The Week in Internet News: Huge Data Breach at Hotel Chain

Millions of records stolen: Marriott International, one of the world’s largest hotel chains, has reported a data breach affecting up to 500 million customers, the Washington Post reports. The breached database includes information on guests staying at Sheraton, Westin and St. Regis hotels. The 500 million records lost makes it the second largest data breach reported.

Encryption debate back yet again: U.S. deputy attorney general Rod Rosenstein, best known for overseeing the investigation into President Donald Trump’s ties to Russia, has renewed the Department of Justice’s long-term call for encryption workarounds in tech products, Wired.com reports. Addressing critics of encryption backdoors, Rosenstein said: “Just because people are quick to criticize you does not mean that you are doing the wrong thing. Take it from me.”

Countering view: Meanwhile, Robert Anderson, a former top cyber official at the FBI, said that since leaving the agency and working on cybersecurity issues, he now understands why tech companies would oppose government efforts to break encryption. Companies “entrusted by the clients who have given them information” have a responsibility to protect it, he said in an FCW.com story.

Someone’s watching you: Chinese Internet companies have begun to keep detailed records Continue reading

How to buy SD-WAN technology: Key questions to consider when selecting a supplier

Software-defined WAN traffic is exploding, and so is the number of technology providers competing for enterprise SD-WAN customers. Here are some key issues to consider as IT pros investigate SD-WAN deployment options and weigh the importance of features such as application prioritization, multicloud support and integrated network security.SD-WAN technologies and services are designed to combine multiple physical WAN links into one logical network and provide traffic prioritization to accelerate application performance. Using network abstraction, SD-WAN improves the economics of branch connectivity by enabling organizations to leverage inexpensive circuits, such as the Internet, to address growing bandwidth requirements. SD-WAN is relatively easy to deploy and manage as it maps new services – application prioritization, security, management – on top of existing physical networks.To read this article in full, please click here

How to buy SD-WAN technology: Key questions to consider when selecting a supplier

Software-defined WAN traffic is exploding, and so is the number of technology providers competing for enterprise SD-WAN customers. Here are some key issues to consider as IT pros investigate SD-WAN deployment options and weigh the importance of features such as application prioritization, multicloud support and integrated network security.SD-WAN technologies and services are designed to combine multiple physical WAN links into one logical network and provide traffic prioritization to accelerate application performance. Using network abstraction, SD-WAN improves the economics of branch connectivity by enabling organizations to leverage inexpensive circuits, such as the Internet, to address growing bandwidth requirements. SD-WAN is relatively easy to deploy and manage as it maps new services – application prioritization, security, management – on top of existing physical networks.To read this article in full, please click here

IDC: Expect 175 zettabytes of data worldwide by 2025

IDC has released a report on the ever-growing datasphere, what it calls the collective world’s data, and just like the recent Cisco study, the numbers are staggering. IDC predicts that the collective sum of the world’s data will grow from 33 zettabytes this year to a 175ZB by 2025, for a compounded annual growth rate of 61 percent.The 175ZB figure represents a 9 percent increase over last year’s prediction of data growth by 2025. IDC's “Data Age 2025” whitepaper, sponsored by Seagate, says the datasphere has three locations. First is the core, which includes traditional and cloud data centers, second is the edge, which includes things like cell towers and branch offices, and third is endpoints, which include PCs, smartphones, and Internet of Things (IoT) devices.To read this article in full, please click here

IDC: Expect 175 zettabytes of data worldwide by 2025

IDC has released a report on the ever-growing datasphere, what it calls the collective world’s data, and just like the recent Cisco study, the numbers are staggering. IDC predicts that the collective sum of the world’s data will grow from 33 zettabytes this year to a 175ZB by 2025, for a compounded annual growth rate of 61 percent.The 175ZB figure represents a 9 percent increase over last year’s prediction of data growth by 2025. IDC's “Data Age 2025” whitepaper, sponsored by Seagate, says the datasphere has three locations. First is the core, which includes traditional and cloud data centers, second is the edge, which includes things like cell towers and branch offices, and third is endpoints, which include PCs, smartphones, and Internet of Things (IoT) devices.To read this article in full, please click here

Why I’m telling network engineers to learn Python

Why I'm telling network engineers to learn Python

During a wet autumnal walk, I was explaining to my girlfriend about my recent presentations. I've been doing my 'Getting Started with Python' talk at Aruba Airheads meet-ups. I recorded an early version of it, see below. One point I mentioned is that the reaction is always mixed. When I ask who is learning Python, about 5% of each audience put their hands up. Regularly people object to the idea of network engineers learning Python. The arguments are usually along the lines of 'network engineers already have enough to learn'.
The conversation continued as we walked through sodden leaves and we discussed why, if the other speakers were doing talks that the crowds want to hear, like product updates, I'm burdened with a subject the audience are less enthusiastic about. The assumption being that I was assigned this topic. My response: "Oh no, I choose to do this." The next question was, of course, "Why?"

