Salesforce erects Shield for better enterprise-app security

Security has been an increasingly dominant theme in the enterprise software chorus in recent months, and on Tuesday Salesforce added a new voice to the mix with Shield, a set of platform services designed to help companies build secure apps.Designed as part of the Salesforce1 platform, Shield offers four security-minded components intended to make it easier for companies with regulatory, compliance or governance requirements to build cloud apps with built-in auditing, encryption, archiving and monitoring functions.A platform encryption feature, for instance, means that companies can easily designate sensitive data to be encrypted while preserving key business capabilities and workflow. A health insurance company, say, could manage personally identifiable information (PII) and protected health information (PHI) without compromising its agents’ ability to perform key functions using that data, such as searching claims, determining coverage eligibility and approving payments.To read this article in full or to leave a comment, please click here

Revisiting Apple and IPv6

A few weeks ago I wrote about Apple's IPv6 announcements at the Apple Developers Conference. While I thought that in IPv6 terms Apple gets it, the story was not complete and there were a number of aspects of Apple's systems that were not quite there with IPv6. So I gave them a 7/10 for their IPv6 efforts. Time to reassess that score in the light of a few recent posts from Apple.

SDN router using merchant silicon top of rack switch

The talk from David Barroso describes how Spotify optimizes hardware routing on a commodity switch by using sFlow analytics to identify the routes carrying the most traffic.  The full Internet routing table contains nearly 600,000 entries, too many for commodity switch hardware to handle. However, not all entries are active all the time. The Spotify solution uses traffic analytics to track the 30,000 most active routes (representing 6% of the full routing table) and push them into hardware. Based on Spotify's experience, offloading the active 30,000 routes to the switch provides hardware routing for 99% of their traffic.

David is interviewed by Ivan Pepelnjak,  SDN ROUTER @ SPOTIFY ON SOFTWARE GONE WILD. The SDN Internet Router (SIR) source code and documentation is available on GitHub.
The diagram from David's talk shows the overall architecture of the solution. Initially the Internet Router (commodity switch hardware) uses a default route to direct outbound traffic to a Transit Provider (capable of handling all the outbound traffic). The BGP Controller learns routes via BGP and observes traffic using the standard sFlow measurement technology embedded with most commodity switch silicon.
After a period (1 hour) the BGP Controller identifies the most active 30,000 prefixes and Continue reading

Mozilla blocks all Flash in Firefox after third zero-day

Mozilla on Monday began blocking all versions of Adobe Flash Player from running automatically in its Firefox browser, reacting to news of even more zero-day vulnerabilities unearthed in a massive document cache pilfered from the Italian Hacking Team surveillance firm.Computerworld confirmed that the current production versions of Firefox -- dubbed v. 39 -- on both Windows and OS X now block Flash.MORE ON NETWORK WORLD: Free security tools you should try Mozilla engineers swung into action over the weekend after reports surfaced late Friday of another Flash zero-day -- the term that describes a flaw for which there is yet no fix, or patch -- discovered in the gigabytes of data and documents stolen from the Hacking Team. At the time, the bug was the second in Flash spotted in just five days.To read this article in full or to leave a comment, please click here

Hacking Team’s malware uses UEFI rootkit to survive OS reinstalls

Surveillance software maker Hacking Team has provided its government customers with the ability to infect the low-level firmware found in laptops and other computers that they wanted to spy on.The company developed a tool that can be used to modify a computer’s UEFI (Unified Extensible Firmware Interface) so that it silently reinstalls its surveillance tool even if the hard drive is wiped clean or replaced.UEFI is a replacement for the traditional BIOS (Basic Input/Output System) and is meant to standardize modern computer firmware through a reference specification. But there are multiple companies that develop UEFI firmware, and there can be significant differences between the implementations used by PC manufactures.To read this article in full or to leave a comment, please click here

Plexxi Announces New Network Switch Series to Power the Next Era of IT

Plexxi_Switch_#2-01

Its not very often that something comes along that has the potential to be transformative through a new and truly differentiated approach. With Plexxi’s announcement this morning of our new Switch 2 Series , coupled with Plexxi Control and Plexxi Connect, we’re making strides to change the way networks function to support the business. Based on the needs of individual data and application workloads, the Switch 2 Series uses the innovation of Plexxi Control to dynamically change fabric topology in real time, intelligently forwarding traffic and delivering needed network capacity.

The next era of IT is being forged by the evolution of virtualization, hyperconvergence, Big Data and scale-out applications. Storage and compute have rapidly evolved over the last decade to keep pace but networking architectures have remained relatively unchanged.

