Twenty Year Anniversary

cyberul.html

cyberul.html
Posted Aug 17, 1999
Authored by Tan

Cyber UL - "Paper discussing the way computer security systems are rated and how out of whack these ratings are from reality. Maybe a system based on the ratings the UL uses for alarm systems and safes makes more sense."

tags | paper
MD5 | 04fd4afa9299decc006a7acdf3a77f4b

cyberul.html

Change Mirror Download
<PRE>
Cyberspace Underwriters Laboratories
[2]tan@l0pht.com

Cyberspace Underwriters Laboratories - 01/11/1999
Underwriters Laboratory

Underwriters Laboratories was founded in 1894 by an electrical
inspector from Boston, William Henry Merrill. In 1893, Chicago
authorities grew concerned over the public safety due to the
proliferation of untamed DC circuits and the new, even more dangerous
technology of AC circuits. These new and little-understood
technologies threatened our society with frequent fires which caused
critics to question if the technology could ever be harnessed safely.
Merrill was called in and setup a one-room laboratory with $350.00 in
electrical test equipment and published his first report on March 24,
1894.

Back in Boston, insurance underwriters rejected Merrill's plans for a
non-biased testing facility for certification of electrical devices.
Chicago however, embraced the idea. Merrill took advantage of the
situation in Chicago to get up and running and within months had
support at the national level.

Today, UL has tested over 12,500 products world-wide and is a
internationally recognized authority on safety and technology. The UL
mark of approval has come to provide an earned level of trust between
customers and manufacturers and safely allowed our society to leverage
hundreds of inventions that would have otherwise been unfit for public
use.

While originally targeting inventions which could potentially cause
physical harm to the user, the UL has expanded into the listing of
alarm system products as well as alarm system installers. Individual
products are listed as meeting UL standards and the companies that
install those products are also listed as qualified to install the
product as intended. Insurance companies have leveraged the UL's
scrutiny to properly ascertain their risks.

Cyberspace

Today, technology continues to grow at a rapid pace, perhaps even out
of control. The commercialization of the Internet has led many
businesses to offer services out there in what has been called the
Wild Wild West (WWW). As a result, the public safety is at risk.
Utilities are bridging control systems to Internet attached
back-office systems. Banks are offering 'cyber-banking' and merchants
are collecting information about consumers as they transact their
business over the Web. Individual privacy and the fiduciary trust
banks and merchants have established over hundreds of years are open
to new threats as these activities become more and more prevalent.

Similarly to early electrical inventions, today's computer security
products may introduce more harm than good when implemented by end
users. While some of these products do what they claim, most do not.
The lack of standards and meaningful certification has allowed the
sale of products that are either intentionally or unintentionally
snake-oil. While many of the products may solve old problems and
inadvertently introduce worse ones, some just do not perform as
advertised at all. For instance, some products have been marketed as
utilizing the latest and greatest encryption mechanisms when in fact,
the version they are selling does not utilize any encryption at all.

Just as in the late 1800's, the consumers have little understanding of
the inventions they are purchasing. They are presented with claims by
the product's marketers and have no way of proving those claims to be
true or false. Just as it was back then, this has not stopped the
large-scale application of these inventions, regardless of public
safety. In the late 1900's, nobody has stepped up to the plate to
expand the UL's role into computer security products or to take that
role as their own. To some extent, groups like Nomad Mobile Research
Center and L0pht Heavy Industries have acted as modern day Merrill's,
publishing non-biased findings to this affect.

This is not to say that certification of computer security products
has not been attempted in the past. ICSA for instance, operates a
certification program for products. CISSP and other organizations also
offer certification of information security professionals. These
organizations however, have failed drastically at providing what the
UL has provided on a more general 'technology' level. These failures
could be examined in detail but such an excersise is outside the scope
of this article.

The bottom line for ICSA is that it does not have the rigorous
standards that the UL has and its credibility has suffered as a
result. ICSA fails to see the certification process as ongoing or
cyclical allowing for products to inherit their 'certification'. As a
result, it is believed by some that there is a problem in that there
is a lack of non-biased inspection of software and that money buys
more certifications than good product design and implementation.

CISSP certifies individuals in the computer security industry. While
sorting out those who are fluent in the industry jargin and concept,
the work of CISSP's still lacks accountability in that their
certification is tied to a test rather than what the UL referrs to as
a 'field counter-check'. Like most computer certifications however,
this is simply a test of test-taking skills rather than a test of
experience and understanding.

