Hot answers tagged risk-analysis
48
Recently, at the OWASP AppSec 2010 conference in Orange County, Bill Cheswick from AT&T talked at length about this issue.
In brief, there's insufficient research.
In long, here are some of his ideas for less painful account locking:
Don't count duplicate password attempts (they probably thought they mistyped it)
Make the password hint about the ...
24
Paranoia, professional skepticism, risk management... sometimes these concept are hard to separate. The odds that somebody is reading my packets right at this moment are relatively low. The odds that somebody has sniffed my internet traffic at some point in the past year... I guarantee it has happened, I've been to DEFCON.
The advent of wireless networking ...
24
Any website that complies with PCI Data Security Standards has to adhere to sections
8.5.13 (Limit repeated access attempts by locking out the user ID after not more than six attempts)
8.5.14 (Set the lockout duration to thirty minutes or until administrator enables the user ID).
This is unfortunately why a lot of sites accepting credit cards have ...
15
I see two sides on this:
most government bodies I review/audit tend to believe that because they secure everything then they are the most secure and that is the way it should be!
In actuality the organisations that go down the security nazi route usually end up more open than those who are pragmatic about it. For example, locking down your users too hard ...
12
Wouldn't be surprised if it came from the baseball "Three strikes" rule rather than anything technical.
One justification (for alphanumerics passwords anyway) is
Typically a failed attempt is either a mis-type or a CAPS on/off issue. So you try to log on and get rejected (1), try again because you think you mis-typed (2) and then realize the CAPS key is ...
12
Yes, I think it's possible to be too paranoid. Although, also, I just finished talking security with a bunch of performing artists - people with no money who really need to spend their time promoting their work and creating new work... not building the Fort Knox of security just so they can use Facebook. They need common sense, a basic understanding of ...
11
This is such an astonishing question that I find it difficult to answer.
This distrust doesn't come from theory, but from experience. When we say "FTP is too dangerous to use" is because we've found it, in practice, too dangerous to use.
You seem to think that a "packet logger" is either difficult to obtain or difficult to use. Neither is true. It takes ...
10
I agree with the OP. If you think about what the lockout protects you against, there is no difference between 3 or 20 attempts (or 100, for that matter).
All you achieve with these lockouts, apart from punishing forgetful users, is to prevent a brute-force attack.
You can also user it to trigger a warning that an attack is on-going, but that isn't the ...
9
Short answer: Yes, computers can get a whole lot wrong before any human can realize that there's a problem so "trust" just doesn't work in computer systems.
Default distrust is the only viable posture for high-performance system. To explain why, I'll contrast interactions between computers to interactions between humans.
In human interactions, default ...
8
There are two aspects to this.
The first, as you mention, is preventing brute-force attacks.
For this purpose, really any number of tries should do - 3, 5, 20, 2000... with a proper password policy (length+complexity+...) giving a large enough keyspace, any kind of throttling (X number of tries per hour) will ensure that bruteforcing the entire space ...
8
I believe I'm late to this debate, but I hope I have something useful to add here.
The account lockout policy (with the number of consecutive invalid attempts usually in the range of single digits for most organizations) was not devised solely against automated brute force attacks.
It is more of a protection against password guessing by human attackers, ...
7
If you read Schneier, you'll be familiar with one of the basic premises of "smart" security that he also pushes a lot:
Security is a Trade-off.
It simply does not make sense to go full metal paranoid on your systems, since security can NEVER be 100% anyway (we used to be told the only way to be 100% is to unplug the computer... now we know that's ...
7
I can tell you why I act this way from personal experience. Here is what I have experienced in my life:
A friend of mine didn't trust her boyfriend, and installed a snooper on her network. It was some commercial product she just installed on her windows laptop. When he came to her house with his laptop, she was able to get all his plaintext logins. When ...
6
In general, since I don't have a specific case to look at, you simply need to answer the question:
Which is worth more to you?
Where worth is defined however you like. Hardware is expensive and data is cheap monetarily, so let me expand and consider two use-case scenarios:
You're working on something ground-breaking/commercially sensitive. Having your ...
6
There's always going to be hackers that do these type of things because they can. The extent to which that pool overlaps with those with malicious intent is the magnitude of the concern, I think.
