<?xml version="1.0" encoding="utf-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" version="2.0">
  <channel>
    <title><![CDATA[[SecurityRatty] tag: unlock]]></title>
    <link>http://securityratty.com/tag/unlock</link>
    <description></description>
    <pubDate>Tue, 04 Sep 2007 18:14:00 +0000</pubDate>
    <generator>iRatty Engine</generator>
    <docs>http://blogs.law.harvard.edu/tech/rss</docs>
    <item>
      <title><![CDATA[Google mislabels Blogger sites as splogs, locks them]]></title>
      <link>http://securityratty.com/article/4dd38e557f60b66911a6d18ef20bb36f</link>
      <guid>http://securityratty.com/article/4dd38e557f60b66911a6d18ef20bb36f</guid>
      <description><![CDATA[In an attempt to rid its Blogger service from spam blogs, or splogs, Google mistakenly flagged a number of legitimate sites last week, prompting the company to scramble to unlock...]]></description>
      <content:encoded><![CDATA[In an attempt to rid its Blogger service from spam blogs, or splogs, Google mistakenly flagged a number of legitimate sites last week, prompting the company to scramble to unlock them.]]></content:encoded>
      <pubDate>Sun, 03 Aug 2008 20:00:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/google mistakenly">google mistakenly</category>
      <category domain="http://securityratty.com/tag/sites">sites</category>
      <category domain="http://securityratty.com/tag/blogger service">blogger service</category>
      <category domain="http://securityratty.com/tag/splogs">splogs</category>
      <category domain="http://securityratty.com/tag/spam blogs">spam blogs</category>
      <category domain="http://securityratty.com/tag/unlock">unlock</category>
      <category domain="http://securityratty.com/tag/week">week</category>
      <category domain="http://securityratty.com/tag/rid">rid</category>
      <category domain="http://securityratty.com/tag/attempt">attempt</category>
      <source url="http://www.networkworld.com/news/2008/080408-google-mislabels-blogger-sites-as.html?fsrc=rss-security">Google mislabels Blogger sites as splogs, locks them</source>
    </item>
    <item>
      <title><![CDATA[Mashup of the Titans]]></title>
      <link>http://securityratty.com/article/6289294023616c0d4219941919c976a5</link>
      <guid>http://securityratty.com/article/6289294023616c0d4219941919c976a5</guid>
      <description><![CDATA[Information Security - an Oxymoron for the information age

Always the beautiful answer who asks a more beautiful question. e. e. cummings
or why i am with Gelernter

