Veracode State of Software Security Report

I downloaded the Veracode State of Software Security Report Volume 4

Very useful reading for anybody interested in the state of software security.

One thing that struck me was the actual download process. To download the report, you have to register giving your contact details. Fair enough, Veracode wants to see who is reading their reports. However a few security related thoughts on this process:

• The registration process does not use SSL, so my contact details travel in clear text.
• The information is posted to:
• http://app-d.marketo.com/index.php/leadCapture/save

• Who is Marketo? I can see no privacy statement to say what happens to my contact details.

You can argue that if I was so worried about these points, why did I register? Good question....and I actually did give accurate details.

I have to ask myself whether am I over the top? Maybe, then again....

Social: del.icio.us DiggIt! Reddit Stumble Google Bookmarks Technorati Slashdot

To SSL or not to SSL

Update: November 29th, 2011. I have just noticed that Troy Hunt has posted an excellent article on SSL/TLS

I started a poll on LinkedIn. The question:

• "Should web applications which process Personally Identifiable Information (PII) be legally required to use SSL/TLS? "

with a simple Yes or No answer. There is a link to the LinkedIn poll at the bottom of this blog. However, I suggest you read through the following thoughts before answering.

The question could have been:

•  "Should web applications which process Personally Identifiable Information (PII)  use SSL/TLS? "

But that would have been easy. Most people would probably vote yes because SSL is A GOOD THING. The addition of  the "be legally required to" clause makes it more interesting.

What prompted this soul searching? I was recently looking through a UK based web site. The privacy policy states:

• "We take your individual privacy very seriously. We aim to ensure that this website meets and exceeds all relevant legal and regulatory requirements, including the Data Protection Act."

Great  - until you see that they don't use SSL to protect account information. This includes name, address, phone number etc.  In fact, you could argue that this website processes sensitive personal data under the Information Commission's Office (ICO) definition. According to the ICO, sensitive personal date " needs to be treated with greater care than other personal data". But no SSL on said website.

Is SSL Already an EU Legal Requirement?

Does the Data Protection Act require SSL? The UK version of the Act is a bit vague. Principle 7

states you "should have security that is appropriate to:

• the nature of the information in question; and
• the harm that might result from its improper use, or from its accidental loss or destruction."

Then the question becomes: "is SSL appropriate"?  The website operator can argue that they considered using SSL, but concluded that it wasn't appropriate. The Irish Data Protection commissioner goes a bit further in their security guidance, stating that encryption:

• "is considered an essential security measure where personal data is stored on a portable device or transmitted over a public network."

So no clear answer. 

Why Don't Website Operators Use SSL?

Maybe it's because:

• they genuinely don't even think about it. Although the little "https" lock on the browser is a fairly well known security measure. This is an InfoSec problem where awareness needs to be raised.
• it is easy to say something like  "We take your individual privacy very seriously" but then do nothing about it.That's lip service..
•  "Facebook don't use it - so why should we?" FB seems to be changing
• it's too difficult to configure. It probably takes a while, but it isn't that difficult
• it's because it's too expensive.  Google "SSL Certificate" and you can get a GoDaddy cert for €9.99
• it kills performance. According to Google,"SSL/TLS is not computationally expensive any more."
• SSL is broken and has been more or less every year since 1995. 
• users will keep getting security warnings as content switches between secure and non-secure
• apart from firesheep like utilities,  where is the evidence that the lack of SSL has really been exploited all that much?  

Reasons To Use SSL

SSL:

• does raise the infamous "security bar"
• is not too difficult to implement 
• comes in at number 9 in the OWASP Top 10
• is required by PCI DSS  
• gives you a nice warm feeling inside

Conclusion

But back to the original question. "Should SSL be legally required when processing PII?" The problem with this approach is that a requirement like this is very difficult to enforce. I think it would be much better trying to persuade developers and website operators to implement SSL rather than trying to use the crude hammer of legislation. So I think I will vote NO.

Here is the link to the Poll itself if you want to cast your vote:

• Should web applications which process Personally Identifiable Information (PII) be legally required to use SSL/TLS?  

Social: del.icio.us DiggIt! Reddit Stumble Google Bookmarks Technorati Slashdot

BBC Article on CEOP Website Security

There is an article on the BBC about a security vulnerability found on the Child Exploitation and Online Protection Centre (CEOP) website. According to the BBC:

"A member of the public found a form on the Child Exploitation and Online Protection Centre's website - to report alleged offenders - was unencrypted.
Security experts have described the breach of data as a serious error which could have put children at risk.

...

There will now be a full investigation by the Information Commissioner's Office.

...

The unencrypted pages meant personal details entered on the site could have been visible to anyone with a sinister motive."

So it looks like  the non-use of SSL on a website is a serious error which warrants a full invesitigation by the ICO.  Granted the CEOP processes sensitive information.


What does all this mean? What about the gazillion other websites that children use and which don't force the use of SSL? Answers on a postcard......

Social: del.icio.us DiggIt! Reddit Stumble Google Bookmarks Technorati Slashdot

Twitter Supports SSL

Twitter now supports SSL. Unfortunately, like Facebook, you have to opt-in. You can set it using the "HTTPS Only" setting under your Account options.

TWITTER

1. Select "Profile" and then "Edit Your Profile"
2. Down towards the bottom of the page you will see "HTTPS Only".
3. Check the "Always use HTTPS" option
4. Select "Save" to store your settings.

Do it now - you know you should!

