As an increasing number of sites are breached and passwords phished, attackers attempt to reuse the stolen credentials on multiple services.

Department of Defense (DoD) Instruction 8500.01 directs that the Defense Information Systems Agency (DISA) “develops and maintains control correlation identifiers (CCIs), security requirements guides (SRGs), security technical implementation guides (STIGs), and mobile code risk categories and usage guides that implement and are consistent with DoD cybersecurity policies, standards, architectures, security controls, and validation procedures, with the support of the NSA/CSS, using input from stakeholders” and DoD Component heads “ensure that all DoD IT under their purview complies with applicable STIGs, security configuration guides, and SRGs.” In accordance with DoD Instruction 8500.01, the Microsoft Windows Privileged Access Workstation (PAW) STIG Version 1 is released for immediate use.

Remotely manage high-value IT resources only via a PAW.

• Administrative accounts will not be used for non-administrative functions (for example, read email, browse Internet)

High-value IT resources are the most important and critical IT resources within an organization. Administrator accounts for high-value IT resources must be protected against various threats and attacks because threats to sensitive privileged accounts are high and risk of compromise is increasing. Requiring a PAW used exclusively for remote administrative management of designated high-value IT resources, including servers, workstations, directory services, applications, databases, and network components, will provide a separate "channel" for the performance of administrative tasks on high-value IT resources and isolate these functions from the majority of threats and attack vectors found on higher-risk standard client systems. Note: The term "manage" in the Requirement statement includes any remote connection to a high-value IT resource (for example, to view resource status and current configuration or to make changes to any resource configuration The Information System Security Manager (ISSM) or other site personnel will assist the Authorizing Official (AO) in designating and documenting which IT resources in the organization are high value. The organization's list of high-value IT resources will include the following:

• Active Directory
• Cloud service
• Identity management service
• Privileged access management service
• Credential management service
• Security management service (anti-virus, network monitoring/scanning, IDS/IPS, etc.)
• Any sensitive business service
• Any other IT resource designated as high value by the AO

Implement a whitelist of authorized PAW applications using Device Guard. See the Device Guard Deployment Guide (https://docs.microsoft.com/en-us/windows/device-security/device-guard/device-guard-deployment-guide) for deployment information and hardware requirements and the IAD Device Guard document "Implementing a Secure Administrative Workstation using Device Guard" at https://github.com/iadgov/Secure-Host-Baseline/tree/master/Device%20Guard.

• Pre-authentication Integrity (SMB 3.1.1+). Protects against security downgrade attacks.
• Secure Dialect Negotiation (SMB 3.0, 3.02). Protects against security downgrade attacks.
• Encryption (SMB 3.0+). Prevents inspection of data on the wire, MiTM attacks. In SMB 3.1.1 encryption performance is even better than signing!
• Insecure guest auth blocking (SMB 3.0+ on Windows 10+) . Protects against MiTM attacks.
• Better message signing (SMB 2.02+). HMAC SHA-256 replaces MD5 as the hashing algorithm in SMB 2.02, SMB 2.1 and AES-CMAC replaces that in SMB 3.0+. Signing performance increases in SMB2 and 3.

TechNet Guidance on Enabling/Disabling SMBv1/2/3 (February 28, 2017)

• The Registry Editor for LanmanServer
• PowerShell’s Set-SmbServerConfiguration for SMB server
• sc.exe with config options for lanmanworkstation

Microsoft Published Security Bulletin MS17-010 (March 14, 2017)

Enter Global Ransomware Attack (May 12, 2017)

U.S. CERT Advisory (May 12, 2017)

• Disabling SMBv1 and
• blocking all versions of SMB at the network boundary by blocking TCP port 445 with related protocols on UDP ports 137-138 and TCP port 139, for all boundary devices.

SMB Vulnerability Patch for Windows XP & Server 2003 (May 13, 2017)

Enterprise Approach to Disable SMB v1 using GPO

Disable SMBv1 Server with Group Policy:

1. Open the Group Policy Management Console. Right-click the Group Policy object (GPO) that should contain the new preference item, and then click Edit.
2. In the console tree under Computer Configuration, expand the Preferences folder, and then expand the Windows Settings folder.
3. Right-click the Registry node, point to New, and select Registry Item.

• Action: Create
• Hive: HKEY_LOCAL_MACHINE
• Key Path: SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters
• Value name: SMB1
• Value type: REG_DWORD
• Value data: 0

Disable SMBv1 Client with Group Policy:

1. Open the Group Policy Management Console. Right-click the Group Policy object (GPO) that should contain the new preference item, and then click Edit.
2. In the console tree under Computer Configuration, expand the Preferences folder, and then expand the Windows Settings folder.
3. Right-click the Registry node, point to New, and select Registry Item.

