Aardvarks to Zorillas - Anything goes

Been hearing about this worm since November 2008. The researchers have found that it may have a payload that it may unleash today. Not sure how bad it could be, depending on all those un-patched machines out there in the wild. So what does it do.... It has a very interesting payload and we have already seen more than 4 variants. Interestingly it looks like they let version A and B to check on how the community is going to respond. The cabal to counter its domain generation algorithm got a new lease and a new algorithm in the C version and also contains a p2p communication mechanism. The other part is how a digital signatures can be used effectively to control the compromised host. This is important to protect other bot commanders to take over the already compromised Conficker bots. Network traces have not yielded much, but looks like it is a widely distributed system which has already started pushing the latest DLL updates across to the already compromised machines. Lets look at the ch...

Organizations fail as a consequence of decisions taken by the collective intellect of the powers at the board. They are successful because of the same powers that make effective, efficient decisions and manage risk. As an investor every individual looks at a number of parameters before investing. These rules of investing have over the years been honed and tuned to such a level that the health of an organization can be gleaned from the statistics and information available to the public. Do any of the organizations that have got funding from the Government eligible as good Investments or Investment Grade? None of them would pass the muster, they are bleeding organizations which should have been asked to die or scale down become more efficient. Well now that the funding has been secured, what is the guarantee that these funds are to be utilized properly and efficiently. Would the Government end up with another body to oversee governance of these Organizations. Are we ready and prime for ...

Humans have and will always be using techniques we now call Threat Modeling. The circumstances we are in and history is full of threat modeling techniques employed at and effectively used to counter an  adversary. The adversary has multitude of forms and attacks utilizes any vector for effectively neutralizing your efforts to counter the adversary. So what do we do when we say threat modeling. Is threat an adversary? There are tomes written on the approach towards an adversary. Here in this blog, I will term "Threat Modeling" as something akin to understanding the adversary in terms of the threat he brings to the table and the varied tools (Armaments) in his disposal, his ability to understand your weaknesses and exploit it. All this put together helps the incumbent to understand the posture he has taken viz the adversary and therefore understands the various actions and reactions thereof. The activity to list all the threats, countermeasures, weaknesses and appropriate actio...

Security Verification is a process through which Code can be analyzed. However, as prerequisite, it needs to be addressed with due consideration of What the application is and the business operation that it supports. The main reason for this is that it would be very difficult to prioritize and address the weaknesses. The threat modeling is an important tool and along with the threat model a security review would be an indispensable tool in identifying the root cause of vulnerabilities – CODE. Based on the prioritized functions and possible attack vectors – For example Protocol Errors may be a potential area for Input validation problems. Based on the preliminary build, it is possible for a preliminary scan of the code base. This should provide a base input that can again be cleaned up to remove unwanted areas to concentrate the efforts and to move to areas of potential weaknesses. The easiest way to achieve this is to use a Static Code Analyzer, a lot of tools are available both open s...

Software design is the important stage where the code is really put to work to deliver or build an business function and application. This is a stage where the SRS (Software Requirements Specifications) is finalized and signed off for design and development. The major difficult in software design is to incorporate the business requirements as well as do threat modeling to understand the attack surface of the applications. Many applications do not show up problems in regular normal use but show up funny ways of responding when provided with a different input or action not generally considered as part of the application design. The major areas that a threat model derived needs to address are – The Microsoft STRIDE model provides the following areas to be addressed as part of the design. 1. Spoofing 2. Tampering 3. Repudiation 4. Information Disclosure 5. Denial of Service 6. Elevation of Privilege 7. Integrity of Data Even though all aspects are not covered most of ...

One of main tenants of secure application development is to include Information Security Planning at the earliest in the projects that are executed. It has been our experience, that to include or to make provisions for security and related concepts into the application at a later date is very difficult and expensive. The major design model that we use are the TOGAF open standards and SUP – a derivative of RUP customized for use in our organization. It is mandatory that a resource from the Information Security Team is included from the inception stage in any projects. We ensure that projects do not exclude the Information Security aspect of the project by ensuring that no projects get approval to procure or be issued a Project ID (for project tracking as well as for resource allocation) unless an approval is provided by the IT Integration and Security team. We have found that this has vastly improved our project delivery schedules as well as to improve the Information Gathering stage, w...