Service and a Culture of Ownership for Information Security

Ownership

No time for losers, cause we are the champions of the world!

DevOps practitioners take ownership not only of their individual performance, but also in the success of the team, and recognize that work they do has an impact on the success of the whole company.

Persistence

After I graduated from college, I backpacked around the world. I visited great cities: Hong Kong, Bangkok, Singapore, Beijing, Delhi, Mumbai, Jerusalem, Cairo, Marrakech. I trekked and climbed; I did odd jobs and taught ESL; I met incredible people and learned so much. I was out of the country for more than a year. That was 1995, the "Year of the Internet."  The Internet was exploding back home, and I could feel it. When I returned to the States, I was ready to launch my career. I moved to the Bay Area and started looking for a job.  

I had my old Apple Macintosh. I busily played with Java and HTML making wildly homebrew web pages; linking my page to people that I admired and making graphic puzzles linking to all manner of strange and interesting things. I followed job postings on Craigslist, when it was still a listserv. These were dial-up days and I networked online bulletin boards, like The Well. In a Java conference, I connected to one long-timer user, Bob Pasker, aka (rbp). Bob arranged a phone call to talk about a Systems Administrator position he had at a startup he co-founded, WebLogic. 

Or dumb luck?

It's worth stepping out of this story to make note that when it came to technology, nothing got by Bob. There was no obfuscating or charming your way past him. You knew if you were not doing well in an interview with him. One person that did get a job at WebLogic that had a particularly memorable reaction to his interview with Bob. Michael Smith, Jr, Smitty, who was interviewing for an entry level Sales Engineer position, started the interviewing feeling pretty good, and left feeling like he knew nothing about Java. 

Back to my interview. None of my experience and education--Electrical Engineering, AS/400, retail software, Novell 4.0 certification nor the Java basics I was teaching myself was of much use in this interview. Nevertheless, I was confident and insisted I could learn. I doubt I was convincing, but as Bob was extricating himself off the phone, he did offer me a temp job setting up some computers. I said yes.  

WebLogic, early days

Soon after I showed up in WebLogic’s downtown San Francisco office. The WebLogic office was tiny. They shared space with an accountant. The accountant had a corner office and a couple of adjoining rooms. Four smaller offices comprised the rest of WebLogic’s space. Dave Parker, the WebLogic president, occupied one of them. There was a small conference room with a floor to ceiling glass wall. That conference room sticks my mind. Dave gave what seemed like an inordinately long interview to a very attractive young women who wore her red mini-skirt very well. It turns out, that Dave was capable of talking an inordinately long time for any occasion at all. But, I digress. In another room Bob was setting up for the first three staff engineers they hired. One was for Sam Pullara and another was for our departed friend Joe Weinstein. The four co-founders, Bob, his wife Laurie Pitman, Paul Ambrose, and Karl Resnicoff worked from home over an ISDN network Bob setup. 

Bob had three mini-tower workstations to setup for his new engineers. The workstations had arrived from Micron along with some 3^rd party memory upgrades. Bob handed me the memory, and told to get to work installing it. This was something I'd already done a number of times in my life. I knew exactly what to do. And yet, I was so nervous I could hardly hold the memory stick. I could not get it to pop into the socket. After a bit, Bob quietly lost his patience watching me fumble with the memory stick. He reached over and popped it in. And we moved on.

I left some kind of impression on him, because I heard from him soon. Bob had me back to setup more computers. I setup Windows NT 4.0, Microsoft Office and development tools, like Perforce and Cygwin. Soon WebLogic was prepping to move out of its shared office and into larger space. Bob needed someone on the IT front-line to help get things going, and offered me a full-time job. At the same time, I was offered a more money to be a Novell administration for a San Francisco hospital. I passed on the Novell job and went to work at WebLogic.

First Days at the Job and Lessons Learned -- WebLogic 1996

בּוֹקֶר טוֹב

On my way to my first full-time day at WebLogic, I emerged from the BART station at Montgomery St. A a well-dressed stranger greeted me with Boker tov! Good morning in Hebrew. I had arrived at my destination. I headed underneath the Charles Schwab ticker; looked up at the sun shining on the pyramid building; and marched down Montgomery St. to start my new job.

One day during my first week, I was asked to move a printer. There was some issue, and it was taking me time to get it working. This did not go over well with Bob. He made it clear to me in a way that has stayed with me always: IT is a service job. Yes it’s technical, but its function is to enable other people to get their work done. Printers and cables or anything else technical did not come up in this discussion. The point was about providing service to business users. If my work is causing a work stoppage because the printer I am working on is off-line, I am not getting my job done. I took that feedback, and remembered a theater “techie” creed: 

You don’t see or hear us, but you don’t see or hear without us!