• Action: Update
• Hive: HKEY_LOCAL_MACHINE
• Key Path: SYSTEM\CurrentControlSet\services\mrxsmb10
• Value name: Start
• Value type: REG_DWORD
• Value data: 4

• Action: Replace
• Hive: HKEY_LOCAL_MACHINE
• Key Path: SYSTEM\CurrentControlSet\Services\LanmanWorkstation
• Value name: DependOnService
• Value type REG_MULTI_SZ
• Value data:
  • Bowser
  • MRxSmb20
  • NSI

Reboot Required

Summary

Testing and Validation

Additional SMB v1 Resources

• https://technet.microsoft.com/en-us/library/security/ms17-010.aspx
• https://blogs.technet.microsoft.com/filecab/2016/09/16/stop-using-smb1/
• https://www.us-cert.gov/ncas/current-activity/2017/01/16/SMB-Security-Best-Practices
• https://support.microsoft.com/en-us/help/204279/direct-hosting-of-smb-over-tcp-ip

·       Identify high-value assets ·       Protect against known and unknown threats ·       Detect attacks and anomalous activities ·       Respond to suspicious activity ·       Recover from breach

What to Protect?

Asset Management (Identify)

• Backup Operators – Can back up and restore all files on DCs
• Server Operators – Can log on interactively, create and delete shared resources, start and stop some services, back up and restore files, format the hard disk of DCs
• Group Policy Creator Owners – can modify Group Policy that affect DCs
• Print Operators – can load and unload device drivers on all DCs

• Decommissioned Systems - If a files server has been migrated, make sure old server is properly decommissioned and taken offline as sometimes old servers stay online for years unmanaged and exposed.
• Backups Data - Make sure backup tapes are monitored and tracked as well as any system where backups are copied to in any unencrypted format
• Private Keys - Make sure private keys for certificates are deleted after installation on web servers as often PCKS#12 files are copied to shares with a .txt file with the password. This is a treasure for bad guys who scan for these and steal certificates quietly for man-in-the-middle attacks.

• Control Systems (e.g. utilities, medical equipment, weapons) – Many IT admins and cyber teams do not understand the implications of losing control of their Supervisory Control and Data Acquisition (SCADA), Process Control Networks (PCN), and Industrial Control Systems (ICS) which often have direct control of equipment that can affect the environment, public safety and health systems
• Point of Sale (POS) and Automated Teller Machines (ATM) also fall under a similar category whereby access to these can lead to theft of finances and ultimately identity theft.

• Critical Software (e.g. security and management tools) that grant full admin control over critical high-value assets – Most IT admins and cyber teams do not understand the risks associated with software agents and services (Microsoft or 3^rd party) installed on high value asset machines. Control from lower assurance PCs to systems managing Tier-0 accounts (e.g. Certificate Authorities, Domain Controllers), high value data servers.

• Outgoing and Incoming Trusts – Many organizations have way forest exposed an organization to security risks. All of those trusts need to be understood, well documented and monitored by the security organizations in the agencies. When possible Selective Authentication trusts or leverage Active Directory Federation Services (ADFS) in lieu of trusts.

How to Protect?

Access Control (Protect)

• Tier classifications for all users (e.g. Interactive Logons, Certs, Services)
• Tier classifications for all computers (e.g. Windows, Linux, Macintosh)
• Dedicated administrative AD forest protecting Tier-0 assets leveraging
  • IPsec isolation
  • One-way selective authentication trusts
  • Dedicated admin workstations for Tier-0 only enhanced security configuration and IPsec isolation from the production
  • Smart Card required for interactive (SCRIL) logons only for Tier-0
  • Rotation of SCRIL on a frequent basis for new random password hash rotation
• Credential hygiene and operational best practices (e.g. not exposing credentials across tiers)

• GPOs to ensure that local system accounts are not allowed to connect to other client systems
• Local firewall on client machines to ensure they do not have connectivity to each other unless specifically allowed
• Local Administrator Password Solution (LAPS) leveraged to randomize the local administrator passwords and storing passwords in AD in a secure fashion

Awareness and Training (Protect)

Data Security, Information Protection (Protect)

Processes and Procedures (Protect)

Maintenance (Protect)

Protective Technology (Protect)

