Technology Short Take 145

Welcome to Technology Short Take #145! What will you find in this Tech Short Take? Well, let’s see…stuff on Envoy, network automation, network designs, M1 chips (and potential open source variants!), a bevy of security articles (including a couple on very severe vulnerabilities), Kubernetes, AWS IAM, and so much more! I hope that you find something useful here. Enjoy!

Networking

Servers/Hardware

  • Howard Oakley of The Eclectic Light Company discusses some details on Apple’s M1 chip and what it does differently than other chips. Also included in this post are links to other articles with even more details—very helpful.
  • Are open source M1-style chips a possibility? This article Continue reading

Cisco patches three critical holes in IOS XE software

Cisco has patched three critical security holes in its IOS XE software that's used across a variety of its core routers and switches.The three critical warnings are part of a big release of 32 security alerts, many of which are IOS XE-related, including firewall, SD-WAN and wireless access vulnerabilities.Linux security: Cmd provides visibility, control over user activity Of the critical patches, the worst is a weakness in the Cisco IOS XE Software for Cisco Catalyst 9000 Family Wireless Controllers; it's rated as a 10 out of 10 on the Common Vulnerability Scoring System (CVSS).To read this article in full, please click here

Cisco patches three critical holes in IOS XE software

Cisco has patched three critical security holes in its IOS XE software that's used across a variety of its core routers and switches.The three critical warnings are part of a big release of 32 security alerts, many of which are IOS XE-related, including firewall, SD-WAN and wireless access vulnerabilities.Linux security: Cmd provides visibility, control over user activity Of the critical patches, the worst is a weakness in the Cisco IOS XE Software for Cisco Catalyst 9000 Family Wireless Controllers; it's rated as a 10 out of 10 on the Common Vulnerability Scoring System (CVSS).To read this article in full, please click here

Weekend Reads 092421


Microsoft on Tuesday addressed a quartet of security flaws as part of its Patch Tuesday updates that could be abused by adversaries to target Azure cloud customers and elevate privileges as well as allow for remote takeover of vulnerable systems.


To meet current demands, as well as those of the next normal and an unpredictable future, retailers are now adopting software-driven strategies to deliver connected retail experiences and operations, ultimately resulting in the software-defined store.


Network measurement techniques have been mostly developed independently from protocols and, therefore, typically build upon externally visible semantics. One example of this is TCP sequence numbers and acknowledgements, which can be used to derive a flow’s round-trip time (RTT).


Ordinarily, when developing something, you start with a set of requirements or goals. But DNSSEC was a research project, so in place of requirements, developers set expectations of what needed to be done and what could be done to solve the DNS security problem.


Open-source M1-style chips may be in our future, according to a reverse-engineering document released online, Tom’s Hardware reports.


But how can they know that the plan they have is efficient enough to alleviate future cyber incidents? By using a cyber crisis tabletop Continue reading

Heavy Networking 599: DriveNets Taps Disaggregation To Build Networks Like Cloud (Sponsored)

On today's sponsored Heavy Networking we talk with DriveNets about why it’s time to take the disaggregated model--where you buy whitebox hardware and put a network operating system of your choice on it--seriously. Along the way, we’re going to hit DriveNets network architectures and operating models, and get you thinking about why disaggregated networking might make sense for you.

Heavy Networking 599: DriveNets Taps Disaggregation To Build Networks Like Cloud (Sponsored)

On today's sponsored Heavy Networking we talk with DriveNets about why it’s time to take the disaggregated model--where you buy whitebox hardware and put a network operating system of your choice on it--seriously. Along the way, we’re going to hit DriveNets network architectures and operating models, and get you thinking about why disaggregated networking might make sense for you.

The post Heavy Networking 599: DriveNets Taps Disaggregation To Build Networks Like Cloud (Sponsored) appeared first on Packet Pushers.

AWS Networking – Part VIII: AWS Network ACL (NACL)

In this section, I am going to introduce the default Network ACL for subnets in VPC NVKT-VPC-01.

Figure 1-28 shows the complete structure of our VPC NVKT-VPC-01. We have a Public subnet 10.10.0.0/24 in AZ eu-west-2c a Private subnet 10.10.1.0/24 in AZ eu-west-2a. Both subnets are protected by the default VPC’s NACL named NWKT-NACL. NACL allows all traffic to and from the subnet by default.


Figure 1-37: Complete VPC Stack.

Continue reading

AWS Networking – Part VII: Create Subnet and RT Using AWS CloudFormation

In this post, we create a Subnet with the set of properties and attach it to VPC. We also specify a Route Table, which we associate with the Subnet using association.

