Vulnerabilities Equities Process and Threat Modeling
[no description provided]
[Update: More at DarkReading, " The Critical Difference Between Vulnerabilities Equities & Threat Equities."]
The Vulnerabilities Equities Process (VEP) is how the US Government decides if they'll disclose a vulnerability to the manufacturer for fixing. The process has come under a great deal of criticism, because it's never been clear what's being disclosed, what fraction of vulnerabilities are disclosed, if the process is working, or how anyone without a clearance is supposed to evaluate that beyond "we're from the government, we're here to help," or perhaps "I know people who managed this process, they're good folks." Neither of those is satisfactory.
So it's a very positive step that on Wednesday, White House Cybersecurity Coordinator Rob Joyce published "Improving and Making the Vulnerability Equities Process Transparent is the Right Thing to Do," [link to https://www.whitehouse.gov/blog/2017/11/15/improving-and-making-vulnerability-equities-process-transparent-right-thing-do no longer works] along with the process. Schneier says "I am less [pleased]; it looks to me like the same old policy with some new transparency measures -- which I'm not sure I trust. The devil is in the details, and we don't know the details -- and it has giant loopholes."
I have two overall questions, and an observation.
The first question is, was the published policy written when we had commitments to international leadership and being a fair dealer, or was it created or revised with an "America First" agenda?
The second question relates to there being four equities to be considered. These are the "major factors" that senior government officials are supposed to consider in exercising their judgement. But, surprisingly, there's an "additional" consideration. ("At a high level we consider four major groups of equities: defensive equities; intelligence / law enforcement / operational equities; commercial equities; and international partnership equities. Additionally, ordinary people want to know the systems they use are resilient, safe, and sound.") Does that imply that those officials are not required to weigh public desire for resilient and safe systems? What does it mean that the "additionally" sentence is not an equity being considered?
Lastly, the observation is that the VEP is all about vulnerabilities, not about flaws or design tradeoffs. From the charter, [link to https://www.whitehouse.gov/sites/whitehouse.gov/files/images/External%20-%20Unclassified%20VEP%20Charter%20FINAL.PDF no longer works] page 9-10:
The following will not be considered to be part of the vulnerability evaluation process:
- Misconfiguration or poor configuration of a device that sacrifices security in lieu of availability, ease of use or operational resiliency.
- Misuse of available device features that enables non-standard operation.
- Misuse of engineering and configuration tools, techniques and scripts that increase/decrease functionality of the device for possible nefarious operations.
- Stating/discovering that a device/system has no inherent security features by design.
Threat Modeling is the umbrella term for security engineering to discover and deal with these issues. It's what I spend my days on, because I see the tremendous effort in dealing with vulnerabilities is paying off, and we see fewer of them in well-engineered systems.
In October, I wrote about the fact we're getting better at dealing with vulnerabilities, and need to think about design issues. I closed:
In summary, we’re doing a great job at finding and squishing bugs, and that’s opening up new and exciting opportunities to think more deeply about design issues. (Emergent Design Issues)
Here, I'm going to disagree with Bruce, because I think that this disclosure shows us an important detail that we didn't previously know. Publication exposes it, and lets us talk about it.
So, I'm going to double-down on what I wrote in October, and say that we need the VEP to expand to cover those issues. I'm not going to claim that will be easy, that the current approach will translate, or that they should have waited to handle those before publishing. One obvious place it gets harder is the sources and methods tradeoff. But we need the internet to be a resilient and trustworthy infrastructure. As Bill Gates wrote 15 years ago, we need systems that people "will always be able to rely on, [] to be available and to secure their information. Trustworthy Computing is computing that is as available, reliable and secure as electricity, water services and telephony."
We cannot achieve that goal with the VEP being narrowly scoped. It must evolve to deal with the sorts of flaws and design tradeoffs that threat modeling helps us find.
Photo by David Clode on Unsplash.