There is suffering.
Suffering has a cause.
Suffering has an end.
There is a path that leads to the end of suffering.– Gautama Buddha
For many years I’ve been editing /etc/motd warning unwelcome visitors that they shouldn’t be on my systems. Unfortunately, by the time they see the motd they’re already on my system! SSH has an option to display a banner before a visitor is prompted for a password! Not only is this feature great for warning unwelcome visitors they should stay away… It can also be used as acknowledgment of an acceptable use policy! They have to read the banner before they login!
So what do I have to do to make this work? Read on!
First login into the server you wish to set up the banner for. The configuration files for sshd are all located in /etc! Next you’ll need to create the file that contains the disclaimer. In my case in named it ssh_banner.
Open you favorite text editor and create your login banner file:
sudo vi /etc/sshd_banner
Edit the file however you wish. I have the following:
Unauthorized Access Prohibited!
Authorized users are bound by randomdog.net’s acceptable use policy!
Next you’re going to have to edit the ssd_config file.
sudo vi /etc/sshd_config
The line you are looking for is:
# no default banner path
# Banner path/to/file
Edit it to read
# no default banner path
Banner /etc/sshd_banner
The last thing you need to do is restart the sshd process.
This can either be done by using ServerAdmin Select the server you were working on… then under the settings tab deselect Remote Login (SSH) save and then re-enable.
or on OS X client go to Sharing… then deselect Remote Login save and then re-enable.
You should now see something like this:
columbia:~ billheese$ ssh billheese@10.0.10.10
Unauthorized Access Prohibited!
Authorized users are bound by randomdog.net’s acceptable use policy!
Password:
Many things go into the exchange of information. How is it communicated? How is that information received and most importantly how is that information interpreted? Things such as the person’s tone or their body language or in the case of the written word, what words were chosen and how they were used. Is the wording formal or informal? All of these factors are part of the communication process. It is evident from reading the article that different people may interpret the information in many ways. Clearly and precisely stating you point is extremely important especially when human lives are at stake.
Let’s take a look at what we have learned.
In the case of the Columbia accident, the information that was passed around happened over a long period of time. NASA knew that foam from the external fuel tank breaks free during the launch and could cause damage to the shuttle. NASA failed to take timely measures to correct the problem.
In the case of the Challenger disaster, the engineers at Morton Thiokol had expressed to NASA their concerns for hat the cold could cause the o-rings to fail. The information that was being communicated happened over a very short period of time (less than 24 hours). The engineers didn’t have hard facts and NASA was under pressure to launch.
Now, let’s take a look at another NASA mishap, the Apollo 1 fire. On January 27, 1967, the Apollo 1 astronauts were performing a test and training exercise. During the course of the event a fire broke out in the spacecraft killing all three astronauts. A number of factors were to blame, the 100% oxygen environment, the flammable materials in the cockpit (Velcro) and an inward opening hatch. North American Aviation (the spacecraft’s builder) had argued with NASA officials that these factors could have catastrophic consequences.
It is interesting to note, the only times that we have lost astronauts in their spacecraft; NASA has been at odds with the spacecraft’s manufacturer. No one wants to be blame with death of another human being… so the blame game begins!
During the hearings of the shuttle tragedy, it came to light that two different people had two different opinions on what was being said. The article did not go into any length on who these individuals were and whether or not they worked for NASA or the spacecraft’s manufacturer. It’s important to know about which side of the fence these individuals sat? Without this information an objective third party could draw the wrong conclusions. Clear and precise wording is just as important as what is being said.
Changing corporate culture? Hmmm, now there’s an idea.