Cyber-UL

Product certification needs to be performed on every version of a
product. Small changes that could ripple through traditional
technologies causing safety problems are at least ten fold when
applied to computer software. Many similarities may be drawn between
the certification of computer security products and the listing of
alarm systems and components that UL performs today.

UL has a stringent set of tests which are performed on physical
security systems which seek UL listing. For instance, safes and vaults
have a number of different labels which indicate their adherence to
different standards. UL utilizes 'young hotshot' safe-crackers wishing
to make a name for themselves, to do the actual testing. This way,
specialists are motivated (by not only fame but by financial
compensation as well) to validate the claims that the vendors'
marketing people want to make. The entire safe and vault business
operates around these ratings to communicate to the customer what it
is that the product was designed to do. Based on value and risk, a
customer may choose to spend more or less on higher or lower rated
labels.

The two major factors which influence the level of rating are time and
tools. The 'hotshot' safe-crackers are given samples of the product
and guidelines for their attempts to defeat its security. For
instance, a TL-30 rating means that the cracker is limited to tools
not including torches or explosives and is given 30 minutes of actual
working time to defeat the security. If X6 is appended to the rating,
the rating applies to not only the door, but the container (the rest
of the safe). This aligns the vendor's claims to the actual
performance of the product. Also, if a new version of the safe comes
out, it does not inherit the old version's listing, it must be
re-listed.

This addresses a big problem that was sure to arise with safe vendors
and has definitely risen in the computer security arena. Customers,
due to human nature, want products to be certified as 'secure'. Just
as customers like to hear promises of security, vendors love to make
them. In 1913, UL tested the first 'security devices'. With this
expansion into security devices, they recognized the need to replace
the word 'Approved' with the words 'Inspected' or 'Listed'. Due to
what UL has established with security devices, customers are not
lulled into a false sense of security and vendors do not make
outrageous claims. Customers are presented with 'product x is rated at
rating y' rather than 'its ICSA certified'. Vendors claim to be
resistant to certain toolsets for certain amounts of time. This is not
what the computer security field looks like today, but is where it
needs to go. The manufacturer and consumer must realize that testing
'security' is not the same as testing 'functionality' and because of
that, claims need to be adjusted to fit reality. If a door-knob opens
a door, the door works. If a safe-lock opens when you dial the
combination, it does not mean the safe works. You can however, perform
tests on the safe to assure that it operates as advertised within
certain heat and force constraints.

While listing individual devices as meeting UL standards is useful to
a security professional or consumer, it is only a small part of the
picture. Installation and configuration of components is critical to
the actual effectiveness of the security solution. For this reason,
installation of alarm systems is another area of influence for the UL.
This may seem like a daunting task since the number of implementations
is exponential to the number of products. UL has, with only about
4,000 employees, listed more than 12,500 products in over 40 countries
and developed over 600 standards for product safety. The tact taken to
assure the correct installation of alarm systems has been to list
alarm installation companies. Systems installed by UL listed companies
may qualify for a UL issued certificate. The certificate registers the
customer's alarm system becomes an eligible candidate for 'field
counter-checks' (spot-audits) which are performed to assure that
listed installers are not cutting corners. If a system which has
received a certificate fails the field counter-check, the installer
could potentially loose their UL listing. The UL has maintained a
quality program by scaling the number of field counter-checks as
needed.

Problems with the model

While the UL model for security devices seems to address many of the
same issues that surround Cyberspace, there are a number of problems
with deploying the model for computer security devices as it stands.

The first problem is that if a security system is defeated in the
physical world, it is typically very obvious to those who come into
work on Monday and see that the money is gone and the safe is in
pieces. Detection of a cyber intrusion is typically NOT very obvious
to those who come into work on Monday. Because of this fact,
safe-crackers have very limited time to crack a vault. Hackers on the
other hand, have unlimited time to crack a system. Once they get in,
safe crackers typically REMOVE items which then become 'missing'.
Hackers typically COPY items unless their motives are political rather
than financial, leaving the originals and the system intact. For cyber
intrusions to become less surreptitious, intrusion detection needs to
mature and become more widely deployed if 'time' is to be a meaningful
factor in the process.

