1. Information Security Summit 2013
October 23rd 2013 @ Hong Kong
(Mis)trust in the Cyber Era
Albert Hui GREM, GCFA, GCFE, GCIA, GCIH, GXPN, GPEN, GAWN, GSNA, CISA
Principal Consultant

2. Who Am I?
Albert Hui
GREM, GCIA, GCIH, GCFA, GCFE,
GPEN, GXPN, GAWN, GSNA, CISA
SANS Advisory Board Member
GRC Consultant for Banks,
Government and Critical
Infrastructures.
Spoken at Black Hat, HTCIA-AP,
and
Economist Corporate Network.
Former HKUST lecturer.

3. Agenda
1. Trust Defined
2. Ramifications of Trusting Another Party
3. Privacy at Stake
4. The Solution?

5. A Story of
Trust and (Alleged) Betrayal

6. Dropbox’s Clarification

7. Dropbox’s Clarification (cont.)

8. Sad but True
“If you expect a cloud provider to do anything more
interesting than simply store your files for you and
give them back to you at a later date, they are
going to have to have access to the plaintext.”
Bruce Schneier

9. Understanding
Trust

10. Why Important
to Reflect on Trust?
1
𝑅𝑖𝑠𝑘 =
𝑇𝑟𝑢𝑠𝑡

11. What Exactly is Trust?
Faith
Evidenced
Assurance
Knowing
Reality
Ideal

12. Trust
Outsourcing

13. Risk is Often Outsourced
Insurance
Hedging

14. Trust is Often Outsourced Too

15. Public Key Infrastructure
Simplified
Certificate Authority
Alice
Bob

16. Compromised
Root Certificate Authorities

17. Signed
Malware
Stuxnet, Duqu, …

18. Transitive Trust

19. Reality
RISK OUTSOURCING
TRUST OUTSOURCING
1.
Assess risks
1.
Transfer trust
2.
Treat some risks
2.
3.
Terminate some risks
4.
Tolerate some risks
Trust that transferee is
trustworthy (secure, reliable
and aligns with your
risk appetite & risk strategy)
5.
Transfer remaining risks

20. Trust
Crowdsourcing

21. Herd Mentality

22. Open Source’s “Many Eyes” Claim
Evidence to the Contrary
Generates Predictable Keys
(CVE-2008-0166)

23. Privacy

24. Recap
“If you expect a cloud provider to do anything more
interesting than simply store your files for you and
give them back to you at a later date, they are
going to have to have access to the plaintext.”
Bruce Schneier

25. Privacy Seppuku

26. The Public-Private
Surveillance Partnership

27. Technologically Speaking
A court order is no different from an insider attack.

28. Suggestions
1. Conservative in assessing trust outsourcing risks.
2. Be skeptical.
3. Defense in depth.
4. End-to-end encryption.

29. Thank You
albert@securityronin.com