This is a mashup of Saltzer &amp;...]]></description>
      <content:encoded><![CDATA[<div>Information Security - an Oxymoron for the information age</div><br /><div>“Always the beautiful answer who asks a more beautiful question.” e. e. cummings</div><div>...or why i am with Gelernter</div><br /><div>This is a mashup of Saltzer &amp; Schroeder&#39;s famous <a href="http://www.cs.virginia.edu/~evans/cs551/saltzer/">information security principles</a> with David Gelernter&#39;s <a href="http://www.edge.org/documents/archive/edge70.html">Manifesto</a>.</div><br /><div>The premise of this mashup is to examine the paper by Saltzer and Schroeder which was written in 1975 and serves as the basis for most information security programs against the Gelernter&#39;s manifesto as to where computing is actually going. Each of the eight principles in Saltzer and Schroeder&#39;s paper is listed in order, and followed by select excerpts of Gelernter&#39;s manifesto. This comparison is to examine theoretical information security principles vis a vis the actual utility of modern information systems. I will not make an attempt to reconcile theory and practice, but will point out where the two schools of thought agree. In fairness, Saltzer and Schroeder&#39;s paper was written 25 years before Gelernter&#39;s, however Saltzer and Schroeder&#39;s principles dominate the thinking about information security to this day and so its important to view them side by side with Gelernter&#39;s thinking on the direction of computing.</div><br /><div style="color: #bf5f00; ">Saltzer and Schroeder:</div><div>&quot;a) Economy of mechanism: Keep the design as simple and small as possible. This well-known principle applies to any aspect of a system, but it deserves emphasis for protection mechanisms for this reason: design and implementation errors that result in unwanted access paths will not be noticed during normal use (since normal use usually does not include attempts to exercise improper access paths). As a result, techniques such as line-by-line inspection of software and physical examination of hardware that implements protection mechanisms are necessary. For such techniques to be successful, a small and simple design is essential.&quot;</div><br /><div style="color: #0060bf; ">Gelernter:</div><div>&quot;9. The computing future is based on &quot;cyberbodies&quot; — self-contained, neatly-ordered, beautifully-laid-out collections of information, like immaculate giant gardens.&quot;</div><br /><div><span style="color: #00bf00; ">Conclusion(gp):</span>&#0160;So far, so good</div><br /><div>**</div><br /><div><span style="color: #bf5f00; ">Saltzer and Schroeder:</span><br /></div><div>&quot;b) Fail-safe defaults: Base access decisions on permission rather than exclusion. This principle, suggested by E. Glaser in 1965,8 means that the default situation is lack of access, and the protection scheme identifies conditions under which access is permitted. The alternative, in which mechanisms attempt to identify conditions under which access should be refused, presents the wrong psychological base for secure system design. A conservative design must be based on arguments why objects should be accessible, rather than why they should not. In a large system some objects will be inadequately considered, so a default of lack of permission is safer. A design or implementation mistake in a mechanism that gives explicit permission tends to fail by refusing permission, a safe situation, since it will be quickly detected. On the other hand, a design or implementation mistake in a mechanism that explicitly excludes access tends to fail by allowing access, a failure which may go unnoticed in normal use. This principle applies both to the outward appearance of the protection mechanism and to its underlying implementation.&quot;</div><br /><div><span style="color: #00bf00; ">Conclusion(gp):</span>&#0160;A conservative design principle that puts the object&#39;s owner in control of permissions. This makes a lot of sense from the object point of view, but does little to address the use case in which it executes.</div><br /><div>**</div><br /><div><span style="color: #bf5f00; ">Saltzer and Schroeder:</span><br /></div><div>&quot;c) Complete mediation: Every access to every object must be checked for authority. This principle, when systematically applied, is the primary underpinning of the protection system. It forces a system-wide view of access control, which in addition to normal operation includes initialization, recovery, shutdown, and maintenance. It implies that a foolproof method of identifying the source of every request must be devised. It also requires that proposals to gain performance by remembering the result of an authority check be examined skeptically. If a change in authority occurs, such remembered results must be systematically updated.&quot;</div><br /><div><span style="color: #0060bf; ">Gelernter:</span><br /></div><div>&quot;8. The software systems we depend on most today are operating systems (Unix, the Macintosh OS, Windows et. al.) and browsers (Internet Explorer, Netscape Communicator...). Operating systems are connectors that fasten users to computers; they attach to the computer at one end, the user at the other. Browsers fasten users to remote computers, to &quot;servers&quot; on the internet.</div><br /><div>Today&#39;s operating systems and browsers are obsolete because people no longer want to be connected to computers — near ones OR remote ones. (They probably never did). They want to be connected to information. In the future, people are connected to cyberbodies; cyberbodies drift in the computational cosmos — also known as the Swarm, the Cybersphere.</div><br /><div>13. Any well-designed next-generation electronic gadget will come with a ``Disable Omniscience&#39;&#39; button.</div><br /><div>17. A cyberbody can be replicated or distributed over many computers; can inhabit many computers at the same time. If the Cybersphere&#39;s computers are tiles in a paved courtyard, a cyberbody is a cloud&#39;s drifting shadow covering many tiles simultaneously.</div><br /><div>20. If a million people use a Web site simultaneously, doesn&#39;t that mean that we must have a heavy-duty remote server to keep them all happy? No; we could move the site onto a million desktops and use the internet for coordination. The &quot;site&quot; is like a military unit in the field, the general moving with his troops (or like a hockey team in constant swarming motion). (We used essentially this technique to build the first tuple space implementations. They seemed to depend on a shared server, but the server was an illusion; there was no server, just a swarm of clients.) Could Amazon.com be an itinerant horde instead of a fixed Central Command Post? Yes.&quot;</div><br /><div><span style="color: #00bf00; ">Conclusion(gp):</span>&#0160;Complete mediation provides the underpinning for Saltzer and Schroeder&#39;s system, but does not appear to scale to the desired itinerant horde at least in common interpretation.