Published: Designing Scalable Web Applications
The first batch of the latest materials for my Designing Scalable Web Applications course have been published on my free content web site.
The basics – MTU, MSS, GRE, and PMTU
One of the truly fascinating things about networking is how much of it ‘just works’. There are so many low level pieces of a network stack that you don’t really have to know (although you should) to be an expert at something like OSPF, BGP, or any other higher level networking protocol. One of the ones that often gets overlooked is MTU (Maximum Transmission Unit), MSS (Maximum Segment Size) and all of the funs tuff that comes along with it. So let’s start with the basics…
Here’s your average looking IP packet encapsulated in an Ethernet Header. For the sake of conversation, I’ll assume going forward that we are referring to TCP only but I did put the UDP header length in there just for reference. So a standard IP packet is 1500 bytes long. There’s 20 bytes for the IP header, 20 bytes for the TCP header, leaving 1460 bytes for the data payload. This does not include the 18 bytes of Ethernet headersFCS that surround the IP packet.
When we look at this frame layout, we can further categorize components of the frame by MTU and MSS…
The MTU is defined Continue reading
BRKSEC-2010: Emerging Threats — The State of Cyber Security
Presenter: Craig Williams (@security_craig) - Sr Technical Leader / Security Outreach Manager, Cisco TALOS
“I'm from Talos. We love to stop bad guys.”
Talos by the numbers:
- 1.1 million incoming malware samples per day
- 1.5 billion Sender Base reputation queries per day
Talos has a serious amount of data. For serious.
BRKARC-3004 APIC-EM Controller Workflow and Use Cases
Presenter: Markus Harbek, CCIE, CCDE
Who knows what SDN stands for?
- Still Don't kNow
- Still Does Nothing
- Schnitzel Dinner Night
BRKARC-2032 — Designing for Secure Convergence of Enterprise and PCNs
Presenter: Chuck Stickney, Cisco SE
Handful of OT folks in the room; majority IT.
Convergence Benefits
- Simplification (common protocols)
- Reduced Cost
- Pervasive enablement of features and services
Using Vagrant to Help Learn Ansible
I’ve been spending some time with Ansible recently, and I have to say that it’s really growing on me. While Ansible doesn’t have a steep learning curve, there is still a learning curve—albeit a smaller/less steep curve—so I wanted to share here a “trick” that I found for using Vagrant to help with learning Ansible. (I say “trick” here because it isn’t that this is complicated or undocumented, but rather that it may not be immediately obvious how to combine these two.)
Note that this is not to be confused with using Ansible from within Vagrant as a provisioner; that’s something different (see the Vagrant docs for more information on that use case). What I’m talking about is having a setup where you can easily explore how Ansible works and iterate through your playbooks using a Vagrant-managed VM.
Here are the key components:
- You’ll need a Vagrant environment (you know, a working
Vagrantfileand any associated support files). - You’ll need Ansible installed on the system where you’ll be running Vagrant and the appropriate back-end virtualization platform (I tested this with VMware Fusion, but there’s nothing VMware-specific here).
- In the same directory as the
Vagrantfile, you’ll need an Continue reading
What’s the state of iPhone PIN guessing
I think even some experts have gotten this wrong, so I want to ask everyone: what's the current state-of-the-art for trying to crack Apple PIN codes?This is how I think it works currently (in iOS 8).
To start with, there is a special "crypto-chip" inside the iPhone that holds your secrets (like a TPM or ARM TrustZone). I think originally it was ARM's TrustZone, but now that Apple designs its own chips, that they've customized it. I think they needed to add stuff to make Touch ID work.
All the data (on the internal flash drive) is encrypted with a random AES key that nobody, not even the NSA, can crack. This random AES key is stored on the crypto-chip. Thus, if your phone is stolen, the robbers cannot steal the data from it -- as long as your phone is locked properly.
To unlock your phone, you type in a 4 digit passcode. This passcode gets sent to the crypto-chip, which verifies the code, then gives you the AES key needed to decrypt the flash drive. This is all invisible, of course, but that's what's going on underneath the scenes. Since the NSA can't crack the AES key Continue reading
BRKSEC-3005 – An IoT Security Model for Securing IT-OT Assets
Presenter: Jeff Schutt – Cybersecurity Solutions Architect (Jeff works in Adv Services in the IoT team)
Full Title: An IoT Security Model & Architecture for Securing Cyber-Physical and IT-OT Converged Assets
Mix of IT/OT folks in the room.
How do we do physical security?
- Protect the perimeter
- Detect breaches
- Situational awareness (<< THIS!)
- Forensics
How do we do cybersecurity?
- Same principles!
- Just different tools
IT landscape
- Systems approach
- Requirements dominated by business data focus
- Time horizon: driven by Moore’s law and high tech product cycles
- Scale: 1000s
- Security: built into protocols (IPsec, TLS)
OT landscape
- Requirements dominated by needs of physical systems
- Time horizon driven by capital equipment life; complete lifecycle determined and managed by engineers
- Scale: few; 10s – 100s
- Security: No access to outside systems; insecure protocols
With IT and OT convergence, ther’s no way people are going to lose their jobs. We all have too much to do for anyone to be redundant. Additionally, there is a well-known shortage of skilled workers in this area.
Security awareness and training: a combination of people, process, and technology.
“Airgap security” does not address “people, process and technology”. Airgap is NOT security (on its own). Airgap is not Continue reading