Russ

Author Archives: Russ

Worth Reading: An opaque alternative to oblivious cloud analytics

Even as encryption methods and security procedures have improved, the data is still at risk of being attacked through such vulnerabilities as access pattern leakage through memory or the network. It’s the threat of an attack via access pattern leakage that a group of researchers from UC Berkeley wanted to address when they developed an “oblivious” distributed data analytics platform that leverages the hardware enclave technology available in Intel’s Software Guard Extensions (SGX). The sensitive nature of much of the data that is being collected and analyzed in the cloud – from medical and financial data to user information like emails and shopping histories – makes it an attractive target for cyber-criminals, so the need to protect the data in such cloud environments is growing. —The Next Platform

The post Worth Reading: An opaque alternative to oblivious cloud analytics appeared first on rule 11 reader.

Worth Reading: Seven steps to successful IPv4 transfers

In the northern hemisphere, spring is arriving; the trees are blooming, the grass is greening, and the sun is shining. In the southern hemisphere, autumn is approaching and the long lazy summer is coming to an end. But in the IPv4 transfer market space, it is hot, steamy, and full of action! The transfer market is booming. Hundreds of millions of IPv4 addresses are being transferred between buyers and sellers. The market is a fast-moving place, and so it is important to square away a few key items before you start making enquiries.—APNIC

The post Worth Reading: Seven steps to successful IPv4 transfers appeared first on rule 11 reader.

Worth Reading: TIIME to pay attention to identity

The global Research and Education (R&E) community has led the way in developing and fine-tuning the technologies and associated policies that enable Federated IAM to work well, and the technology has become core infrastructure for R&E worldwide. Industries and governments around the world have adopted various aspects of Federated IAM around the world, with more certain to follow. Federations tend to be set up around logical constituencies, such as a local or federal government offering services to its constituents, or vertical industries such as automotive or pharmaceuticals. In the R&E sector federations tend to be national or built around particular fields of study, and in many cases they are run by or at least closely associated with National Research and Education Networks (NRENs). —Internet Society

The post Worth Reading: TIIME to pay attention to identity appeared first on rule 11 reader.

Administravia 20170420

A couple of minor items for this week. First, I’ve removed the series page, and started adding subcategories. I think the subcategories will be more helpful in finding the material you’re looking for among the 700’ish posts on this site. I need to work through the rest of the posts here to build more subcategoies, but what is there is a start. Second, I’ve changed the primary domain from rule11.us to rule11.tech, and started using the rule 11 reader name more than the ‘net Work name. rule11.us will still work to reach this site, eventually ntwrk.guru will time out and die. Finally, I’ve put it on my todo list to get a chronological post page up at some point.

Happy Reading!

The post Administravia 20170420 appeared first on rule 11 reader.

Worth Reading: Game of nodes

There’s a whirlwind of information on the topic of network commoditization. Seriously. Just search in your favorite search engine for “SDN,” “NFV,” or “telco cloud.” You will find dozens of open source projects, communities, forums, architectural definitions, standards, standard bodies, news articles, press releases, and blog sites dedicated to the aforementioned. With such a myriad of information, you’d think people out there would have a deep understanding of why these topics are creating so much noise. I make it a point to ask everyone I meet this simple question: “In a few sentences, what does telco cloud, NFV, or SDN mean to you?” In many cases, people generally just quote a bunch of buzz words — most of which I’m programmed to forget. Others jump into the “What” and “How” of these trends. Only a very few understand the “Why” and that there’s a fundamental challenge to the current business models in their industry. Something has to change. —New Stack

The post Worth Reading: Game of nodes appeared first on rule 11 reader.

Worth Reading: GraphQL

Practically speaking, the GraphQL layer lives between the client and one or more data sources, receiving client requests and fetching the necessary data according to your instructions. Confused? It’s metaphor time! The old REST model is like ordering pizza, then getting groceries delivered, then calling your dry cleaner to get your clothes. Three shops, three phone calls. GraphQL on the other hand is like having a personal assistant: once you’ve given them the addresses to all three places, you can simply ask for what you want (“get me my dry cleaning, a large pizza, and two dozen eggs”) and wait for them to return. —Free Code Camp

The post Worth Reading: GraphQL appeared first on rule 11 reader.

Worth Reading: Networking in Azure

Hybrid networking is a nice thing, but the question then is how do we define hybrid networking? For me, in the context of the connectivity to virtual networks, ExpressRoute’s private peering or VPN connectivity, it is the ability to connect cross-premises resources to one or more Virtual Networks (VNets). While this all works nicely, and we know how to connect to the cloud, how do we network within the cloud? There are at least 3 Azure built-in ways of doing this. In this series of 3 blog posts, my intent is to briefly explain… —Azure

The post Worth Reading: Networking in Azure appeared first on rule 11 reader.

Worth Reading: IPv6 data exfiltration

The transition to internet protocol version 6 has opened up a whole new range of threat vectors that allow attackers to set up undetectable communications channels across networks, researchers have found. A paper has been published by researchers at the NATO defence alliance’s Cooperative Cyber Defence Centre of Excellence and Estonia’s Tallinn University of Technology. It outlines how attackers can create covert data exfiltration channels and system remote control, using IPv6 transition mechanisms. IPv6 aims to remove the technical drawbacks of the older IPv4 addressing scheme but brings its own fresh set of dangers, the researchers warned. Since IPv6 implementations and security solutions are relatively new and untested, and systems engineers aren’t fully aware of them, the new protocol can become a network backdoor attackers can exploit undetected. —itnews

The post Worth Reading: IPv6 data exfiltration appeared first on rule 11 reader.

