Microsoft's Misconfiguration Discloses Millions of Customer Records; The Fight Against Election Meddling; Seattle Testing Web-Based Voting

One aspect of the story here is that if a company as skilled as Microsoft is making catastrophic configuration errors in setting up cloud and open source applications, how badly configured are those applications when used by less sophisticated organizations?

Alan Paller

If we cannot rely upon Microsoft to properly configure systems, it is unlikely that their customers will be able to do so. We need fewer choices, safe defaults out of the box, and better direction, documentation, and supervision.

William Hugh Murray

OWASP A6 "Security Misconfigurations" is really getting a lot of action with admin misconfigurations of cloud services and open source software in particular. The telling quote in the Microsoft Response Center blog post: "Misconfigurations are unfortunately a common error across the industry. We have solutions to help prevent this kind of mistake, but unfortunately, they were not enabled for this database." Why not, and where else has this happened are the key questions: were the controls simply policy statements (This should be done) vs. gates (Database does not go production unless this has been done.)?

John Pescatore

Security misconfiguration of cloud services has become a recurring theme. While developers have embraced the ease of creating and deploying solutions, the criticality of appropriate access controls seems to be missed. Rapid deployment of solutions needs to include independent verification of the security settings prior to production release. When implementing services, particularly cloud-based, be sure to enable verification and monitoring of the security baseline.

Lee Neely

We've seen in cybersecurity that big long lists of what needs to be done generally results in very little meaningful steps forward - lots of talk, very little action. The big issue of social media companies like Facebook knowingly allowing false and dangerous "information" to be passed on the networks is pretty similar to ISPs knowingly allowing phishing attacks and malware to be carried out over their networks. Putting that part of the problem aside, actually increasing the security of election systems and *not* allowing untested systems and software be used without making sure that basic security hygiene is included is a more manageable problem. I think we have seen that aircraft flight control software that isn't sufficiently tested can lead to disastrous results - election systems should be viewed with that same lens.

John Pescatore

This is a small test in a local election for a conservation board member seat, with a lot of manual checking proposed. It is underwritten by the Tusk Philanthropies, which has an admirable goal of increasing voting participation while also increasing the security of election systems. If Tusk is seriously focusing on the security, we need efforts like this to help drive things forward. If the slant is too much towards "Let's use the latest technology for elections!" then just a big step backwards. I hope they produce a detailed after-action assessment.

John Pescatore

Votes collected through the LiveBallot application will be signed on the device screen. The submitted ballot is then printed and compared with on-file signatures. Washington state's mail-in ballots are verified with a signature matching process. Using digital signatures with appropriate issuing processes could reduce the variability of creating on-screen signatures and can be digitally verified.

Lee Neely

The CMA was enacted to fill gaps in existing legislation rather than be a comprehensive computer crime law and was based on relevant issues from 1990. While the computer crime legislation and supporting policy, such as the CMA, are designed to be technology-independent for long term relevance and applicability, they need to include a plan for review and update as technology, risks and tactics evolve.

Lee Neely

We have both of these problems in our own Computer Fraud and Abuse Act. Both laws were passed when most computer systems were private and most "authorized" use was by insiders. We have known about these problems in these laws for a decade. While drafting the necessary changes is difficult, it is, nonetheless, about time.

William Hugh Murray

ProtonVPN published the reports from the audits by SEC Consult, which identified issues such as hard coded credentials, and lack of certificate pinning, which have been resolved.

Lee Neely

The failure of the banks to address legitimate concerns of their customers (e.g., the persistence of the infamous magnetic stripe on credit and debit cards, the continued acceptance of credit card numbers from merchants ("card not present" fraud), failure to resist "account takeovers" and other unauthorized transactions, social engineering of support desks) should be of interest to the Treasury. The banks are part of the problem. While bank security is dramatically better than it was fifty years ago, the increase in the use of and reliance on banking still leaves us with a deficit.

William Hugh Murray