The Eyes of Texas Are on Baseboard Management Controllers? WHAT??!!!
OR TEXAS HB1830S IS SWINEFLU LEGISLATION, IT’S BEEN INFECTED BY PORK!
**UPDATE: It looks like the “vendor language” around Section Six has been struck!
Given Bejtlich’s recent promises, I thought we’d take a quick but pragmatic look at why risk assessments, even dumb, back-of-the-envelope assessments, might just be a beneficial thing.
As you probably know, the guys here at NewSchool and the guys at sister site EmergentChaos are very interested in the government regulation of cyberspace. Oh, we also happen to be pretty good with the information risk stuff, too. So I’m sure you wouldn’t be surprised that we spent some time looking over what one of the biggest, most influential states in the Union, Texas (Austin is also one of my most favorite places thanks to my friend Joe Visconti), is doing about legislating information security. Currently they have a bill in consideration, HB1830S. Highlights here:
http://www.legis.state.tx.us/tlodocs/81R/analysis/html/HB01830S.htm
HB1830S has some pretty good stuff in it. The kind of legislation that tends to make sense, even if you are a “government hands off” kind of guy like I am.
Section 2 is about background checks and having policies and so forth. This is wonderful, it addresses about the only control we have against Internal threat agents with significant privileges.
Section 3 seems to excuse information security information (like specific vulnerabilities) from the public record. I’m all for some level of disclosure here (Something like the letter grades the federal government releases is fine), but really, the citizens of the state don’t need particulars.
Section 4 talks about what InfoSec information should be confidential and talks about vendor relationships. After working on some state RFPs (not Texas) and watching how specific requirement for a “Penetration Test” was awarded to someone who, in their RFP, specifically said that they were only going to only perform a “Vulnerability Assessment”, I appreciate these sorts of clauses.
Section 5 covers internal state reporting concerns for vuln data, great.
SECTION SIX WHAT THE !@#%^!@@#$* IS THIS???!!!
“Government Code, to require that the biennial operating plan describe the state agency’s current and proposed projects for the biennium, including how the projects will address certain matters, including using, to the fullest extent, technology owned or adapted by other state agencies, including closed loop event management technology that secures, logs, and provides audit management of baseboard management controllers and consoles of cyber assets.”
Let’s parse that and read it again:
“Government Code, to require that the biennial operating plan describe the state agency’s current and proposed projects for the biennium, including how the projects will address certain matters,…”
Looking good, it’s always nice to have a plan.
“…including using, to the fullest extent, technology owned or adapted by other state agencies,…”
Great! I’m all for sharing information among security professionals, that’s pretty much one of the fundamental pillars of the New School.
“…including closed loop event management technology that secures, logs, and provides audit management of baseboard management controllers and consoles of cyber assets.”
Wait, what?
Ok, I’ve heard of closed loop processing in Business Intelligence (A system is said to perform closed-loop processing if the system feeds information back into itself). I’ve heard the phrase Closed-Loop in SOA. But I’m sorry, the use of “closed loop event management technology that secures, logs, and provides audit management of baseboard management controllers” sounds like somebody lifted it from a vendor brochure.
Also, I know that this blog generally attracts some of the best and most forward thinking InfoSec readers/professionals – even if you disagree with us. But if you need to go look up what a baseboard management controller (BMC) is and does, to remind yourself, go right ahead. I had to.
Now read the rest of HB1830S highlights there and put Section Six in context.
Is it just me, or does this seem like someone in Texas is trying to legislate the use of a specific vendor’s rather esoteric and specific security control? I mean, even if BMC is really important in, say, SCADA systems – is there a reason that the dozens (?) of other agencies would have to waste their money on this?
And why legislate this specific technology? Shouldn’t the agency security management be able to do their own risk assessments and prioritize based on the significant threats that, you know, they’re ACTUALLY SEEING? And I’m not asking for Forests of Bayesian Belief Networks to establish risk and vulnerability information via Monte Carlo simulations here, I’m asking for a basic risk-based sanity check to make decisions, decisions based in reality, not fear. I mean, a quick poll of Security pros on Twitter about the BMC and so far nobody has claimed to ever seen one piece of exploit code, more or less heard of an actual *incident*. Now I’m sure that the State of Texas does a great job with Information Security and all, but I’m willing to bet good money that the BMC’s of their systems is the least of their security problems.
Bottom line, Legislating disclosure, policy, and even ensuring critical processes are in place is a useful endeavor, and the rest of HB1803 does a good job. But legislating a specific technology is bad for a couple of reasons:
1.) It removes management’s ability to expend resources on the actual problems they have. You are legislating without the context of risk, even poorly derived risk statements.
2.) If it takes an act of legislature to force adoption, it will take a similar or more difficult act of politics to remove that technology when it’s outlived it’s usefulness (and one wonders if BMC securing technology would EVER be useful except in fringe cases).
Things Are Tough, Don’t Waste Taxpayer Money, Please!
HB1830S could be a good piece of legislation. Strike the BMC aspect of Section Six and it becomes more than reasonable. Heck, add “to the fullest extent POSSIBLE” or “to the extent that’s REASONABLE” and ask state CISO’s to provide Threat Event Metrics for the BMC if you want. But please Texas, whatever this vendor is paying you in lobbying perks – it’s not worth the waste and hassle and the risk of derision from the parts of the Information Security community that actually happen to be concerned with public safety.
Texas…vendor….computer….
Could it be….Dell?
http://en.wikipedia.org/wiki/Baseboard_Management_Controller
I report, you decide.
LOL Chris.
Actually, my money is on someone else, as I doubt Dell offers a security management solution around the BMC.
On section 3, I think you’re letting them off too easy. While we clearly don’t want to increase vulnerability by talking about live vulns, I would like to know what type of vulns they had and how long it’s taking to patch each. Maybe releasing that information 90 days after they’re fixed.
Such information along with the context could both help us assess if the state is managing its systems well and help inform a baseline of reasonableness.
We need to stop asking why, and ask why not share data. We need to go from need to know to need to share.
@Adam – I agree, but first things first. It would be even better if they took the clause about information sharing, started a consortium, and released aggregate State Gov. information, too.
Try googling “baseboard management controller” and “closed loop” event management and clicking on the first entry. A Plano, Texas based company…
Your analysis was spot on and very helpful, thanks for taking the time and bringing this to the public’s attention. The following was cut and paste from:
http://www.journals.senate.state.tx.us/sjrnl/81r/pdf/81RSJ05-07-F.PDF#page=24
COMMITTEEiiSUBSTITUTE
HOUSE BILL 1830 ON SECOND READING
On motion of Senator Ellis and by unanimous consent, the regular order of business was suspended to take up for consideration CSHB 1830 at this time on its second reading:
CSHB 1830, Relating to information technology security practices of state agencies.
The bill was read second time.
Senator Ogden offered the following amendment to the bill:
Floor Amendment No. 1 Amend CSHB 1830 (committee printing), in SECTION 6 of the bill, on page 3, lines 47, by striking “, including closed loop event management technology that
secures, logs, and provides audit management of baseboard management controllers and consoles of cyber assets”.
The amendment to CSHB 1830 was read and was adopted by a viva voce vote.
All Members are deemed to have voted “Yea” on the adoption of Floor
Amendment No. 1.
On motion of Senator Ellis and by unanimous consent, the caption was amended to conform to the body of the bill as amended.
CSHB 1830 as amended was passed to third reading by a viva voce vote.
All Members are deemed to have voted “Yea” on the passage to third reading.
Section 3 is also the one that caught my eye the most. I’ll be interested where that could go or lead over the years, especially since that information can cut multiple ways.