</div><br /><div>**</div><br /><div><span style="color: #bf5f00; ">Saltzer and Schroeder:</span><br /></div><div>&quot;d) Open design: The design should not be secret. The mechanisms should not depend on the ignorance of potential attackers, but rather on the possession of specific, more easily protected, keys or passwords. This decoupling of protection mechanisms from protection keys permits the mechanisms to be examined by many reviewers without concern that the review may itself compromise the safeguards. In addition, any skeptical user may be allowed to convince himself that the system he is about to use is adequate for his purpose. Finally, it is simply not realistic to attempt to maintain secrecy for any system which receives wide distribution.&quot;</div><br /><div><span style="color: #00bf00; ">Conclusion(gp):</span>&#0160;both seem to agree, hard to get the itinerant horde moving in a swarm without open standards.</div><br /><div>**</div><br /><div><span style="color: #bf5f00; ">Saltzer and Schroeder:</span><br /></div><div>&quot;e) Separation of privilege: Where feasible, a protection mechanism that requires two keys to unlock it is more robust and flexible than one that allows access to the presenter of only a single key. The relevance of this observation to computer systems was pointed out by R. Needham in 1973. The reason is that, once the mechanism is locked, the two keys can be physically separated and distinct programs, organizations, or individuals made responsible for them. From then on, no single accident, deception, or breach of trust is sufficient to compromise the protected information. This principle is often used in bank safe-deposit boxes. It is also at work in the defense system that fires a nuclear weapon only if two different people both give the correct command. In a computer system, separated keys apply to any situation in which two or more conditions must be met before access should be permitted. For example, systems providing user-extendible protected data types usually depend on separation of privilege for their implementation.&quot;</div><br /><div><span style="color: #0060bf; ">Gelernter:</span><br /></div><div>&quot;37. Elements stored in a mind do not have names and are not organized into folders; are retrieved not by name or folder but by contents. (Hear a voice, think of a face: you&#39;ve retrieved a memory that contains the voice as one component.) You can see everything in your memory from the standpoint of past, present and future. Using a file cabinet, you classify information when you put it in; minds classify information when it is taken out. (Yesterday afternoon at four you stood with Natasha on Fifth Avenue in the rain — as you might recall when you are thinking about &quot;Fifth Avenue,&quot; &quot;rain,&quot; &quot;Natasha&quot; or many other things. But you attached no such labels to the memory when you acquired it. The classification happened retrospectively.)&quot;</div><br /><div><span style="color: #00bf00; ">Conclusion(gp):</span>&#0160;Information Security models tend to look at things statically through information classification lenses, but its how information is used that makes it valuable. In practice this is how information security theory breaks down in the face of reality - what does an access control matrix look like for a mashup? What does it look like for a data mining app?</div><br /><div>**</div><br /><div><span style="color: #bf5f00; ">Saltzer and Schroeder:</span><br /></div><div>&quot;f) Least privilege: Every program and every user of the system should operate using the least set of privileges necessary to complete the job. Primarily, this principle limits the damage that can result from an accident or error. It also reduces the number of potential interactions among privileged programs to the minimum for correct operation, so that unintentional, unwanted, or improper uses of privilege are less likely to occur. Thus, if a question arises related to misuse of a privilege, the number of programs that must be audited is minimized. Put another way, if a mechanism can provide &quot;firewalls,&quot; the principle of least privilege provides a rationale for where to install the firewalls. The military security rule of &quot;need-to-know&quot; is an example of this principle.&quot;</div><br /><div><span style="color: #0060bf; ">Gelernter:</span><br /></div><div>&quot;28. Metaphors have a profound effect on computing: the file-cabinet metaphor traps us in a &quot;passive&quot; instead of &quot;active&quot; view of information management that is fundamentally wrong for computers.</div><br /><div>29. The rigid file and directory system you are stuck with on your Mac or PC was designed by programmers for programmers — and is still a good system for programmers. It is no good for non-programmers. It never was, and was never intended to be.</div><br /><div>30. If you have three pet dogs, give them names. If you have 10,000 head of cattle, don&#39;t bother. Nowadays the idea of giving a name to every file on your computer is ridiculous.&quot;</div><br /><div><span style="color: #00bf00; ">Conclusion(gp):</span>&#0160;Least Privilege is the point where the practical matter of applying Saltzer and Schroeder&#39;s principles breaks down in modern systems. Its a deployment issue, and a matter of insufficient models and modes.</div><br /><div>**</div><br /><div><span style="color: #bf5f00; ">Saltzer and Schroeder:</span><br /></div><div>&quot;g) Least common mechanism: Minimize the amount of mechanism common to more than one user and depended on by all users [28]. Every shared mechanism (especially one involving shared variables) represents a potential information path between users and must be designed with great care to be sure it does not unintentionally compromise security. Further, any mechanism serving all users must be certified to the satisfaction of every user, a job presumably harder than satisfying only one or a few users. For example, given the choice of implementing a new function as a supervisor procedure shared by all users or as a library procedure that can be handled as though it were the user&#39;s own, choose the latter course. Then, if one or a few users are not satisfied with the level of certification of the function, they can provide a substitute or not use it at all. Either way, they can avoid being harmed by a mistake in it.&quot;</div><br /><div><span style="color: #0060bf; ">Gelernter:</span><br /></div><div>&quot;6. Miniaturization was the big theme in the first age of computers: rising power, falling prices, computers for everybody. Theme of the Second Age now approaching: computing transcends computers. Information travels through a sea of anonymous, interchangeable computers like a breeze through tall grass. A dekstop computer is a scooped-out hole in the beach where information from the Cybersphere wells up like seawater.