By Matt Hines
August 01, 2007
Government initiatives aimed at fostering the sharing of security
intelligence throughout the federal space are helping to establish the
community atmosphere and best practices necessary to help those agencies
-- and private enterprises -- improve their network and applications
defenses, a National Security Agency leader told attendees of the Black
Hat conference on Wednesday
Stepping to the stage to deliver a keynote presentation at the annual
hacker confab in Las Vegas, Tony Stager, chief of the Vulnerability
Analysis and Operations Group at the NSA, said that data-sharing efforts
led by his agency and others in the federal space are maturing rapidly.
Having served a little less than 30 years as a security expert at the
NSA, Stager said that federal agencies are finally succeeding in their
efforts to build standards for issues such as secure configuration of
Microsoft's Windows operating systems, and that those guidelines are
likewise being adopted by other security initiatives and moving into the
At the heart of the progress is the notion that government entities and
private institutions cannot effectively tackle security problems on
their own, a deduction that seems obvious, but one that has been hard to
implement on a practical level, in particular among agencies such as the
NSA and U.S. Department of Defense, which closely guard all their IT
"NSA has shifted the nature of its work over the last few years; the
time has come when we are all living in this same chaotic network and
need to come together to solve problems of this scale," Sager said.
"In the old days, the idea was that we could simply design away the
risk, but this is a much more complex world today," he said. "We've gone
from protecting [assets] to protecting not only data, but all the
information around that and the infrastructure that supports it; it's a
much more dynamic problem, and there's no way of escaping that this is a
As part of its effort to help foster security data sharing, NSA has
moved its focus from trying to build technologies aimed at solving major
security issues to attempting to influence practices across the
government space that can also be adopted by private-sector firms, he
A major element of the vision is pushing for standards that translate
security intelligence into language that any organization can interpret,
said Sager. He highlighted the Common Weakness Enumeration (CWE) project
-- an effort aimed at creating a common language for identifying
software vulnerabilities that is backed by the Department of Homeland
Security and nonprofit Mitre -- as one example of the types of standards
that are delivering on the NSA's goal.
"The time has come when folks in my business are thinking about how to
transfer knowledge outwardly; we don't solve these problems one
organization or one vulnerability at a time, so we're thinking of ways
to leverage knowledge in light of the available economies of scale,"
Sager said. "We must be able to deliver expertise within the context of
others' problems. In that way, this has become a business of influence
[for the NSA]."
In a nod to the challenges of the past, Sager said that organizations
such as the NSA traditionally developed their own practices for handling
issues such as secure configuration of Windows, and that nearly every
other government agency would do the same.
As government bodies finally began sharing their security information
and establishing more unilateral best practices, the agencies realized
that they could even drive technology vendors such as Microsoft to begin
shipping their products in the state that the organizations demanded --
and that other organizations, such as private enterprises, could begin
to adopt the same measures and benefit from the data as well.
Despite the progress that is being made, Sager said that the ongoing
process of creating unilateral security frameworks such as the CWE and
many other projects backed by Mitre -- a quasi-governmental body --
remains a challenge.
Organizations are sharing information, but the underlying processes that
support the efforts still need further refinement, he said.
"We can't just dump our inboxes on each other. It has to be about
sharing all of our different outputs in the same language, and people
still don't understand that in a lot of cases," said Sager. "But through
a lot of these efforts, the understanding is growing, and people are
getting onto the same page, which is crucial to improving security for
Other observers agreed that the process of creating standard security
language and practices across the government and private sectors are
moving forward quickly.
Robert Martin, head of Mitre's CVE (Common Vulnerability Exposures)
compatibility effort and a contributor to the CWE initiative, said that
momentum is building behind his organization's guidelines and helping
many government and private entities to better understand and share
their own practices.
"With all these different pieces that are coming together, we are
standardizing the basic concepts of security themselves as well as
methods for reviewing and improving computing and networking systems,"
said Martin. "I see a future where a tapestry of tools, procedures, and
processes are built over time that recognize and address the common
problems that exist among all these constituencies."
Martin said that Mitre's efforts to add new security policy frameworks
will continue to improve as they mature and even more parties begin to
contribute their intelligence to the initiatives.
Black Hat attendees seemed encouraged by the progress being made, at
least in terms of getting all the necessary parties to come together and
share their tools and processes.
This level of collaboration is what has been sorely lacking in the
security community in the past, observed Ray Kaplan, an independent
security consultant based out of St. Paul, Minn.
"At last there's a metaview of all these shared problems. Up until
recently, it seemed that this process was a confusing morass where
everyone had different tools and procedures," Kaplan said. "The
complimentary nature of what is going on with NSA and other agencies,
and with Mitre and private involvement, should help create the common
infrastructure needed to address these issues."
Matt Hines is a senior writer at InfoWorld.
Attend Black Hat USA, July 28-August 2 in Las Vegas,
the world's premier technical event for ICT security
experts. Featuring 30 hands-on training courses and
90 Briefings presentations with lots of new content
and new tools. Network with 4,000 delegates from
70 nations. Visit product displays by 30 top
sponsors in a relaxed setting. Rates increase on
June 1 so register today. http://www.blackhat.com