Technical Storyteller
I’ll be leaving IBM at the end of the month and starting a cool new adventure with a great organization. I’m really excited about the opportunity for growth, and looking forward to jumping in with both feet. To all those I’ve worked with over the years at Big Blue, my sincere thanks for the collaboration and friendship. I’ve learned from each of you, and wish you all the best in the future. Here’s to new horizons!
Like many security folks, I always grab and read the Verizon Data Breach Investigations report when it comes out, looking for trends and themes. One of the things that struck me this year is that email remains a broad attack surface. At that same time, my own conversations with security teams have seen a troubling anti-pattern: unmanaged devices, especially mobile and BYOD, because users ‘only get email’ on them. Combine the two, and it’s an attack vector in waiting.
Email is a broad theme across sections of the report – it’s the most common entry point for malware, phishing (almost always via email) is the top social action in a breach, sending data to the wrong people, attempts to compromise accounts either for or via email, fraud perpetrated by a man-in-the-middle attack in payment email chains, and a number of others. Part of the threat is that Email is the most common vector to reset passwords, bypassing most MFA systems – and attackers know this, and force fail back to that method. If they get access to your email account, they really do have the keys to the kingdom.
At the same time, there’s growing demand by employees to allow BYOD, especially on mobile devices. Coupled with financial pressures to reduce corporate assets, a highly mobile and remote workforce, and a blurring of traditional office hours, access to email is happening on a growing number of endpoints. Most BYOD is mobile which are a mixed bag in terms of built-in security, ranging from Apple’s hardened iOS environment and walled garden at one end, to cheap offshore android phones that come with free pre-installed malware. Validating email on mobile, as the report notes, is extremely difficult (ever try to view the raw headers on an iPhone?).
On the laptop side, allowing access to corporate email or systems isn’t as widespread, but it still happens fairly frequently. Even though it’s easier to validate email contents, it’s still not perfect. One company I work with had a C-level executive’s credentials stolen…by phishing his children, who clicked the link, installed malware on the personal machine, which then captured the executives credentials logging into the corporate system.
As an aside on personal email account, remember that free email accounts, along with the you’re-the-product privacy implications, can be very difficult to recover if they are compromised. A paid service, like Exchange Online, lets you have a separate administrator account which you can use to disable and recover control over your email account. Of course, you’ll also have access to actual people to help too. The services are cheaper than a latte, and worth every penny.
For both corporate and personal email our risk models need to change: email is a major threat vector that provides a foothold for credential compromise, account takeover, and malware installation, and we need to assess risk in that overall context, not just the risk of data leakage.
Put it more simply, the idea that we don’t need to manage endpoints that only get email is misguided – we especially need to manage them if they have email access.
Microsoft just released patches for a ‘wormable’ vulnerability, and took the unusual step of including XP and Server 2003. That’s prompted conversations and comments about legacy operating systems and ‘enabling’ tardy upgraders. While there are people who still have their head down in denial, there are other cases where it’s much more complicated.
Clearly end users shouldn’t be on XP these days (and soon shouldn’t be on Windows 7). But what happens when that endpoint is controlling a multi-million dollar piece of industrial equipment? Or when it’s embedded into devices like an ATM that require significant investment to replace across an environment In many cases the vendor doesn’t support an upgrade (or has gone out of business), and requires either a major overhaul or outright replacement of the entire system.
On the Server 2003 side, it can be similar – large scale applications have been built that cannot be upgraded easily (or at all), either because the vendor is out of business, or there isn’t sufficient capital available to replace the system. In some cases, it’s a critical line of business application and the source code isn’t even available.
Security folks tend to default to a ‘replace it’ approach, and that’s definitely reasonable given the legacy nature of those platforms, but it’s never that simple. Risk has to be balanced with cost, and often that results in lingering legacy environments. In most of those cases, companies have either firewalled or airgapped those endpoints, sometimes moving to a virtual environment as well. Unfortunately, some do require internet access for maintenance or functionality, so there may be ways in.
So when a vulnerability comes along that can be ‘wormable’ – autonomous spreading of malware without user intervention, there’s a small (but very important) set of infrastructure that’s at risk. These systems can’t just be unplugged or disabled easily, as it can have significant impact to the business – potentially to the ‘go out of’ level.
That’s why Microsoft’s decision to issue the patches is commendable. They’re protecting the ones that legitimately can’t upgrade from the tardy upgraders. In some cases folks won’t, so a worm may still hit, but if a significant portion do, the effects will be contained and isolated – and that’s where herd immunity comes it. If we can get most of the legacy systems patched, the risk to the entire environment drops.
If you have legacy systems, by all means, use this as a reason to have the conversation (again) with your stakeholders and vendors about upgrading. But first, find the machines, and get the patches applied, courtesy of Microsoft’s good will. Kudos to them for protecting the herd.