</div><br /><div>16. The future is dense with computers. They will hang around everywhere in lush growths like Spanish moss. They will swarm like locusts. But a swarm is not merely a big crowd. The individuals in the swarm lose their identities. The computers that make up this global swarm will blend together into the seamless substance of the Cybersphere. Within the swarm, individual computers will be as anonymous as molecules of air.</div><br /><div>55. Software can solve hard problems in two ways: by algorithm or by making connections — by delivering the problem to exactly the right human problem-solver. The second technique is just as powerful as the first, but so far we have ignored it.</div><br /><div>56. Lifestreams and microcosms are the two most important cyberbody types; they relate to each other as a single musical line relates to a single chord. The stream is a &quot;moment in space,&quot; the microcosm a moment in time.&quot;</div><br /><div>**</div><br /><div><span style="color: #bf5f00; ">Saltzer and Schroeder:</span><br /></div><div>&quot;h) Psychological acceptability: It is essential that the human interface be designed for ease of use, so that users routinely and automatically apply the protection mechanisms correctly. Also, to the extent that the user&#39;s mental image of his protection goals matches the mechanisms he must use, mistakes will be minimized. If he must translate his image of his protection needs into a radically different specification language, he will make errors.&quot;</div><br /><div><span style="color: #0060bf; ">Gelernter:</span><br /></div><div>&quot;7. &quot;The network is the computer&quot; — yes; but we&#39;re less interested in computers all the time. The real topic in astronomy is the cosmos, not telescopes. The real topic in computing is the Cybersphere and the cyberstructures in it, not the computers we use as telescopes and tuners.</div><br /><div>27. Modern computing is based on an analogy between computers and file cabinets that is fundamentally wrong and affects nearly every move we make. (We store &quot;files&quot; on disks, write &quot;records,&quot; organize files into &quot;folders&quot; — file-cabinet language.) Computers are fundamentally unlike file cabinets because they can take action.</div><br /><div>31. Our standard policy on file names has far-reaching consequences: doesn&#39;t merely force us to make up names where no name is called for; also imposes strong limits on our handling of an important class of documents — ones that arrive from the outside world. A newly-arrived email message (for example) can&#39;t stand on its own as a separate document — can&#39;t show up alongside other files in searches, sit by itself on the desktop, be opened or printed independently; it has no name, so it must be buried on arrival inside some existing file (the mail file) that does have a name. The same holds for incoming photos and faxes, Web bookmarks, scanned images...</div><br /><div>32. You shouldn&#39;t have to put files in directories. The directories should reach out and take them. If a file belongs in six directories, all six should reach out and grab it automatically, simultaneously.</div><br /><div>33. A file should be allowed to have no name, one name or many names. Many files should be allowed to share one name. A file should be allowed to be in no directory, one directory, or many directories. Many files should be allowed to share one directory. Of these eight possibilities, only three are legal and the other five are banned — for no good reason.</div><br /><div>53. Your car, your school, your company and yourself are all one-track vehicles moving forward through time, and they will each leave a stream-shaped cyberbody (like an aircraft&#39;s contrail) behind them as they go. These vapor-trails of crystallized experience will represent our first concrete answer to a hard question: what is a company, a university, any sort of ongoing organization or institution, if its staff and customers and owners can all change, its buildings be bulldozed, its site relocated — what&#39;s left? What is it? The answer: a lifestream in cyberspace.&quot;</div><br /><br /><div>**</div><div style="color: #00bf00; ">Conclusion(gp):</div><br /><div>The Saltzer and Schroeder principles of Open Design and Economy of Mechanism hold up well in the face of modern computing realities, and to a certain extent Fail Safe Defaults does as well; however if we information security people are to be effective we need to re-think the other principles.</div><br /><div>**</div><br /><div>Last word:&#0160;<span style="color: #0060bf; ">Gelernter:</span></div><div>We&#39;ll know the system is working when a butterfly wanders into the in-box and (a few wingbeats later) flutters out — and in that brief interval the system has transcribed the creature&#39;s appearance and analyzed its way of moving, and the real butterfly leaves a shadow-butterfly behind. Some time soon afterward you&#39;ll be examining some tedious electronic document and a cyber-butterfly will appear at the bottom left corner of your screen (maybe a Hamearis lucina) and pause there, briefly hiding the text (and showing its neatly-folded rusty-chocolate wings like Victorian paisley, with orange eyespots) — and moments later will have crossed the screen and be gone.</div>]]></content:encoded>
      <pubDate>Wed, 25 Jun 2008 13:29:25 +0000</pubDate>
      <category domain="http://securityratty.com/tag/protection mechanisms">protection mechanisms</category>
      <category domain="http://securityratty.com/tag/protection mechanisms correctly">protection mechanisms correctly</category>
      <category domain="http://securityratty.com/tag/information security">information security</category>
      <category domain="http://securityratty.com/tag/information">information</category>
      <category domain="http://securityratty.com/tag/implements protection mechanisms">implements protection mechanisms</category>
      <category domain="http://securityratty.com/tag/information travels">information travels</category>
      <category domain="http://securityratty.com/tag/information security people">information security people</category>
      <category domain="http://securityratty.com/tag/protection">protection</category>
      <category domain="http://securityratty.com/tag/potential information path">potential information path</category>
      <source url="http://1raindrop.typepad.com/1_raindrop/2008/06/mashup-of-the-titans.html">Mashup of the Titans</source>
    </item>
    <item>
      <title><![CDATA[More on functional encryption and two-level keys]]></title>
      <link>http://securityratty.com/article/4e150b836dca29c027bd01c5855d20a3</link>
      <guid>http://securityratty.com/article/4e150b836dca29c027bd01c5855d20a3</guid>
      <description><![CDATA[Following up to my previous post on functional encryption. Just read another interesting article on the subject

