Ethics: University of Minnesota’s hostile patches

The University of Minnesota (UMN) got into trouble this week for doing a study where they have submitted deliberately vulnerable patches into open-source projects, in order to test whether hostile actors can do this to hack things. After a UMN researcher submitted a crappy patch to the Linux Kernel, kernel maintainers decided to rip out all recent UMN patches.

Both things can be true:

• Their study was an important contribution to the field of cybersecurity.
• Their study was unethical.

Dell reportedly looking to unload its cloud unit

Hot on the heels of its pending spin-off of VMware, Dell is now reportedly looking to sell off its Boomi cloud business for $3 billion. Bloomberg first broke the news, citing people familiar with the matter.Dell is working with a financial adviser on the sale, sources told Bloomberg, and the idea is said to be in the early stages. One thing about Dell, it does not rush these decisions. The VMware spin-off, which has been discussed for years, started last summer and only now is coming to fruition.Boomi provides an integration platform as a service (iPaaS), which enables the connection of applications and data sources. The platform provides API, lifecycle management, and event-driven architecture features for cloud integration. Dell acquired Boomi in 2010.To read this article in full, please click here

The Hedge 80: Ian Goetz and 5G

Although there are varying opinions 5G—is it real? Is it really going to have extremely low latency? Does the disaggregation of software and hardware really matter? Is it really going to provide a lot more bandwidth? Are existing backhaul networks going to be able to handle the additional load? For network engineers in particular, the world of 5G is a foreign country with its own language, expectations, and ways of doing things.

On this episode of the Hedge, Ian Goetz joins Tom Ammon and Russ White to provide a basic overview of 5G, and inject some reality into the discussion.

download

Juniper: Managing the complexity of future networks

Juniper Networks Manoj Leelanivas Like most of its competitors, Juniper Networks is leaning hard on developing all manner of software components—from automation to intent-based networking—in order to address the changing needs of enterprise-network customers. Moving into the software realm is no small task as Juniper has to integrate products from a number of acquisitions including Mist, 128 Technologies, Apstra, and NetRounds. At the same time it continues to develop its own Junos software and invest in key open-source projects such Software for Open Networking in the Cloud (SONiC) among other undertakings. Network World talked with Manoj Leelanivas, Juniper’s executive vice president and chief product officer about the company’s software directions and how it is preparing for challenges of the future. Here is an edited version of that conversation. To read this article in full, please click here

Juniper: Managing the complexity of future networks

Juniper Networks Manoj Leelanivas Like most of its competitors, Juniper Networks is leaning hard on developing all manner of software components—from automation to intent-based networking—in order to address the changing needs of enterprise-network customers. Moving into the software realm is no small task as Juniper has to integrate products from a number of acquisitions including Mist, 128 Technologies, Apstra, and NetRounds. At the same time it continues to develop its own Junos software and invest in key open-source projects such Software for Open Networking in the Cloud (SONiC) among other undertakings. Network World talked with Manoj Leelanivas, Juniper’s executive vice president and chief product officer about the company’s software directions and how it is preparing for challenges of the future. Here is an edited version of that conversation. To read this article in full, please click here

How to Implement Network Segmentation with Zero Changes to Your Network

Across industries, network segmentation is quickly becoming a critical capability for enterprises of all sizes. Why? First, network segmentation prevents the lateral spread of threats inside the network. Second, it separates dev, test, and production environments. And lastly, it meets increasingly complex compliance requirements while enabling a Zero Trust security strategy. 

However, historically network segmentation has been fraught with operational challenges and limited by platform capabilities, leading to the perception that setting up and configuring segmentation policies requires massive changes to the physical network as well as a complex, bloated, and costly deployment of physical firewall appliances. 

Not anymore. VMware takes a distributed, software-based approach to segmentation, eliminating the need to redesign your network in order to deploy security. Instead, segmentation policies are applied at the workload level through NSX Firewall, which is deployed on top of your existing VSphere 7 environments. This allows you to easily create zones in the data center where you can separate traffic by application or environment — providing the quickest and easiest way to achieve your data center segmentation Continue reading

Tech Bytes: Unifying Cloud Automation And Network Infrastructure With Gluware (Sponsored)

Tech Bytes: Unifying Cloud Automation And Network Infrastructure With Gluware (Sponsored)

In this Tech Byte podcast, sponsored by Gluware, we explore the latest features and capabilities in the Gluware network automation and orchestration platform, including an API-based controller to work with SD-WAN, and Terraform integration to support infrastructure automation across public clouds.

The post Tech Bytes: Unifying Cloud Automation And Network Infrastructure With Gluware (Sponsored) appeared first on Packet Pushers.

How Fast Object Storage Enables a WFH Backup and DR Strategy

Day Two Cloud 094: Essential Concepts Of Zero Trust

Day Two Cloud 094: Essential Concepts Of Zero Trust

Today's Day Two Cloud episode aims to pick apart the marketing fluff around Zero Trust (there's a lot of it) to uncover a workable definition, discuss the rationale for this approach, and develop a framework for how to think about zero trust.

The post Day Two Cloud 094: Essential Concepts Of Zero Trust appeared first on Packet Pushers.

Cloudflare obtains new ISO/IEC 27701:2019 privacy certification and what that means for you

This post is also available in French and German.