Conclusion

• Every Virtual Machine (VM) administrator who manages a Domain Controller (DC) virtual machine is effectively a domain admin. 
• Every SAN administrator managing the virtual drives of a DC is effectively domain admin.
• An agent or service from a management tool (i.e. antivirus) running on a DC is often used to compromise domain admin 
• A compromised SAN or database admin’s PC accessing the crown jewels (Intellectual Property, HBI or PII) can be THE most valuable target
• Multi-factor authentication can still be compromised after authentication if a system is owned via man-in-the-middle attacks.
• Password Credential Vaults joined to a compromised domain are not your password vault anymore.
• PKI w/ Smart Cards and multi-factor OTP/token solutions cannot stop, cookie/session hijacking, credential thefts or pass-the-hash
• Is your critical infrastructure SCADA or Industrial Control System (ICS) controlling chlorine for public water supply on a network connected to Internet terrorists? Why?
• If you have EVER surfed the Web with a high-power credentialed account, your network is at risk for system credential theft/pass-the-hash compromise.
• If you deploy machines using images with common local admins or network accounts in administrators group, your entire network may be AT RISK for pass-the-hash attacks.
• If ANY 3rd party plugin or Software on ANY PC is not patched ANYWHERE in your network and you are not whitelisting apps (i.e. AppLocker), then you are at great RISK.

We are not at risk because we have bad security software.  Its never been better, but technology is still not a panacea.  The bad guys have adapted to the way we build and operate.  Systems administrators, developers and engineers protecting our critical infrastructure have allowed themselves become uneducated and passive on securing against the current threats often times solely dependent on firewalls, security appliances and intrusion detection systems (IDS) to protect their networks, computers and data systems from malicious intrusions or theft.  Wouldn't you know the bad guys noticed our laziness, and even nation states capitalized on it, got organized, educated and tooled up becoming strategic in their efforts to get the lead conducting offensive hacking with coordinated targeted attacks.  Wake-up CISOs, admins, and developers -  Firewalls, IDS/IPS, and Antivirus won't cut it any more against state sponsored cyber attacks!

The bad guys are attacking all layers from printer firmware to compromising conference room phones eavesdropping on real-time conversations; targeting employee's’ mobile phone apps; attacking unpatched O/S  and browser plugin vulnerabilities; exploiting poor credential protection in the cloud; and secretly dropping never seen zero days for sale to highest nation state government bidders.  How many phone admins have trained on Defense in Depth or Incident Response?  How many PKI administrators understand the risks of BYOD scenarios and how to adequately plan for securing communications with MDM providers?  How many critical SCADA and Industrial Control Systems are directly connected to the Internet for convenience via management PCs that are managed no differently than any other machine on the network?

Intrusion detection is imperfect!.  Spam filters catch a lot, but are inadequate to trap targeted spear phishing which like most social engineering attacks almost always work and are nigh impossible to stop.  Once a low-level beachhead PC is owned and foothold established, often from a browser based drive by exploit, zero-day or clicked link using custom compiled code specific to your organization tested specifically to be undetectable by your security software.  Because of historical scenarios, often imaged-bases approach are used to deploy computers with common management accounts or local admin passwords coupled with domain administrators surfing the Web using privileged accounts (double whammy) allowing the foreign invaders to then traverse the network laterally, elevate privileges, and take control of the DCs, password storage databases and virtual machine or SAN management software to effectively own the network and harvest data conducting unrestricted espionage for years undetected with potential for complete data destruction at the command of a button outside your borders.  Its in the news everyday and affects business, education and government alike.

So, do we throw in the towel and give up?  No, we may lose a few low hanging sheep to the wolves, but we don't have to lose the shepherds too!  The Domain Admins, VM admins, SAN Admins, DB Admins, SCADA systems need to be protected from the Internet and compromised PCs in the network differently using a secure architecture and design and well defined and enforceable operational security practices that are effectively monitored.  Assume for a second that every workstation and server on your network with direct internet access or using common credentials shared admin accounts with a machine that has Internet access (regardless of whether its Windows, Unix, Linux, Mac, Appliance etc...) has an undetectable rootkit with a keystroke logger and a credential editor/Pass-the-Hash tool installed and you begin to understand the reality of the threat and how you must deal with it.  Think like the enemy before you are the next headline news article.   Sun Tzu said in the Art of War, “If you know neither the enemy nor yourself, you will succumb in every battle”

Be proactive and hunt for the hidden threats that may lurk unnoticed on your network; if you are targeted specifically you likely won't ever detect it internally using COTS tools.  Perhaps it may be discovered only after a law enforcement agency brings it to your attention or after a proactive incident response investigation.  Educate IT staff on the real current threats and analyze the techniques used by attackers and the operational security needed to properly deal with those threats.  Defend at all layers and coordinate suspicious activity between platform security admins.  Never assume your AV or IDS signatures and heuristics will automatically catch the threat.  Understand and monitor event logs and patch those plugins and 3rd party browsers.  Use security policies to configure systems and manage drift.   Identify your valuables assets using a risk management model.  Follow the recommended guidance for securing AD and mitigating PtH threats. 

