The Cloud Security Boom Has Just Started
Information security technology is undergoing a generational shift. Once thought of as a collection of point solutions, security technology is moving to the cloud, where a coordinated suite of real-time software tools are needed.
The End of the Internet
Will the Internet survive centralization, a Black Hat keynoter asks.
DNS parser, meet Go fuzzer
Here at CloudFlare we are heavy users of the github.com/miekg/dns Go DNS library and we make sure to contribute to its development as much as possible. Therefore when Dmitry Vyukov published go-fuzz and started to uncover tens of bugs in the Go standard library, our task was clear.
Hot Fuzz
Fuzzing is the technique of testing software by continuously feeding it inputs that are automatically mutated. For C/C++, the wildly successful afl-fuzz tool by Michał Zalewski uses instrumented source coverage to judge which mutations pushed the program into new paths, eventually hitting many rarely-tested branches.
go-fuzz applies the same technique to Go programs, instrumenting the source by rewriting it (like godebug does). An interesting difference between afl-fuzz and go-fuzz is that the former normally operates on file inputs to unmodified programs, while the latter asks you to write a Go function and passes inputs to that. The former usually forks a new process for each input, the latter keeps calling the function without restarting often.
There is no strong technical reason for this difference (and indeed afl recently gained the ability to behave like go-fuzz), but it's likely due to the different ecosystems in which they Continue reading
How a Chinese Hacking Ring Loots Corporate Secrets
A Dell SecureWorks survey explains how compromised sites can be used for highly selective attacks.
Skyport DemoFriday: Learn How SkySecure Intends to Disrupt the Security & Server Markets
Security threats are changing. Your security measures need to change, too. Find out what to do with the help of Skyport Systems and its SkySecure product.
F5 Badger Adds Azure Support, Targets Hybrid Cloud
BIG-IP gets a DevOps twist.
Zscaler Scales Up With $100M Series B
Another big round for a security startup.
Software-Defined Perimeter Remains Undefeated in Hackathon
'We don't have to be vulnerable.'
Worth Reading: Access Control with Segmentation
The post Worth Reading: Access Control with Segmentation appeared first on 'net work.
Worth Reading: Outsourcing
This is a point that many people don’t get — if all businesses are data businesses (and they are, despite the constant refrain I’ve heard throughout my career that “we don’t make technology, here, so…”), then all the data, and all the analysis you do on that data, is just like the famous Coke recipe.
Know data, know your business. No data, no business.
It’s really that simple. When will we learn — and take this idea seriously? And when will we realize this rule applies to the network as well as the data in many cases?
The post Worth Reading: Outsourcing appeared first on 'net work.
VLAN Bridging with FirePOWER
Although not immediately obvious, the FirePOWER Series 3 devices can do a form of IPS on a stick. This means that the capability described here should be available to the current appliance versions of the FirePOWER managed devices. The premise involves connecting broadcast domains (VLANs) to bring the managed device inline between the initiator and responder of a flow. Configuration is fairly straightforward but does have some caveats.
Caveats
- Even though only a single port is required, a virtual switch must be configured (this cannot just be an inline pair)
- BPDUs being bridged between VLANs are detected and will render the switchport(s) in an inconsistent state
- The FirePOWER physical interface will not activate until it is also bound to a Virtual Switch
The diagram shows two devices in the same VLAN (we will assume /24 for the configuration). The device on the top is in VLAN 100. The FirePOWER managed device bridges VLAN 100 to VLAN 101 and allows the two devices to communicate directly with one another. The connection to the FirePOWER device is a single 802.1q trunk.
Frames arriving on VLAN 100 will be processed and egress with a VLAN tag of 101. This configuration is similar to a Continue reading
Understanding Rowhammer
As I learned in my early days in electronics, every wire is an antenna. This means that a signal in any wire, given enough power, can be transmitted, and that same signal, in an adjacent wire, can be received (and potentially decoded) through electromagnetic induction (Rule 3 may apply). This is a major problem in the carrying of signals through a wire, a phenomenon known as cross talk. How do communications engineers overcome this? By observing that a signal carried along parallel wires at opposite polarities will cancel each other out electromagnetically. The figure below might help out, if you’re not familiar with this.
This canceling effect of two waveforms traveling a pair of wires 180deg out of phase is why the twisted is in twisted pair, and why it’s so crucial not to unbundle too much wire when punching down a jack or connector. The more untwisted the wire there is, the less effective the canceling effect is around the punch down, and the more likely you are to have near end or far end crosstalk.
If you consider one row of memory in a chip one wire, and a second, adjacent row of memory in the Continue reading
Video: Overview of IPv6 First-Hop Security Challenges
Like all other ipSpace.net webinars, the IPv6 Microsegmentation webinar starts with a brief description of the problem we’re trying to solve: the IPv6 first-hop security challenges.
For an overview of this problem, watch this free video from the IPv6 microsegmentation webinar, for more details, watch the IPv6 Security webinar.
FireEye CFO Michael Sheridan Quits For a Startup Job
FireEye shares tumble on exec departure.
A quick review of the BIND9 code
Its biggest problem is that it has too many feature. It attempts to implement every possible DNS feature known to man, few of which are needed on publicly facing servers. Today's bug was in the rarely used "TKEY" feature, for example. DNS servers exposed to the public should have the minimum number of features -- the server priding itself on having the maximum number of features is automatically disqualified.
Another problem is that DNS itself has some outdated design issues. The control-plane and data-plane need to be separate. This bug is in the control-plane code, but it's exploited from the data-plane. (Data-plane is queries from the Internet looking up names, control-plane is zones updates, Continue reading
Security Needs a New Approach — The Why & How of Skyport SkySecure
Security threats are evolving, so protection methods need to change, too. Register for the Skyport DemoFriday to learn how.
What’s Hot in SDx Infrastructure Security? Read our Report Now
Be first to learn about security innovations in the protection of SDx Infrastructure: Data Centers and Cloud, Enterprise Campus and Branch and IoT
Mitigate DoS Attack using TCP Intercept on Cisco Router
How does Internet work - We know what is networking
This is really cool feature on Cisco router not usually mentioned until you dig a little deeper inside Cisco IOS. But first a bit of theory… What is TCP SYN flood attack TCP 3-way handshake SYN flood DoS attack happens when many sources start to send a flood of TCP SYN packets usually with fake source IP. This attack uses TCP 3-way handshake to reserve all server available resources with fake SYN requests thus not allowing legitimate users to establish connection to the server. SYN packet is the first step in TCP 3-way handshake where client sends connection synchronization request
Security Firm CloudPassage Adds Container Support
Behold the Docker golden image.
Security – Just Another Risk
I made a conscious decision to move away from full-time information security work. I retain an interest, and try to keep up with developments, but I don’t want to be “the security guy.” There are several reasons for it, but a large part is due to the hype, the bullshit, and general inability for the security industry to act like grown-ups.
The most frustrating part was the inability to properly classify risk. Robert Graham put this eloquently here:
Infosec isn’t a real profession. Among the things missing is proper “risk analysis”. Instead of quantifying risk, we treat it as an absolute. Risk is binary, either there is risk or there isn’t. We respond to risk emotionally rather than rationally, claiming all risk needs to be removed. This is why nobody listens to us. Business leaders quantify and prioritize risk, but we don’t, so our useless advice is ignored.
Security folk often forget that they are just another risk. Yes, it’s a risk shipping the product with that bug. But not shipping at all might be a larger risk to the business. Even complete data breach may or may not be catastrophic to the business – RSA is still Continue reading