Security holes are everywhere even in secure virtualization systems, says Green Hills Software CEO

Posted by John McHale
If the Wikileaks scandal shows anything it proves that no system is secure as people may think it is -- especially software virtualization systems, said Dan O'Dowd, chief executive officer of Green Hills Software during the company’s Software Elite Users Technology Summit. "Virtualization adds nothing to security," he added.

O'Dowd pointed out that virtualization systems have less code, "but that just means they are less bad, not more secure. Running bug-ridden operating systems in virtual machines does not solve the security issue unless the virtualization system itself is secure."

He then made a point that I think resonates well beyond virtualization systems. "The security claims of popular virtualization systems are just marketing fluff to exploit the desperate need of all computer users for security," O'Dowd says. These systems have only been evaluated to the National Security Agency's (NSA's) Common Criteria EAL4+.

According to the Common criteria EAL4+ "makes them appropriate for protecting against 'inadvertent or casual attempts to breach system security,'" O’Dowd said. It's as if they have five doors to their house but only locked four, he added.

O'Dowd was working up to making the case for his company's EAL6+ secure virtualization software, but, I think he's also right on that this is not just a virtualization security phenomenon.

People are lazy when it comes to securing their computers. They all want their systems to be secure, but typically buy into the marketing fluff of certain technology because they like the convenience it provides. However, in the long run they are setting themselves up for security breaches.

It reminded me of something an export compliance officer at a major aerospace company once told me that he tells his employees who travel overseas. He says they need to assume that their emails are being read and their phone conversations are being listened to. It doesn't make you paranoid, it makes you vigilant, he said.

Speaking of vigilance, let's get back to the secure virtualization discussion.

During their work in this area O'Dowd's engineers found security vulnerabilities in standard device drivers in virtual machines. He said they attempted to use I/O memory management units (MMUs) to improve the security of virtual machines, but found that "it doesn't work.

"We weren't looking for vulnerabilities, we were just trying to make the device drivers work," O'Dowd said. "Modern I/O devices often contain huge software control programs consisting of hundreds of thousands lines of code and they have just as many security vulnerabilities as traditional operating systems."

He made the case that if users want to be vigilant with their virtualization systems they need to use an EAL6+ secure system like that offered by Green Hills. Makes sense but with that vigilance also comes cost.

Systems like Green Hills do not come cheap, so it becomes a matter of managing risk. Military and avionics systems cannot take that chance, but companies in less mission/life critical applications may be able to get away with it.

What's more expensive paying for the security ahead of time or not paying and hoping nothing happens? I guess it depends on whether or not you think you, your company, or your technology is actually a target.

Counter-MANPADS for commercial aircraft, where'd it go?

Posted by John McHale
Counter-MANPADS (man-portable air defense systems) for commercial aircraft got a lot of press after the terrorist attacks on Sept. 11, 2001 and I covered it quite a bit in our Homeland Security Solutions magazine back then, but I have not heard much about it in recent years till this week at the AUSA in Washington, DC.

Some of the technology explored for Counter-MANPADS was based on the Advanced Threat Infrared Countermeasures (ATIRCM) system from BAE Systems in Nashua, N.H. I learned this while interviewing Burt Keirstead, director of integrated ASE (aircraft survivability equipment) at BAE Systems in Nashua, N.H., this week at AUSA about the ATIRCM.

The Department of Homeland Security (DHS) Counter-MANPADS program was basically shelved due to reluctance from the airlines to spend money on the system unless subsidized by the government or if there is an attack from a shoulder-fired missile on a commercial airliner causing COutner-MANPADS to be mandated, Keirstead said.

Technologically "it was a success story," he said. BAE System's solution flew about 5,000 hours on a Boeing 767 back forth between Los Angeles International Airport (LAX) in Los Angeles and John F. Kennedy airport outside of New York, Keirstead continued. A couple of the flights included celebrities such as Brittany Spears and Liza Minelli, he added.

It was mounted upside down about 10 feet in front of the fuselage and painted white, Keirstead said. The system was optimized for use on commercial jets with a different cockpit display and a lightening protection unit, among other adjustments, he added.