Firewalls are necessary, but so is a security development lifecycle (SDL) for applications to prevent and respond to application threats.  Antivirus is important, but so is adding security controls such as ASLR, DEP and Certificate verification (such as available with the EMET 4.0). Patching the O/S is important, but so is application whitelisting and 3rd party application inventory and patch management.
Secure builds are important, but as critical are secure monitoring and IPsec restrictions to protect valuable assets on the wire and to prevent malicious inbound traffic.  Limiting the number of domain admins is crucial, but even one privileged account of any kind with access to the manage the storage systems or virtual machines and is Internet or email connected compromises the security for the entire network.

We are at risk primarily because admins don't always understand the threats.  We are failing because we are using antiquated architectures and designs that have not been modified to keep up with the ever-changing threat landscape.  We lose data and become the story of the day because we use poor design and operational security and most of the time don't know whether or not they have been compromised because we rely solely on security software notifications as the authority of the state of our network.

Let’s take the example of a 3-tier CA hierarchy (Root CA, Intermediate CA and Issuing CA) with end-entity certificates valid for 1-year maximum.  One approach is to have Issuing CA certificates valid for at least double the life of its issued certificates, yet scheduled renewal with at least 1 year remaining (corresponding to the max life of end-entity  certificates).

For example:

In this example PKI with 1-year maximum end-entity certificate lifetimes, the green bar shows the validity period of the Issuing CA certificate while the schedule (year 3, 6, 9, etc.) to the left of the bar shows the scheduled renewal times every 3 years.  (See chart below):

Since end-entity certificates in this example are available for 1 year maximum, the end-entity would be always be able to be issued for the 1 years because the Issuing CAs would have more than 1 year left because the Issuing CA certificates here are valid for 5 years total.

The Issuing CA in this example is scheduled for renewal every 3 years.  The Intermediate CA Certificates which are valid for 10 years could then be renewed prior to the 3^rd renewal of the Issuing CA certificate (every 9 years).  This would then allow the Root CA Certificate which is valid for 20 years to be renewed prior to the 2^nd renewal of the Intermediate CA certificate (every 18 years).

This type of cascading schedule is just one simple strategy that allows the end-entity and CA certificates to be issued on a regular schedule in a simple and easy-to-follow while allowing full certificate lifetimes for all issued end-entity and CA certificates.

Online distractions like texting and driving, though, can be very dangerous and deadly as shown in the recently reported double-tragedy of a teen who was convicted of motor vehicle homicide as a result of texting while driving in an event resulting in the death of another driver. There is little doubt that the sentence imposed by the judge was strict and meant to send a message of deterrence to the public in an attempt to curb texting and driving.

What may seem surprising to some, however, is the response from the Transportation Department (DOT). I listened to a story on National Public Radio (NPR) last Thursday entitled, Texting and Driving Bans May Make Roads Less Safe by Robert Siegel and Audie Cornish. NPR reported that, “Thirty-nine states have rushed in recent years to pass bans on texting while driving like the one used to convict the Massachusetts teenager. Secretary LaHood says the remaining states should hurry up and follow suit. And he announced a $2.5 million grant to beef up enforcement”

Furthermore, Neal Conan of NPR reported the same day on “Talk of the Nation on “What'd Make You Stop Texting While Driving?” In it he reported that:

“Secretary of Transportation Ray LaHood earlier suggested technology to disable cell phones in vehicles. There's a lot of technology out there now, he said, which can disable phones. We're looking at that, he said on MSNBC, the possibility - I think it will be done, said Ray LaHood. I think the technology is there, and I think you're going to see the technology become adaptable in automobiles to disable cell phones. We do need to do this a lot more if we're going to save lives.”

Obviously there is a real threat that needs to be addressed; there is no question on the danger. However, a ban of specific types of technology or restricting driving freedom is not a real solution. Disabling cell phones in vehicles is just a bad idea and can have unintended consequences. Just briefly aftermarket hacks and scenarios where someone experiences their own tragedy because they are unable to access their cell phone to call a loved one in an emergency. Just imagine the “What if....” situations.

Still it does not really address the distraction issue. According to the NPR report, “Russ Rader is with the Insurance Institute for Highway Safety, which does research for insurers. He says laws can even backfire as drivers try to hide their phones lower down in their lap. Also, he says cellphone bans can only do so much since cellphones are only a small fraction of what distracts drivers.”

Russ goes on to say, “there is dispute about whether any law can actually get drivers to put down their phones…Distracted driving is as old as driving. And whether it's putting on lipstick, or reading the newspaper, or reaching into the backseat for the MP3 player, all those things are distracting. So focusing on phone use will have limited effect on reducing crashes.”

