Roger Halbheer on Security » Internet

Why Today’s End-User Education Fails!

Roger Halbheer — Sat, 27 Mar 2010 10:00:00 +0000

I was reading a paper recently, where I initially thought it is a joke (it looked scientifically, therefore I was not too scared). But as our research department did it, it is serious and really, really good – at least it definitely made me think. It is called So Long, And No Thanks for the Externalities: The Rational Rejection of Security Advice by Users – you should read it!

Basically it focuses on the cost/benefit of advice to end-user from an end-user perspective. there are a few quotes from the paper (to tease you):

We argue that users’ rejection of the security advice they receive is entirely rational from an economic perspective.
A study of pass-word habits in 2007 [26] found that users still choose the weakest they can get away with, much as they did three decades earlier [45].
For example, it makes little sense to invest e ort in password strength requirements if phishing and keylogging are the main threats. It does not pay to learn URL reading rules to recognize phishing sites when the direct losses borne by users average less than a dollar a year. It’s hard to blame users for not being interested in SSL and certificates when (as far as we can determine) 100% of all certificate errors seen by users are false positives.

If you think it through – they are right. Then, they draw a few conclusions:

Users Understand Risks better than We do
Worst Case Harm and Actual Harm are not the Same
User Effort is not Free
Designing Security Advice is not an Unconstrained Optimization
The Economic Harm of Security Advice

and then, please, read their final chapter on What Can We Do? – otherwise you will stay frustrated

Roger

Strong Authentication and Privacy – A Contradiction in Terms?

Roger Halbheer — Wed, 17 Mar 2010 18:00:35 +0000

You know that I am not a big fan of the requirement for having all Internet users authenticate strongly. There are people in the security arena who think that this is the only way to fight cybercrime – and in parallel accept that they would kill freedom of speech.

I recently had a good discussion where somebody gave the following example: Would we be able to get completely rid of crime? Probably yes, if we would be ready to give up all our privacy and accept a 24*7 surveillance of everybody (I am not sure whether it would even work then but we could get close to). However, this is socially definitely not acceptable – not in the physical world, nor on the Internet. Nevertheless we want to have a certain level of assurance if we offer some service.

This is, where U-Prove comes in. We just announced the availability of the U-Prove CTP at RSA. This by itself is great news. However, when I talked about the concept, people sometimes failed understanding, what this really means – now I think we have a great showcase:

The German government will offer its citizens the possibility to apply for an eID starting in November. Additionally the Fraunhofer institute worked on leveraging U-Prove together with the German eID. An awesome case. Look at the video:

From my point of view, this technology is something you should think about and think about how to leverage it.

Roger

Legal Challenges of International Business and the Cloud

Roger Halbheer — Tue, 09 Mar 2010 07:10:41 +0000

To start with: I am an engineer not a lawyer – and this might be part of the problem…

When I started to think about the Cloud and security and thought about all the work I do with Law Enforcement and the challenges they face. Additionally, I started to think about the legal challenges we – as an industry – already had. Or better, the legal challenges I knew about. Our Cloud Security Challenges paper just touches a little bit on this but to me it is a big challenge (to big for an engineer ?)

Let me give you an example: A case which happens often is that Law Enforcement is approaching any mail-provider with the request to access the content of a mailbox because they have a case where the suspect is expected to have mails which can be used as evidence. This is actually fairly standard and within the legal boundaries of a country straight-forward if the law enforcement officer has a court decision. Now, with international providers it gets more complicated as a case in Belgium showed: The Belgium policed asked Yahoo! to give them access to a mailbox of a person living in Belgium based on a Belgium court decision. However, this data is hosted in the United States. Pretty normal: The police then should the FBI for help, they issue the corresponding papers (together with the court) and Yahoo! would hand over the data – this process is called MLAT (mutual legal assistance treaty). Belgium refused to do that as it was their position that a Belgium decision is good enough because the suspect lives in Belgium. Yahoo! now had two choices: Violate the US law by handing over the data or violate the Belgium court decision by not handing over the data – a lose-lose position they were in .

And the worst thing to me is that we all have just one goal: We want to get the criminals arrested – this is a battle where law enforcement, policy makers and the industry are on the same side! If you want to read more: Yahoo Fined By Belgian Court For Refusing To Give Up E-Mail Account Info

And there are a lot of cases like this. Cases where the data retention policy in one country asks for data up to 12 months and another country tells you that you are not allowed to keep data for longer than 8 months because of the Data Protection law – if you operate in both, what do you do?

The longer I work in this space the more complicated it gets for me and more of such challenges pop up. This morning I read the following article: A step in the right direction. Basically this blog post covers a privacy law put in place in Massachusetts which has broad impact as it is valid not only if you are located in Massachusetts but if the company owns or licenses, receives, stores, maintains, processes, or otherwise has access to personal information in connection with the provision of goods or services or in connection with employment. In other words – if you “run the risk” of selling to somebody in Massachusetts, you are subject to this law!

As I said, the situation gets incredible complex.

Where does this lead us to? To me there are a few things which should be done:

Governments and the industry have to work much closer together. The industry has to have the ability to show the stumbling blocks for the businesses and together – the government and the industry – have to find solutions which protects the citizens’ rights, helps to grow the economy and helps to go after the criminals.
Governments have to think globally and act locally. Today’s cybercrime environment does not allow anymore for “local only” solutions. There needs to be a certain level of harmonization of laws across the countries and the willingness to collaboration fast. As there is not a global jurisdiction on that level, the willingness to have harmonized legislation will be key. The challenge however is that governments are re-elected locally – not globally…
The Industry has to behave responsibly. In order to make this happen, the industry has to be seen as a partner for the government. The only way to get there – in my opinion – is to act responsibly. If I look at certain behaviors I see in the industry, it is sometimes too much focused on the short-term revenue, rather than a responsible behavior.

This will definitely be the basis for a better collaboration and an environment where the legal challenges (see the Yahoo! case above) do not have to be solved on the shoulders of the businesses “just because” of legal deficiencies between countries. As I said above, we all want to fight crime as it is necessary and as it is the only way to grow the Internet in the future. And this all helps us I think

Roger