Computer data is physically nothing more than ones and zeros; yet the information that those ones and zeros represent can prove to be vastly important. On a very personal level it could represent our life’s saving in a QFD (Intuit Quicken) file or it could be something a little more dramatic such as the design plans of a Blackhawk helicopter! Either way we wouldn’t want to let the information get out into the wrong hands. There are many ways to protect our data, certainly in the case of the Quicken data file, Intuit allows for password protecting the file. Microsoft Office files and Adobe PDFs both have their own password protection schemes. BUT is your data truly safe? In the case of the later two… It’s a fairly trivial task to crack the passwords. So what’s a person to do? Well you could always hide things in plain sight using any number of steganographic tools! BUT all you’re really doing is hiding your data in much the same way a pirates burying their booty! No… want we want (and many governmental agencies need… HELLO VA!) is whole disk encryption. There are many companies that provide encryption scheme for the boot partition… enter a password and boot your computer. This type of protection can get a bit expensive and problematic from an IT management perspective. In fact we really don’t need to encrypt the entire disk… in actuality… we only need to encrypt the partition that contains our data. And for that we don’t need to spend a lot of money! Enter Truecrypt.
Truecrypt is an open source, cross platform disk encryption tool. You can use it to create encrypted files. It will even do traditional boot disk encryption of a Windows partition! But as I mentioned earlier we’re looking to just encrypt a single partition that houses our important data. Truecrypt uses AES-256, Serpent, and Twofish encryption algorithms and it provides plausible deniability! During the Iran-Contra Hearings, Senator Sam Nunn (D-Georgia) provided a perfect definition for plausible deniability…
Everybody I’ve talked to in the intelligence community and around town . . . tells me that the definition of that term is that when you set up plausible deniability for someone . . . they know the facts in question, but they can deny the knowledge, and that the denial is believable.” (Schwartz, 1987)
WOW it doesn’t get any better than that! SO how do we use this tool! First you can download the application from http://www.truecrypt.org/downloads. Once downloaded the first thing I would do is make sure that I indeed downloaded the correct software by validating the PGP key provided by the developers! We’re talking about protecting your trusted data… Take the extra step!
Install the application… Double-click to launch the executable!
We want to encrypt a USB thumb drive with a hidden volume… The default window should look similar to this.
Click on Create Volume. You’ll be prompted through a bunch of questions. In our case select because we are encrypting an entire USB thumb drive we should be selecting…
Next select because we want plausible deniability select the second option… If it was good enough for Ollie North it’s good enough for me!
You’ll next be asked to select a disk to encrypt. You will be asked to provide the password of an administrator of the system you are working on. This is needed because Truecrypt will eventually be formatting out the disk and this requires administrative permissions.
Select the Encryption and HASH algorithms you prefer…
Select OK and Truecrypt will begin the process of encrypting your thumb drive. This could take some time… In the case of a 2GB thumb drive, this took about 15 minutes.
The one gotcha is that you will need to populate the outer volumes with files that look important NOW! We do this so that if you are forced to compromise the password… when “they” unlock the drive and it will look as if they got what they want. So make those files look good without giving away the farm!
After the process has finished, you will be prompted to create the hidden volume.
Creating the hidden volume is very much similar to the outer volume! You’ll be prompted again to select which encryption and hash algorithms you prefer to use on your hidden partition. Next you’ll be asked how much space to allocate to your hidden partition… In my case I chose to allocate 3/4 of the space in half!
You’ll be asked to select a file system for the hidden volume. In my case I chose FAT as this gaves me the most options with regard to the OSs I can use the thumb drive with!
When the process is finally completed you’ll be presented with the following disclaimer…
Congratulations… You’ve just created you encrypted plausibly deniable USB thumb drive!
Resources:
Schwartz, J., (1987, July 22), PLAUSIBLE DENIABILITY Series: The Iran-Contra Hearings: The Tenth Week of Testimony, The Washington Post
It’s all about being professional… The more one prepares the better you present! One thing most people fear is speaking in front of a crowd. Creating an outline of all your talking points is more important that having a scripted presentation. If you speak from a script you’re going to come across as dry and rehearsed. People all too often put everything they want to say in slides. People for the most part are visual learners. Reading off a slide is the quickest way to put your audience to sleep. It is often said that Steve Jobs is one of the best presenters in Silicon Valley. Why because he is passionate. Why because he knows his product offering. He sets up the protagonist and then along comes Steve (Apple) to save the day! He may a sentence quoted from a magazine (his evidence) one a slide but there’s never more than one or two words for any given slide when he’s presenting product.