Like anything else in medicine, there is a tradeoff between costs and benefits, so if the convenience to the patient and power to control dosing and other ...
6
If some people have put some hidden backdoors in your system, and if they were competent at it, then you won't be able to find them. "Competence", here, means "having an Internet access and typing 'rootkit mac os x' in Google". See e.g. this. It is theoretically impossible to completely hide a backdoor, but only in the same sense that it is theoretically ...
5
Your question is similar to asking why should I lock my doors but with the twist that all cyber doors get jiggled by would-be intruders constantly.
An unprotected system placed on the Internet will undergo simple automated port scan attacks within minutes of being booted
...
5
Following Neal's suggestion, I am adapting my earlier comment in to an answer... with a bit more detail which is hopefully easier to understand :-)
My laptop's hard-drive is fully encrypted so the data on it is safe from thieves and the such.
However, I still have Prey (tracker) installed on it with an open access Guest account because I always keep my ...
5
Does human misery and heaps of money sound like good reasons? A hundred years ago any living person interacted with maybe a few thousands of people in the course of a lifetime, most of those for a very short time. Now consider that your computer (depending on your and your ISP's setup) is reachable by billions of other machines all the time. If any one of ...
5
In regards to the suggestions of time incrementing 'lock-outs' to delay successive failed attempts and hence prevent brute forcing, do please remember this only works on targeted user attacks.
If the attacker only cares about gaining entry to the system, they could perform a breadth first attack (Cycle all known/guessed user names before cycling to the next ...
5
The fundamental deference between the two methodologies is that GAIT is qualitative while FAIR is quantitative.
Bottom line, GAIT is another one of those methods such as SAS70, SOX, Cobit and the rest that will end up to be a checklist exercise that will tell you nothing about your security or what the monetary value of your IT risk is.
5
"IRL" criminal attempts are limited by the resources available (how many bank robbers / thieves / muggers / fraudsters can you get working for you at once; how quickly can you identify and focus on potential victims) and by fear of detectability/traceability (how can you avoid being spotted in the attempt and recognised; how do you avoid being informed on).
...
5
SANS.org have a few really good resources. Including:
http://www.sans.org/windows-security/2009/07/11/practical-risk-analysis-spreadsheet/
http://software-security.sans.org/resources/paper/reading-room/threat-modeling-process-ensure-application-security
...
4
I suggest reading Krag Brotby's Information Security Management Metrics book for coverage of most of the relevant risk analysis frameworks that are usually tailored to a specific kind of risk (e.g. financial analysis for information security management programs or risk management programs could use ROSI, ALE/SLE, VAR, cost-effectiveness, etc).
I also ...
4
It's a silly arbitrary rule that comes with a risk of a strange kinda of DDOS attack. Lets say Marv hates website X and web site X has a Y number of attempt lock out policy. Marv could raise some serious hell by having a script automatically try random names Y times with bogus passwords. Even if a password worked Marv would likely not care and ignore it. ...
4
Is the level of paranoia warranted? And why would people act this way?
Frequently, it is caused by an over-reaction to a previous event. Humans are terrible with statistics (which is why casinos and insurance companies get fabulously wealthy), so we tend to over-emphasize past anecdotal events.
In companies, this gets embedded into policies and ...
4
Absolutely - these happen a lot, because there is big money to be made, and that drives crime. To give you some specifics on your points:
Exactly how often does a MITM happen? ... Lets be serious, this
doesn't happen often (eg 90% of the population)
It happens a lot - but to be fair, it is often easier to attack using a trojan (Man in the Browser or ...
4
I believe the reports before 2011 are valid. The architecture of Skype hasn't changed since before then afaik. This type of report has been done before by many folk that I've known or worked with as well as myself. I can't give you the finished working papers obviously as it's essentially PII but here's some papers that research was based upon (apologies if ...
4
How much risk arises from password aggregation?
This is a difficult measure to quantify. Certainly, if the cryptography protecting your password store is poor, or in the case of a cloud-based tool their host system security is poor and their storage scheme allows an attacker to recover your password database, then all password data is freely available ...
Only top voted, non community-wiki answers of a minimum length are eligible