The gist of it is in using policy as a way of granting acess and reducing the reliance...]]></description>
      <content:encoded><![CDATA[Following up to my <a href="http://bitarmor.blogspot.com/2008/04/functional-cryptography-future.html">previous post </a>on functional encryption. Just read <a href="http://arstechnica.com/news.ars/post/20080502-anew-way-to-think-about-data-encryption-two-level-keys.html">another interesting article </a>on the subject.<br /><br />The gist of it is in using policy as a way of granting acess and reducing the reliance on a "trusted server". From the article..<br /><br /><em><span style="color:#993300;">"In a functional encryption system, keys are personalized and only one is needed for a person to gain access to all the data that should be available to them. In addition to simplifying the key process, this idea allows users—with proper access rights—to search encrypted volumes for specific information. "</span></em><br /><em><span style="color:#993300;"></span></em><br /><span style="color:#000000;">The key used here is a personal key which contains attributes of a person which is used to unlock the document... Seems intriguing, but I am not sure how multiple people (or even groups such as HR) can be given access to a document based on such keys... Would like to understand this a bit more...</span><div class="feedflare">
<a href="http://feeds.feedburner.com/~f/BitArmor1?a=UhyMtH"><img src="http://feeds.feedburner.com/~f/BitArmor1?i=UhyMtH" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/BitArmor1?a=HRDjvh"><img src="http://feeds.feedburner.com/~f/BitArmor1?i=HRDjvh" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/BitArmor1?a=Gw9gMH"><img src="http://feeds.feedburner.com/~f/BitArmor1?i=Gw9gMH" border="0"></img></a>
</div><img src="http://feeds.feedburner.com/~r/BitArmor1/~4/284668644" height="1" width="1"/>]]></content:encoded>
      <pubDate>Tue, 06 May 2008 10:01:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/functional encryption">functional encryption</category>
      <category domain="http://securityratty.com/tag/key">key</category>
      <category domain="http://securityratty.com/tag/functional encryption system">functional encryption system</category>
      <category domain="http://securityratty.com/tag/personal key">personal key</category>
      <category domain="http://securityratty.com/tag/keys">keys</category>
      <category domain="http://securityratty.com/tag/document">document</category>
      <category domain="http://securityratty.com/tag/document based">document based</category>
      <category domain="http://securityratty.com/tag/gain access">gain access</category>
      <category domain="http://securityratty.com/tag/access">access</category>
      <source url="http://feeds.feedburner.com/~r/BitArmor1/~3/284668644/more-on-functional-encryption-and-two.html">More on functional encryption and two-level keys</source>
    </item>
    <item>
      <title><![CDATA[OnStar Offers a Model for IT Security]]></title>
      <link>http://securityratty.com/article/c41d8b202e7ddfec3a4ae2d7f3f68cac</link>
      <guid>http://securityratty.com/article/c41d8b202e7ddfec3a4ae2d7f3f68cac</guid>
      <description><![CDATA[At the recent Gartner Mobile and Wireless Conference, Sanjay Khunger, the chief technologist of GM's OnStar unit, gave a presentation on the history of OnStar's satellite-based remote safety, security...]]></description>
      <content:encoded><![CDATA[At the recent Gartner Mobile and Wireless Conference, Sanjay Khunger, the chief technologist of GM's OnStar unit, gave a presentation on the history of OnStar's satellite-based remote safety, security and diagnostic service. GM looks at auto safety as being in three distinct phases: before the crash, during the crash and after the crash. Another way to look at this is preventing/avoiding the crash, surviving the crash and recovering after the crash. GM designs features into cars in each of those phases (anti-lock brakes to avoid crashes, chassis design and airbags that reduce injury during the crash, and so on). I always thought of OnStar as a "push the button to call for help" service, but Khunger explained how it was an integrated part of GM's overall safety strategy. <br />
<br />
Beyond the obvious capabilities to call for help after a crash, OnStar has features that also apply to the first two phases. Hands- and eyes-free navigation and cell phone capabilities minimize driver distraction and reduce accidents. Remote proactive diagnostics and remote door unlock services reduce the time a driver spends standing next to a dead car on the side of the road. Multiple sensors in the vehicle provide information on the type of crash and the number of occupants so that emergency personnel have more information to ensure that EMTs have the right equipment to best save lives at the crash scene.<br />
<br />
This isn't meant to be a commercial for OnStar - if you watch sports on TV, you've already seen plenty of those. However, GM's placement of a security-related service in the larger context of customer safety really hits home on a larger point: Security and, just as importantly, safety need to be worked into all the critical business and IT processes at your business. The biggest bang for the buck comes from avoiding incidents - minimizing vulnerabilities in applications, not just by having secure development life cycles but by thinking about user safety. What are the abuse cases where a user or customer might accidentally put themselves in danger? What features are built into your business applications to avoid those situations? <br />
<br />
Financially, OnStar makes more money by helping its customers avoid accidents. But stuff happens, and building in instrumentation, response and recovery features to minimize damage during an incident and speed to ensure swift resumption of business after an incident is important, as well. This applies as much to car crashes as it does to identity theft incidents, insider attacks and every other IT security "crash." Build security into your critical business processes, and keep your customers safe. ]]></content:encoded>
      <pubDate>Fri, 07 Mar 2008 08:08:35 +0000</pubDate>
      <category domain="http://securityratty.com/tag/processes">processes</category>
      <category domain="http://securityratty.com/tag/critical business processes">critical business processes</category>
      <category domain="http://securityratty.com/tag/onstar">onstar</category>
      <category domain="http://securityratty.com/tag/critical business">critical business</category>
      <category domain="http://securityratty.com/tag/crash">crash</category>
      <category domain="http://securityratty.com/tag/remote safety">remote safety</category>
      <category domain="http://securityratty.com/tag/crash scene">crash scene</category>
      <category domain="http://securityratty.com/tag/safety">safety</category>
      <category domain="http://securityratty.com/tag/auto safety">auto safety</category>
      <source url="http://blog.gartner.com/blog/security.php?x=0&amp;itemid=3186">OnStar Offers a Model for IT Security</source>
    </item>
    <item>
      <title><![CDATA['DVD Jon' offers content sharing Facebook app]]></title>
      <link>http://securityratty.com/article/480669359bf92b2a82768149d1fc2dc2</link>
      <guid>http://securityratty.com/article/480669359bf92b2a82768149d1fc2dc2</guid>
      <description><![CDATA[DVD Jon's new venture, DoubleTwist, has released beta versions of two applications to unlock music bought from Apple's iTunes...]]></description>
      <content:encoded><![CDATA[DVD Jon's new venture, DoubleTwist, has released beta versions of two applications to unlock music bought from Apple's iTunes Store.
<p><a href="http://feeds.computerworld.com/~a/Computerworld/Security/News?a=5vkZh9"><img src="http://feeds.computerworld.com/~a/Computerworld/Security/News?i=5vkZh9" border="0"></img></a></p><img src="http://feeds.computerworld.com/~r/Computerworld/Security/News/~4/237722875" height="1" width="1"/>]]></content:encoded>
      <pubDate>Tue, 19 Feb 2008 11:00:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/dvd jon">dvd jon</category>
      <category domain="http://securityratty.com/tag/beta versions">beta versions</category>
      <category domain="http://securityratty.com/tag/unlock music">unlock music</category>
      <category domain="http://securityratty.com/tag/itunes store">itunes store</category>
      <category domain="http://securityratty.com/tag/apple">apple</category>
      <category domain="http://securityratty.com/tag/applications">applications</category>
      <category domain="http://securityratty.com/tag/venture">venture</category>
      <category domain="http://securityratty.com/tag/doubletwist">doubletwist</category>
      <source url="http://feeds.computerworld.com/~r/Computerworld/Security/News/~3/237722875/article.do">'DVD Jon' offers content sharing Facebook app</source>
    </item>
    <item>
      <title><![CDATA[Lock-In]]></title>
      <link>http://securityratty.com/article/1ab18251eb3274fedf88e690c694ab78</link>
      <guid>http://securityratty.com/article/1ab18251eb3274fedf88e690c694ab78</guid>
      <description><![CDATA[Buying an iPhone isn't the same as buying a car or a toaster. Your iPhone comes with a complicated list of rules about what you can and can't do with it. You can't install unapproved third-party...]]></description>
      <content:encoded><![CDATA[<p>Buying an iPhone isn't the same as buying a car or a toaster. Your iPhone comes with a complicated list of rules about what you can and can't do with it. You can't install unapproved third-party applications on it. You can't unlock it and use it with the cellphone carrier of your choice. And Apple is serious about these rules: A software update released in September 2007 erased unauthorized software and -- in some cases -- rendered unlocked phones unusable.</p>

