Security ‘net: Google, Watson, and other thoughts
Encryption, security, and privacy are at the top of our list, it seems. The question is — who really cares about your privacy? Is Google a champion of freedom, or a threat to national sovereignty?
Google is unique in its leadership, plans, and global marketpower to accelerate the majority of all global Web traffic “going dark,” i.e. encrypted by default. Google’s “going dark” leadership seriously threatens to neuter sovereign nations’ law-enforcement and intelligence capabilities to investigate and prevent terrorism and crime going forward.
But the truth about where the giants of tech stand on user privacy is another matter entirely. No organizations on earth have exploited users more than Google (GOOGL) and Facebook (FB) have in their zealous quest to boost ad revenues by providing users’ personal data – demographics, searches, email and location, among others – to an ever-growing list of digital advertisers.
Russ’ take: The truth is probably out there someplace, but I doubt it’s as clean cut as either of these articles Continue reading
VMware NSX Secures Armor’s Customers with Micro-Segmentation
VMware NSX equips Armor with the ability to orchestrate each customer in a cloud-like 
environment while giving them a threat-tight security wrapper via micro-segmentation from day one. Continue reading
First Internet ecommerce was at least 1990
This article from FastCompany claims that the first Internet e-commerce transaction was 1994. This isn't true. The site "cdconnection.com" was selling CDs online since 1990. Well, they claim 1990, I don't know what evidence they have. But I personally can remember buying CDs on their site for over a year before I switched jobs in mid-1994 (so probably at least 1993).I write this up because it's apparently an important concern when Internet e-commerce was "invented", so I'm writing up what I witnessed. It's a silly competition, of course, since Internet e-commerce is such an obvious idea that nobody can "invent" it. Somebody probably accepted payments for things online even before that. But, as of 1993 when I purchased music, CDconnection was a well-honed business, a "site", with an interface, with a wide selection, using Telnet with V100 commands to format the screen.
Security for the New Battlefield
What will be our security challenge in the coming decade? Running trusted services even on untrusted infrastructure. That means protecting the confidentiality and integrity of data as it moves through the network. One possible solution – distributed network encryption – a new approach made possible by network virtualization and the software-defined data center that addresses some of the current challenges of widespread encryption usage inside the data center.
VMware’s head of security products Tom Corn recently spoke on the topic at VMworld 2015 U.S., noting, “Network encryption is a great example of taking something that was once a point product, and turning it into a distributed service—or what you might call an infinite service. It’s everywhere; and maybe more importantly it changes how you implement policy. From thinking about it through the physical infrastructure—how you route data, etcetera—to through the lens of the application, which is ultimately what you’re trying to protect. It eventually becomes really a check box on an application.”
VMware NSX holds the promise of simplifying encryption, incorporating it directly so that it becomes a fundamental attribute of the application. That means so as long as it has that attribute, any packet will be Continue reading
Featured White Paper: How to Illuminate Blind Spots in a Virtualized Environment
Traditional taps are not enough to monitor and protect complex networks. Ixia outlines how to achieve visibility in virtualized environments without degrading performance.
Collecting MAC and IP Adresses of Hosts Connected to Cisco Switches Using SNMP
The goal of this article is to introduce a script that automates a process of collecting MAC and IP address of hosts connected to Cisco switches using Simple Network Management Protocol (SNMP). We will configure SNMP version 2c and 3 on Cisco switches and create a BASH script that collects required data for us. For this purpose I have created a test network lab using GNS3. The topology consists of three Cisco virtual switch appliances running vIOS-L2 and one network management station (NMS) based on Kali Linux. Network hosts are simulated by Core Linux appliances connected to Cisco vIOS-l2 switches.
1. GNS3 Lab
1.1 List of software used for creating GNS3 lab
- Host OS
x86-64 Linux Fedora with installed GNS3 1.3.11 and Qemu1.4.0 - Network Management Station
Linux Kali 3.18.0-kali3-amd64 - Swiches
Cisco vIOS l2 Software (vios_l2-ADVENTERPRISEK9-M), Version 15.2
Cisco Catalyst 3550 (C3550-IPSERVICESK9-M), Version 12.2(55)SE9 - Network Host (End device)
Linux Core 3.16.6-tinycore64
1.2 Network Topology Description
All virtual network and host devices are running inside GNS3 project and they are emulated by Qemu emulator and virtualizer. The only exception is a Cisco Catalyst 3550 switch that is connected to topology via GNS3 network Continue reading
Palo Alto Networks’ Growth Continues in Q1
Another quarter of 55% growth, ho hum.
Some notes on the eDellRoot key
If I were a black-hat hacker, I'd immediately go to the nearest big city airport and sit outside the international first class lounges and eavesdrop on everyone's encrypted communications. I suggest "international first class", because if they can afford $10,000 for a ticket, they probably have something juicy on their computer worth hacking.
I point this out in order to describe the severity of Dell's mistake. It's not a simple bug that needs to be fixed, it's a drop-everything and panic sort of bug. Dell needs to panic. Dell's corporate customers need to panic.
Note that Dell's spinning of this issue has started, saying that they aren't like Lenovo, because they didn't install bloatware like Superfish. This doesn't matter. The problem with Superfish wasn't the software, but the private key. In this respect, Dell's error is exactly as bad as the Superfish error.
Worth Reading Roundup: Security and Privacy
“If I haven’t done anything wrong, then I don’t have anything to hide.” This is one of those bits of nonsense that never seems to lose it’s power regardless of how many times it’s been proven wrong in history. Privacy is one of the most important freedoms we enjoy — the privacy to try, the privacy to work things out among friends, and even the privacy to fail.
