STE WILLIAMS

Question: What do you do when you can’t patch your IoT endpoints?

Dr. Mike Lloyd, CTO of RedSeal: Internet of Things devices are great because they aren’t as complicated as phones, laptops, or servers. General-purpose computers cause headaches. Unfortunately for security, IoT devices are also a curse for the same reason – precisely because they aren’t flexible. The security toolchain and ecosystem we’ve built up assumes we can put stuff on network endpoints, but IoT “things” are different. Agents? Scanning? Patching? Antivirus? None of that works in the new world of IoT widgets. Worse, many of these devices are built en masse by companies focused on price point, with no intention of supporting patching.

The answer, in a word, is segmentation. You have to treat these fragile endpoints like the boy in the bubble: They have a compromised immune system, so isolate them from the digital germs being cooked up continually around the Internet.

Do your smart lightbulbs really need open access to your databases?  Probably not. Industrial networks know this; they were traditionally air-gapped (although that has broken down over time). Segmentation is easy in principal – just separate the network you use for X for the one you use for Y. The reason to do so is clear: You want to limit the blast radius. But the inconvenient truth is that segmentation is hard. Defenders have to map out their zones and ensure the as-built matches the as-designed. This requires diligence, but it’s a great job for automation. Software can be taught to find any defensive gaps.

Do you have questions you’d like answered? Send them to [email protected].

Related Content:

• A Beginner’s Guide to Microsegmentation
• Meet FPGA: The Tiny, Powerful, Hackable Bit of Silicon at the Heart of IoT
• The Etiquette of Respecting Privacy in the Age of IoT
• 6 Security Considerations for Wrangling IoT
• 8 Microsegmentation Pitfalls to Avoid
• The 2019 Security Buyers Guide (from Akamai)

This free, all-day online conference offers a look at the latest tools, strategies, and best practices for protecting your organization’s most sensitive data. Click for more information and, to register, here.

Dr. Mike Lloyd, CTO of RedSeal, has more than 25 years of experience in the modeling and control of fast-moving, complex systems. He has been granted 21 patents on security, network assessment, and dynamic network control. Before joining RedSeal, Mike was CTO at RouteScience … View Full Bio

Article source: https://www.darkreading.com/edge/theedge/what-do-you-do-when-you-cant-patch-your-iot-endpoints/b/d-id/1336196?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Paper ballots and risk-limiting audits — the manual sampling of votes — have become the new best practices for protecting US elections in the aftermath of Russia’s election meddling and hacking of voter registration databases during the 2016 presidential campaign.

Adding a paper trail to electronic voting to ensure ballots get accurately counted in the digital age may seem, well, a bit counterintuitive. But while some election officials and system security experts double down on old-school practices of paper and manual ballot counts to ensure election integrity, a hotly debated movement also is underway for casting votes via personal mobile devices.

Election jurisdictions in several states have tested mobile app-based voting for state, federal, county, and municipal elections — mainly military and civilian residents stationed overseas to cast votes from their smartphones and tablets in lieu of traditional email, fax, and paper methods. West Virginia offered mobile voting for both state and federal elections in 2018; Utah County, Utah and Denver County, Colo., offered it for their municipal elections this year. In all, 29 counties across five states have tested Voatz’s mobile-voting app in official elections.

The underlying goal of mobile voting, its organizers say, is to encourage more voter participation by making the process easier and more accessible. Oregon’s Jackson and Umatilla counties, as well as Utah County, recently extended their mobile-voting pilots for municipal general elections to include civilian stateside voters with disabilities.

Critics argue that this method of voting is inherently risky and insecure: Vulnerabilities are regularly unearthed in both Android and iOS, and cybercriminals and nation-state actors increasingly are waging mobile exploits to target their victims.

Mobile voting is “a bad idea,” says Ibrahim Baggili, who is the founder and co-director of the Cyber Forensics Research and Education Group and an associate professor at the University of New Haven. “Until we can have secure devices for every voter, I don’t think it’s worth it,” he says.

More Secure Than the Status Quo?
But proponents of mobile-voting maintain that the apps and process are more secure and private than the standard practice of sending PDF-based ballots via unencrypted email to military personnel overseas.

Some mobile-voting technology contains built-in security and vetting functions: The Voatz app used in Colorado, Oregon, Utah, and West Virginia, for example, comes with three layers of user authentication, and its blockchain distributed-ledger technology encrypts the data and provides privacy and an audit trail, its proponents say. The app also scans the voter’s device for malware and proper Apple or Google digital certificates before allowing the voter to cast his or her ballot.