Furthermore according to futurist Michio Kaku, we will, in the not-so-different future, have “millions of chips in all our possessions: furniture, cars, appliances, clothes”. Today it may be a phone ban, but where does the ban stop or start for other devices? Are we going to disable all devices and gadgets going forward too? What about scenarios not involving vehicles that can be just as deadly such as pedestrians walking down a busy street while distracted while texting?

There is, however, a historically proven and practical approach to staying safe online while on the go. It’s the model that’s been used for year’s successfully with other safety technologies in vehicles. If we decide legislation of technology is required to solve the problem of the distracted driver, then let’s legislate an enabling technology solution.

There are plenty of examples of legislation enforcing the provision of a technology that will then create a safer driving environment without impeding our freedoms. Whether you like them or not, most modern cars come with seat belts and air bags as a result of mandated legislation. Though some would argue that seat belts limit freedom, a seat belt can easily be un-latched or air bags disabled as needed for required scenarios while driving or dealing with internal distractions. Furthermore, seat belts, air bags, tail lights, emergency flashers, catalytic converters, and anti-lock brakes are safety features that are built-in to the motorist’s ecosystem. All cars come with these safety features and a plethora of other technology designed to keep motorists safe and healthy while driving. The usage of the technology is enforced by laws, but the technology does not have to be purchased or installed aftermarket.

How many of us, despite the risks, would go out and buy a driver-side air bag for an older car without one and install it? If we decide legislation of technology is required, then draft a legal solution that resolves the problem. If hands-free technology solves the problem, why not make hands-free technology required components of ALL modern vehicles. Then train motorists how to use the enabling technology rather than restricting freedoms with an un-proven cell-phone disabling technology or banning cell phones in vehicles.

Combine the new technology with a strong public awareness campaign similar to the designated driver message done for DUIs that will promote change in risky behaviors. In either case, let’s take advantage of safe technology like Microsoft Sync which let you keep your eyes on the road and make hands-free technology mandatory in all cars. If we need to draft legislation to solve this difficult and epidemic problem; let’s embrace safer technology to address the real issue which are distractions as a result of the cell phone form-factor.

Once the technology is available everywhere, then we can enforce laws to mandate hands-free use as we do with seat belts and turn signals, and people will mostly comply because it’s simple-to-use, safe and readily available in every vehicle.  In the meantime, check out Microsoft Sync.

Note: Just to be clear, even though I provide a link to Microsoft Sync, I am not suggesting (or implying) that Microsoft Sync (or any specific branded hands-free technology) should be the solution.  I suspect there could be many types of competitive technologies available in the vehicle market. 

In a recent announcement by Lucian Constantin, it was noted that Google Chrome will no longer check for revoked SSL certificates online.  The article begins discussing a background of how:

“Google plans to remove online certificate revocation checks from future versions of Chrome because it considers the process inefficient and slow.”

There is little doubt that in some cases revocation checking can actually be slow if it is not designed appropriately or if there are mitigating factors like large Certificate Revocation Lists (CRLs) transferred over networks lacking the bandwidth capacity for timely delivery or even too many clients checking in far too often to download full CRLs.  This can be the case on Internet facing sites and could affect HTTPS site verification performance for some sites.  However, lets take a look at how CRLs work, and recommended practices for ensuring optimal performance for a PKI.

Certificate Revocation List (CRL) - A CRL is really just a list of revoked certificate serial numbers that has been digitally signed by a Certificate Authority and time-stamped and placed in a public in a repository such as a web site.  Applications that use certificates have the option of checking the CDP repositories for CRLs.  Many applications ignore CRLs altogether while other applications check CRLs and choose what to do if the certificate has been revoked as is the case with many web browsers.

There are different kinds of CRLs that are generally published on repositories known as CRL distribution points or CDPs:

• Full CRL or Base CRL - The most common and widely supported are the full CRLs also known as base CRLs which contain serial numbers of all revoked certificates for a particular Certificate Authority (CA).
• Delta CRL – Delta CRLs contain the list of serial numbers of only certificates that have been revoked since the last Base CRL was published. 

One of the challenges with designing a PKI is to determine the best publication interval, and there are several factors to consider.

CRL Publishing considerations:

• Publishing a base CRL more frequently, revoked certificates could be more quickly known, but the CRLs are downloaded more often, and consequently as the CRLs grow can generate more traffic for the full CRL downloading by all clients.
• Publishing CRLs less often can increase the latency before a client becomes aware of a newly revoked certificate, but may reduce overall network traffic because CRLs are downloaded less often.

Care has to be taken to make sure the PKI is designed with these considerations in mind.