<p>"<a href="http://www.nytimes.com/2007/09/29/technology/29iphone.html">Bricked</a>" is the term, and Apple isn't the least bit apologetic about it.</p>

<p>Computer companies want more control over the products they sell you, and they're resorting to increasingly draconian security measures to get that control. The reasons are economic.</p>

<p>Control allows a company to limit competition for ancillary products. With Mac computers, anyone can sell software that does anything. But Apple gets to decide who can sell what on the iPhone. It can foster competition when it wants, and reserve itself a monopoly position when it wants. And it can dictate terms to any company that wants to sell iPhone software and accessories.</p>

<p>This increases Apple's bottom line. But the primary benefit of all this control for Apple is that it increases lock-in. "Lock-in" is an economic term for the difficulty of switching to a competing product. For some products -- cola, for example -- there's no lock-in. I can drink a Coke today and a Pepsi tomorrow: no big deal. But for other products, it's harder.</p>

<p>Switching word processors, for example, requires installing a new application, learning a new interface and a new set of commands, converting all the files (which may not convert cleanly) and custom software (which will certainly require rewriting), and possibly even buying new hardware. If Coke stops satisfying me for even a moment, I'll switch: something Coke learned the hard way in 1985 when it changed the formula and started marketing New Coke. But my word processor has to really piss me off for a good long time before I'll even consider going through all that work and expense.</p>

<p>Lock-in isn't new. It's why all gaming-console manufacturers make sure that their game cartridges don't work on any other console, and how they can price the consoles at a loss and make the profit up by selling games. It's why Microsoft never wants to open up its file formats so other applications can read them. It's why music purchased from Apple for your iPod won't work on other brands of music players. It's why every U.S. cellphone company fought against phone number portability. It's why Facebook sues any company that tries to scrape its data and put it on a competing website. It explains airline frequent flyer programs, supermarket affinity cards and the new My Coke Rewards program.</p>

<p>With enough lock-in, a company can protect its market share even as it reduces customer service, raises prices, refuses to innovate and otherwise abuses its customer base. It should be no surprise that this sounds like pretty much every experience you've had with IT companies: Once the industry discovered lock-in, everyone started figuring out how to get as much of it as they can.</p>

<p>Economists <a href="http://www.amazon.com/Information-Rules-Strategic-Network-Economy/dp/087584863X/ref=sr_1_1?ie=UTF8&s=books&qid=1202236504&sr=1-1">Carl Shapiro and Hal Varian</a> even proved that the value of a software company is the total lock-in. Here's the logic: Assume, for example, that you have 100 people in a company using MS Office at a cost of $500 each. If it cost the company less than $50,000 to switch to Open Office, they would. If it cost the company more than $50,000, Microsoft would increase its prices.</p>

<p>Mostly, companies increase their lock-in through security mechanisms. Sometimes patents preserve lock-in, but more often it's copy protection, digital rights management (DRM), code signing or other security mechanisms. These security features aren't what we normally think of as security: They don't protect us from some outside threat, they protect the companies from <em>us</em>.</p>

<p>Microsoft has been planning this sort of control-based security mechanism for years. First called <a href="http://schneier.com/crypto-gram-0208.html#1">Palladium</a> and now NGSCB (Next-Generation Secure Computing Base), the idea is to build a control-based security system into the computing hardware. The details are complicated, but the results range from only allowing a computer to boot from an authorized copy of the OS to prohibiting the user from accessing "unauthorized" files or running unauthorized software. The competitive benefits to Microsoft are <a href="http://www.cl.cam.ac.uk/~rja14/Papers/tcpa.pdf">enormous</a> (.pdf).</p>

<p>Of course, that's not how <a href="http://www.microsoft.com/technet/archive/security/news/ngscb.mspx">Microsoft advertises NGSCB</a>. The company has positioned it as a security measure, protecting users from worms, Trojans and other malware. But control does not equal security; and this sort of control-based security is <a href="http://www.schneier.com/blog/archives/2005/08/trusted_computi.html">very difficult to get right</a>, and sometimes makes us more vulnerable to other threats. Perhaps this is why Microsoft is quietly killing NGSCB -- we've gotten BitLocker, and we might get some other security features down the line -- despite the huge investment hardware manufacturers made when incorporating special security hardware into their motherboards.</p>

<p>In my <a href="http://www.wired.com/politics/security/commentary/securitymatters/2008/01/securitymatters_0124">last column</a>, I talked about the security-versus-privacy debate, and how it's actually a debate about liberty versus control. Here we see the same dynamic, but in a commercial setting. By confusing control and security, companies are able to force control measures that work against our interests by convincing us they are doing it for our own safety.</p>

<p>As for Apple and the iPhone, I don't know what they're going to do. On the one hand, there's this <a href="http://www.bloomberg.com/apps/news?pid=20601087&sid=aWmgi08ZjbpM">analyst report that claims there are over a million unlocked iPhones</a>, costing Apple between $300 million and $400 million in revenue. On the other hand, Apple is <a href="http://www.engadget.com/2007/10/17/apple-planning-iphone-sdk-for-february/ ">planning to release</a> a software development kit this month, reversing its earlier restriction and allowing third-party vendors to write iPhone applications. Apple will attempt to keep control through a secret application key that will be required by all "official" third-party applications, but of course it's already been <a href="http://www.engadget.com/2008/01/28/iphone-sdk-key-leaked/">leaked</a>.</p>

<p>And the security arms race goes on ...</p>

<p><br />
This essay <a href="http://www.wired.com/politics/security/commentary/securitymatters/2008/02/securitymatters_0207">previously appeared</a> on Wired.com.</p>

<p>EDITED TO ADD (2/12): SlashDot <a href="http://yro.slashdot.org/yro/08/02/07/2138201.shtml">thread</a>.</p>

<p>And critical <a href="http://stumble.kapowaz.net/post/25792347">commentary</a>, which is oddly political:</p>

<blockquote>This isn’t lock-in, it’s called choosing a product that meets your needs. If you don’t want to be tied to a particular phone network, don’t buy an iPhone. If installing third-party applications (between now and the end of February, when officially-sanctioned ones will start to appear) is critically important to you, don’t buy an iPhone.

