Search
Pete Silva - Daily Dose of Pete
You are here: DevCentral > Weblogs

Wednesday, February 08, 2012 #


A Community within our Society

You are what you eat; You become what you believe; I am not my art.  A 2011 study from the University of Texas at Austin's Department of Psychology titled "Manifestations of Personality in Online Social Networks: Self-Reported Facebook-Related Behaviors and Observable Profile Information" found that Facebook users are no different online than they are offline. The study also declared a strong connection between someone’s real personality and their Facebook-related behavior. Social and personality processes, according to the study, accurately mirror non-virtual environments.  It was published in the academic journal Cyberpsychology, Behavior, and Social Networking.  Professor Samuel D. Gosling and his team looked at the big five personality traits - openness, conscientiousness, extraversion, agreeableness and neuroticism and found that self-reported personality traits are accurately reflected in online social networks such as Facebook.  Extroverted users reported the most friends and the highest engagement while conscientious types had the least.  Simply, extroverts engaged more than introverts.

Merriam-Webster defines society in part as, companionship or association with one's fellows : a voluntary association of individuals for common ends : an organized group working together or periodically meeting because of common interests, beliefs, or profession : an enduring and cooperating social group whose members have developed organized patterns of relationships through interaction with one another : a community, nation, or broad grouping of people having common traditions, institutions, and collective activities and interests.

Social media has changed society in many ways.  We used to just live in a society – our neighborhood, town, city – and (hopefully) looked out for each other, cared for each other and got together for specific causes. This is our community.  The human social creature needed human contact/interaction and participated within that society…but the circle was somewhat limited to a geographic region.  Granted, some societies are nationwide clubs, groups, memberships or associations that span greater distances – Toastmasters, Kiwanis or college alumni for instance.  Now, our circle of friends or association with one’s fellows requires no physical gathering.  We live in our physical geographic society but also engage in our cyber communities that span cities, states, countries and with SETI, universes.  Years ago I often wondered if the internet would create a society of hermits since no one really needed to go outside and interact with others in the real world.  But we are social creatures and our survival requires us to participate in a non-cyber way.  Of course there are people that do not want anything to do with society and live in secluded locations to avoid any human interaction.  Most of us, however, like it or not, must interact in society on a daily basis.

Often our social cyber-interaction is in response to events in the physical society.  We use social media as a way to report, learn and engage with those who are experiencing anything from turmoil to joy in their physical society. World events.  Even the Occupiers, who have used social media to great extent, still came together physically – within their geographic circle(s) – to form their mini-societies.  In some situations, social media has been the only avenue for ‘breaking’ news getting out to the masses.  (Incidentally, it seems like every story on news websites is ‘breaking’ these days – it seems to have lost it’s power) 

Breaking Bad, on the other hand, is a darn good show.

In societies we often share – information, goods, ideas, secrets – for the benefit of the society.  Many of us have heard the warnings from security experts about keeping passwords a secret.  Now, as a form of affection and devotion, teens are sharing their passwords to email, social networks and other accounts.  Since it is risky and relationships can quickly sour via social media, they feel that the symbolism is powerful.  Apparently, the world’s first divorce by Facebook occurred back in 2009 and more recently Deion Sanders announced his divorce on Facebook this past December.  In addition, a survey conducted by UK divorce website www.divorce-online.co.uk in December 2009 found that 20% of behavior petitions contained the word “Facebook.”  A follow up survey in December 2011 found that number has greatly increased during 2011 to 33% of behavior allegations in petitions.

Even the crooks are involved.  We’ve seen the stories about hijacked accounts, malware distribution and the ever popular, ‘I’m stuck in some foreign country, lost my wallet and need to pay the hotel’ scam.  I’m amazed that just a decade ago, security experts warned that you shouldn’t say, ‘We’re not home right now,’ on your answering machine.  That tells riff-raff that the property is ripe for the pickings.  Yet, just a few years later people are posting that they are over the river and through the woods to grandmother’s house some 300 miles away.  Their coordinates are available, their home town and sometimes a picture of the actual empty home are posted on the social network.  And then they wonder how they could have been burglarized.  It’s has also caught/captured the idiot criminals who feel the need to share their misdeeds.  In some cases, we share too much and don’t even realize that we’re diminishing our own privacy.  And, of course, there are some who can’t get enough exposure with 24 hour cams following their every move.

