Archive

Category Archives for "Security"

Transforming Security in a Cloud and Mobile World – Security Showcase Session

Over the last several years, VMware has been heavily investing in technology and solutions to transform security.  Our goal has been simple; leverage the virtual and mobile infrastructure to build security in – making it intrinsic, simple, aligned to applications and data, and infinitely more effective.

5 years ago, with NSX, we introduced the concept of micro-segmentation, enabling organizations to leverage network virtualization to compartmentalize their critical applications at a network level.

Last VMworld, we introduced VMware AppDefense, to protect the applications running on that virtual infrastructure.  This enabled organizations to leverage server virtualization to ensure the only thing running is what the application intended – flipping the security model to “ensuring good” versus “chasing bad”

Meanwhile, our Workspace ONE team has been steadily building out their platform that leverages user infrastructure, to ensure only legitimate users can get access to critical applications from devices we can trust.

The momentum for NSX, AppDefense, and Workspace ONE has been growing exponentially. And our product teams have not been standing still.  They’ve been hard at work on some incredible innovations and integrations.

 

Transforming Security in a Cloud and Mobile World

In my security showcase session, Transforming Security in Continue reading

What the Caesars (@DefCon) WiFi situation looks like

So I took a survey of WiFi at Caesar's Palace and thought I'd write up some results.


When we go to DEF CON in Vegas, hundreds of us bring our WiFi tools to look at the world. Actually, no special hardware is necessary, as modern laptops/phones have WiFi built-in, while the operating system (Windows, macOS, Linux) enables “monitor mode”. Software is widely available and free. We still love our specialized WiFi dongles and directional antennas, but they aren’t really needed anymore.

It’s also legal, as long as you are just grabbing header information and broadcasts. Which is about all that’s useful anymore as encryption has become the norm -- we can pretty much only see what we are allowed to see. The days of grabbing somebody’s session-cookie and hijacking their web email are long gone (though the was a fun period). There are still a few targets around if you want to WiFi hack, but most are gone.

So naturally I wanted to do a survey of what Caesar’s Palace has for WiFi during the DEF CON hacker conference located there.

Here is a list of access-points (on channel 1 only) sorted by popularity, the number of stations using Continue reading

Juniper Announces New Acceleration Cards For SRX5000 Security Appliances

Juniper Networks has announced that it will soon begin shipping new SPC3 (Services Process Card) Advanced Security Acceleration cards for its SRX5000 line of security gateways, which includes the 5400, 5600, and 5800 appliances. These security appliances target large enterprises, service providers, and cloud providers. Customers can mix and match security features including firewalling, IPS, […]

Gigamon Acquires SaaS Security Startup For Network Analytics

Gigamon has acquired Icebrg, a security startup that collects and analyzes network metadata to detect attacks and help security teams investigate incidents. Icebrg uses on-premises sensors to collect packet metadata from switches and routers, and then sends that data to its cloud platform. Customers then access the data from a portal for analysis and investigation. […]

Cisco and the Two-Factor Two-Step

In case you missed the news, Cisco announced yesterday that they are buying Duo Security. This is a great move on Cisco’s part. They need to beef up their security portfolio to compete against not only Palo Alto Networks but also against all the up-and-coming startups that are trying to solve problems that are largely being ignored by large enterprise security vendors. But how does an authentication vendor help Cisco?

Who Are You?

The world relies on passwords to run. Banks, email, and even your mobile device has some kind of passcode. We memorize them, write them down, or sometimes just use a password manager (like 1Password) to keep them safe. But passwords can be guessed. Trivial passwords are especially vulnerable. And when you factor in things like rainbow tables, it gets even scarier.

The most secure systems require you to have some additional form of authentication. You may have heard this termed as Two Factor Authentication (2FA). 2FA makes sure that no one is just going to be able to guess your password. The most commonly accepted forms of multi-factor authentication are:

  • Something You Know – Password, PIN, etc
  • Something You Have – Credit Card, Auth token, Continue reading

Research; HTTPS Interceptions

I have written elsewhere about the problems with the “little green lock” shown by browsers to indicate a web page (or site) is secure. In that article, I considered the problem of freely available certificates, and a hole in the way browsers load pages. In March of 2017, another paper was published documenting another problem with the “green lock” paradigm—the impact of HTTPS interception. In theory, a successful HTTPS session means the session between host and the server has been encrypted, which means no third party can read the contents of the packets passing between the two.

This works, modulo the trustworthiness of the certificates involved in encrypting the traffic, so long as there is no-one in the middle of the connection encrypting packets from the receiver, and re-encrypting them towards the transmitter. This “man in the middle,” or MITM, can read the contents of all the packets in the exchange, even though the data is encrypted on transmit. Surely such MITM situations are rare, right?

Right.

The researchers in this paper set out to discover just how often HTTPS (LTS) sessions are terminated and re-encrypted by some device or piece of software in the middle. To discover how often Continue reading

1 … 85 86 87 88 89 … 181