<p>It’s one thing to grumble about an otherwise tempting device not supporting some feature you would find useful; it’s another entirely to imply that this represents anti-libertarian lock-in. The fact remains, you are free to buy one of the many other devices on the market that existed before there ever was an iPhone.</blockquote></p>

<p>Actually, lock-in is one of the factors you have to consider when choosing a product to meet your needs.  It's not one thing or the other.  And lock-in is certainly not "anti-libertarian."  Lock-in is what you get when you have an unfettered free market competing for customers; it's libertarian utopia.  Government regulations that limit lock-in tactics -- something I think would be very good for society -- is what's anti-libertarian.</p>

<p>Here's <a href="http://www.kryogenix.org/days/2008/02/08/there-can-be-no-fud">a commentary</a> on that previous commentary.  <a href="http://girtby.net/archives/2008/2/8/vendor-lock-in">This</a> is some good commentary, too.</p><div class="feedflare">
<a href="http://feeds.feedburner.com/~f/schneier/fulltext?a=Ykew7fE"><img src="http://feeds.feedburner.com/~f/schneier/fulltext?i=Ykew7fE" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/schneier/fulltext?a=LfLokuE"><img src="http://feeds.feedburner.com/~f/schneier/fulltext?i=LfLokuE" border="0"></img></a>
</div>]]></content:encoded>
      <pubDate>Tue, 12 Feb 2008 03:08:15 +0000</pubDate>
      <category domain="http://securityratty.com/tag/lock-in">lock-in</category>
      <category domain="http://securityratty.com/tag/software">software</category>
      <category domain="http://securityratty.com/tag/software development kit">software development kit</category>
      <category domain="http://securityratty.com/tag/custom software">custom software</category>
      <category domain="http://securityratty.com/tag/software company">software company</category>
      <category domain="http://securityratty.com/tag/security">security</category>
      <category domain="http://securityratty.com/tag/hardware">hardware</category>
      <category domain="http://securityratty.com/tag/special security hardware">special security hardware</category>
      <category domain="http://securityratty.com/tag/security mechanism">security mechanism</category>
      <source url="http://www.schneier.com/blog/archives/2008/02/lockin.html">Lock-In</source>
    </item>
    <item>
      <title><![CDATA[Security Updates: WinPatrol, Lock Bumping Facts]]></title>
      <link>http://securityratty.com/article/cfbe1c2fae2d40ef94cc41d6616a2f7d</link>
      <guid>http://securityratty.com/article/cfbe1c2fae2d40ef94cc41d6616a2f7d</guid>
      <description><![CDATA[Last summer my colleague Erik Larkin went to Defcon, the security conference. He learned how to unlock card-protected, locked office doors with a homemade $10 gadget. He blogged it--see &quot;Simple Hack...]]></description>
      <content:encoded><![CDATA[Last summer my colleague Erik Larkin went to Defcon, the security conference. He learned how to unlock card-protected, locked office doors with a homemade $10 gadget. He blogged it--see "Simple Hack Can Unlock Most Any Office Door ." (There's also a video on our site, "$10 Hack Breaks Key-Card Security.")
			
			<div style="margin-top:20" />
			<table border="1" BORDERCOLOR="#0033CC" cellspacing="0" cellpadding="2">
				<tr valign="top" align="left">
					<td>
						<table border="0" cellspacing="3" cellpadding="2" width="100%">
			
			
		  
		<tr> 
		<tr>
      <td width="*">
				<font face="Arial,Helvetica,Geneva,Sans-serif,sans-serif" size="-1">
				<p>	
			
			<a href="http://rsslinks.industrybrains.com/click?sid=93&scid=10069&rqctid=589&lid=472196&cid=133720&pr=2&tstamp=20080206000000&url=http://www.apc.com/go/promo/whitepapers/form.cfm%3fpromo_num%3d11754%26thepromo%3d101%26tsk%3da127w" target=_blank><strong>Fundamental Principles of Network Security</strong></a></p>
				<td align="right">
					<font face="Arial,Helvetica,Geneva,Sans-serif,sans-serif" COLOR="#0033CC" size="-1"><p>Advertisement</p></font>
				</td>
				</tr>
				<tr><td colspan="2"><font face="Arial,Helvetica,Geneva,Sans-serif,sans-serif" size="-1"><p>Protect the organization. Learn the 'Need To Know' aspects of network security. Free paper from APC.
			
				</p>
				</font>
		 	</td>
     </tr>
		 
		 
			