 

Fourk 3: IT is a service job. Yes, it’s technical, but its function is to enable other people. 

Service and a Culture of Ownership for Information Security

It's 2024 now, nearly thirty years later, and this is a lesson I come back to often. It is lesson that I routinely share with my Information Security colleagues. As Information Security practitioners, our function is "Information Security." Our purpose is Risk Management. We support the business by safeguarding its assets and ensuring compliance. We do this in order to reduce risk to the business. Understanding and embracing one's mission is a the first requirement of the, National Institute of Standards and Technology, Cybersecurity Framework (NIST CSF v2.0 released in March), which states, "The organizational mission is understood and informs cybersecurity risk management." By maintaining a service-oriented approach and aligning with our mission, we not only secure the company but also ensure we meet compliance objectives and foster an Information Security centric culture of ownership. 

Security DON'T dos, The Wild West of Old and DevOps to the Rescue

Security Tenets

Keep these DON’Ts at the top of your list.

 

Fourk 7: Security DON'T dos

1. DON’T leak data.
2. DON’T corrupt data. 
3. DON’T keep users from their data.

DO keep your customers data secure. 

 

Kevin Eberman's take on the triad, the three legged stool of Information Security: 

confidentiality, integrity and availability

The tenets of Information Security deserve regular consideration. They form the basis of many laws, regulations and industry standards. When I was first introduced to this formal definition of security tenets, I learned Information Security is about more than keeping secrets. I was expecting confidentiality to be a concern, but I did not expect integrity and availability to be equal concerns. Integrity made sense, but it took me a moment to get behind the idea that availability was a security concern. I was not and am not alone in this reaction. A lot of people have this reaction. Even people that should know better, like some developers I've worked with, have had this reaction. But, not having access to your data can have serious consequences. Imagine not being able to access your bank account! You have to be able to get to your data. 

Confidentiality: When users think about Information Security, this is generally what they think about. It is typically the type of breach that makes for headlines. The disclosure of private information.  

Integrity: The data you are minding has to be accurate. Making decisions with incorrect data leads to all kinds of problems, just ask someone who is trying to scrub their credit card rating of a false report or identity theft.

Availability:  Finally there’s availability. There is no data security if users cannot access their data. 

The Wild West of Old

In the Wild West of old settlers faced many risks. The environment was hostile. The weather, wild beasts, bandits, and of course, a native population made it very risky to be a settler. Yet people were driven by the opportunity of a new life and a place to claim as their own. 

Business has always operated with risk. Indeed, risk is required in business. Business is competitive. There are winners and losers. In order to get the spoils, in order to get an advantage over their competitors, the greatest business people, the greatest leaders need to take risks to get ahead.

After more than twenty years of the commercialization, the Internet remains a vast frontier with weak security--a lot like the Wild West of old. It provides ample opportunities for modern day bandits to wreak havoc on today’s Internet settlers. Like the frontier of bygone days, the Internet provides a new way to for people to live and make money. Despite the risks we continue to use the Internet at an ever expanding rate! 

The Internet: A Modern Wild West

The Internet was conceived and built as an open system. Government, universities and large businesses at the root of the foundation of the Internet shared a common purpose and interest in having and maintaining an open Internet. For decades these open standards fostered a high-level of engagement and usage by participants. 

As the Web commercialized the Internet, those groovy open standards emerged as an on-going vector for attacks. In the 90s, attackers were often individuals writing prank viruses that were mostly intended to cause a bit of disruption and draw attention to the prankster and his l33t h4xs0r sk1lz. Nowadays there are serious and coordinated threats by organized criminals and governments to scan, monitor and infiltrate systems for all types of misuses. Information Security continues to grow in importance for governments, businesses and individuals. Vast data disclosures by retailers and governments have become a feature of our news. Spying, theft and sabotage have made way for even more insidious attacks like misinformation. And then there's GenAI, poised to generate all types of automated mischief spiked with intelligence.  

Security exploits continue to emerge at all levels of the stack. As one part of the infrastructure is tightened up, millions of new code is distributed to millions of systems. The attack surface grows faster than our defenses.