Social networks have become one of our society’s primary tools for communication and as a society it is important to communicate effectively.  I’ve always felt that the internet, particularly the web, was a reflection of society.  It’s chronicled, reflected and magnified our lives along with automatically storing and archiving almost every move we make.  People have fallen in love, ordered goods, started movements, spread rumors, gotten arrested/fired/dumped, done banking, filed complaints/kudos, kept in touch, tracked progress, committed crimes, shared ideas and pretty much anything else that didn’t require physical contact.  It’s our journal, reminder, mirror, confidant and has certainly wiggled it’s way into and become part of society.  A community within our society.  But remember, What Happens on the Internet, Stays on the Internet.

ps

Related:

Technorati Tags: blog, social media, comscore, music, statistics, society, web traffic, digital media, mobile device, analytics

Connect with Peter: Connect with F5:
o_linkedin[1] o_rss[1] o_facebook[1] o_twitter[1]   o_facebook[1] o_twitter[1] o_slideshare[1] o_youtube[1]

Thursday, February 02, 2012 #


One thing I’ve noticed over the last couple years is that there are 5 Stages of a Data Breach:

Denial: We do not believe these attacks breached our critical servers.

Anger: We want to make it clear that we take security seriously!

Bargaining: We’d like to offer our affected customers a credit monitoring service.

Depression: We wish we could have done things differently.

Acceptance: Well, it just shows that no one is safe from hackers.

ps

Technorati Tags: F5, cyber-crime, trojan, Pete Silva, security, business, education, 5 stages, cyber war, hackers, breach, verisign, internet, security, privacy,

Connect with Peter: Connect with F5:
o_linkedin[1] o_rss[1] o_facebook[1] o_twitter[1]   o_facebook[1] o_twitter[1] o_slideshare[1] o_youtube[1]

Tuesday, January 31, 2012 #


The longer an application remains vulnerable, the more likely it is to be compromised.

Protecting web applications is an around-the-clock job. Almost anything that is connected to the Internet is a target these days, and organizations are scrambling to keep their web properties available and secure. The ramifications of a breach or downtime can be severe: brand reputation, the ability to meet regulatory requirements, and revenue are all on the line.  A 2011 survey conducted by Merrill Research on behalf of VeriSign found that 60 percent of respondents rely on their websites for at least 25 percent of their annual revenue.

And the threat landscape is only getting worse. Targeted attacks are designed to gather intelligence; steal trade secrets, sensitive customer information, or intellectual property; disrupt operations; or even destroy critical infrastructure.  Targeted attacks have been around for a number of years, but 2011 brought a whole new meaning to advanced persistent threat. Symantec reported that the number of targeted attacks increased almost four-fold from January 2011 to November 2011.

In the past, the typical profile of a target organization was a large, well-known, multinational company in the public, financial, government, pharmaceutical, or utility sector.  Today, the scope has widened to include almost any size organization from any industry. The attacks are also layered in that the malicious hackers attempt to penetrate both the network and application layers.  To defend against targeted attacks, organizations can deploy a scanner to check web applications for vulnerabilities such as SQL injection, cross site scripting (XSS), and forceful browsing; or they can use a web application firewall (WAF) to protect against these vulnerabilities. However a better, more complete solution is to deploy both a scanner and a WAF.  BIG-IP Application Security Manager (ASM) version 11.1 is a WAF that gives organizations the tools they need to easily manage and secure web application vulnerabilities with multiple web vulnerability scanner integrations.

As enterprises continue to deploy web applications, network and security architects need visibility into who is attacking those applications, as well as a big-picture view of all violations to plan future attack mitigation.  Administrators must be able to understand what they see to determine whether a request is valid or an attack that requires application protection.  Administrators must also troubleshoot application performance and capacity issues, which proves the need for detailed statistics.  With the increase in application deployments and the resulting vulnerabilities, administrators need a proven multi-vulnerability assessment and application security solution for maximum coverage and attack protection.  But as many companies also support geographically diverse application users, they must be able to define who is granted or denied application access based on geolocation information.

 
Application Vulnerability Scanners

To assess a web application’s vulnerability, most organizations turn to a vulnerability scanner.  The scanning schedule might depend on a change control, like when an application is initially being deployed, or other factors like a quarterly report.  The vulnerability scanner scours the web application, and in some cases actually attempts potential hacks to generate a report indicating all possible vulnerabilities.  This gives the administrator managing the web security devices a clear view of all the exposed areas and potential threats to the website. It is a moment-in-time report and might not give full application coverage, but the assessment should give administrators a clear picture of their web application security posture.  It includes information about coding errors, weak authentication mechanisms, fields or parameters that query the database directly, or other vulnerabilities that provide unauthorized access to information, sensitive or not.  Many of these vulnerabilities would need to be manually re-coded or manually added to the WAF policy—both expensive undertakings.

Another challenge is that every web application is different.  Some are developed in .NET, some in PHP or PERL. Some scanners execute better on different development platforms, so it’s important for organizations to select the right one.  Some companies may need a PCI DSS report for an auditor, some for targeted penetration testing, and some for WAF tuning.  These factors can also play a role in determining the right vulnerability scanner for an organization.  Ease of use, target specifics, and automated testing are the baselines.  Once an organization has considered all those details, the job is still only half done.  Simply having the vulnerability report, while beneficial, doesn’t mean a web app is secure.  The real value of the report lies in how it enables an organization to determine the risk level and how best to mitigate the risk. Since re-coding an application is expensive and time-consuming, and may generate even more errors, many organizations deploy a web application firewall like BIG-IP ASM.

A WAF enables an organization to protect its web applications by virtually patching the open vulnerabilities until it has an opportunity to properly close the hole.  Often, organizations use the vulnerability scanner report to then either tighten or initially generate a WAF policy.  Attackers can come from anywhere, so organizations need to quickly mitigate vulnerabilities before they become threats. They need a quick, easy, effective solution for creating security policies.  Although it’s preferable to have multiple scanners or scanning services, many companies only have one, which significantly impedes their ability to get a full vulnerability assessment.  Further, if an organization’s WAF and scanner aren’t integrated, neither is its view of vulnerabilities, as a non-integrated WAF UI displays no scanner data.  Integration enables organizations both to manage the vulnerability scanner results and to modify the WAF policy to protect against the scanner’s findings—all in one UI.

Integration Reduces Risk

While finding vulnerabilities helps organizations understand their exposure, they must also have the ability to quickly mitigate found vulnerabilities to greatly reduce the risk of application exploits. The longer an application remains vulnerable, the more likely it is to be compromised.  F5 BIG-IP ASM, a flexible web application firewall, enables strong visibility with granular, session-based enforcement and reporting; grouped violations for correlation; and a quick view into valid and attack requests. BIG-IP ASM delivers comprehensive vulnerability assessment and application protection that can quickly reduce web threats with easy geolocation-based blocking—greatly improving the security posture of an organization’s critical infrastructure.

image

BIG-IP ASM version 11.1 includes integration with IBM Rational AppScan, Cenzic Hailstorm, QualysGuard WAS, and WhiteHat Sentinel, building more integrity into the policy lifecycle and making it the most advanced vulnerability assessment and application protection on the market.  In addition, administrators can better create and enforce policies with information about attack patterns from a grouping of violations or otherwise correlated incidents. In this way, BIG-IP ASM enables  organizations to mitigate threats in a timely manner and greatly reduce the overall risk of attacks and solve most vulnerabilities.

With multiple vulnerability scanner assessments in one GUI, administrators can discover and remediate vulnerabilities within minutes from a central location.  BIG-IP ASM offers easy policy implementation, fast assessment and policy creation, and the ability to dynamically configure policies in real time during assessment.  To significantly reduce data loss, administrators can test and verify vulnerabilities from the BIG-IP ASM GUI, and automatically create policies with a single click to mitigate unknown application vulnerabilities. 

Security is a never-ending battle.  The bad guys advance, organizations counter, bad guys cross over—and so the cat and mouse game continues.  The need to properly secure web applications is absolute. Knowing what vulnerabilities exist within a web application can help organizations contain possible points of exposure.  BIG-IP ASM v11.1 offers unprecedented web application protection by integrating with many market-leading vulnerability scanners to provide a complete vulnerability scan and remediate solution.  BIG-IP ASM v11.1 enables organizations to understand inherent threats and take specific measures to protect their web application infrastructure.  It gives them the tools they need to greatly reduce the risk of becoming the next failed security headline.

ps

Resources:

Technorati Tags: F5, big-ip, virtualization, cloud computing, Pete Silva, security, waf, web scanners, compliance, application security, internet, TMOS, big-ip, asm

Connect with Peter: Connect with F5:
o_linkedin[1] o_rss[1] o_facebook[1] o_twitter[1]   o_facebook[1] o_twitter[1] o_slideshare[1] o_youtube[1]

Thursday, January 26, 2012 #


IMG_0095When I talk on the phone, I’ve always used my left ear to listen.  Listening in the right ear just doesn’t sound right.  This might be due to being right handed, doing the shoulder hold to take notes when needed.  As corded turned to cordless and mobile along with the hands-free ear-plugs, that plug went into the left ear whenever I was on the phone.  Recently, I’ve been listening to some music while walking the dog and have run into an issue.  The stereo ear plugs do not fit, sit or stay in my right ear.  I have no problem with the nub in my left ear but need to keep re-inserting, adjusting and holding the plug in my right ear.  I’m sure I was born with the same size opening for both ears years ago and my only explanation is that my left ear has evolved over the years to accommodate an ear plug.  Even measuring each indicates that the left is opened more ever so slightly.  I seem to be fine, or at least better, with the isolation earphone style but it’s the ear-bud type that won’t fit in my right ear.  I realize there are tons of earplug types for various needs and I could just get one that works for me but it got me thinking.  If my ears or specifically my left ear has morphed due to technology, what other human physical characteristics might evolve over time.

As computers became commonplace and more people started using keyboards, we started to see a huge increase of carpal tunnel syndrome.  Sure, other repetitive tasks of the hand and wrist can cause carpal tunnel but typing on a computer keyboard is probably the most common cause.  Posture related injuries like back, neck, shoulder and arm pain along with headaches are common computer related injuries.  Focusing your eyes at the same distance over extended periods of time can cause fatigue and eye strain.  It might not do permanent damage to your eyesight but you could experience blurred vision, headaches and a temporary inability to focus on faraway objects.  Things like proper design of your workstation and taking breaks that encourage blood flow can help reduce computer related injuries.  Of course, every profession has their specific repetitive tasks which can lead to some sort of injury and, depending on your work, the body adjusts and has it’s own physical memory to accomplish the task.  Riding a bike.  Often smokers who are trying to quit can tolerate the nicotine deduction but it’s the repetitive physical act of bringing the dart up that causes grief.  That’s why many turn to straws or toothpicks or some other item to break the habit. 