Worth Reading: A new YANG module catalogue

From a high level point of this YANG catalog goal is to become a reference for all YANG modules available in the industry, for both YANG developers (to search on what exists already) and for operators (to discover the more mature YANG models to automate services). This YANG catalog should not only contain pointers to the YANG modules themselves, but also contains metadata related to those YANG modules: What is the module type (service model or not?) What is the maturity level? (for the IETF: is this a RFC, a working group document or an individual draft?), Is this module implemented? Who is the contact? Is there open-source code available? And we expect much more in the future. —Benoît Claise

The post Worth Reading: A new YANG module catalogue appeared first on rule 11 reader.

Optimal Route Reflection


There are—in theory—three ways BGP can be deployed within a single AS. You can deploy a full mesh of iBGP peers; this might be practical for a small’ish deployment (say less than 10), but it quickly becomes a management problem in larger, or constantly changing, deployments. You can deploy multiple BGP confederations; creating internal autonomous systems that are invisible to the world because the internal AS numbers are stripped at the real eBGP edge.

The third solution is (probably) the only solution anyone reading this has deployed in a production network: route reflectors. A quick review might be useful to set the stage.

In this diagram, B and E are connected to eBGP peers, each of which is advertising a different destination; F is advertising the 100::64 prefix, and G is advertising the 101::/64 prefix. Assume A is the route reflector, and B,C, D, and E are route reflector clients. What happens when F advertises 100::/64 to B?

  • B receives the route and advertises it through iBGP to A
  • A adds its router ID to the cluster list, and reflect the route to C, D, and E
  • E receives this route and advertises it through its eBGP session towards G
  • Continue reading

Worth Reading: PDoS attacks

Imagine a fast moving bot attack designed to render the victim’s hardware from functioning. Called Permanent Denial of Service attacks (PDoS attacks), this form of cyber-attack is becoming increasingly popular in 2017 as more incidents involving this hardware-damaging assault occur. Also known loosely as “phlashing” in some circles, PDoS is an attack that damages a system so badly that it requires replacement or reinstallation of hardware. By exploiting security flaws or misconfigurations, this type of cyber attack can destroy the firmware and/or basic functions of system. It is a contrast to its well-known cousin, DDoS attacks, which overloads systems with requests meant to saturate resources through unintended usage. —radware

The post Worth Reading: PDoS attacks appeared first on rule 11 reader.

Worth Reading: SGXIO

Intel’s SGX provides hardware-secured enclaves for trusted execution of applications in an untrusted environment. Previously we’ve looked at Haven, which uses SGX in the context of cloud infrastructure, SCONE which shows how to run docker containers under SGX, and Panoply which looks at what happens when multiple applications services, each in their own enclave, need to communicate with each other (think kubernetes pod or a collection of local microservices). SGXIO provides support for generic, trusted I/O paths to protect user input and output between enclaves and I/O devices. (The generic qualifier is important here – currently SGX only works with proprietary trusted paths such as Intel’s Protected Audio Video Path). —the morning paper

The post Worth Reading: SGXIO appeared first on 'net work.

Worth Reading: SGXIO

Intel’s SGX provides hardware-secured enclaves for trusted execution of applications in an untrusted environment. Previously we’ve looked at Haven, which uses SGX in the context of cloud infrastructure, SCONE which shows how to run docker containers under SGX, and Panoply which looks at what happens when multiple applications services, each in their own enclave, need to communicate with each other (think kubernetes pod or a collection of local microservices). SGXIO provides support for generic, trusted I/O paths to protect user input and output between enclaves and I/O devices. (The generic qualifier is important here – currently SGX only works with proprietary trusted paths such as Intel’s Protected Audio Video Path). —the morning paper

The post Worth Reading: SGXIO appeared first on rule 11 reader.

Worth Reading: Criminals getting closer to state actors

A few years ago, we saw a clear difference between state actors and criminals looking at the technologies and procedures they applied attacking an environment. Over time we have seen these two groups coming closer together. In the meantime, criminals seem to have caught up. They started to use more sophisticated and targeted malware and they do not shy away from calling their victims and helping them to run “the macro in the Word document”… —Halbheer on Security

The post Worth Reading: Criminals getting closer to state actors appeared first on 'net work.

Worth Reading: Criminals getting closer to state actors

A few years ago, we saw a clear difference between state actors and criminals looking at the technologies and procedures they applied attacking an environment. Over time we have seen these two groups coming closer together. In the meantime, criminals seem to have caught up. They started to use more sophisticated and targeted malware and they do not shy away from calling their victims and helping them to run “the macro in the Word document”… —Halbheer on Security

The post Worth Reading: Criminals getting closer to state actors appeared first on rule 11 reader.

Worth Reading: Building Venice

What we do with Venice is support incremental upgrades of the cluster. Both of these approaches use a cluster of storage nodes. Given that our database is both sharded and replicated, we can bring down one storage node, upgrade it to the new version of the code, and bring it back online without affecting the usability of the system. Doing this one node at a time with each storage node in the cluster lets us do a zero-downtime upgrade. —LinkedIn

The post Worth Reading: Building Venice appeared first on 'net work.

1 … 89 90 91 92 93 … 159