Ten Laws for Security

290 Pages·2016·4.117 MB·English

by  Eric Diehl (auth.)

Eric Diehl
Ten Laws
for Security
Ten Laws for Security
Eric Diehl
Ten Laws for Security
123
EricDiehl
SonyPictures Entertainment
CulverCity, CA
USA
ISBN978-3-319-42639-6 ISBN978-3-319-42641-9 (eBook)
DOI 10.1007/978-3-319-42641-9
LibraryofCongressControlNumber:2016950417
©SpringerInternationalPublishingSwitzerland2016
Thisworkissubjecttocopyright.AllrightsarereservedbythePublisher,whetherthewholeorpart
of the material is concerned, specifically the rights of translation, reprinting, reuse of illustrations,
recitation, broadcasting, reproduction on microfilms or in any other physical way, and transmission
orinformationstorageandretrieval,electronicadaptation,computersoftware,orbysimilarordissimilar
methodologynowknownorhereafterdeveloped.
The use of general descriptive names, registered names, trademarks, service marks, etc. in this
publicationdoesnotimply,evenintheabsenceofaspecificstatement,thatsuchnamesareexemptfrom
therelevantprotectivelawsandregulationsandthereforefreeforgeneraluse.
The publisher, the authors and the editors are safe to assume that the advice and information in this
book are believed to be true and accurate at the date of publication. Neither the publisher nor the
authorsortheeditorsgiveawarranty,expressorimplied,withrespecttothematerialcontainedhereinor
foranyerrorsoromissionsthatmayhavebeenmade.
Printedonacid-freepaper
ThisSpringerimprintispublishedbySpringerNature
TheregisteredcompanyisSpringerInternationalPublishingAG
Theregisteredcompanyaddressis:Gewerbestrasse11,6330Cham,Switzerland
Foreword
Twenty-six years ago, after a series of exhausting interviews, Eric Diehl agreed to
hire me as a member of his team in Thomson Consumer Electronics. At the time,
IcouldnotimaginethehugeimpactthattheencounterwithEricwouldhaveonmy
future career. Under his mantle, I learned what information security is about. Eric
taught me the fundamentals of Pay TV scrambling, hacking, smart card protocols,
and hardware security. He encouraged out-of-the-box thinking and constantly
strove to perfection, clarity, and precision.
My work with Eric taught me to think about security from a variety of angles.
Security can be approached according to the attack’s timeline: Predictive security
detects a coming attack (future), defensive security measures attempt to stop an
ongoingattack,whilereactivesecuritycomesaftertheattackandattemptstorestore
security.Securitycanalsobeseenfromathreat-sourceperspective:accountingfor
thedifferentmotivationsandmeansofhackers,agencies,academics,andcriminals.
Thetraditionalwaytoapproachsecurityconsistsinaddressingsecuritybyfunction:
confidentiality, availability, integrity, etc. Eric’s holistic approach consists in
comprehensively approaching security by answering systemic clarifying questions
such as: Where do we compute (device security)? With whom do we compute
(network security)? What computes (system security)? How do we compute (pro-
gram security)? and What does computation mean (information and knowledge
security)?
As theyears passed, Eric feltthat recordinghis experience andpassing ittothe
cominggenerationofsecurityengineersbecameanecessity.Hisfirstbookbecame
a reference textbook in engineering laboratories and academia around the world.
This second book is a practically oriented continuation allowing readers to
understand both the commonsense foundations and the general principles under-
lying security.