The system works and could be added in on to the aircraft if it is ever mandated, Keirstead said.

Let's hope it's not necessary.

Neil Armstrong on being there

Posted by John McHale
I saw a great quote from Neil Armstrong on a board at the National Business Aviation Association (NBAA) show here in Atlanta that I'd love to use for our Avionics Europe Event. "You can settle with e-mails and conference calls, but there's nothing like being there. Trust me on this."

I agree with him, even though I've never been to the Moon. Live events and in-person meetings cannot be completely replaced by webinars and e-mails. Pressing the flesh and looking people in the eye is how you build relationships, not by just trading e-mails.

Maybe we can hold Avionics 2030 in a lunar base and get Mr. Armstrong to speak. Just a thought.

Owning my own jet vs. flying commercial

Posted by John McHale
On the flight down to my first National Business Aviation Association (NBAA) show in Atlanta this week, I contemplated what it would be like to own my jet -- a Gulfstream or Embraer Phenom jet. Then I remembered I'm a journalist -- in other words not rich. So I'm stuck flying commercial, which can be good and bad.

The good is the occasional low fare, the safety of air travel in the U.S., and meeting interesting people. The bad is the myriad of ways airlines look to charge you, their bizarre rules, lost luggage, etc.

My most recent headache involved a trip to Germany on Lufthansa. I called the night before my return trip to the U.S. to reserve my seat. I was given 52C. The next day I get to the airport and was told I was put on standby. Of course I asked HOW CAN THAT BE? I had a seat, who moved me to standby?

Apparently Lufthansa can bump your seat if they oversell their aircraft. Essentially it becomes the German Southwest overnight, by making it first come, first serve to the airport.

Seems pretty silly, doesn't it? It was especially insane to the guy behind me in the standby line. He bought his ticket and reserved his seat in January! Funny thing, the Lufthansa agent neglected to tell him and me that the seats were not guaranteed. All we got was "enjoy your flight."

Despite all that silliness, I did enjoy my flight. I still got an aisle seat and lucked out with an interesting seat mate -- a recent Boston College law school graduate returning from a trek through Europe.

She had some crazy stories from her vacation. The strangest had to be the one about moped-riding, wristwatch thieves in a less elegant part of Naples, Italy. Apparently they are quite common and dangerous, ripping women's Rolexes right off their wrist as they speed by.

Yes, I've gotten off topic a bit, but the moped thieves story really stuck with me.

Back to business jets. I still want one. I put my business card in a bowl at a Boeing press conference, hoping to win one -- no dice. It was a model airplane, but I have to start somewhere.

Maybe I'll have better luck on the show floor tomorrow.

Ada is not nearly as dead a language as Latin

Posted by John McHale
The Ada programming language has been said to be an obsolete language for years. However, it is still used throughout the defense and avionics communities and still taught in the schools, although it is not as popular a course selection as C or C++.

Ada is mostly a higher-course level subject at universities, Greg Gicca, director of safety and security at AdaCore in New York, told me during the Embedded Systems Conference in Boston last week. It would be nice if it could be offered as a 101 course to students because it would give them a better understanding of software fundamentals, object-oriented programming, etc., than say C or C++, he adds.

Adacore works with many colleges and universities across the country, educating new students in Ada code, Gicca says. The military and avionics world keeps Ada alive and provides a steady revenue stream for companies like AdaCore, he adds.

It is the professors who are driving the ada course load, but there is plenty of interest from students as well, Gicca says.

DDC-I, a designer of Ada products in Phoenix, also provides education services to universities such as Georgia Tech, says Greg Rose, vice president of marketing at DDC-I.

The Ada language was created for the U.S. Department of Defense about 30 years ago to better handle safety-critical programming in mission-critical military systems and since then has also become a staple of commercial avionics software programs.

According to Wikipedia it was named after, Augusta Ada, Countess of Lovelace also known as Augusta Ada Byron, daughter of the Poet Lord Byron. She is considered by some to be the world's first computer programmer after writing what is considered to be the first algorithm intended to be processed by a machine -- for her work on an early mechanical general-purpose computer, designed by Charles Babbage, according to her Wikipedia entry.

