Ambiguity and complexity: once more into the breach

Recent research into the text of RFCs versus the security of the protocols described came to this conclusion—

While not conclusive, this suggests that there may be some correlation between the level of ambiguity in RFCs and subsequent implementation security flaws.

This should come as no surprise to network engineers—after all, complexity is the enemy of security. Beyond the novel ways the authors use to understand the shape of the world of RFCs (you should really read the paper; it’s really interesting), this desire to increase security by decreasing the ambiguity of specifications is fascinating. We often think that writing better specifications requires having better requirements, but down this path only lies despair.

Better requirements are the one thing a network engineer can never really hope for.

It’s not just that networks are often used as a sort of “complexity sink,” the place where every hard problem goes to be solved. It’s also the uncertainty of the environment in which the network must operate. What new application will be stuffed on top of the network this week? Will anyone tell the network folks about this new application, or just open a ticket when it doesn’t work right? What about all Continue reading

Unifying Kubernetes Service Networking (Again) with the Gateway API

The in detail — and in-person — at Kubecon 2019 in San Diego. There were already many well-known and Gateway API was intended as a redo of these APIs, built on the lessons from Services, Ingress and the service mesh community. With a group of Ingress and Service

Cisco 8000 Series routers

flow exporter-map SF-EXP-MAP-1
 version sflow v5
 !
 packet-length 1468
 transport udp 6343
 source GigabitEthernet0/0/0/1
 destination 192.127.0.1
 dfbit set
!

flow monitor-map SF-MON-MAP
 record sflow
 sflow options
  extended-router
  extended-gateway
  if-counters polling-interval 300
  input ifindex physical
  output ifindex physical
 !
 exporter SF-EXP-MAP-1
!

sampler-map SF-SAMP-MAP
 random 1 out-of 20000
!

interface GigabitEthernet0/0/0/3
 flow datalinkframesection monitor-map SF-MON-MAP sampler SF-SAMP-MAP ingress

Network Break 331: Proofpoint Goes Private In $12 Billion Deal; Defense Dept. Unveils IPv4 Address Cache

Network Break 331: Proofpoint Goes Private In $12 Billion Deal; Defense Dept. Unveils IPv4 Address Cache

Guest analyst Johna Till Johnson, CEO and Founder of Nemertes Research, joins the Network Break to discuss a variety of IT news including the rising price of copper, Proofpoint going private in a $12.3 billion deal, why the US Defense Department suddenly began advertising a huge block of IPv4 addresses, and space networking.

The post Network Break 331: Proofpoint Goes Private In $12 Billion Deal; Defense Dept. Unveils IPv4 Address Cache appeared first on Packet Pushers.

The 4 Definitions of Multicloud: Part 4 — Traffic Portability

With the goal of bringing more productive discussions on this topic into focus and understanding which types of multicloud capabilities are worth pursuing, this series concludes with a look at multicloud through the lens of traffic portability. Traffic Portability Armon Dadgar Armon is co-founder and CTO of HashiCorp, where he brings his passion for distributed systems to the world of DevOps tooling and cloud infrastructure. Multicloud traffic portability means you can shift traffic between environments dynamically. If you have geographically dispersed users, traffic portability would allow you to route traffic to the nearest cloud provider that could service them. So, if your app can run on Azure and AWS, maybe there’s a closer AWS data center to your customer than Azure. Or maybe one cloud vendor works better for data sovereignty in Europe, so you route to a particular vendor only for those requests. In most cases, the goal of traffic portability is to have the ability to dynamically shift traffic very quickly between multiple cloud platforms and on-premises data centers. This could also mean you’re balancing 50/50 traffic between AWS and Azure. Or maybe you’re doing maintenance in your Google Cloud environments, so you move 100% of traffic to Continue reading

Extreme CEO talks AI, automation, chip shortages

Fresh off one of the strongest quarters in the company’s 25 year history where it hit double-digit, year-over-year revenue growth and a fourth consecutive quarter of growth, Extreme Networks is betting heavily on automation, AI and cloud management to keep the party going. Extreme Networks Extreme CEO Ed MeyercordTo read this article in full, please click here

The Week in Internet News: India Tries to Censor Online Critics

Shut your mouth: The government in India has tried to silence critics of its response to the COVID-19 pandemic there as cases spike in the country, BuzzFeed News reports. India’s IT ministry recently ordered Twitter to block more than 50 tweets from being seen in the country, and Facebook, Instagram, and YouTube also had content critical […]

The post The Week in Internet News: India Tries to Censor Online Critics appeared first on Internet Society.

IBM updates its storage-systems portfolio

IBM announced a pair of additions to its storage portfolio designed to improve the access to and management of data across hybrid-cloud environments and offer faster, higher capacity.The first is container-native software defined storage (SDS) called IBM Spectrum Fusion that’s due out in the second half of 2021. It will initially come in the form of a container-native hyperconverged infrastructure (HCI) system that integrates compute, storage, and networking. Next year, IBM plans to release an SDS-only version of Spectrum Fusion.To read this article in full, please click here

Tech employers focus on training for IT pros

IT teams are dealing with rapid technology changes with increased retraining and skill development, according to a report by trade association CompTIA.Seven in 10 HR professionals surveyed who work with IT personnel said they plan a substantially increased effort to help workers re-skill in the coming year, with larger firms reporting a particularly strong emphasis in that area. Nearly 80% of IT HR professionals employed at such companies rated re-skilling or up-skilling as “more important” for the coming year, in contrast to 68% at medium-sized firms and 52% at smaller businesses.Network training 2021: Businesses grow their own expertise These numbers mark a changed relationship between employers and tech, according to CompTIA director of education and ed tech Stephanie Morgan, adding that the pandemic helped force companies to rethink the way they deal with their workers. “Businesses have realized they have to talk about people like they’re people, not like they’re assets,” she said.To read this article in full, please click here