 .....AND DONT FORGET FACEBOOK

To configure SSL in your Facebook account:

1. Select "Account" and then "Account Settings"
2. Select "Account Security"
3. Under "Secure Browsing (https)" check the "Browse Facebook on a secure connection (https) whenever possible" option
4. Select "Save" to store your settings

  .....AND IF YOU ARE DEVELOPING YOUR OWN WEB/ONLINE APPLICATIONS

Configure your website so that it uses SSL. Your users will thank you. Actually they won't...but you can feel smug.

Social: del.icio.us DiggIt! Reddit Stumble Google Bookmarks Technorati Slashdot

Facebook and SSL

*               *               *               *

I see that FaceBook has decided to support SSL.


Maybe they read my Previous Post and got frightened - but maybe again they didn't.


*               *               *               *

Social: del.icio.us DiggIt! Reddit Stumble Google Bookmarks Technorati Slashdot

European Data Protection Legislation and SSL

Summary

Many major websites do not use SSL to protect personal data as it travels across the internet. This was highlighted by the publication of the Firesheep Firefox extension in late 2010. This post looks at what European Data Protection Legislation has to say about the use of SSL to protect personal data. 

Very little as it turns out.  

It really only says that "appropriate measures" must be taken to protect the data. The UK and Ireland were examined a bit more detail. In these two countries, some of the accompanying notes to the legislation talk about encryption, but it is vague. The situation in other EU countries was not reviewed.

So, it seems to be unclear whether websites that transmit personal data across the internet in cleartext are in breach of European Data Protection Legislation. However, based on the experience with Google Streetview, the combined EU Data Protection bodies should be in a position to put pressure on these websites to configure and use SSL properly. 

Most information security professionals would think that SSL is a basic security measure.

Feedback is welcome - especially on the situation in other EU countries.

Background
The Firesheep Firefox extension shows how easy it is to hijack user sessions on websites that do not implement SSL properly. In summary, you can use Firesheep to steal personal data (names, addresses etc.) from many major websites that do not use SSL or only use it during authentication.

So what does European Data Protection legislation have to say about SSL? Are websites who do not use SSL to protect personal data in breach of Data Protection Legislation?

European Data Protection Legislation and American Websites
First of all a quick note about American companies. Most of the major websites are run by American companies. You might wonder whether they care about European Data Protection legislation or what the relationship is. The answer is the  Safe Harbor program administered by the US Department of Commerce.

Essentially it means that companies who sign up to the Safe Harbor program agree to comply with EU Data Protection rules. In general, the major websites do sign up. You can search the list at:

• https://safeharbor.export.gov/list.aspx

There is even a separate Swiss List at:

• https://safeharbor.export.gov/swisslist.aspx

So eventhough the websites are run by American companies, European Data Protection legislation is relevant.

European Data Directive
The main security driver for the protection of personal data in the EU is
DIRECTIVE 95/46/EC OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 24 October 1995

Article 17 Security of processing of the Directive states:

• "the controller must implement appropriate technical and organizational measures to protect personal data against accidental or unlawful destruction or accidental loss and against unauthorized alteration, disclosure or access, in particular where the processing involves the transmission of data over a network, and against all other unlawful forms of processing"

It says that "appropriate technical" measures must be taken  "in particular where the processing involves the transmission of data over a network". That implies that something should be done to protect personal data as it is being transmitted across the internet - but it does not mention SSL or encryption.

Every EU country has implemented the European Data Directive into its own legislation. Each EU country has a local Data Protection body who is responsible for enforcing this legislation in that country. The following sections look at two countries in a bit more detail - the UK and Ireland.

UK
In the UK the Information Commissioner's Office is responsible. Does the commissioner have anything to say? The ICO  document "Data Protection Good Practice Note - Collecting personal information using websites contains a number of questions. Question 9 is relevant:

Question 9:

• We collect personal information through our website. Do we have to use an encryption-based transmission system?

Answer:

• "You are responsible for processing personal information securely. You must adopt appropriate technical and organisational measures to protect the information you collect. It is difficult to see how you could do this without having a secure, encryption-based transmission system if the personal information is sensitive or poses a risk to individuals, for example, if it includes credit card numbers.
  
  You should be aware that although a secure transmission system will protect the personal information in transit, there is a potentially greater threat to the security of the information when it is decrypted and held on a website operator's server. Any sensitive personal information, or information that would pose a risk to individuals, should not be held on a website server unless it is properly secured by encryption or similar techniques."

Unfortunately, this answer is also not clear-cut. While it does talk about "a secure, encryption-based transmission system", it is only with respect to personal information that is "sensitive". And "sensitive personal information" has a special meaning. See the section "Sensitive personal information" in About the Code.

Ireland
The Data Protection Commissioner is responsible for personal data in Ireland. The document A Guide to the New Data Protection Rules is a bit more specific:

• "Transmission over external networks, such as the internet, should normally be subject to robust encryption"

This would imply that SSL (or equivalent) should "normally" be used.

Other EU Countries
The legislation in other EU countries was not examined.

Conclusion
It seems to be unclear whether websites that transmit personal data in clear text are in breach of EU Data Protection legislation.

However the EU Data Protection bodies were able to force Google to make changes to its Streetview product to comply with Data Protection legislation. These same bodies should be in a position to force the major websites to configure and use SSL properly.

Social: del.icio.us DiggIt! Reddit Stumble Google Bookmarks Technorati Slashdot