And yet, even as the threats mount, old problems persist! E-mail has suffered mighty abuse. The true source of the e-mail is easily forged. Phishers pretend to be from a known service or source. They masquerade as trusted interlocutor and get marks to disclose information they meant to keep secret. Users are bombarded by these types social engineering attacks that are made more effective when forging email through an open-relay mail server. Improvements have been made to the e-mail infrastructure; both servers and clients have gotten better. Nowadays, it has become common for email operators to utilize new mechanisms to insure mail has proof of authenticity. 

DevOps to the Rescue

Security threats emerge very quickly. They often put Ops and Dev on high alert reacting to new threats. Quick action is necessary to implement security patches and maintain operations. Even a flawless security operation will be faced with unexpected challenges on today’s Internet. Zero day security threats, serious threats that emerge without any prior notice, require the type of rapid response, central control, communication and automation that a fully functioning DevOps environment provides. 

The Security Perspective - Risk Mitigation and Monitoring Tools

The Security Perspective

1. Growing roll of security
2. Regulatory and industry compliance
3. Zero day threats require constant vigilance
4. Suite of monitoring systems

The ubiquitous threat and constant reporting of all manner of security breaches is finally starting to elevate security concerns within the enterprise. Companies historically were willing to give lip service to security, but they were a lot less likely to commit to costly security programs and additional time and effort to enhance security. Security is complicated and time consuming. When security is added as varnish over an existing process or product it will be ineffective. Security must be addressed throughout the life cycle of the product and throughout the organization. Increasingly security is being promoted within the organization. C-level executives are being appointed to guide security horizontally throughout the organization. 

Security is about reducing risks. But risk cannot be completely eliminated. If you are going to do something, anything, there is some risk involved. If you want to completely eliminate risk, do nothing, put yourself in the closet and close the door. It should be noted, that security is a process, not a destination. You need to continually reevaluate your security position and adapt to changes. Modern applications need to be regularly tested for emerging security vulnerabilities in code, included libraries, operating environments and practices. Tactical security requires defining a perimeter, choke points, and other means to limit access to your goods. On many occasions Ops will try to define the perimeter inside out. 

While security is a concern for any organization that wants to survive, organizations in regulated industries are required to pay particular attention to security. If your business handles credit card data or health care information it will be subjected to all manner of scrutiny including extensive questionnaires, audits and regulations. Organizations need to be able to demonstrate they are handling data in a secure way. They will need to have policies that provide an overview of management’s position on the rules. They will need to have procedures that detail how policies will be enacted. Finally, they will need to document adherence to policy and procedures in order to provide evidence that the organization is adhering to those same policies and procedures. 

Security has a number of dedicated tools to assist with enforcing policies and providing evidence of compliance. These tools are monitoring tools focused on specific security concerns. Perhaps the most familiar application in this category is virus protection software. A mainstay on computers in this day, virus software scans your files for signatures of known viruses. Regular updates to your virus signatures are required in order to keep up with emerging threats. Virus scanning software does have the unfortunate impact of burdening systems with a disk intensive process. Particularly on servers, a balance must be struck between how aggressively virus scanning performs it work and keeping the system running so it can perform its function.

Monitoring Tools - DLP

Another application in this class of security monitoring software is called Data Loss Prevention (DLP). Data Loss Prevention (DLP) is used to deter and detect if data is “leaking” out of the production environment. DLP programs are installed on servers, and other systems like operators’ desktops and laptops that access secure data. These programs may also work down at the hardware level disabling USB ports to prevent downloading sensitive data (or any data at all) onto a thumb drive. They may also enforce screen savers and locks to keep prying eyes or sneaky hands off your computer when you are away from it.

Monitoring Tools - WAF

Twenty years ago, it was not uncommon for organizations to connect to the Internet with just a router and without any firewall. Firewalls are now commonplace. Increasing a requirement is a type of firewall called a Web Application Firewall (WAF). Traditional firewalls operate at the network level. They filter out unwanted traffic aimed at applications and services that could be used as a vector to launch an attack. However, a typical firewall does not distinguish between authentic web traffic and malicious traffic that is encapsulated or hidden in benign looking web traffic. This is where a WAF comes in. A WAF is smarter than a traditional firewall. It knows details about the protocol used to transmit web pages. It can discern non-conforming traffic that may exploit weaknesses in the application. A WAF can also include a white list of allowable requests that can be made to the application. 

PCI Requirements

These monitoring tools are requirements for the Payment Card Industry (PCI) standard. They increase the security of the application in real-time and provide historical logs that can be reviewed after a security incident for forensic analysis. Even when they are not required by for a certification or a standard, they are best practices. They may not all be suitable for all environments every time, but they should all be considered. A conscious decision should be made before forgoing a best practice.