Next-gen networks: Feds have cash for good ideas

The National Science Foundation (NSF) is not inclined to wait for next-generation (NextG) networks. And who can blame it? NextG promises faster cellular, Wi-Fi, and satellite networks, all of which can be used to enhance data streaming, wireless communications, analytics, and automation.For the NSF, this translates into improved national defense, education, public health and safety, transportation, and digital infrastructure. For enterprises, NextG means greater efficiency, flexibility, business insights, and more opportunities to replace human workers with robots. (I’m just sayin’.)To read this article in full, please click here

IBM updates its storage-systems portfolio

IBM announced a pair of additions to its storage portfolio designed to improve the access to and management of data across hybrid-cloud environments and offer faster, higher capacity.The first is container-native software defined storage (SDS) called IBM Spectrum Fusion that’s due out in the second half of 2021. It will initially come in the form of a container-native hyperconverged infrastructure (HCI) system that integrates compute, storage, and networking. Next year, IBM plans to release an SDS-only version of Spectrum Fusion.To read this article in full, please click here

Feedback: Microsoft Azure Networking

Azure and AWS have decent documentation (I always found it relatively easy to figure out what they’re doing), but what they implemented is sometimes so far away from what we’re used to that it’s hard to bridge the gap. Here’s how Olle Wilhelmsson solved that challenge:

Feedback: Microsoft Azure Networking

Azure and AWS have decent documentation (I always found it relatively easy to figure out what they’re doing), but what they implemented is sometimes so far away from what we’re used to that it’s hard to bridge the gap. Here’s how Olle Wilhelmsson solved that challenge:

Weekend Reads 050121

Attacks on virtual private networks, like those this week targeting a trio of known vulnerabilities in Pulse Secure appliances, have intensified in recent months along with the increase in remote and hybrid work environments since the outbreak of COVID-19.

Over the last couple of years, policy-making institutions have been putting greater focus on the study of various aspects of Artificial Intelligence (AI). This doesn’t come as a surprise.

Forty-six percent of all malware uses the cryptographic protocol to evade detection, communicate with attacker-controlled servers, and to exfiltrate data, new study shows.

One position I think more people should be aware of is a CISO. What does this actually mean – besides being made redundant when a breach is announced? I have personally worked within a CISO-as-a-Service position, but I wanted to get some more insight from those who are working in the trenches daily in an in-house CISO position.

According to Help Net Security, organizations in the pharmaceutical and biotech sectors witnessed a 50% increase in digital attacks between 2019 and 2020. It appears that at least part of those attacks originated from nation-state actors who specifically sought to steal COVID-19 vaccine research.

As further proof of this, new research Continue reading

VyControl – Web UI for VyOS Firewall

RFC 7868: The Definitive EIGRP Guide

Seventeen years after I started working on my EIGRP book, the reverse engineering days were over: RFC 7868 is the definitive guide to modern EIGRP (I’m not familiar with at least half of the concepts mentioned in it).

Just in case you’re interested in a bit of historical trivia:

• My EIGRP deciphering history started a few years before the book was published. In mid-1990s I was asked (as an external trainer) to create an EIGRP course for Cisco EMEA Training.
• I’ve never seen any internal EIGRP documentation or code – everything I knew about EIGRP I’ve learned from trying out crazy stuff and deciphering debugging messages.
• Two of the RFC authors (Russ White and Don Slice) were the technical reviewers for my EIGRP book. Russ copiously rewrote my pidgin English into something understandable – if you like reading my blog posts today, you should (also) thank Russ.

RFC 7868: The Definitive EIGRP Guide

Seventeen years after I started working on my EIGRP book, the reverse engineering days were over: RFC 7868 is the definitive guide to modern EIGRP (I’m not familiar with at least half of the concepts mentioned in it).

Just in case you’re interested in a bit of historical trivia:

• My EIGRP deciphering history started a few years before the book was published. In mid-1990s I was asked (as an external trainer) to create an EIGRP course for Cisco EMEA Training.
• I’ve never seen any internal EIGRP documentation or code – everything I knew about EIGRP I’ve learned from trying out crazy stuff and deciphering debugging messages.
• Two of the RFC authors (Russ White and Don Slice) were the technical reviewers for my EIGRP book. Russ copiously rewrote my pidgin English into something understandable – if you like reading my blog posts today, you should (also) thank Russ.

Fast Friday Thoughts from the Woods

I’m at camp this week helping put on the second weekend of the Last Frontier Council Wood Badge course which is my idea of a vacation. I’m learning a lot, teaching a lot more, and having fun. But that does’t mean I’m not working too. Lots of fun conversations that make me recall the way people consume information, communicate what they know, and all too often overlook the important things they take for granted.

• Why is IT one of the few disciplines that expects people to come in fully trained and do the job instead of learning while doing it? Is that because hiring managers don’t want to train people? Or is it because senior people are less likely to impart knowledge to protect their jobs? I don’t have a good answer but I know what the result looks like and it’s not something that’s positive, either for the people doing the job or how it’s perceived outside of IT.
• There is a ton of value in doing something for real instead of just planning it and calling it good. DR plans need to be tested. Network changes need to be mocked up. No matter what kind of critical thing Continue reading

Member News: Chapters Respond to Proposed Internet Regulations

Big, big data: Several chapters of the Internet Society have joined the debate over proposed government Internet regulations. The Israeli Internet Association, for example, has raised concerns about a Ministry of Communications proposal to require all communications companies in Israel, including cellular, Internet, and television providers, to regularly give the ministry detailed information on the […]

The post Member News: Chapters Respond to Proposed Internet Regulations appeared first on Internet Society.