The commercial model is based around the storage of valuables,
particularly jewelry and cash. In addition to the (American) UL
standards (TL-15, TL-30, TRTL-30, TRTL-15/6, TRTL-30/6, TXTL-60),
there is a German standard (A,B,C1,C2,D 10, D20, E 10) and a
Scandinavian standard (60-80, 80-100, 100-120, 120-140, 140-160,
160-180, 180-200, 200-240, 240-280, 280-320, 320-360). All three are
based on time and tools. Time and tools is an excellent set of
criteria for rating computer security components in areas such as
encryption. In America, the various insurance agencies determine what
rating is required for them to insure a given amount to be stored in
the safe or vault. In Europe, the Dutch Safe Rating Committee
publishes a similar standard assigning a range of financial value to
each rating in each of the three systems.

This does not, however, address liability for storage of information
such as credit ratings, social security numbers, bank balances, web
surfing preferences, political affiliations, which is subject not only
to theft but to alteration or even just surreptitious access. When
storing sensitive information, a more appropriate place to look for
examples is to the government. Classified information presents many of
the same requirements for storage that sensitive information on the
public or even commercial interests.

To meet the U.S. Government's needs in this area, General Services
Administration (GSA) has published standards (classes 1-8, black, red,
green and blue labels) which rate storage containers for everything
from weapons to information processing systems to filing cabinets.
They additionally publish information on storage of confidential,
secret, and top-secret materials in GSA Approved (or Non-GSA Approved)
containers. This information includes additional requirements for
alarm systems, restricted building access, guard check points, etc...
Specifics on GSA classes and labels are seemingly difficult to come
by. Based on the information I have found in the document library of
locks.nfsec.navy.mil/document_library/guides however, much of what has
been worked out by the GSA could potentially serve as a foundation for
developing similar standards for the storage of information on the
public.

The U.S. Department of Commerce has commissioned the National
Institute of Standards and Technology (NIST) to maintain FIPS PUB
140-1, Security Requirements For Cryptographic Modules. The document
sets forth a standard for specification of cryptographic-based
security systems protecting unclassified information. It provides for
product ratings from 1 to 4 with 1 being lame and 4 being k-rad. This
range is designed to cover a wide range of data sensitivity, from 'low
value administrative data' to 'million dollar funds transfers' to
'life protecting data'. The standard is typically utilized for devices
which protect tokens or encrypt data such as crypto boxes.

While this system may or may not be successful in real life, it
certainly deserves closer examination in that it represents what may
be the closest thing that the U.S. Government has to UL for computer
security products. Under the FIPS 140-1 Testing and Validation model,
vendors select an accredited FIPS 140-1 testing lab, submit their
'module' for testing and pay the testing fee. The lab then tests the
product for conformance to FIPS 140-1 and passes a report on the
'module' to NIST/CSE for validation. Throughout this process, the lab
may submit questions for guidance and clarification to NIST/CSE. If
the report is favorable, a validation certificate is issued by
NIST/CSE for the 'module'. The certificate is presented to the vendor
through the lab and the 'module' is added to the published list of
Validated FIPS 140-1 Modules.

The problem may stem from the difference between UL's roots and those
of ICSA and CISSP. It certainly manifested itself in the fact that the
UL is the only one providing non-biased product inspections as well as
accountability for the quality of the installations out there in the
field. Requirements for the use of 'listed' intrusion detection
systems, encryption mechanisms, and companies could on its own make an
impact if that listing actually meant something. The use of strict
procedures and specific levels of physical security could be required
as in the GSA model and this too could help the private sector. This
has not been the tact taken to date, however.

The second problem is that manufacturers of physical security devices
are pressured by customers to have a UL listing. This is because
customers are pressured by insurance underwriters to use products that
meet UL specifications. In Cyberspace, businesses currently feel that
the embarrassment and loss of public trust are more costly than the
actual damage caused by hackers. Citibank has become the most
well-known example of what happens when computer intrusions are made
public knowledge. By taking commendable actions and not covering up
the intrusion, Citibank is now known as the bank that got hacked
instead of the bank that handled the situation appropriately. Since
silence seems to be the best policy, cyber merchants choose to 'eat'
their losses rather than risk the negative publicity. Until these
losses become intolerable and insurance is necessary, there may be no
motivation to drive the certification, approval or listing of products
by UL or any similar organization.