Why am I spending so much time on this… because one needs to come off as polished as opposed to contrived. We may not always be able to set up a protagonist BUT we can be intimately familiar with our product offering (whatever it is we are trying to say). We can be passionate! We can be polished. Have outline. Know your talking points… BUT don’t spend extreme amounts of effort getting your wording prefect! Learn from your mistakes… very often as part of my job responsibilities, I have to present technical material. Often I have to give the same presentation over and over. I learn what works from what doesn’t. I make adjustments… I may use the same lines over and over but you never get the same presentation twice. I try to present technical matters as simply as possible. In explaining bandwidth concerns, I often use plumbing as an analogy (the bigger the pipe, the more water can go through it). Put your ideas into words most people can relate to. Remember you’re not speaking to yourself… and those who are familiar with your ideas… you’re speaking to the an audience that can be made up of people from various different technical backgrounds. You have to assume they aren’t as familiar with the subject matter as you (otherwise you wouldn’t be there)! These are the people you need to convince. So convince them!
It truly is amazing how one of the most basic of protocols is the foundation of the Internet. DNS is a service/protocol that is essential to traffic out on the Internet AND in many cases MORE important on internal networks. Humans, by nature, aren’t really adept at remembering long strings of numbers. Hell, most of us can’t remember a name five minutes after you tell it to us! And while IPv4 addresses are broken down into four octets separated by decimals (or dot-decimal notation), it’s still longer than most phone numbers. Servers (or hosts) are not usually referred to by their IP address but rather their hostname (www) followed by the domain’s name (yahoo.com). Enter DNS (or the Domain Name System). It takes a domain name (such as weblog.randomdog.net) and converts it to an associated IP address for that domain (such as 69.0.94.158). It also does the reverse (converting IPs to domain names). DNS is a hierarchical naming system meaning that there are a few top-level domains (.com, .net, .org, .gov, etc) that pass requests to authoritative name servers for each domain, and in turn pass request authoritative name servers for their sub-domains.
Today DNS has expanded beyond its humble roots! It supplies the name of the administrator for the domain and the IP address of the mails servers for that domain. Additionally, DNS has also been expanded to provide listings of where services can be found out on a network, as in the case of SRV records. These SRV records inform systems as to where on the network certain resources (LDAP, AD, mail) can be located. Many other services rely on a properly functioning DNS system. In fact, Microsoft’s Active Directory and Apple’s OpenDirectory will break without a properly functioning DNS.
SO what if DNS breaks?
Well that’s a problem. DNS was not designed with security in mind. It actually grew out of a shared file. Before DNS, people passed host files around. The thought of actually tampering with the associations between host and address was not likely. People wanted to be able to reach the host they were looking for. Times have changed and there’s money at stake. DNS cache poisoning is a very real problem. If I were able to redirect your web browser to a ‘fake’ banking site, I could collect your credentials and make unauthorized withdrawals against your account. In March of 2008, Dan Kaminsky met with various software vendors than provide DNS solutions to discuss a vulnerability he had discovered. The consequences of this discovery were of such concern that all vendors present agreed to release a software patch that would fix the vulnerability on the same day. In very simple terms, Kaminsky’s vulnerability centered on the possibility of a “man in the middle” cause by the lack of true randomization of transaction IDs possible with only 65,000 values available. A DNS look-up query is assigned a random translation ID, but Kaminsky observed that when a vulnerable DNS server is able to perform recursive DNS queries, it was possible to guess the transaction ID and redirect the results (Vamosi, 2008).
Enter DNSSEC!
DNSSEC (short for DNS Security Extensions) adds a layer of security to DNS. Its aim is to minimize threats against the Domain Name System. These threats include the following:
1. DNS Cache Poisoning
2. DNS Amplification Attacks
3. DNS Man-in-the-Middle Attack
4. DNS Spoofing Attacks
The US government has already deployed DNSSEC on the root servers for the .gov and .mil domains. Unfortunately, as of today DNSSEC has not been deployed for the root server of the .com, .net and .org top-level domains.
