What a week! …
The Internet is a Scary Place
As you know by now, we’ve had quite a week in Cybersecurity.
One root certificate authority publishing a private key with a value of 4. Check out We Have A Problem for the whole sordid story. Two RCEs in PHP disclosed before the patch was ready. Hacker News is one of the many places you can read about this one. And that was just the tip of the iceberg!
Why?
PHP
PHP is one of those languages that was all the rage a few decades ago to build anything on the WWW. It was not super secure, but worked really well to create responsive web pages. So, everyone used it and still do. It’s not bad. It’s not great. But, it gets the job done which is what is needed.
The flaw, called php2shell was leaked ahead of the patches. This was the main problem. Yes, you have to upgrade ASAP. Yes, it’s a serious problem. But, apart from being leaked early, the response was professional and well done.
In contrast to …
CA Authority Signing Key is 4
This is an utter failure of everything, at all levels. eMudhra, an Indian company, released a root CA with a private key of 4. Any attacker with the private key of any of the compromised intermediate CAs could impersonate any website or service. Astonishingly, the other private keys were 56, 66, 115, 155, 156, 230, and 237.
How does this happen?
eMudhra has put up some early public relations materials, including a promise to do a “full root cause analysis”. However, this is beside the point. Generally, when something like this happens, it is an utter failure at all levels of the company: from the top to the trenches. Everyone is responsible for security and the only way this can happen is when no one bothers.
Are You Immune to Something Like This Happening?
Security is a dye, not a paint. — John Denholm
Maybe today is the day you look at your processes and see what could happen. At a bare minimum, you should have these things in place:
- A patch cycle where you automatically update dependencies to the latest version. This requires solid and complete testing suites and environments.
- A security upgrade cycle where you automatically update your dependencies if there is a security issue. Again, test suites are a must have.
- An incident management process which tells your staff how to respond to a security incident. Of course, you must train this or it is useless.
“We don’t rise to the level of our expectations, we fall to the level of our training.” ― Archilochus
Remember, Who is Responsible for Security?
Imagine, if you will, a day when all the drama is removed from your software production: no panic, no crisis, just smooth software releases that exceed your customer’s expectations. This is what we have done in the past and can do for you.