Archie Bunker, counter-terror expert

Posted by John McHale
On a JetBlue flight to Phoenix this week, I took a break from a story I was writing on software defined radio and the Joint Tactical Radio System (JTRS) and caught a couple episodes of "All in the Family" playing on JetBlue's in-flight entertainment system.

You only see shows like that on cable or premium channels like HBO, the language and Archie's very un-PC rants scare networks away. Exemplified in the first episode I watched on the flight where Archie was arguing with his son-in-law Mike (Meathead), about gun control. They had just seen a local TV station manager give a speech on gun control and Archie demanded equal time.

Archie's premise was that if more people had guns there would be less crime. Then he delivered this bit of counter-terrorism advice: "you could end sky-jacking tomorrow by arming all the passengers. The airline would hand out guns at the beginning of the flight, then collect them all when they land."

Just as he said this the flight attendant was coming by with headphones... weird.

Some 88-year-old woman had a break-in at her house, and Archie argued it wouldn't have happened if she had a gun.

Mike: "How would 88-year old walk around carrying a gun?!"

Archie: "I don't know, maybe put in her stocking next to her varicose vein!"

Some more lines: Archie's daughter, Gloria, shouts out statistics about how many people are killed by guns. Archie: "Would it make you feel any better if they were pushed outta windows, little girl?"

Mike mentions Supreme Court rulings in favor of gun control. Archie responds with "the Supreme Court ain't got nothin to do with the law!"

Fun stuff, although I left out the more ethnic-oriented comments from Archie -- thought it best to stay away from those. However, there was some funny dialogue from the other episode on the flight, which had Archie and his wife Edith visiting cousin Maude (Bea Arthur). Maybe this was the episode that launched that show -- "Maude."

Some exchanges:
Maude: "I happen to be a Hubert Humphrey Democrat."
Maude's daughter Carol: "What does that mean?"
Maude's husband Walter: "It means she's not against anything."

One more!

Walter to Carol: "Why are you wearing white for your wedding?"
Maude chimes in: "Because white has always been a symbol of innocence and purity in marriages."”
Walter: "Married before ... multiple affairs ... so how did she manage that tricky u-turn back to innocence and purity?"

Those shows made the flight ... lotta laughs.

Executive layoffs at Boeing, Lockheed Martin signal tough times ahead

Posted by John McHale
Boeing and Lockheed Martin leaders call it re-aligning, focusing on core competencies, better positioning for the future, empowering the younger generation, yadda, yadda, yadda... but what they really mean is that the Obama Administration's next Department of Defense budget is likely to be a lot smaller than in years past and the big primes want to hoard their cash now by eliminating high-level executive salaries -- about 600 in the case of Lockheed Martin.

I'd heard rumblings in my travels this summer from defense electronics suppliers that there could be trouble in the defense market. These recent announcements from behemoths -- Lockheed Martin and Boeing -- are probably only the beginning. It's not that hardware and software solutions won't be needed it's just that there will be fewer opportunities.

The growth areas will continue to be unmanned systems and electro-optics for unmanned and other intelligence, surveillance, and reconnaissance platforms. Electro-optical companies should still see steady growth. A sign of this might be the recent acquisition of electro-optical systems and multispectral sensors specialist OASYS Technology LLC in Manchester, N.H., by BAE Systems.

As one system integrator told me at the AUVSI unmanned systems show this summer in Denver "we know there will be unmanned platforms getting funding, but guessing the right one will be the trick."

Do not fear Lockheed Martin and Boeing are not in trouble and they are still cash cows, but they are letting go of some experienced good people and that is unfortunate to say the least.

This reminds me of something someone once told me when there were layoffs at a publishing company I'm somewhat familiar with. A long-time manager was let go not due to cause or because his property was performing poorly, but rather to maintain the property as a cash cow -- that at the end of the day it's all about maintaining cash cowness.

I hope that someday I find my own cash cowness...