Delta CRLs which are much smaller than base CRLs generally are defined in RFC 2380 and allow base CRLs to be downloaded at intervals further apart with more frequent downloads of the delta CRL.  This allows for more frequent updates to the known revoked certificates without the necessity to download the full CRL very often.  Not all devices or applications recognize delta CRLs.

OCSP - for real-time validation, the Online Certificate Services Protocol (OCSP) is an HTTP protocol that acts as an intermediary to responder to clients that support the protocol.  The OCSP response is a digitally signed response for the certificate status, but the response size does not change regardless of the number of revoked certificates.  On the back end, the OCSP responder generally relies on CRLs.  The advantage with OCSP over CRLs, is that in the event of a revocation that requires near immediate response a new CRL can be published and the OCSP responder can be configured to get the new CRL at a pre-determined interval (i.e. a few minutes) rather than waiting on the next update cached in the CRL.

If CDPs are highly available, distributed appropriately and publishing frequency published with careful consideration to the factors involved such as latency, network traffic, and CRL then they can be efficient at providing accurate revocation information.  Further optimization can be achieve if clients support Delta CRLs, and the OCSP protocol.

The aforementioned announcement goes on to state:

If browsers were to insist on talking to the CA before accepting a certificate, all these cases would stop working. There's also the concern that the CA may experience downtime and it's bad engineering practice to build in single points of failure.

CRL Distribution Points - Recommended practices for CAs are that CDPs be placed on highly available servers that are resilient to downtime and outages.  In fact an outage of a certificate authority should not affect the availability of CRLs unless the CA is down for an extended period of time extending beyond the next CRL publishing interval.  Even in those cases, the CRL can be re-signed with the CA’s private key even if the CA is unavailable.

Furthermore, the discussion focuses on an attacker scenario where:

If the attacker is close to the server then online revocation checks can be effective, but an attacker close to the server can get certificates issued from many CAs and deploy different certificates as needed.

Certificate Issuance - In general, recommended practice for a PKI is to limit certificate issuance to only authorized recipient users and devices approved by the certificate manager.  If the CAs are well-protected with good physical  and logical security and the private keys secured and possibly protected by hardware security modules (HSM)s then the attack surface on the CAs themselves is greatly reduced as is the likelihood of CAs issuing certificates to unauthorized entities.

Most of the successful attacks on HTTPS sites require control of both the certificates and the DNS.

Examples:

• http://www.symantec.com/connect/blogs/new-ssl-attack-revealed-black-hat
• http://pcworld.about.net/od/securit1/Kaminsky-Many-Ways-to-Attack.htm
• http://www.eweek.com/c/a/Security/Fake-SSL-Certificate-Incident-Highlights-Flaws-in-DNS-Comodo-CEO-440985/

The assertion here also suggested that “While the benefits of online revocation checking are hard to find, the costs are clear: online revocation checks…compromise privacy.”  What is the “privacy concern because the CA learns the IP address of users and which sites they're visiting?”  A web browser or any application can check revocation using CRLs or OCSP from a CDP, but typically not a CA if following recommended practices for protecting CAs.

SSL Authentication - If a client visits a secure sites (https), then the browser may check revocation status of the SSL certificate on that site (server) and optionally server will do the same for the certificates on the client, but these will usually checked against different CDP altogether unless client and server were published from the same CA.  In this type of scenario, two different IP addresses for client and server check revocation against two different CDP locations for the others’ certs.  The general case for this does not lend itself to a loss of privacy using CRLs or OCSP for SSL communications.

While the future of PKI and certificate trust model may change in the future; for the foreseeable future, CRLs still have an important role and provide tremendous value for PKIs

Photo GeoTagging seems to be making headlines this week and bring to our attention the potential dangers of Photo GeoTagging.

• http://abclocal.go.com/wabc/video?id=7621105&syndicate=syndicate&section
• http://www.myfoxtwincities.com/dpp/news/scitech/smart-phone-‘geo-tagging’-tracks-location-feb-22-2011

There is also popular web site ICanStalkU.com which also brings out the security and privacy issues implicated by this technology as well which states that they are raising awareness and noting that:

"After analyzing your photos, someone could find out: 

• Where you live
• Who else lives there
• Your commuting patterns
• Where you go for lunch each day
• Who you go to lunch with
• Why you...like to visit a certain nice restaurant on a regular basis

I think that most people if they realized they were posting exactly where they were each time they clicked "send" on their phone to post a photo to Twitter they would stop doing it at all!”

How can you protect yourself and others from potential privacy threats when using Windows Phone 7 privacy settings or Microsoft tools.

If you've allowed Camera to access your location, when you capture a photo with WP7, your location will be stored as metadata of the captured photo.  For photos, your location information is stored in the Exchangeable Image File Format (EXIF) tag.

