Network Security and BYOD

February 25, 2013, TCG Security Sessions, San Francisco—A panel considered the requirements for security in networks, critical infrastructure, and in environments with BYOD. Phil Schacter from Gartner moderated the panel. Panel members included Steve Venema from Boeing, Dave Waltermire from NIST, and Phyllis Lee from NSA.

Venema introduced himself as involved with government and user issues and large scale enterprises.
Waltermire is working on a national vulnerability database and developing government and industry use cases and standards.
Lee is concerned with standards for security automation.

Networks are fairly secure with tools like firewalls and security software. Now, however, the infrastructure is changing as BYOD changes the risk decisions. Now the systems need to recognize new devices and behaviors and quality. There are standards but no drivers for adoption. What is the role of interoperability in standards and automation?
Venema suggested that the drivers are there. BYOD is an outgrowth of supplier network growth. There are various solutions for security and the costs of dealing with various subsystems. In many ares, management is incoherent when trying to address new technology.
Waltermire agreed that his space is similar. There are multi-vendor suites of tools that handle levels of hygiene and deal with threats. Interoperability is important and will help to reduce the additional costs for integration.
Lee concurred that different product lines need to talk together. There is a great need for automatic tools for support and implementation.

This latest change in the landscape involves increased endpoint intelligence and partners. Now we have to segregate devices as we know about them. Proper architecture, maturity?
Venema noted that the threat landscape changes quickly, so we need faster responses. TCG cannot monitor other group standards well in this environment, so we need to reduce cycle time of response through continuous monitoring and secure states. These are operational issues.
Waltermire commented that reviewing sensors and employees is challenging since no standards are available to pull the data together to monitor enterprise health and status. Risk decisions would like to have autonomous tools that use standards to expose information to analytics and drive security practices. There is still a lot of room for more work.
Lee had the same opinion and wants to see continuous monitoring of what exists, asset management, etc, leading to true insights on what is on the network. The tools need to get information on how the network normally behaves, so the command and control functions in the network can defend the network with automation. These are fragmented areas that need more work and studies.

Infrastructure security increase in awareness leads to more resources for defense. BYOD requires new policies, recognition modes, and whether to allow?
Waltermire admitted that there are some root of trust issues, but generally this is similar to other compute authorization. The security posture requires a software inventory on the device, OS and apps patched to current, and known configurations. Existing standards address some of the issues such as software ID tags per ISO 19770-2. Mobile presents opportunities to integrate with apps stores to deploy tags on the apps.

Configuration management calls for the OS and apps to expose their configuration settings for enforcement and security confirmation protocols. Software that is not part of the approved inventory is remotely checked and acted upon. Apps need to have their signature information available for sharing.
Lee considered that it is not just new devices, but data at rest, access, and other activities. It is important to check frequently when on the network to confirm security policy enforcement.
Schacter noted that the new equipment affects the security zone model. It is not just the DMZ and the tools, but totally new devices and behaviors. The management of unmanaged devices affects the whole security posture. Where do you place these devices in the network model? A semi-trusted device can be allowed limited access, but not the same as a guest. Or you can scan the configuration but don’t completely block all access. all of these issues are risk management decisions that need higher approvals.

Infrastructure control systems?
Venema called out a problem space that is getting denser. For high-level security, the problem fixes are critical but the lifecycle for infrastructure is measured in decades. There are many legacy security issues and forward looks unlike a server with a 3-year update cycle.
Users need more metadata for industrial security. A second perimeter overlay retention with protection on top of the underlying infrastructure helps. The challenge is that much of the infrastructure is a network of multiple SCADA networks with untrusted or unknown network structures. Traditionally, infrastructure concerns were for confidentially, availability, and integrity. Now the priorities are availability, integrity, and confidentiality.
Lee returned to the need for security automation standards. Due diligence for critical infrastructure requires interoperability. Any standards in this area needs to support automation and due diligence.
Waltermire suggested a common point of action, and the impact depends upon the endpoint devices. The critical systems need to make fine-grain choices about security. TCG offers their work on fine tuning access control and standards on viewing device interactions. Users and devices behavior affects the whole network, and this area needs more work to get to a holistic view of the network. For example, are patches deployed, restricting some network resources, etc.

Vendor external support in SCADA, restricted access, privileges and monitoring and the lack of standards?
Venema offered the example of an automotive manufacturer who use one site for support over many others. There is limited access for debug and VLAN doesn’t scale. Dynamic access control through VSEC is not able to control access to only those machines that need attention. Now, leasing and outsourcing of functions is making matters worse.

Intra-versus inter-enterprise networking, data storage?
Waltermire considered this an early warning to similar organizations. They need to collect data, automatically generate signatures, and share intelligence. Deploying security automatically to existing tools helps to detect similar attacks. The industry is starting to move to better models.

Schacter surmised that sharing and security for infrastructure critical systems are seeing a threat change, leading to an increased need for sharing intelligence. The IT departments in the infrastructure used to have 20-30 years to react, but now the APT attacks are more agile. The lifecycle of IT equipment is 2-3 years, but infrastructure is 20-50 years.

The dollar investments prevent upgrades to the software, so changing the shell perimeters, putting web apps behind a firewall, and other overlay functions can provide defense in depth.
Waltermire agreed the infrastructure needs to implement defense in depth. The range of equipment and update costs are too high to consider any alternatives. Other perimeters can use the TCG holistic approach so other devices and networks can provide an early warning.

Medical equipment needs re-certification for software changes, so need an additional layer for protection?
Waltermire surmised that this is a win for regular compute devices and helps keep them updated.

Transition from user-centric to identity of devices-centric creates a challenge for specifications for minimum capabilities and automatic security within existing standards. The need to prove that all sensitive data are on SED is an inhibitor, but also enables adoption.
Lee concurred that IT needs to get machine IDs that self-assert and identification is rolled up with TPM. Scale, government procedures, automatic standards, and work through example will eventually provide standards to get to an end-to-end solution. The result must be interactive with TPM machine authentication. The customer capabilities are the bottleneck.

Onscreen display and TPM require patience for full implementation. 98 percent of all DOD PCs have TPM installed. The NIST guidance and other suggestions are seeing very slow execution to implement. Now is the time to increase the energy level?
Waltermire offered that everyone wants to put in a good foundation for increased functionality and security. NIST works with everyone, including ISO, IEFT and others to integrate all facets into a working solution. They are developing profiles for better use. This is an international problem, so it requires international standards.