 In our YAML template (figure 1-34), we have four AWS resources (logical name within parenthesis):

    1) AWS::EC2::VPC (NwktVPC)

    2) AWS::EC2::Subnet (NwktSubnet)

    3) AWS::EC2::RouteTable (NwktPUB2RouteTable)

    4) AWS::EC2::SubnetRouteTableAssociation(NwktRouteTableAssociation)

We are using a Ref function for defining the dependencies between AWS resources when the actual AWS resource Identifier is unknown. For example, the Ref function in AWS::EC2::Subnet resource [2] refers to the resource AWS::EC2::VPC’s logical name NwktVPC (A). We have to use an intrinsic function because we don’t know which  VPC Identifier AWS generates to VPC. After creating the subnet, we specify the subnet-specific Route Table [3]. First, we need to bind it to VPC using the Ref function value NwktVPC (B). Next, we “glue” the Route Table to Subnet using RouteTableAssociation, where we use two Ref functions. The first one refers to Route Table (C), and the second to Subnet (D).


Figure 1-34: Subnet Route Table.

Continue reading

Intel: Under attack, fighting back on many fronts

At first glance, Intel doesn’t look like a company under siege. In its last fiscal year, it recorded $77.8 billion in sales and $20 billion in profit. Its market capitalization is $220 billion as of mid-September 2021.And yet it is. When you’re the leader, all your competition is gunning for you. Intel is wrestling with a loss of leadership in manufacturing and process nodes, it’s losing share to a very resurgent AMD, an unrelenting Nvidia is challenging Intel for AI dominance, the Atom processor failed spectacularly against Arm in the mobile market, and it’s on its third CEO in three years. More about Intel: A closer look at two newly announced Intel chips Intel shifts to a multiarchitecture model Intel revises its chip terminology and branding CEO Gelsinger shakes up Intel But Intel revels in the competition. “Our success in so many markets makes us targets for lots of companies,” said Lisa Spelman, corporate vice president and general manager of the Xeon and memory group. “So it’s not a surprise that we have competitors that want a piece of that.” To read this article in full, please click here

Intel: Under attack, fighting back on many fronts

At first glance, Intel doesn’t look like a company under siege. In its last fiscal year, it recorded $77.8 billion in sales and $20 billion in profit. Its market capitalization is $220 billion as of mid-September 2021.And yet it is. When you’re the leader, all your competition is gunning for you. Intel is wrestling with a loss of leadership in manufacturing and process nodes, it’s losing share to a very resurgent AMD, an unrelenting Nvidia is challenging Intel for AI dominance, the Atom processor failed spectacularly against Arm in the mobile market, and it’s on its third CEO in three years. More about Intel: A closer look at two newly announced Intel chips Intel shifts to a multiarchitecture model Intel revises its chip terminology and branding CEO Gelsinger shakes up Intel But Intel revels in the competition. “Our success in so many markets makes us targets for lots of companies,” said Lisa Spelman, corporate vice president and general manager of the Xeon and memory group. “So it’s not a surprise that we have competitors that want a piece of that.” To read this article in full, please click here

Check: that Republican audit of Maricopa

Author: Robert Graham (@erratarob)

Later today (Friday, September 24, 2021), Republican auditors release their final report on the found with elections in Maricopa county. Draft copies have circulated online. In this blogpost, I write up my comments on the cybersecurity portions of their draft.

https://arizonaagenda.substack.com/p/we-got-the-senate-audit-report

The three main problems are:

  • They misapply cybersecurity principles that are meaningful for normal networks, but which don’t really apply to the air gapped networks we see here.
  • They make some errors about technology, especially networking.
  • They are overstretching themselves to find dirt, claiming the things they don't understand are evidence of something bad.

In the parts below, I pick apart individual pieces from that document to demonstrate these criticisms. I focus on section 7, the cybersecurity section, and ignore the other parts of the document, where others are more qualified than I to opine.

In short, when corrected, section 7 is nearly empty of any content.

7.5.2.1.1 Software and Patch Management, part 1

They claim Dominion is defective at one of the best-known cyber-security issues: applying patches.

It’s not true. The systems are “air gapped”, disconnected from the typical sort of threat that exploits unpatched systems. The primary Continue reading

Augmented MISP Integration with NSX Advanced Threat Analyzer

Contributors: Jason Zhang (NSBU TAU), Stefano Ortolani (NSBU TAU)

Introduction

Formerly known as the Malware Information Sharing Platform, MISP is a leading open-source threat intelligence platform (TIP) that organizations of all sizes can leverage to store, share, and enrich threat indicators of compromise (IoCs).

The MISP ecosystem primarily comprises two parts: MISP core (or engine) and MISP modules. MISP core is responsible for the main functionality of the platform, while MISP modules were introduced to extend the capability of MISP without changing MISP core components.

Thanks to the simple API interface provided by MISP, many third-party MISP modules have been developed to greatly extend MISP’s capabilities. There are mainly three types of MISP modules: expansion modules, import modules, and export modules. More details on MISP modules can be found on MISP’s GitHub MISP module repository, which includes three modules developed by Lastline (now part of VMware) that integrate MISP with VMware NSX Advanced Threat Analyzer (ATA), as we reported earlier.

Recently VMware’s Threat Analysis Unit (TAU) developed a new expansion module, which replaces the three Lastline modules. The improvements from the new module are twofold: a simplified enrichment process and an augmented enrichment capability.

In this blog post, Continue reading

1 … 658 659 660 661 662 … 3,841