Sheila Nix, president of Tusk Philanthropies, the nonprofit that’s funding the Voatz-based mobile-voting pilots in the four states, says she’s well aware of security concerns about mobile voting, which is why the group has hired outside security experts to test and evaluate the security of the technology.

“My overall theory is we don’t want to promote something that’s not secure. Then our goal backfires,” she says.

Snake Oil?
Mobile voting seems like a natural progression for a society of users who already bank, shop, share, and communicate via their smartphones. Some experts believe its adoption, in some form, may be inevitable in the future despite the current misgivings about its security. But mobile technology is fraught with vulnerabilities, and blockchain security remains a big question mark, opponents say.

Among the critics of mobile voting is DEF CON Voting Village organizer Harri Hursti, who believes mobile voting won’t survive beyond the pilot phase.

“It’s going to be fizzled out after all the money has been milked [from it],” he says. “It’s truly profitable for companies promoting this. The whole idea of snake oil always [sells] well.”

Hursti was one of the first researchers in the world to hack voting machines. As part of a 2006 project organized by a nonprofit election watchdog group called Black Box Voting, Hursti, along with Hugh Thompson, found major security vulnerabilities in Diebold voting machines. The project was profiled in the HBO documentary Hacking Democracy.

He says he worries about the risk of voter coercion in mobile voting; merely having your smartphone as your personal voting machine leaves a voter vulnerable to pressures from other individuals. And smartphones are far too prone to malware and other cyberthreats to be considered a reliable voting tool, he says.

“Just because Apple improved security doesn’t mean you’re secure as a user,” he says.

Security services and consulting firm ShiftState Security has been analyzing the Voatz mobile platform on behalf of Tusk. Jason Truppi, co-founder of ShiftState and a former FBI cybersecurity agent, says there’s no such thing as unbreakable security, and he definitely gets why critics are wary of mobile voting.

“I’ve seen all the threats,” says Truppi, referring to his past work investigating nation-state and cybercrime breaches while with the FBI and in the security field the past two decades. “So if you want to talk skeptical, I’m as skeptical as the industry itself.”

But Truppi also believes voting methods are gradually changing. “It’s hard to imagine a world that’s still going to the [physical] polls 10 to 15 years from now,” he says. “Mobile voting is an eventuality. Why not solve some of the [security] problems now?”

Coming into Focus
It wasn’t until the past three years that the security of voting and elections received much public attention at all. That changed dramatically after the 2016 presidential election and was punctutated by the DEF CON hacking conference’s maiden Voting Village event in 2017, where it took just 90 minutes for the first two security researchers to hack voting machines using flaws they discovered.

Marian Schneider, president of nonprofit Verified Voting, told attendees at a presentation during the 2019 Voting Village this past August in Las Vegas that mobile device vulnerabilities could be abused in the voting process — and voters’ personal information could be exposed.

“I understand the worthy desire to increase voter participation and to remove a barrier to voting,” Schneider said. “But voting with my mobile app is not the way to do it. It’s opening the door to the county and state to an attack.”

She noted that when the mobile app sends the vote back to the voter to ensure its accuracy, this also opens up privacy holes to the voter. “How is the app developer not able to see it,” as well as the biometric and other data provided by the user, she argued.

Schneider’s organization has been one of the leaders in pushing for paper ballots in elections as a way to validate vote counts, and one of its board members in May co-authored a report calling out Voatz for a lack of transparency in providing the details of its blockchain implementation. 

A researcher who was one of the first to hack voting machines in the Voting Village in 2017 also considers mobile voting too risky. “It’s a good first step, but there are a lot of things missing,” such as a privacy layer atop the blockchain, says Carsten Schuermann, an academic expert in election security who has been studying election security for a decade.

Schuermann, a computer scientist at the IT University of Copenhagen in Denmark, compromised a WinVote voting machine on the Wi-Fi network at the 2017 Voting Village, exposing real election and voting data that was still stored on it.  

{STORY CONTINUES ON PAGE 2}

Kelly Jackson Higgins is the Executive Editor of Dark Reading. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise … View Full Bio

Article source: https://www.darkreading.com/edge/theedge/is-voting-by-mobile-app-a-better-security-option-or-just-a-bad-idea/b/d-id/1336152?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Vulnerability research competition Pwn2Own is expanding to include industrial control system (ICS), giving researchers an opportunity to hunt for bugs in popular ICS software and protocols.