						</table>
					</td>
				</tr>
			</table>
			<div style="margin-top:20" />
			
			]]></content:encoded>
      <pubDate>Mon, 04 Feb 2008 21:00:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/network security">network security</category>
      <category domain="http://securityratty.com/tag/colleague erik larkin">colleague erik larkin</category>
      <category domain="http://securityratty.com/tag/simple hack">simple hack</category>
      <category domain="http://securityratty.com/tag/security conference">security conference</category>
      <category domain="http://securityratty.com/tag/office door">office door</category>
      <category domain="http://securityratty.com/tag/unlock">unlock</category>
      <category domain="http://securityratty.com/tag/office doors">office doors</category>
      <category domain="http://securityratty.com/tag/free paper">free paper</category>
      <category domain="http://securityratty.com/tag/fundamental principles">fundamental principles</category>
      <source url="http://www.networkworld.com/news/2008/020508-security-updates--winpatrol-lock-bumping.html?fsrc=rss-security">Security Updates: WinPatrol, Lock Bumping Facts</source>
    </item>
    <item>
      <title><![CDATA[Password policies. Once again.]]></title>
      <link>http://securityratty.com/article/cf7409e9ae19a733e3eaa177558b33cc</link>
      <guid>http://securityratty.com/article/cf7409e9ae19a733e3eaa177558b33cc</guid>
      <description><![CDATA[Recently in the newsgroups ( news:microsoft.public.security , to be specific) the question of password polices and the out-of-box defaults came up. The poster lamented a number of things: that...]]></description>
      <content:encoded><![CDATA[<P>Recently in the newsgroups (<A href="news:microsoft.public.security" mce_href="news:microsoft.public.security">news:microsoft.public.security</A>, to be specific) the question of password polices and the out-of-box defaults came up. The poster lamented a number of things: that Microsoft doesn't enable account lockout by default, that we don't have a built-in mechanism for automatically disabling unused accounts, that the 42-day default expiration is troublesome. Here's my response; figured that it would make for a useful blog post, too. 
<H4>Account lockouts</H4>
<P>Account lockout is a poor substitute for good passwords -- and is one of the most expensive security features you can use. Let's think about this by considering the threat. What threat does account lockout (attempt to) mitigate? Password guessing. How can you make password guessing attacks become useless for an attacker? Two ways: implement lockouts or use good (meaning long) passwords. 
<P>Consider the first choice, account lockouts. The typical cost to an organization to reset locked accounts is US$75 per help desk call. In a medium or large organization, this can become a very high monthly maintenance cost. In nearly all instances, the call results from users locking themselves out (too many vodka tonics on the plane, maybe?), not users encountering locked out accounts because some bad guy was trying to guess passwords. Account lockouts have one more -- very bad -- problem: they <EM>create</EM> opportunities for bad guys to conduct denial-of-service attacks against accounts or entire domains! Even if you use a timed unlock of, say, 15 minutes, then the attacker can write his script to churn through thousands of bogus logon attempts every 15 minutes 2 seconds. So, contrary to the&nbsp;claim, enabling this setting actually can have significant impact on usability. 
<P>Account lockout is there for people who absolutely need it. But I can't think of any instance where this is true. Instead, have a policy that requires simple passwords at least 15 characters long. Forget about complexity rules that force people to write down passwords. A simple 15-character passphrase (think short sentence) is easy to remember, quick to type, and far stronger than any short complex password. A passphrase like this will withstand any kind of automated password attack, including those based on rainbow tables. And you can even use a method that helps you remember unique phrases for each site, if you wish: 
<UL>
<LI>web mail: "my dog and i got the mail" 
<LI>shopping: "my dog and i bought some stuff" 
<LI>office: "my dog and i went to work" </LI></UL>
<P>This is why we disable account lockout by default. There are much better --&nbsp; and much less expensive -- ways to mitigate the threat. 
<H4>Disabling unused accounts</H4>
<P>You're right, there's no built-in method to automatically disable unused accounts. A variety of third-party products can provide you with this functionality. I suspect some of them might be free, perhaps simple scripts even. I tried searching on "automatically disable unused accounts" and saw a few hits that looked promising. This particular function, however, rightly belongs in the HR process. A number of customers I've spoken with have automated the account creation/disablement/deletion process, incorporating it into HR systems. When a new user is hired, the account is created; when the user departs, the account is disabled; some time later, it's deleted. The HR systems take care of this, not domain or enterprise administrators. I wrote more about this subject in "<A href="http://blogs.technet.com/steriley/archive/2007/05/31/when-you-say-goodbye-to-an-employee.aspx" target=_blank mce_href="http://blogs.technet.com/steriley/archive/2007/05/31/when-you-say-goodbye-to-an-employee.aspx">When you say goodbye to an employee</A>." 
<H4>Password expiration</H4>
<P>Password expiration is an important setting for everyone. It mitigates two threats: employees sharing passwords and bad guys discovering passwords. Because we can eliminate the second threat using long simple passphrases as I described above, then we have only one remaining threat: password sharing. Your estimation of how prevalent this threat is in your environment will guide you toward choosing an expiration time that works for you. 42 days is a reasonable default; our own corpnet uses 70 days. My experience with most customers shows that password sharing isn't a problem. So for those who do enforce long simple passphrases, I suggest that a reasonable default for expiration is 120 days. 
<P>Windows begins notifying you 14 days before your password expires. You can change this time period through group policy. I was in a similar situation recently. Last month my domain password expired while I was in Australia for TechEd there. I could continue to log on to my laptop with cached credentials, but couldn't use Outlook Web Access or RPC+HTTP of course. So I connected to a Terminal Server computer we have on the Internet, logged on there, and changed my password.</P><img src="http://blogs.technet.com/aggbug.aspx?PostID=1897577" width="1" height="1">]]></content:encoded>
      <pubDate>Tue, 04 Sep 2007 18:14:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/account">account</category>
      <category domain="http://securityratty.com/tag/enable account lockout">enable account lockout</category>
      <category domain="http://securityratty.com/tag/password">password</category>
      <category domain="http://securityratty.com/tag/account lockouts">account lockouts</category>
      <category domain="http://securityratty.com/tag/disable account lockout">disable account lockout</category>
      <category domain="http://securityratty.com/tag/42-day default expiration">42-day default expiration</category>
      <category domain="http://securityratty.com/tag/default">default</category>
      <category domain="http://securityratty.com/tag/expiration">expiration</category>
      <category domain="http://securityratty.com/tag/password expires">password expires</category>
      <source url="http://blogs.technet.com/steriley/archive/2007/09/04/passwords-policies-once-again.aspx">Password policies. Once again.</source>
    </item>
  </channel>
</rss>