Resources:
Vamosi, R., (2008, July 9), Massive, coordinated DNS patch released, Retrieved on May 27th, 2009 from http://www.zdnet.com.au/news/security/soa/Massive-coordinated-DNS-patch-released/0,130061744,339290456,00.htm
Security surrounding PDAs and other “smart-phones” is a complicated issue. I for one own an iPhone (but hopefully for not much longer)! I know… I know! Here comes the classic iPhone / Blackberry debate. It’s been a hotly contested acquisition! IT would prefer I use a Blackberry. They feel they have more control over the device and in many respects they do… BUT they don’t want to pay my expenses and I’d much rather a richer Internet experience. Fortunately for me many senior VPs in the organization wanted an iPhone as well.
Why give all the background?
Because sometimes technology is driven by the business and thus needs to be supported by IT. We need to find the best way to make these devices secure even tough they may not have all the security bells and whistles IT is looking for.
These devices have allowed us to spend a little less time in the office and a little more time doing the things we want… But there is a cost. Sometimes in the course of using information we have to deal with data that is sensitive… whether it is of a military nature or mere intellectual property concerns! The reality is these devices are now capable of holding a lot more information. In fact some of these device now offer the ability to extend its capabilities though the use of SD cards! So how do we protect the company and the data we all work so hard to create? Corporate policy! We need to have clear guidelines as to what data we will allow on any device… that includes USB thumb drives!
Most of us use these so-called smart-phones as glorified email and calendaring clients. Both Blackberry and the iPhone offer differing levels of security over these devices… Both offerings allow for remote wipe! Blackberry does this though the use of its proprietary server product… the iPhone relies on its implementation of Microsoft’s ActiveSync. Certainly RIM’s offering is a lot more feature rich… but one needs to keep in mind the type of data we are protecting.
Email in many ways has become the ultimate corporate communication tool. I’ve recently rolled out a BPM solution where I work and as I’ve been demo’ing the application, I’m constantly asked if the tool will email everyone involved in the project. And while it is possible I stress that the tool is not a replacement for picking up the phone and speaking… collaborating… understanding! Another example… the people I support in Asia have 10’s of GBs worth of emails… dating back 10 or more years. Why? To cover their bottoms! I think the need to cover one’s bottom is pervasive in many corporate cultures… and thus email is the perfect tool. Now one has it in writing, one can receive delivered and read notifications too!
Just picture it… “There’s no denying you read my emails!” as I slap down a stack of printed copies like Perry Mason.
I bring up Perry Mason because like it or not we are a very litigious society! We sue over the smallest thing! Some rightfully so, other suits… ahh not so much! E-discovery has become a big thing. In American law, discovery is the pre-trial phase in a lawsuit in which each party through the law of civil procedure can request documents and other evidence from other parties and can compel the production of evidence by using a subpoena (wikipedia.org, 2010). Therefore e-discovery is the production of electronic evidence, which can include… IM chats transcripts, excel/word documents, PDFs, web pages, source code, databases, graphic files or in our case emails. Not only does the defendant have to produce these documents, they need to provide complete records and in a timely fashion. If the defendant does not comply accordingly, many jurors perceive this as… “They have something to hide.” These documents are required to be preserved. Additionally, the company needing to disclose these documents needs to provide a document detailing the extent of the search they conducted.
E-Discovery is no small matter and requires a great deal of attention to adequately produce relevant documents. Systems need to be put into place to ensure e-discovery compliance. These systems include a stated policy on the retention of email distributed within a company. Centralizing data is another way to minimize the efforts required to comply with discovery demands. Additionally, organizing the data and providing mechanisms to rapidly search documents for specific keywords across the entire enterprise. Maintaining strong access controls over your data is essential to providing strong evidence! If a lawyer can prove that you didn’t have full control over your data, they can then argue that the data could have been tampered with reducing its credibility in court.
Ultimately, being able to produce evidence in a timely fashion helps your credibility in court. Noncompliance can be costly as well! Fines and other legal sanctions can be placed upon an organization that fails to “protect” its data!
Resources:
Various, (2010, February 9th), Discovery (law), Retrieved on February 23rd, 2010 from http://en.wikipedia.org/wiki/Discovery_(law)
A quick message from Izzy to her Grandmoms!
Let us be judged by our acts!