This is the first time Trend Micro’s Pwn2Own, now in its twelfth year, has added ICS tech to its lineup. The Vancouver-based contest started out challenging ethical hackers to find flaws in Web browsers; since then, it has expanded to include virtualization software and enterprise applications. This past March, PWn2Own participants hacked into a Tesla Model 3’s infotainment system.

Its first ICS security competition will take place at the January S4 conference in Miami Beach. The decision to have ICS Pwn2Own at S4 was mutual, says Dale Petersen, founder of S4 Events and Digital Bond. When he approached Trend Micro’s Zero-Day Initiative (ZDI) back in the spring to propose bringing ICS Pwn2Own to S4x20, they had already been thinking about it. In 2018, ZDI purchased 224% more zero-day vulnerabilities in ICS software compared with the previous year, demonstrating a growing need to research bugs in industrial control software.

One challenge has been finding the right time to introduce a hacking contest for ICS technology, which as Peterson points out, has long lagged behind in terms of security. “The industry wasn’t ready for it,” he says. Pwn2Own could have held an offensive security contest, but it would have been relatively easy for researchers to break into systems. Now, systems’ protections are stronger, he explains. Today’s ICS technology, while not perfect, gives researchers a challenge.

Brian Gorenc, director of Zero-Day Initiative, says S4 is the “perfect location” to launch an ICS-focused Pwn2Own. “Those products control many pieces of critical infrastructure but are often overlooked by researchers,” he explains. The goal of Pwn2Own Miami is to build on the security of existing ICS technology by discovering vulnerabilities and providing the research to vendors.

This kind of competition presents a host of logistical challenges, he continues. Are products easily available for organizers and researchers? How are they configured? Can all the necessary equipment be shipped to the conference location?

“With ICS, we obviously can’t ship a centrifuge to a hotel, and researchers are unlikely to have pump controllers sitting around for them to test,” Gorenc adds. “However, we were able to work with our industry contacts to find readily available, software-based ICS products that make sense to include in the contest.”

Organizers reached out to several people and firms in the ICS sector, says Peterson, and technologies were considered with two key factors in mind. First was the footprint, or how widely used the system is. Second was its relevance to researchers and the ICS community. Rockwell Automation, for one, is providing virtual machines with their products for the contest.

ICS Pwn2Own will be broken down into five categories: Control Server, OPC Unified Architecture (OPC UA) Server, DNP3 Gateway, Human Machine Interface (HMI)/Operator Workstation, and Engineering Workstation Software (EWS).

“We chose these categories based on the conversations we had with those in the ICS sector and based on what we could logistically accomplish,” he continues. “These five categories provide a broad look at different aspects of ICS and provide a wide set of targets for researchers.

EWS is a hot target for attackers as it directly communicates and can configure primary control equipment like PLCs, Gorenc says. The HMI category is similar: attackers target the HMI as it often has Web server components and can definitely be affected by Web-based exploits. “Highly deployed ICS software is often locked behind a paywall and not easily accessible to researchers,” he says. Pwn2Own aims to remove these barriers to let researchers evaluate security.

The Contest

How it works: targets will be announced three months before the competition, giving Pwn2Own contestants a window of time to develop an exploit, Peterson explains. At the show, they have three five-minute attempts to exploit the target. If a denial of service, information disclosure, or remote code execution exploit works, the successful researcher, Pwn2Own team, and ICS vendor (if they choose to participate) will meet to discuss the details. The vendor will verify if it’s a true zero-day; if so, it follows ZDI’s disclosure policy allowing the vendor 120 days to fix it.

Pwn2Own has allocated more than $250,000 in cash and prizes for eight targets across these five categories, Gorenc writes in a blog post on the news. The contest will usually buy many successful exploits for a target, a tactic meant to encourage participation from more researchers.

Is the ICS community ready for a competition like this? There will be people who don’t like it, Peterson says, though he believes it’s a positive step forward for the industry. In his view, the organizations that don’t update their systems put the industry at greater risk than researchers looking for vulnerabilities in them. Gorenc notes the overall reaction has been positive.

“There is definitely some trepidation, but Pwn2Own has a history of working with vendors to get bugs fixed before they are used in active attacks,” he says.

