What John Oliver gets wrong about Bitcoin

How Bitcoin works

Rough Guide to IETF 101: Internet Infrastructure Resilience

In this post of the Internet Society Rough Guide to IETF 101, I’ll focus on important work the IETF is doing that helps improve security and resilience of the Internet infrastructure.

BGP

What happens if an IXP operator begins maintenance work on the switches without ensuring that BGP sessions between the peers have been shut down? A network disruption and outage. A draft now in the RFC editor queue, “Mitigating Negative Impact of Maintenance through BGP Session Culling”, provides guidance to IXP operators on how to avoid such situations by forcefully tearing down the BGP sessions (session culling) affected by the maintenance before the maintenance activities commence. This approach allows BGP speakers to pre-emptively converge onto alternative paths while the lower layer network’s forwarding plane remains fully operational.

Another draft also in the RFC editor queue, “Graceful BGP session shutdown”, addresses issues related to planned maintenance. The procedures described in this document can be applied to reduce or avoid packet loss for outbound and inbound traffic flows initially forwarded along the peering link to be shut down.  These procedures trigger, in both Autonomous Systems (AS), rerouting to alternate paths if they exist within the Continue reading

CGN, IPv6 and fighting online crime…

Security and Speed Remain Tradeoffs for Containers in HPC Environments

The National Center for Atmospheric Research developed its own container platform.

Short Take – Side Channel Attack

Do you know what a side channel attack is? Do you know how it relates to you as a Network Engineer? In today’s Network Collective Short Take, Russ White helps explain what a side channel attack is, how it works, and some of the challenges that are inherent in defending against it.

Russ White

The post Short Take – Side Channel Attack appeared first on Network Collective.

Tenable’s Lumin Helps CISOs Measure and Quantify Cyber Risk

The company says the average customer detects upwards of 9,000 high- or critical-severity vulnerabilities every month.

Netsparker Closes $40M Series A for its App Scanning Software

San Francisco private equity fund Turn/River Capital led the round.

Mesosphere Tightly Integrates Kubernetes in DC/OS Update

The DC/OS platform slashes the steps required for production-ready Kubernetes.

Some notes on memcached DDoS

Test your servers

Before Commenting on Someone Mentioning RFC1925 ;)

Some of my readers got annoyed when I mentioned Google’s BeyondCorp and RFC 1925 in the same sentence (to be perfectly clear, I had Rule#11 in mind). I totally understand that sentiment – reading the reactions from industry press it seems to be the best thing that happened to Enterprise IT in decades.

Let me explain in simple terms why I think it’s not such a big deal and definitely not something new, let alone revolutionary.

Tensions Between U.S. and China Factor into Qualcomm-Broadcom Fight

Broadcom offers to sweeten the pot with $1.5B for engineer training.

McAfee Adds Azure Cloud Security, Integrates Skyhigh’s CASB Tech

The firm plans to add container and serverless security later this year.

Cisco Adds Workload Protection To Tetration

There’s a New SD-WAN Kid on the Block: Netsurion

Netsurion's SD-WAN is targeted to multi-tenant enterprises.

Routing Security BoF – APRICOT 2018

On Sunday, 25 February, the first day of APRICOT 2018, a “Routing Security BoF” (birds of a feather: An informal discussion group) was organized to address the ever-growing routing related incidents happening on daily basis. We have discussed routing security in general within the Asia Pacific region but there was a need to have a platform for open and candid discussion among the network operator community to find a possible way forward, where operators can share their approach in securing their own infrastructure and keeping the internet routing table clean as well.

A quick introduction was provided by the moderator (Aftab Siddiqui) on why it is important to have this BoF. Here are the introductory slides:

The first technical community presenter was Yoshinobu Matsuzaki (Maz) from Internet Initiative Japan (IIJ), the first ISP in Japan started in 1992. IIJ is one of the few ISPs in the region implementing prefix filtering, source address validation for their end customers, and making sure that all their routing information is reflecting the current status in the peeringdb for AS2497. IIJ was the first Asia Pacific ISP to join MANRS (Mutually Agreed Norms for Routing Security), a global initiative, supported by the Continue reading

Routing Security is a Serious Problem – and MANRS Can Help. A Report from APRICOT 2018.

Last week, at APRICOT 2018 in Kathmandu, Nepal, there were a lot of talks and discussions focused on routing security and the Mutually Agreed Norms for Routing Security (MANRS).

First, there was a Routing Security BoF, attended by about 150 people, where we talked about what it takes to implement routing security practices, how CDNs and other players can help, and why it is so difficult to make progress in this area. The BoF included an interactive poll at the end, and it showed some interesting results:

• Participants almost unanimously see lack of routing security as a serious problem.
• Slow progress in this area is largely seen as due to a lack of incentives
• Participants see community initiatives (like MANRS) as the main driving forces for improvement, followed by CDNs and cloud providers. They doubt that governments or end-customers can effectively drive change.

My colleague Aftab Siddiqui is writing a separate blog post just about that BoF, so watch the blog in the next day or two.

Later, in the security track of the main APRICOT programme, Andrei Robachevsky, ISOC’s Technology Programme Manager, presented statistics on routing incidents and suggested a way forward based on the MANRS approach. In his Continue reading

Cisco’s Tetration Extends Security Analytics, Policy to Multi-Cloud Apps

The updates also support containerized workloads.

Treasury Department Throws Fuel on Qualcomm and Broadcom Fire

The U.S. government postponed Qualcomm's annual meeting and board elections to investigate.

Memcached DDoS – There’s Still Time to Save Your Mind

In case you haven’t heard, there’s a new vector for Distributed Denial of Service (DDoS) attacks out there right now and it’s pretty massive. The first mention I saw this week was from Cloudflare, where they details that they were seeing a huge influx of traffic from UDP port 11211. That’s the port used by memcached, a database caching system.

Surprisingly, or not, there were thousands of companies that had left UDP/11211 open to the entire Internet. And, by design, memcached responds to anyone that queries that port. Also, carefully crafted packets can be amplified to have massive responses. In Cloudflare’s testing they were able to send a 15 byte packet and get a 134KB response. Given that this protocol is UDP and capable of responding to forged packets in such a way as to make life miserable for Cloudflare and, now, Github, which got blasted with the largest DDoS attack on record.

How can you fix this problem in your network? There are many steps you can take, whether you are a system admin or a network admin:

• Go to Shodan and see if you’re affected. Just plug in your company’s IP address ranges and have it Continue reading

A Guide To Securing Docker and Kubernetes Containers With a Firewall

Containers present a hefty challenge for traditional firewall rules and iptables.