Suchacomprehensiveapproachtosecurityhasbecomeanecessity:Abrieflook
at any “good” cryptographic paper reveals that cryptographers rarely consider the
meaningoreventhestructureofprotecteddata.Whenamessageissigned,hashed,
or encrypted, data is considered as raw bits fed into functions. Interestingly,
v
vi Foreword
cryptographersconsiderthislow-leveltreatmentasavirtueratherthanalimitation
becausecryptographicalgorithmsdonotassumeanythingaboutthestructureofthe
datathatthey process.Information security specialists workatahigherabstraction
level and devise methods to protect structured information. For instance, SQL
injectionstargetdatabaseentries,Javabytecodeverifierschecktypesemantics,and
antiviruses analyze executable programs. As we write these lines, humanity is
moving into an era of ontology and knowledge where protecting data and infor-
mation starts to become insufficient. Ontologies already allow autonomous cars to
makedrivingdecisionsandentrustcomputerswiththeauthoritytomakeimportant
financialdecisions.Hence,itappearsnecessarytostartformalizingthefoundations
of ontological security and approach security in a holistic way.
This precious book sheds light on the fundamental underlying principles of
information security. I hope that you will enjoy reading it as much as I did.
David Naccache
Professor at Ecole normale supérieure
Paris, France
Preface
First of all, I would like to thank my wife Laila for her constant support for this
work and her invaluable patience. I would also like to thank my son Chadi for his
illustrations.
I would like to thank many colleagues and friends who carefully reviewed
portions of the manuscript. Their comments made this book more readable and
attractive. First, I thank my colleagues at Sony Pictures Entertainment, including
Bryan Blank, Mike Melo, and Tim Wright. Second, my gratitude goes to friends,
including Patrice Auffret (La Poste), Mahesh Balasubramanian (Disney), Martin
Bergenwall (Inside Secure), Olivier Brique (Kudelski Security), Eric Filiol
(ESIEA), Eric Freyssinet (French Interior Ministry), Julien Iguchi (Laboratoire
Cristal, Université de Lille), Helena Handschuh (Cryptography Research), Olivier
Heen(Technicolor),Jean-LouisLanet(INRIA),JeffLotspiech,AndrewMcLennan
(Inside Secure), Jean-Jacques Quisquater, and Rei Savafi-Naini (University of
Calgary).
I would like to give a special thanks to my friend David Naccache (Ecole
Normale Supérieure) who wrote the Foreword for this book.
Finally, I am grateful to my editor Ronan Nugent and Springer, who showed a
keen interest in this second book.
Culver City, USA Eric Diehl
vii
Contents
1 Law 1: Attackers Will Always Find Their Way... .... ..... .... 1
1.1 Examples .... .... ..... .... .... .... .... .... ..... .... 1
1.2 Analysis . .... .... ..... .... .... .... .... .... ..... .... 3
1.3 Takeaway.... .... ..... .... .... .... .... .... ..... .... 27
1.4 Summary .... .... ..... .... .... .... .... .... ..... .... 43
2 Law 2: Know the Assets to Protect . .... .... .... .... ..... .... 45
2.1 Examples .... .... ..... .... .... .... .... .... ..... .... 45
2.2 Analysis . .... .... ..... .... .... .... .... .... ..... .... 46
2.3 Takeaway.... .... ..... .... .... .... .... .... ..... .... 61
2.4 Summary .... .... ..... .... .... .... .... .... ..... .... 66
3 Law 3: No Security Through Obscurity . .... .... .... ..... .... 67
3.1 Examples .... .... ..... .... .... .... .... .... ..... .... 67
3.2 Analysis . .... .... ..... .... .... .... .... .... ..... .... 70
3.3 Takeaway.... .... ..... .... .... .... .... .... ..... .... 76
3.4 Summary .... .... ..... .... .... .... .... .... ..... .... 78
4 Law 4: Trust No One ... ..... .... .... .... .... .... ..... .... 81