My Why

There's something of the two-edged sword in the word 'why'. It can be used to undermine, casting doubt about the veracity of an argument, cutting through the rhetoric and leaving those with ill-reasoned ideas to flounder and stutter a response. But Continue reading

Securify: practical security analysis of smart contracts

Securify: practical security analysis of smart contracts Tsankov et al., CCS’18

Sometimes the perfect is the enemy of the good. When we’re talking about securing smart contracts, we need all the help we can get! Bugs can cost millions of dollars. Securify uses a set of expert heuristics (patterns) to help identify issues in smart contracts. It’s available at https://securify.ch, has analysed over 18K uploaded contracts, and is used by security auditors as part of their arsenal.

The increased adoption of smart contracts demands strong security guarantees. Unfortunately, it is challenging to create smart contracts that are free of security bugs. As a consequence, critical vulnerabilities in smart contracts are discovered and exploited every few months. In turn, these exploits have led to losses reaching millions worth of USD in the past few years…. Despite their potential, repeated security concerns have shaken the trust in handling billions of USD by smart contracts.

Too right! We’ve examined some of the challenges involved in creating correct smart contracts in previous editions of The Morning Paper, as well as tools such as Zeus that help with verification.

It’s not a solvable problem in the general case (i.e., ‘perfect’ Continue reading

Large-scale network simulations in Kubernetes, Part 2 – Network topology orchestration

In the previous post I’ve demonstrated a special-purpose CNI plugin for network simulations inside kubernetes called meshnet. I’ve shown how relatively easy it is to build a simple 3-node topology spread across multiple kubernetes nodes. However, when it comes to real-life large-scale topology simulations, using meshnet “as is” becomes problematic due to the following reasons:

  1. Uploading topology information into etcd requires a lot of manual effort.
  2. Any customisation like startup configuration injection or exposure of internal ports is still a manual process.

That is why I built k8s-topo - an orchestrator for network simulations inside kubernetes. It automates a lot of these manual steps and provides a simple and user-friendly interface to create networks of any size and configuration.

k8s-topo overview

k8s-topo is a Python script that creates network topologies inside k8s based on a simple YAML file. It uses syntax similar to docker-topo with a few modifications to account for the specifics of kubernetes environment. For instance, the following file is all what’s required to create and configure a simple 3-node topology:

etcd_port: 32379
links:
  - endpoints: ["host-1:eth1:12.12.12.1/24", "host-2:eth1:12.12.12.2/24"]
  - endpoints: ["host-1:eth2:13.13.13.1/24", "host-3:eth1:13.13.13.3/24"]
  - endpoints: ["host-2:eth2:23.23. Continue reading

Customer Data Isn’t Always an Asset: Lessons from the Marriott Data Breach

As data analytics have improved, the massive amounts of data that companies acquire from their customers has only gained in economic value. In the corporate world of today, this data can be a real asset for companies. However, as today’s news, that the records of over 500 million guests of Marriott International’s Starwood division hotels were involved in a data breach, makes clear, corporate thinking about the value of customer data needs to be reevaluated.

Especially when it comes to corporate acquisitions, companies need to start treating customer data as a potential liability, as well as an asset.

In September 2016, Marriott International acquired Starwood for $13.6 billion. When Marriott International sought to buy the Starwood hotel chain, Starwood’s customer data, played a central role in their reasoning for the acquisition. Citing higher income and better brand loyalty among program members,  Arne Sorenson, the Marriott CEO, specifically referred to Starwood’s loyalty program as a “central, strategic rationale for the transaction.” Loyalty programs, in addition to attracting repeat customers, also “provide hotels with a wealth of information on their guests” which hotels can use to “create laser focused marketing campaigns for various different kinds of guests.”

While Continue reading

Weekend Reads 113018

You might not know the name, but you probably haven’t missed their work — highly targeted credit card skimming attacks, hitting Ticketmaster and British Airways, as well as consumer electronics giant Newegg and likely many more sites that have been silently hacked to scrape consumer credit card data at the checkout. —Zack Whittaker @Tech Crunch

Given this level of concentration, the notion of a “free and open” internet now seems almost quaint. Most information transmitted online today is sieved through a few large search engines, social media networks, and streaming video services. These firms may collectively be referred to as “edge companies”: they provide online content or services over a network, but they do not own the network themselves. —Travis Kavulla @American Affairs

Google is increasingly divided over supporting the news industry, either through direct funding, or with a set of initiatives directly aimed at improving publishers’ bottom line. —Frederic Filloux @Monday Note

To hear the moans on Wall Street, you’d think the end of the world is no longer coming—it has arrived. Successive waves of selling have pushed share prices down this year. To about where they were at the beginning of the year. Hardly a catastrophe for investors. Continue reading

1 … 1,431 1,432 1,433 1,434 1,435 … 3,889