There are a couple of options within WP7 to disable GeoTagging altogether or just when uploading to Facebook or Skydrive.

1. To disable Camera's ability to tag photos and videos you've captured with your phone's location
   • Go to Settings >Applications >Pictures + camera
   • Toggle the Include location (GPS) info in pictures you take
   • Switch to Off
2. If you would like to have location information removed from the metadata of photos you upload from your phone to Facebook or SkyDrive
   • Go to Settings >Applications >Pictures + camera
   • Toggle the Keep location info on uploaded pictures
   • Switch to Off.

Additional details on picture privacy settings can be found here: http://www.microsoft.com/windowsphone/en-us/privacy.aspx

To clean up existing GeoTags in photos already captured or posted, you can manually edit the GeoTag metadata out of photos using a free downloadable tool from Microsoft Pro Photo Tools v2.

The Pro Photo Tools allow you to add, change, and delete common metadata properties for digital photographs. You can place photos on the Live Earth map and then drag them to the right location. The GPS information will be stored back into the photos. If you have a GPS device, you can load track route files from the most popular formats (NMEA, GPX, and KML) and see them on the map. Then you can place your photos on the track route. Again, the GPS info will be stored into your file. When you have the right GPS location for your photos, you can automatically generate location info like country, state, city and even street names. Or if you know the location where a picture was taken, you can type it in and get the GPS location information automatically.

The foundation for e-Government Services is a Services Oriented Architecture (SOA) whereby citizens coming through any number of access channels or routed to any number of interoperability services whereby government agencies taking in, processing or distributing e-government data do not have to be the intake and exchange engine, and can instead focus on their core competency or government service.

Common E-Government Access Channels

Web	E-mail	Digital TV	Fax	Phone	In Person

	Content Delivery Search Electronic Forms Document Submission Collaboration				Application Integration Process Orchestration Message Routing Identity Management
Agency A	Agency B	Agency C	Shared Services	Agency D	Agency E	Agency F

 Moving this model to the Microsoft cloud has tremendous benefits.

• Access is virtually anywhere, anytime
• Share location-independent resources and costs in an environmentally sustainable way
• Allocate resources flexibly and rapidly
• Only pay for what you use

See Microsoft's Government Cloud solutions and begin operating E-Government with increased security and compliance (IS027001, FISMA, SAS70).

For additional information on Microsoft soltutions for Government, check out.

• Cloud Computing
• Cloud Application Center
• Gov 2.0

State governments fund security less than other entities and often CISO’s lack enforcement authority for broad security enforcement throughout the government. The funding problem results in shortage of IT security personnel. The study shows that only 2% of state governments have more than 50 information security FTEs compared to 48.5% for similar sized organizations.

While many state CISO’s at the state have adopted NIST standards for risk assessment, most state governments still do not adhere to enforcement mandates or audit compliance like FISMA (Federal Information Security Management Act) which is enforced at the federal government level. The irony is that adopting better security standards can actually save SLG money on IT procurement and daily management and operations.

According to Gartner's, 2008 "Case Study: Air Force Commodity Councils Take Aim at Mission Effectiveness": The U.S. Air Force adopted new security standards including the Federal Desktop Core Configuration (FDCC) & utilization of a Microsoft support agreement which helped

• Speed up implementation of critical enterprise wide security standards
• Save approximately $156 million in hardware costs
• Enforce enterprise-level cybersecurity policies
• Timely distribution of software updates & configuration management
• Save $100+ million in software licenses & other life cycle costs

In all the USAF achieved better security and saved more than $256 million in 4 years by simply implementing stricter security standards and reining in spending for procurements and excessive IT staff by reducing the number of required systems administrators required to manage systems.

SLG needs to first improve security by implementing the Twenty Critical Controls for Effective Cyber Defense. Few SLG agencies have adopted ALL of these safeguards and as a result we are losing the “Cyber War” in state and local government and subject to threats and data loss potential that could dwarf by magnitudes that which was released by Wikileaks.org.

Automation and software can be mapped to the controls as well in order to combat back and gain the tactical advantage in cyberspace while implementing these controls. In an effort to simplify adoption, SANS has mapped a list of generically user-vetted tools here, however there are a number of Microsoft Cloud & On-Premise technologies that map to each of these 20 Critical Controls:

1. Inventory of Authorized and Unauthorized Devices

• Microsoft System Center Configuration Manager (SCCM)- Hardware Inventory
• System Center Online Asset Inventory Service (AIS)
• Windows Intune (In the Cloud)
• Microsoft Assessment and Planning (MAP) Toolkit

