gadgets vs. process innovations

In the 1980s, defenders had to invent computer emergency response teams. In the 1990s, it was an innovation to have a chief information security officer to centralize authority or build an information sharing and analysis center to share and collaborate with peers. In the 2010s, the idea of a cyber kill chain changed how defenders conceptualize their job. Further improving operational coordination―through response playbooks, frequent exercises, and groups like information sharing and analysis organizations―can be an inexpensive way to build significant capability. Such revolutionary innovations have a very modest cost yet are often overlooked in favor of the newest technological gadgets.

from: Building a Defensible Cyberspace

Disable 445 outbound

Just a friendly reminder to make sure you’re only allowing port 80, 443, and maybe 8080 outbound from your network.  According to this recent US CERT alert advanced attackers are using email attachments to leverage legitimate Microsoft Office functions to retrieve a document from a remote server using the Server Message Block (SMB) protocol.  This sends the user’s credential hash to the remote server prior to retrieving the requested file. (Note: It is not necessary for the file to be retrieved for the transfer of credentials to occur.) The threat actors then likely used password-cracking techniques to obtain the plaintext password.

TCP ports 445 or 139 and UDP ports 137 or 138 (SMB) should only be allowed internally !!!

 

United States v. Microsoft Primer

There’s a great summary of the government’s case against Microsoft concerning the subpoenaing ability of data (email) residing in an overseas data center controlled by a US company.   The crux of the dispute is the territorial reach (and territorial applicability) of the Stored Communications Act (SCA), a subset of the Electronic Communications Privacy Act (ECPA) that governs law enforcement access to communications data.

The dispute arose when the Justice Department brought a warrant to Microsoft – issued based upon probable cause under the SCA (18 U.S.C. § 2703) – asking for the details and contents of an email account believed to be associated with a suspected drug trafficker.

Microsoft produced the transactional records it held on its data centers in the United States, but declined to produce the customer’s emails that it said were stored on a data center in Ireland.

HT: https://lawfareblog.com/primer-microsoft-ireland-supreme-courts-extraterritorial-warrant-case

Coast Guard Prints Spare Parts While at Sea

Wow, imagine the possibilities….

The U.S. Coast Guard is developing the use of 3-D printers to create spare parts on board its ships.The technology has already been used to produce spare parts, and is now being trialed more widely to print parts that are not normally kept on vessels and which may be difficult to source. The Coast Guard said this will improve mission readiness and logistical support.

“Sometimes those parts have lead times of weeks… maybe months, depending on the workload of the manufacturer,” said Captain Joseph Dugan, manager for the National Security Cutter Program.

HT: CIPS

Army Halt Use of Chinese-Made DJI Drones

Citing a worry over “cyber vulnerabilities,” the U.S. Army this week ordered that all drones built by China-based DJI, the world’s biggest drone maker, be immediately removed from Army service. The order comes following a classified study of the issue completed in May by the Army Research Laboratory, and the simultaneous release of a Navy memorandum titled “Operational Risks with Regards to DJI Family of Products.”

He says NASA and the Department of Energy have already stopped using DJI products. When Egan looked into why, he says they weren’t allowed to use the drones “because they are Chinese.”

HT: http://www.airspacemag.com/daily-planet/us-army-stops-using-chinese-made-dji-drones-180964324/

Microsoft & UEFI Secure Boot

A technical solution has finally been proposed to avoid locking out Linux and other OS vendors from UEFI shipped motherboards.  A couple of months ago Microsoft made waves by announcing their Windows 8 support for UEFI.  Open source supports took notice that this security mechanism could prevent other operating systems from booting on UEFI compatible hardware.

The Linux Foundation has released a paper with a possible solution:

papers suggest that all platforms which enable Secure Boot should ship in “setup mode” which would give the system owner control of the Secure Boot system. Initial startup of an operating system should then detect that setup mode and install a KEK (key-exchange-key) and PK to enable Secure Boot. The system would then securely boot that operating system. When a user needed to take control of their system’s secure boot, a “reset” option for UEFI’s keys would allow those keys to be cleared and a different operating system installed. Microsoft’s Windows 8 could also be pre-installed in the same way; the UEFI reset would then unlock the machine for other operating systems.