Cloudflare is one of the first organisations in our industry to have achieved ISO/IEC 27701:2019 certification, and the first web performance & security company to be certified to the new ISO privacy standard as both a data processor and controller.

Providing transparency into our privacy practices has always been a priority for us. We think it is important that we do more than talk about our commitment to privacy — we are continually looking for ways to demonstrate that commitment. For example, after we launched the Internet's fastest, privacy-first public DNS resolver, 1.1.1.1, we didn’t just publish our commitments to our public resolver users, we engaged an independent firm to make sure we were meeting our commitments, and we blogged about it, publishing their report.

Following in that tradition, today we’re excited to announce that Cloudflare has been certified to a new international privacy standard for protecting and managing the processing of personal data — ISO/IEC 27701:2019. The standard is designed such that the requirements organizations must meet to become certified are very closely aligned to the requirements in the EU’s General Data Protection Regulation (“GDPR”). So Continue reading

Deep dive into Trend Micro Deep Security integration modules

At AnsibleFest 2020, we announced the extension of our security automation initiative to support endpoint protection use cases. If you have missed it, check out the recording of the talk “Automate your endpoint protection using Ansible” on the AnsibleFest page.

Today, following this announcement we release the supported Ansible Content Collection for Trend Micro Deep Security. We will walk through several examples and describe the use cases and how we envision the Collection being used in real world scenarios.

If you want to refresh your memory about our endpoint protection support with Ansible in general, head over to the the introducing blog post Automating Endpoint Protection with Ansible.

About Trend Micro Deep Security

Trend Micro Deep Security is one of the latest additions to the Ansible security automation initiative. As an endpoint protection solution it secures services and applications in virtual, cloud and container environments. It provides automated security policies and consolidates the security aspects across different environments in a single platform.

How to install the Certified Ansible Content Collection for Trend Micro Deep Security

The Trend Micro Deep Security Collection is available to Red Hat Ansible Automation Platform customers at Automation Hub, our software-as-a-service offering on Continue reading

Response: Hunting down the stuck BGP routes

If You Haven’t Checked Your Backups, They Probably Aren’t Working

This is a pleasant reminder to check your backups. I don’t mean, “Hey, did the backup run last night? Yes? Then all is well.” That’s slightly better than nothing, but not really what you’re checking for. Instead, you’re determining your ability to return a system to a known state by verifying your backups regularly.

Backups are a key part of disaster recovery, where modern disasters include ransomware, catastrophic public cloud failures, and asset exposure by accidental secrets posting.

For folks in IT operations such as network engineers, systems to be concerned about include network devices such as routers, switches, firewalls, load balancers, and VPN concentrators. Public cloud network artifacts also matter. Automation systems matter, too. And don’t forget about special systems like policy engines, SDN controllers, wifi controllers, network monitoring, AAA, and…you get the idea.

Don’t confuse resiliency for backup.

When I talk about backups, I’m talking about having known good copies of crucial data that exist independently of the systems they normally live on.

• Distributed storage is not backup.
• A cluster is not backup.
• An active/active application delivery system spread over geographically diverse data centers is not backup.

The points above are examples of distributed computing. Distributed computing Continue reading

Hunting down the stuck BGP routes

Hunting down the stuck BGP routes

BGP is the glue between all of the thousands of border routers that make up the internet (you can find this post (battleships) and [this post (EvE)](https://blog.b

Subnetting: Brushing up on the fundamentals

In the IT world, specifically in networking, there aren’t many aspects that are as much of an enigma as subnetting—the act of creating subnetworks.Subnets are logical divisions of an existing network that are defined by both class of IP address and the subnet mask. Often, consultants provide network design services to budding businesses to help establish a network that fits their needs at the time. But as the business grows or its needs change there may come a time when the initial network structure no longer works.IPv6 deployment guide I’m currently working on a project that fits that description to a tee. The network was conceived by consultants when there were not as many devices and users to accommodate. As the needs of the business grew, it became painfully obvious that a single /24 subnet that accommodates up to 254 hosts wasn’t enough anymore. So I’m building out a new network structure that can accommodate all of the devices we currently have, separated by types of devices, and with room for growth.To read this article in full, please click here

Response: Is Switching Latency Relevant?

Minh Ha left another extensive comment on my Is Switching Latency Relevant blog post. As is usual the case, it’s well worth reading, so I’m making sure it doesn’t stay in the small print (this time interspersed with a few comments of mine in gray boxes)

I found Cisco apparently manages to scale port-to-port latency down to 250ns for L3 switching, which is astonishing, and way less (sub 100ns) for L1 and L2.

I don’t know where FPGA fits into this ultra low-latency picture, because FPGA, compared to ASIC, is bigger, and a few times slower, due to the use of Lookup Table in place of gate arrays, and programmable interconnects.

Response: Is Switching Latency Relevant?

Minh Ha left another extensive comment on my Is Switching Latency Relevant blog post. As is usual the case, it’s well worth reading, so I’m making sure it doesn’t stay in the small print (this time interspersed with a few comments of mine in gray boxes)

I found Cisco apparently manages to scale port-to-port latency down to 250ns for L3 switching, which is astonishing, and way less (sub 100ns) for L1 and L2.

I don’t know where FPGA fits into this ultra low-latency picture, because FPGA, compared to ASIC, is bigger, and a few times slower, due to the use of Lookup Table in place of gate arrays, and programmable interconnects.

Exploratory Network Analysis (XNA)