So what does the ‘net say about privacy this week?
One of the most disturbing things is the growing tendency to engineer people for greater efficiency. This trend started more than a hundred years ago — remember this?
But there is something fundamentally dehumanizing about people like machines out of whom you can squeeze infinite amounts of bandwidth — but it seems to be something we’re pushing towards almost as fast as we can, in both the corporate world and in government.
Many countries are in the throes of a debate about the amount of surveillance a government Continue reading
vArmour Has a Plan for Multicloud Security
A 5-step program for securing that pesky hybrid cloud.
Cisco Hits the Refresh Button on CCIE & CCNA
IT professionals need to expand their horizons to IoT and the cloud.
The Next Horizon for Cloud Networking & Security
VMware NSX has been around for more than two years now, and in that time software-defined networking and network virtualization have become 
inextricably integrated into modern data center architecture. It seems like an inconceivable amount of progress has been made. But the reality is that we’re only at the beginning of this journey.
The transformation of networking from a hardware industry into a software industry is having a profound impact on services, security, and IT organizations around the world, according to VMware’s Chief Technology Strategy Officer for Networking, Guido Appenzeller.
“I’ve never seen growth like what we’ve found with NSX,” he says. “Networking is going through a huge transition.” Continue reading
Castle versus Cannon: It’s time to rethink security
In case you’re confused about the modern state of security, let me give you a short lesson.
Your network is pictured to the left. When I first started working on networks in the USAF we were just starting to build well designed DMZs, sort of a gate system for the modern network. “Firewalls” (a term I’m coming to dislike immensely), guard routers, VPN concentrators, and other systems were designed to keep your network from being “penetrated.” Standing at the front gate you’ll find a few folks wearing armor and carrying swords, responsible for letting only the right people inside the walls — policies, and perhaps even an IDS or two.
The world lived with castles for a long time — thousands of years, to be precise. In fact, the pride of the Roman Legion really wasn’t the short sword and battle formation, it was their ability to work in concrete. Certainly they had swords, but they could also build roads and walls, as evidenced by the Roman style fortifications dotting the entire world.
But we don’t live inside concrete walls any longer. Instead, our armies today move on small and large vehicles, defending territory through measure and countermeasure. They gather Continue reading
Docker Security Gets a Hardware Assist
DockerCon EU kicks off with a few practical new features.
Docker Content Trust Gets Hardware Signing
Three months ago we launched Docker Content Trust, integrating the guarantees from The Update Framework (TUF) into Docker using Notary, an open source tool that provides trust over any content. Today we’re incredibly excited to announce the support of hardware … ContinuedJuniper Networks’ New Security CTO Comes From Walmart
Kevin Walker is taking over the security reins, succeeding Chris Hoff.
Twistlock Launches Its Container Security Suite
A container that watches other containers for vulnerabilities.
Five Functional Facts about TACACS+ in ISE 2.0
The oft-requested and long awaited arrival of TACACS+ support in Cisco’s Identity Services Engine (ISE) is finally here starting in version 2.0. I’ve been able to play with this feature in the lab and wanted to blog about it so that existing ISE and ACS (Cisco’s Access Control Server, the long-time defacto TACACS+ server) users know what to expect.
Below are five facts about how TACACS+ works in ISE 2.0.
Distributed Firewall ALG
In the last post, VMware NSX™ Distributed Firewall installation and operation was verified. In this entry, the FTP (file transfer protocol) ALG (Application Level Gateway) is tested for associating data connections with originating control connections – something a stateless ACL (access control list) can’t do.
An added benefit over stateless ACLs – most compliance standards more easily recognize a stateful inspection-based firewall for access control requirements.
To check ALG support for a particular NSX version, refer to the VMware NSX Administration manual. VMware NSX version 6.2 supports FTP, CIFS, ORACLE TNS, MS-RPC, and SUN-RPC ALGs. Do expect additional ALG protocol support with future versions of NSX.
Assuming a default firewall rulebase for simplicity, and a basic setup:
- three ESXi vSphere 6.0 hosts in a cluster
- NSX installed, with the NSX Manager installed on the first host
- two guest VMs running Centos: one running an FTP server, the other an FTP client
Simplified diagram, along with connections for the following test:
Previously, an ESXi host command line was used to interact with the Distributed Firewall. Here, the NSX Manager Central CLI – a new option with NSX 6.2 – is used. Slightly different incantations, but the same results can be Continue reading
CCDE – Firewall And IPS Design Considerations
Introduction
This post will discuss different design options for deploying firewalls and Intrusion Prevention Systems (IPS) and how firewalls can be used in the data center.
Firewall Designs
Firewalls have traditionally been used to protect inside resources from being accessed from the outside. The firewall is then deployed at the edge of the network. The security zones are then referred to as “outside” and “inside” or “untrusted” and “trusted”.
Anything coming from the outside is by default blocked unless the connection initiated from the inside. Anything from the inside going out is allowed by default. The default behavior can of course be modified with access-lists.
It is also common to use a Demilitarized Zone (DMZ) when publishing external services such as e-mail, web and DNS. The goal of the DMZ is to separate the servers hosting these external services from the inside LAN to lower the risk of having a breach on the inside. From the outside only the ports that the service is using will be allowed in to the DMZ such as port 80, 443, 53 and so on. From the DMZ only a very limited set of traffic will be allowed Continue reading