Plexxi_Switch_#2-06

Here is the evolution of networking, as we see it:

Platform One:

The network has, for decades, been built in the same multi-tier (core, leaf/spine) approach making it static and defined by it’s physical cabling.  This architecture was perfectly suited for stationary users and non-mobile applications, which created predictable north/south traffic. The traditional approach for introducing new applications in platform 1 was to “pour” them into the static network, and then Continue reading

‘Morpho’ group goes after corporate IP

Symantec has identified a group of cybercriminals, whom they've named "Morpho," as targeting corporate intellectual property for financial gains, with Twitter, Facebook, Apple and Microsoft among those hit."Attackers going after intellectual property is not that usual," said Vikram Thakur, senior manager at Symantec.However, those attackers tend to be state-sponsored and target information or military or other strategic importance.MORE ON CSO: How to spot a phishing email "That kind of intellectual property is of high value to nations across the board," he said.To read this article in full or to leave a comment, please click here

Workday bets on machine learning with new venture fund

There’s no shortage of software vendors paying lip service to data science in this analytics-infused era, but Workday is putting its money where its mouth is.On Tuesday, the company is announcing the launch of Workday Ventures, a new fund it will use to identify, invest in and partner with young startups that apply data-science and machine-learning in the areas of analytics, applications, security and platform technologies.“We believe the last 10 years of enterprise software have been about migration to the cloud,” said Dan Beck, senior vice president of technology products at Workday. “We think the next 10 years is going to be about machine learning and companies making sense of data.”To read this article in full or to leave a comment, please click here

Can You Avoid Networking Software Bugs?

One of my readers sent me an interesting reliability design question. It all started with a catastrophic WAN failure:

Once a particular volume of encrypted traffic was reached the data center WAN edge router crashed, and then the backup router took over, which also crashed. The traffic then failed over to the second DC, and you can guess what happened then...

Obviously they’re now trying to redesign the network to avoid such failures.

Read more ...

Checking Faulty Cables

I recently had to work with a 3rd part to diagnose a link between our devices and came across this handy command. The link in question was a pretty hefty (75m-ish) UTP cable run between a Cisco and HP switch. I have visibility of the Cisco switch, into the structured cabling into the patch panel, and the 3rd parties cable. Unfortunately I didn’t have a DC Operations tech with access to a Fluke, or the ability to interpret the output of a Fluke, but they did have a laptop with a 100Mbps NIC (this becomes important later on).

So I started by running the diagnostic on the production connection. It’s not working, so I don’t have to worry about taking stuff down. This gives me the following:

test cable-diagnostics tdr interface gi7/21
TDR test started on interface Gi7/21
A TDR test can take a few seconds to run on an interface
Use 'show cable-diagnostics tdr' to read the TDR results.

switchA#show cable-diagnostics tdr interface gi7/21

TDR test last run on: July 09 10:30:20
Interface Speed Pair Cable length Distance to fault Channel Pair status
——— —– —- ——————- ——————- ——- ————
Gi7/21 auto 1-2 77 +/- 6 m N/A Invalid Continue reading

The Upload: Your tech news briefing for Tuesday, July 14

As partner conference kicks off, Microsoft details Win10 launch plans and moreWith Windows 10 set to roll out in just two weeks, Microsoft on Monday shed some light on the marketing support it will put behind the launch: a worldwide, year-long “upgrade your world” ad campaign. And at its annual Worldwide Partner Conference that started in Orlando, Microsoft rolled out a new analytics tool that aims to democratize access to big data using the Cortana voice interface, as well as Project Gigjam, which can pull data from multiple applications into a shared workspace.To read this article in full or to leave a comment, please click here

The Upload: Your tech news briefing for Tuesday, July 14

As partner conference kicks off, Microsoft details Win10 launch plans and moreWith Windows 10 set to roll out in just two weeks, Microsoft on Monday shed some light on the marketing support it will put behind the launch: a worldwide, year-long “upgrade your world” ad campaign. And at its annual Worldwide Partner Conference that started in Orlando, Microsoft rolled out a new analytics tool that aims to democratize access to big data using the Cortana voice interface, as well as Project Gigjam, which can pull data from multiple applications into a shared workspace.To read this article in full or to leave a comment, please click here

IPv6 Multicast

These are my notes for IPv6 multicast for the CCDE exam. Overview

  • Prefix FF::/8 reserved for multicast
  • Multicast Listener Discovery (MLD) replaces IGMP
    • MLD is part of ICMPv6
    • MLDv1 equivalent to IGMPv2
    • MLDv2 equivalent to IGMPv3
  • ASM, SSM and Bidir supported
  • PIM identified by IPv6 next header 103
  • BSR and static RP supported
  • No support for MSDP
    • Anycast supported through PIM, defined in RFC4610
  • Any Source Multicast (ASM)
    • PIM-SM, PIM-BiDir
    • Default for generic multicast and unicast prefix-based multicast
    • Starts with FF3x::/12
  • Source Specific Multicast (SSM)
    • PIM-SSM
    • FF3X::/32 is allocated for SSM by IANA
    • Currently prefix and plen is zero so FF3X::/96 is useable for SSM
  • Embedded RP groups
    • PIM-SM, PIM-BIDir
    • Starts with FF70::/12

IPv6 Multicast Addressing

IPv6 multicast address format includes variable bits to define what type of address it is and what the scope is of the multicast group. The scope can be:

1 – Node

2 – Link

3 – Subnet

4 – Admin

5 – Site

8 – Organization

E – Global

The flags define if embedded RP is used, if the address is based on unicast and if the address is IANA assigned or not (temporary). The unicast based IPv6 multicast address allows an organization to Continue reading

1 … 3,325 3,326 3,327 3,328 3,329 … 3,767