Wikileaks fallout: Keeping your secrets safe

Commentary - What do Metallica and the U.S. government have in common?

They are both fighting to control information once it has been placed on the Internet. Like Napster,which rocked the music industry by enabling piracy and was eventually sued by the band Metallica,the current Wikileaks crisis concerning the unauthorized access and downloading of 250,000 sensitiveand classified diplomatic cables and other files is simply another example of a controversial yet highlyefficient and hard to stop Internet distribution engine for the global sharing of data.

Both Metallica and the U.S. government have gone after these Internet distribution systems in anattempt to regain control of content they own. But it’s a losing battle. For Metallica, not much hasbeen done to stop the millions of people who illegally access and share music files. Internet usersknow several Napster replacements exist that still amass files and enable the sharing of them. Whensomething people want—music or data—becomes public, you can be sure that people will find a way toshare it.

Clearly, once information is available online—whether government cables or music—the people whoown the information have lost all control over it. They can discuss new laws to accommodate newtechnologies, ethics and so on, but an equally pertinent question is “what could we have done toprevent this in the first place?”

The fundamental issue remains that in most organizations, trust is granted to staff allowing themaccess to mass amounts of an organization’s most sensitive data. And now the adoption of mobileand cloud computing pave the way for trusted staff to transfer and share data on the Internet. How doyou manage trust to so much data and how do you recover your sensitive data once it is posted on theInternet? You can’t put the genie back in the bottle, so the real question should be, “What are we doingto keep it in?”

In the early 1990’s both blackhats and whitehats (cyber-savvy individuals who use their knowhow forbad or good, respectively) played around with ways to extract information from systems and wereamazed at the assets they could access. It didn’t require a high level of sophistication to generate avirus and exploit weaknesses in systems. As the security market continued to expand, most of the earlydemand was for solutions to problems that didn’t threaten to siphon sensitive information or stealintellectual property. Rather, the problems that people paid money to fix were annoyances that took upthe IT or security department’s time or that cut into employee productivity. Still, this was enough to fuelsignificant investment in security products to thwart issues like denial-of-service and destruction of data.Now, for the most part, companies seem to have established at least a reasonable state of availabilityto servers, storage, and communication services. Headlines don’t frequently talk of a virus getting into asystem and shutting the whole network down anymore.

Still, we have yet to get ahead of the problem of a capable, motivated attacker who in some cases issponsored by foreign governments. Today, we’re all talking about what happened with Wikileaks andmany are focusing on the “Wiki” and not the leaks. And, while providers have shown good faith byshunning DNS and hosting services to the Wikileaks site, what will follow is a game of whack-a-mole.Case in point, Napster music sharing was replaced with platforms such as Limewire and BitTorrent.The Wikileaks loss represents yesterday’s clumsy virus. Quite simply, the leak originated from a low-level analyst trusted to follow policy. And while the security community is all-a-buzz around emergingadvance persistent threats capable of sophisticated and coordinated attacks on nuclear plants (Stuxnet)let us not forget that we continue to be at great risk from much less sophisticated threats like trusted

insiders with access control enforced with basic tools such as handbooks and written policy.The sticky area has always been the way organizations grant trust and the amount of power given to auser once that trust has been granted. There has to be a shift in paradigm. Companies should still aim toestablish trust—with background investigations and such—when they engage with partners, employees,etc. But organizations can no longer extend that level of trust to things as powerful as informationsystems and technology, and in particular, those trusted to administer and manage these platforms.

Commonly, a system admin gets a background check, gains clearance and is handed the ultimate accessto government or company information and infrastructure. Not anymore. Companies need to moveto a zero-trust model to enforce written policy with technology. At a minimum, the Wikileaks lossshould sound an alarm for access control of privileged users such as web and system administrators. Thepotential for loss is too great to expect that all people are going to pay attention to a memo or followthe employee handbook. After all, it only took one bad seed for Wikileaks to occur.

Just last month, the Executive Office of the President, Office of Management and Budget issued a memofor the heads of departments and agencies regarding Wikileaks and misuse of classified information. Thememo includes the following immediate instruction in support of zero trust:

•Each department or agency that handles classified information shall establish a securityassessment team consisting of counterintelligence, security, and information assurance expertsto review the agency’s implementation of procedures for safeguarding classified informationagainst improper disclosures. Such review should include (without limitation) evaluationof the agency’s configuration of classified government systems to ensure that users do nothave broader access than is necessary to do their jobs effectively, as well as implementationof restrictions on usage of, and removable media capabilities from, classified governmentcomputer networks.

There are a lot of issues that need to be addressed by a solution to the gamut of Internet securitychallenges and the need to share data. At a minimum, though, organizations should tackle high-riskchallenges posed by well understood threats that are easy to solve—like controlling administratorand privileged access to data and systems with today’s existing technologies that are not prohibitivelyexpensive. In fact, a proper privilege management platform designed to control, contain, and auditaccess to assets and systems needed to perform one’s job, could have prevented the Wikileaks leak.

biography
Ken Ammon is the chief strategy officer at Xceedium