Inventory of Authorized and Unauthorized Software

• Microsoft System Center Configuration Manager (SCCM)- Software Inventory
• Windows 7 AppLocker
• Software Restriction Policies (Active Directory GPO)
• Microsoft Software Inventory Analyzer (MSIA) – Free Tool

2. Secure Configurations for Hardware and Software on Laptops, Workstations, and Servers

• Federal Desktop Core Configuration (FDCC) Image
• Microsoft Active Directory GPOs & Security Guidance
• Microsoft Security Compliance Manager(Central Security Baseline Management)
• Microsoft System Center Configuration Manager (SCCM)| Desired Configuration Manager

3. Secure Configurations for Network Devices such as Firewalls, Routers, and Switches

• 802.1X Wired Authentication
• 802.1X Wireless Authentication
• Network Access Protection (NAP) | Cisco Network Access Control (NAC)

4. Boundary Defense

• Microsoft Threat Management Gateway (TMG)
• Microsoft Unified Access Gateway (UAG)

5. Maintenance, Monitoring, and Analysis of Security Audit Logs

• Microsoft System Center Operations Manager (SCOM)
• Audit Collection Services

6. Application Software Security

• Microsoft Security Development Lifecycle (SDL)
• SDL Threat Modeling Tool
• Banned.h (Header file to sanitize code listing banned APIs)
• FxCop (Static code analysis of .NET)
• Code Analysis for C/C++
• Anti-XSS Library (Mitigates Cross Site Scripting)
• BinScope Binary Analyzer (Free Tool)
• MiniFuzz (Free Tool)
• SDL Regex Fuzzer (Free Too)
• AppVerifier (Free Tool)
• Visual Studio 2010
• Microsoft Threat Management Gateway (TMG)
• Microsoft Unified Access Gateway (UAG)

7. Controlled Use of Administrative Privileges

• Microsoft Active Directory
• Microsoft System Center Configuration Manager

8. Controlled Access Based on Need to Know

• Windows Server 2008 R2 File Classification Infrastructure (FCI)
• AD Rights Management Services (RMS)
• Microsoft Active Directory

9. Continuous Vulnerability Assessment and Remediation

• System Center Configuration Manager (SCCM) – Software Update Management
• Microsoft Software Update Services (WSUS)
• Shavlik (SCUPdates) – System Center (SCCM) deployment of updates for both Microsoft & 3^rd party applications
• Eminentware – Simplify 3^rd party patch management via WSUS and SCCM
• Secunia (Corporate Software Inspector - CSI) integrates with WSUS and SCCM for 3^rd party patch management
• Forefront Endpoint Protection 2010 (FEP)

10. Account Monitoring and Control

• Microsoft System Center Operations Manager (SCOM)
• Audit Collection Services
• Microsoft Windows Event Log

11. Malware Defenses

• Forefront Endpoint Protection 2010 (FEP)
• Microsoft Forefront Protection for Exchange
• Microsoft Forefront Protection for SharePoint
• Microsoft Forefront Security for OCS
• Microsoft Forefront Threat Management Gateway (TMG)
• Microsoft Forefront Online Protection for Exchange (FOPE)

12. Limitation and Control of Network Ports, Protocols, and Services

• Forefront Endpoint Protection 2010 (FEP)
• System Center Configuration Manager (SCCM) – Desired Configuration Management
• Windows Firewall
• Microsoft Forefront Threat Management Gateway (TMG)
• Microsoft Forefront Unified Access Gateway (UAG)

13. Wireless Device Control

• 802.1X Wireless Authentication
• Microsoft Internet Authentication Service

14. Data Loss Prevention

• AD Rights Management Services (RMS)
• RSA Data Loss Prevention (integrates with RMS)
• Microsoft Forefront Unified Access Gateway (UAG)- HTTP redaction & Attachment Wiper
• BitLocker Drive Encryption

15. Secure Network Engineering

• Microsoft Consulting Services (MCS)

16. Penetration Tests and Red Team Exercises

• Microsoft IT Attack & Penetration Testing Case Study

17. Incident Response Capability

• Microsoft Security Development Lifecycle (SDL)
• Microsoft Services Premier Support

18. Data Recovery Capability

• Microsoft System Center Data Protection Manager (DPM)
• Volume Shadow Copy Service (VSCS)
• Windows System Restore

19. Security Skills Assessment and Appropriate Training to Fill Gaps

• Microsoft Security Guidance on TechNet
• Microsoft Security Development Lifecycle (SDL)
• Microsoft E-Learning

Microsoft  has solutions, products and technologies that map into each of these weak control  areas identified by the NSA & NIST, and many of them are already licensed by SLG agencies or free  downloads but  many controls still have yet to be deployed.  State and local governments agencies may drastically improve security while saving money by implementing these security controls holistically rather than piecemeal as historically has been the case.