It took UL about 30 years from being subsidized by the insurance
agencies to being self-supporting off fees paid by manufacturers for
testing. Merrill was the first full-time employee as a result of this
change. Insurance underwriters and Consumer Product Safety Commission
were instrumental in gaining public acceptance of UL work. It was the
public's safety that was of concern and liability drove companies to
insure. Insurance underwriters found they were then saddled with the
problem and addressed it effectively with the UL. Perhaps at some
point the collection and storage of information on the public will
carry some sort of liability with it.

A Call for Action

Without a call for action, I would simply be a whiner. At this point,
you the reader can assist with very little effort. Whether you are a
vendor, insurance company, end user, or hacker, let me know your
thoughts on the state of the industry, the state of the UL and/or this
article's conclusions. As a hacker, is the relationship between the
hot-shot safe crackers and the UL an attractive one you would be
interested in? Is the UL listing process for installations sufficient?
Will it encounter problems unforeseen by this article? As an insurer,
am I missing part of the picture; are companies actually insuring
their computer systems and data to mitigate loss or liability? As a
manufacturer do you foresee problems with the UL model being imposed
on computer security products? As an end user do you feel that
computer security is important? Do you feel that the current system
actually is sufficient? Have you been wanting something better or do
you feel that you are being slighted by my insinuation that you do not
fully understand the products you purchase? Any and all feedback on
this article would be appreciated no matter where it comes from
(although manufacturer comments will be taken with a grain of salt).
Forward those comments to tan@l0pht.com. If there is enough feedback,
I may write a follow up article on this topic. I am considering going
into detail on each rating system UL, German, Scandinavian, GSA and
FIPS 140-1, highlighting overlaps with the computer security
discepline.

Thanks to the UL for providing documentation on the history of the UL
and directing me to Peter Tallman of the Melville, N.Y. office. Thanks
to Peter Tallman for clarifying some of the issues surrounding the
listing of safes and alarm systems and directing me to Beverly
Borowski whom I hope can assist me in my future research. Also of use
to date was FED-STD-809, the federal standard for neutralization and
repair of GSA approved containers as well as a yearly publication by
the Dutch Safe Rating Committee called 'Recommendations for Insuring
Money in Safes and Strongrooms'. GSA's web site (www.gsa.gov) provides
a searchable index of federal standards including FED-STD-809. The
Dutch Safe Rating Committee is at Stichting Kwaliteitsbeoordeling
Brandkasten (SKB), P.O. Box 85764, 2508 CL The Hague, The Netherlands
- Tel. 070-3912008. Additional thanks to the researchers at the L0pht
for their assistance, particularly to Brian Oblivion for providing
extensive documentation on FIPS 140-1.

</PRE>

Comments

RSS Feed Subscribe to this comment feed

No comments yet, be the first!

Login or Register to post a comment

File Archive:

September 2018

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Sep 1st
    1 Files
  • 2
    Sep 2nd
    3 Files
  • 3
    Sep 3rd
    15 Files
  • 4
    Sep 4th
    15 Files
  • 5
    Sep 5th
    18 Files
  • 6
    Sep 6th
    18 Files
  • 7
    Sep 7th
    15 Files
  • 8
    Sep 8th
    2 Files
  • 9
    Sep 9th
    2 Files
  • 10
    Sep 10th
    16 Files
  • 11
    Sep 11th
    17 Files
  • 12
    Sep 12th
    15 Files
  • 13
    Sep 13th
    29 Files
  • 14
    Sep 14th
    21 Files
  • 15
    Sep 15th
    3 Files
  • 16
    Sep 16th
    1 Files
  • 17
    Sep 17th
    15 Files
  • 18
    Sep 18th
    16 Files
  • 19
    Sep 19th
    29 Files
  • 20
    Sep 20th
    0 Files
  • 21
    Sep 21st
    0 Files
  • 22
    Sep 22nd
    0 Files
  • 23
    Sep 23rd
    0 Files
  • 24
    Sep 24th
    0 Files
  • 25
    Sep 25th
    0 Files
  • 26
    Sep 26th
    0 Files
  • 27
    Sep 27th
    0 Files
  • 28
    Sep 28th
    0 Files
  • 29
    Sep 29th
    0 Files
  • 30
    Sep 30th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2018 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close