Related Content:

• 8 Tips for More Secure Mobile Computing
  
• State of SMB Insecurity by the Numbers
• Microsoft Office Bug Remains Top Malware Delivery Vector
• 4 Security Lessons Federal IT Pros Can Teach the Private Sector

This free, all-day online conference offers a look at the latest tools, strategies, and best practices for protecting your organization’s most sensitive data. Click for more information and, to register, here.

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance Technology, where she covered financial … View Full Bio

Article source: https://www.darkreading.com/vulnerabilities---threats/pwn2own-adds-industrial-control-systems-to-hacking-contest/d/d-id/1336191?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Network and software security firm Fortinet (NASDAQ: FTNT) has acquired privately held endpoint detection and response firm enSilo in an effort to push its security solutions to the edge of corporate IT environments, Fortinet announced on October 28.

The deal, whose terms were not disclosed, will allow Fortinet to offer agent-based software and services aimed at automating real-time threat detection, speeding response, and secure Internet of Things (IoT) devices, according to the company’s statement. The acquisition also continues the consolidation in the cybersecurity industry driven by companies’ need to simplify. 

Businesses are seeing more complex threat landscapes and need simpler ways of securing their networks and endpoints, Ken Zie, CEO and founder of Fortinet, said in a statement. “As businesses become more networked and operations extend from the cloud to the edge and Internet of Things, the digital attack surface has expanded exponentially and has become more complex to secure,” he said. “Manual threat hunting or point security solutions are ineffective when managing or securing these new environments.”

The purchase of enSilo comes as the endpoint security industry has already begun to consolidate. In 2019, Gartner listed 20 companies in its 2019 Magic Quadrant for Endpoint Protection Products, and some of those companies already have been acquired. HP hooked Bromium in September, VMware collected Carbon Black in August, BlackBerry bought Cylance in November 2018, and Thoma Bravo tossed Sophos a $3.9 billion bone this month. 

Behind the acquisitions are companies’ desires to reduce the number of cybersecurity vendors on which they have to rely. In 2019, the share of companies that had reduced the number of vendors to 10 or fewer increased to 63%, from 54% in 2018, according to Cisco’s “CISO Benchmark Study”. One key factor is the desire to reduce the number of alerts produced by different products, the report stated.

“It’s no surprise that alert management continues to pose challenges,” Steve Martino, senior vice president, and chief information security officer of Cisco, said in a February 2019 blog post on the report. “That’s often because organizations are using multiple disparate security products that don’t share alert data or help prioritize alerts via limited dashboards.”

The survey of CISOs is not the only report to find that organizations are having more trouble responding to proliferating threats and complex IT security environments. Business analyst firm Enterprise Strategy Group estimates that three-quarters of firms find threat detection and response more difficult today than two years ago, primarily because of too many security tools that do not work together.

Fortinet pointed to such issues as a primary reason for its acquisition of enSilo. The problem, the firm maintained, is that as companies faced more threats, they bought more tools to the detriment of their security posture.

“The response by too many organizations … has been to deploy multiple, siloed security products, the bulk of which is focused on prevention,” the company said in a blog post announcing the enSilo acquisition. “But the truth is, 100% prevention is not possible. The result is a fragmented, complicated security architecture that can actually make detection and response more difficult.”

The acquisition will allow Fortinet to target IoT environments, a growing market, the company said in the post. With operational technology increasingly being incorporated into enterprise networks, these devices need to be secured against online threats. 

“The hallmark of the modern network is the rapid expansion of the network edge,” the company said. “New IoT and endpoint devices, bolstered by high performance, robust functionality, and new business applications, have expanded the potential attack surface. This in turn has raised the bar for having a fully integrated security solution that no longer operates in isolation and can extend visibility out to these emerging edges.”

Related Content

• In a Crowded Endpoint Security Market, Consolidation Is Underway
• Where Businesses Waste Endpoint Security Budgets
• Endpoint Security Overload
• The Rebirth of Endpoint Security

This free, all-day online conference offers a look at the latest tools, strategies, and best practices for protecting your organization’s most sensitive data. Click for more information and, to register, here.

Veteran technology journalist of more than 20 years. Former research engineer. Written for more than two dozen publications, including CNET News.com, Dark Reading, MIT’s Technology Review, Popular Science, and Wired News. Five awards for journalism, including Best Deadline … View Full Bio

Article source: https://www.darkreading.com/endpoint/fortinet-bolsters-endpoint-security-with-ensilo-acquisition/d/d-id/1336193?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple