The devil wears Pravda
Classic Bond villain, Elon Musk, has a new plan to create a website dedicated to measuring the credibility and adherence to "core truth" of journalists. He is, without any sense of irony, going to call this "Pravda". This is not simply wrong but evil.
Musk has a point. Journalists do suck, and many suck consistently. I see this in my own industry, cybersecurity, and I frequently criticize them for their suckage.
But what he's doing here is not correcting them when they make mistakes (or what Musk sees as mistakes), but questioning their legitimacy. This legitimacy isn't measured by whether they follow established journalism ethics, but whether their "core truths" agree with Musk's "core truths".
An example of the problem is how the press fixates on Tesla car crashes due to its "autopilot" feature. Pretty much every autopilot crash makes national headlines, while the press ignores the other 40,000 car crashes that happen in the United States each year. Musk spies on Tesla drivers (hello, classic Bond villain everyone) so he can see the dip in autopilot usage every time such a news story breaks. He's got good reason to be concerned about this.
He argues that autopilot is safer Continue reading
Cato Networks Adds Threat Hunting Capability To Its SD-WAN Service
Cato Networks adds a threat-hunting capability to its SD-WAN service to detect compromised devices on customer networks.EMA Report: Network Management Teams Shift Focus to SD-WAN, SDN, and SDDC
SD-WAN is priority for enterprises that want to make their networks more automated.
Kata Containers 1.0 Launch Hones In On Security, Interoperability Fears
The project claims greater security than traditional containers by tapping into virtual machine schema but remains compatible with Docker and Kubernetes in the container ecosystem.
C is to low level
I'm in danger of contradicting myself, after previously pointing out that x86 machine code is a high-level language, but this article claiming C is a not a low level language is bunk. C certainly has some problems, but it's still the closest language to assembly. This is obvious by the fact it's still the fastest compiled language. What we see is a typical academic out of touch with the real world.The author makes the (wrong) observation that we've been stuck emulating the PDP-11 for the past 40 years. C was written for the PDP-11, and since then CPUs have been designed to make C run faster. The author imagines a different world, such as where CPU designers instead target something like LISP as their preferred language, or Erlang. This misunderstands the state of the market. CPUs do indeed supports lots of different abstractions, and C has evolved to accommodate this.
The author criticizes things like "out-of-order" execution which has lead to the Spectre sidechannel vulnerabilities. Out-of-order execution is necessary to make C run faster. The author claims instead that those resources should be spent on having more slower CPUs, with more threads. This sacrifices single-threaded performance in exchange Continue reading
Cisco Warns Massive Russian Malware Attack Hit 500k Routers Globally
Security researchers tied the malware to a Russian group responsible for hacking incidents during the 2016 U.S. presidential campaign.
Verizon Study: 15% of Enterprises Surveyed Are Deploying SDN
Many companies are looking at ways to accelerate their SDN adoption so they don’t risk falling behind.
Short Take: Security as a Tradeoff
We often treat security as an absolute, “that which must be done, and done perfectly, or is of no value at all.” It’s time to take this myth head on, and think about how we should really think about security.
Cato SD-WAN Hunts Down Threats With Zero-Footprint Data Aggregation
The company’s cloud-based SD-WAN platform upgraded its security offering by adding a threat hunting system that eliminates enterprises’ need to deploy data collection infrastructure and analyze raw data.
Securing the Multi-Cloud: It Takes a Village
Even enterprises not in a multi-cloud environment must begin making their security decisions with it in mind. If they don’t, they risk some of their decisions quickly becoming obsolete.
Spectre and Meltdown Chip Flaws Back From the Dead as ‘Variant 4’
Microsoft and Google security researchers disclosed the new bugs, which affect Intel, AMD, and ARM processors.
Lavelle Networks’ Shyamal Kumar Discusses SD-WAN and the Principles of B4
In this interview with Lavelle Networks CEO Shyamal Kumar he shares his views on SD-WAN and how Lavelle has incorporated some of the principles of B4 to create a pure networking software solution.
SafeKeeper: protecting web passwords using trusted execution environments
SafeKeeper: protecting web passwords using trusted execution environments Krawiecka et al., WWW’18
(If you don’t have ACM Digital Library access, the paper can be accessed either by following the link above directly from The Morning Paper blog site, or from the WWW 2018 proceedings page).
