and how we’re expecting the metrics to go up based on our continual measuring of them.  Every couple of months I go back and review it to see if it’s still relevant.  And the answer this week is “yes”.

Now I’ve been thinking and talking probably too much about FISMA and the grades over the past couple of years, so occassionally I come to conclusions .  According to Mr Vlad the Impaler, the report card is a bad idea, but I’m slowly beginning to see the wisdom of it:  it’s an opportunity to have a debate and to raise some awareness of Government security outside of those of us who do it.  The only other time that we have a public debate about security is after a serious data breach, and that’s not a happy time.

I just wish the media would stop with the story line that FISMA is failing because the grades provide recursive evidence of it.

Bookmark to:

photo credit: нσвσ

1. Be A Security Cool Cat: Place penguin stickers on every surface in your cubicle. Stick at least 3 on the dual boot company issued laptop (that hasn’t had a kernel upgrade in 6 months). Use BlackHat stickers for bonus points.
2. Be An Undercover Open Source Evangelist: Unfailingly, recommend open source solutions as more secure. Be sure to quote ‘more eyes, less vulnerabilities’. Recite frequently . Always forward security advisories about commercial products to your boss.
3. Walk the Tech Talk: Learn at Least 10 Bash Keyboard Shortcuts. Treat this as a party trick. Perform rapidly in sequence whenever anyone watches your screen. Giggle and pass the keyboard over and say ‘Your turn!’.
4. Be All Knowing, Jedi Warrior!: Say ‘Trust but verify’ whenever you are asked a question you do not understand. Make it clear in meetings that you trust no-one and “verify” solely through a Google/Secunia search.
5. Impress with a Penetration Test!: Download Metasploit, spend 7 hours modifying the web interface: create custom graphics and hack up the CSS files. Start Metasploit running before you leave for the day. Use Camtasia to capture all screen activity so you can review in the morning. If all went well upload to YouTube and link out via facebook.
6. Practice Defense In Depth’: When you are asked ‘What is the Risk?’, grin inanely and say ‘I’ll tell you after I break out the vulnerability scanners’. Run at least 3 vulnerability scanners to get ‘defense in depth’.
7. Latest *Is* Greatest!: Clipboard stealing attacks are *always* a bigger issue than the CISCO infrastructure with default passwords (how did they get there?!).
8. Educate The Great Unwashed with a Deep Dive Security Awareness Program. Educate end-users about Cross Site Scripting and SQL injection attacks. Don’t invite the outsourced developers - they already know this stuff and have deadlines to meet.
9. Impress Your Peers - Perfect the RFC Shoutout: Pick at least 10 common protocols and learn the associated RFC numbers. Intimidate IT colleagues by shouting out the RFC numbers whenever they mention the protocol.
10. Start A Security Blog: What Can I Say?

Format was fireside chat, with Craig Mundie, Microsoft's Chief Research and Strategy Officer sitting and talking with Chris Leach, Chief Information Security Officer at Affiliated Computer Services.  [fwiw, I personally don't love the fireside chat format.  Give me videos, fancying graphics and lots of acrobats on the stage ...]

I knew generally what Craig was going to talk about, but I was very interested to hear Craig's perspective and see how he thought about and talked about the end-to-end Trust topic.  In my opinion, this is one of the key topics that could help guide where Microsoft security efforts will go over the next 5 years, building on the past 5 years, and I am happy to see that leadership (Craig, Scott Charney) are approaching it as a dialog with industry and a recognition that it needs interoperability and industry support.

Two key topics stuck with me at the end of the keynote:

1. How security and privacy are very independent, supporting each other, while also having a tension between them.
2. Any technological efforts supporting End-to-end Trust will need to be very inclusive in order to work in heterogeneous environments.  Past infrastructure efforts (e.g. PKI) have demonstrated that the level of work and investment required means that it is more likely to hit roadblocks if existing business processes are excluded.

After the keynote, with the excellent assistance of Eric Green, I was able to pin down several Microsoft partners and get their thoughts on these two areas.  Listen to the attached mp3 to hear our discussions with these good folks:

Sandy Porter Director, Strategy Avoco Secure
Jeremiah Beckett President SecureVantage Technologies
Patrick McGregor, Ph.D. CEO BitArmor
Jon Callas CTO & CSO PGP Corporation
Conrad G. Bayer Senior Vice President IDA Strategy Avalaris, Inc.
Edward J. Gaudet Senior Vice President, Corporate Development and Marketing Liquid Machines

 

I did get a couple of these folks on video as well, so once I get that edited and uploaded, I'll update with links to those.

Additional information that is available on End to End Trust:

• Read Scott Charney’s Full Article about End to End Trust
• Read Microsoft's End to End Trust White Paper
• Join the dialogue. Go to Microsoft's End to End Trust forum, and let your voice be heard.

Best regards from RSA ~ Jeff