4.1 Examples .... .... ..... .... .... .... .... .... ..... .... 81
4.2 Analysis . .... .... ..... .... .... .... .... .... ..... .... 84
4.3 Takeaway.... .... ..... .... .... .... .... .... ..... .... 105
4.4 Summary .... .... ..... .... .... .... .... .... ..... .... 122
5 Law 5: Si Vis Pacem, Para Bellum . .... .... .... .... ..... .... 125
5.1 Example. .... .... ..... .... .... .... .... .... ..... .... 125
5.2 Analysis . .... .... ..... .... .... .... .... .... ..... .... 129
5.3 Takeaway.... .... ..... .... .... .... .... .... ..... .... 133
5.4 Summary .... .... ..... .... .... .... .... .... ..... .... 140
6 Law 6: Security Is no Stronger Than Its Weakest Link. ..... .... 141
6.1 Examples .... .... ..... .... .... .... .... .... ..... .... 141
6.2 Analysis . .... .... ..... .... .... .... .... .... ..... .... 144
ix
x Contents
6.3 Takeaway.... .... ..... .... .... .... .... .... ..... .... 154
6.4 Summary .... .... ..... .... .... .... .... .... ..... .... 171
7 Law 7: You are the Weakest Link.. .... .... .... .... ..... .... 173
7.1 Examples .... .... ..... .... .... .... .... .... ..... .... 173
7.2 Analysis . .... .... ..... .... .... .... .... .... ..... .... 176
7.3 Takeaway.... .... ..... .... .... .... .... .... ..... .... 194
7.4 Summary .... .... ..... .... .... .... .... .... ..... .... 204
8 Law 8: If You Watch the Internet, the Internet
Is Watching You... .... ..... .... .... .... .... .... ..... .... 207
8.1 Examples .... .... ..... .... .... .... .... .... ..... .... 207
8.2 Analysis . .... .... ..... .... .... .... .... .... ..... .... 212
8.3 Takeaway.... .... ..... .... .... .... .... .... ..... .... 217
8.4 Summary .... .... ..... .... .... .... .... .... ..... .... 227
9 Law 9: Quis Custodiet Ipsos Custodes?.. .... .... .... ..... .... 229
9.1 Examples .... .... ..... .... .... .... .... .... ..... .... 229
9.2 Analysis . .... .... ..... .... .... .... .... .... ..... .... 232
9.3 Takeaway.... .... ..... .... .... .... .... .... ..... .... 234
9.4 Summary .... .... ..... .... .... .... .... .... ..... .... 240
10 Law 10: Security Is Not a Product, Security Is a Process .... .... 241
10.1 Examples .... .... ..... .... .... .... .... .... ..... .... 241
10.2 Analysis . .... .... ..... .... .... .... .... .... ..... .... 242
10.3 Takeaway.... .... ..... .... .... .... .... .... ..... .... 247
10.4 Summary .... .... ..... .... .... .... .... .... ..... .... 255
Conclusions ... .... .... .... ..... .... .... .... .... .... ..... .... 257
Appendix A: A Brief Introduction to Cryptography ... .... ..... .... 259
Appendix B: Other Ten (or More) Laws of Security... .... ..... .... 263
References.... .... .... .... ..... .... .... .... .... .... ..... .... 265
Abbreviations and Acronyms
AIK Attestation Identity Key
API Application programming interface
ATM Automated teller machine
BIOS Basic Input/Output System
BYOC Bring Your Own Cloud
BYOD Bring Your Own Device
C&C Command and control
CA Certification authority
CAS Conditional access system
CCC Chaos Computer Club
CEO Chief executing officer
CERT Computer Emergency Response Team
CIA Central Intelligence Agency
CMOS Complementary metal–oxide semiconductor
CobiT Control Objectives for Information and Related Technology
CRC Cyclic redundancy code
CSIRT Computer Security Incident Response Team
CSS Content scramble system
CVV Card verification value
DARPA Defense Advanced Research Projects Agency
DDoS Distributed denial of services
DES Data Encryption Standard
DLP Data loss prevention
DMCA Digital Millennium Copyright Act
DMZ Demilitarized zone
DNS Domain name service
DoS Denial of services
DRAM Dynamic random-access memory
DRM Digital Rights Management
DSA Digital signature algorithm
xi