Today’s paper is all about password management for password protected web sites / applications. Even if we assume that passwords are salted and hashed in accordance with best practice (NIST’s June 2017 digital identity guidelines now mandate the use of keyed one-way functions such as CMAC), an adversary that can obtain a copy of the back-end database containing the per-user salts and the hash values can still mount brute force guessing attacks against individual passwords.
SafeKeeper goes a lot further in its protection of passwords. What really stands out is the threat model. SafeKeeper keeps end user passwords safe even when we assume that an adversary has unrestricted access to the password database. Not only that, the adversary is able to modify the content sent to the user from the web site (including active content such as client-side scripts). And not only that! The adversary is also able to read all Continue reading
SD-WAN: Managed or DIY?
In this eBrief from SDxCentral, we compare the pros and cons of using a managed SD-WAN service vs. the DIY model. In addition, we talk to one enterprise about its SD-WAN experience.
masscan, macOS, and firewall
One of the more useful features of masscan is the "--banners" check, which connects to the TCP port, sends some request, and gets a basic response back. However, since masscan has it's own TCP stack, it'll interfere with the operating system's TCP stack if they are sharing the same IPv4 address. The operating system will reply with a RST packet before the TCP connection can be established.The way to fix this is to use the built-in packet-filtering firewall to block those packets in the operating-system TCP/IP stack. The masscan program still sees everything before the packet-filter, but the operating system can't see anything after the packet-filter.
Note that we are talking about the "packet-filter" firewall feature here. Remember that macOS, like most operating systems these days, has two separate firewalls: an application firewall and a packet-filter firewall. The application firewall is the one you see in System Settings labeled "Firewall", and it controls things based upon the application's identity rather than by which ports it uses. This is normally "on" by default. The packet-filter is normally "off" by default and is of little use to normal users.
Also note that macOS changed packet-filters around version 10.10. Continue reading
NSX Workshop: Secure App Infrastructure and Multi-Site Cloud Networking
[Summer 2018] Free NSX Training Workshop near you!
Secure Application Infrastructure and Multi-Site Cloud Networking
What: Attend a half-day lecture and lab designed to get you started with Micro-segmentation and Multi-Site Cloud Networking (Disaster Recovery).
Why: Not only will you get a business and technical overview of NSX Data Center, you’ll also receive hands-on experience with the products. We’ll make sure you leave knowing how NSX can help secure and extend your network across multiple sites, and into the cloud.
Sneak peek (full agenda in registration links):
- Security: Understand your network traffic flows and intelligently create security groups and policies, leveraging vRNI, Service Composer, and Application Rule Manager to secure your network.
- Disaster Recovery: Deep dive into multi-site NSX Data Center topologies, learn how to architect your network overlays, and gain visibility across your virtual and physical networks – all so you can build a resilient and flexible network.
RSVP your spot today (click below):
Rigado Packages IoT-Focused Edge-as-a-Service Platform
The platform relies on Canonical's Ubuntu Core OS and Snaps application packaging system.
Short Take – Security As A Tradeoff
In this episode Russ White talks about how security absolutism is actually detrimental to securing important data and systems, and how shifting our view of security to a balance of tradeoffs would be a much better approach.
Russ White
The post Short Take – Security As A Tradeoff appeared first on Network Collective.
Cisco’s New Security Guru Talks About How to Kill Complexity in 3 Steps
Gee Rittenhouse says security needs to be simpler. The complexity that today's security professionals deal with is overwhelming.
RIPE 76 Sees Strong Focus on Routing Security
The RIPE 76 meeting is happening this week in Marseille, France, held at the fantastic location of the Palais du Pharo overlooking Marseille’s Old Port. And it’s also another record attendance with over 850 people registered.
The first couple of days have primarily been devoted to plenary sessions, and there’s been a big focus on routing security. Erik Bais (A2B Internet) kicked off the discussion with a presentation on ‘Why are we still seeing DDoS traffic?‘, which highlighted that DDoS attacks are still originating from the same networks. Looking at the list of the worst offenders, there’s even one amongst the regular RIPE attendees, and he called for networks to clean up their acts. This was also a good opportunity to highlight the MANRS initiative, which of course includes measures to mitigate amplification attacks, and encourages networks to make good routing practices the norm.
Alexander Azimov (Qrator Labs) reinforced this message by outlining the current problems with BGP, including the ongoing route leaks and hijacks affecting the Internet. There are currently only moral obligations to not use other providers’ address space or to support anti-spoofing policies, yet major providers (including Tier 1 providers) continue to both originate Continue reading