We’ve gotten use to seeing people walking around with little blue-tooth ear apparatus attached to their heads and think nothing of it.  They’ll leave it in all day even if they are not talking on the phone.  Many probably feel ‘naked’ if they forgot it one day, almost like a watch or ring that we wear daily.  I mentioned a couple years ago in IPv6 and the End of the World that with IPv6, each one of us, worldwide, would be able to have our own personal IP address that would follow us anywhere.  Hold on, I’m getting a call through my earring but first must authenticate with the chip in my earlobe. That same chip, after checking my print and pulse, would open the garage, unlock the doors, disable the home alarm, turn on the heat and start the microwave for a nice hot meal as soon as I enter.  Who would have thought that Carol Burnett's ear tug would come back.

Now that many of us have mobile devices with touch-screens, we’re tapping away with index fingers and thumbs.  I know my thumb joints can get sore when tapping too much.  Will our thumbs grow larger or stronger over time to accommodate the new repetitive movement or go smaller and pointy to make sure we’re able to click the the correct virtual keypad on the device.  We got video eyewear so it’s only a matter of time that our email and mobile screens could simply appear while wearing shades or as heads up on the car windshield.  With special gloves or an implant under our hand, we can control the device through movement or tapping the steering wheel.

Ahhh, anyway, I’m sure things will change again in the next decade and we’ll have some other things happening within our evolutionary process but it’ll be interesting to see if we can maintain control over technology or will technology change us.  In the meantime, I’ll be ordering some new earphones.

ps

Technorati Tags: F5, humans, people, Pete Silva, security, behavior, education, technology, mobile, earphone, ipv6, computer injury, iPhone, web,

Connect with Peter: Connect with F5:
o_linkedin[1] o_rss[1] o_facebook[1] o_twitter[1]   o_facebook[1] o_twitter[1] o_slideshare[1] o_youtube[1]

Tuesday, January 24, 2012 #


The BIG-IP platform is now ICSA Certified as a Network Firewall.

Internet threats are widely varied and multi-layered. Although applications and their data are attackers’ primary targets, many attackers gain entry at the network layer.  Internet data centers and public-facing web properties are constant targets for large-scale attacks by hacker/hactivist communities and others looking to grab intellectual property or cause a service outage. Organizations must prepare for the normal influx of users, but they also must defend their infrastructure from the daily barrage of malicious users. 

Security administrators who manage large web properties are struggling with security because traditional firewalls are not meeting their fundamental performance needs. Dynamic and layered attacks that necessitate multiple-box solutions, add to IT distress.  Traditional firewalls can be overwhelmed by their limited ability to scale under a DDoS attack while keeping peak connection performance for valid users, which renders not only the firewalls themselves unresponsive, but the web sites they are supposed to protect.  Additionally, traditional firewalls’ limited capacity to interpret context means they may be unable to make an intelligent decision about how to deliver the application while also keeping services available for valid requests during a DDoS attack.

Traditional firewalls also lack specialized capabilities like SSL offload, which not only helps reduce the load on the web servers, but enables inspection, re-encryption, and certificate storage. Most traditional firewalls lack the agility to react quickly to changes and emerging threats, and many have only limited ability to provide new services such as IP geolocation, traffic redirection, traffic manipulation, content scrubbing, and connection limiting.  An organization’s inability to respond to these threats dynamically, and to minimize the exposure window, means the risk to the overall business is massive.  There are several point solutions in the market that concentrate on specific problem areas; but this creates security silos that only make management and maintenance more costly, more cumbersome, and less effective.

The BIG-IP platform provides a unified view of layer 3 through 7 for both general and ICSA required reporting and alerts, as well as integration with SIEM vendors.  BIG-IP Local Traffic Manager offers native, high-performance firewall services to protect the entire infrastructure.  BIG-IP LTM is a purpose-built, high-performance Application Delivery Controller designed to protect Internet data centers.  In many instances, BIG-IP LTM can replace an existing firewall while also offering scale, performance, and persistence.

  • Performance: BIG-IP LTM manages up to 48 million concurrent connections and 72 Gbps of throughput with various timeout behaviors, buffer sizes, and more when under attack.
  • Protocol security: The BIG-IP system natively decodes IPv4, IPv6, TCP, HTTP, SIP, DNS, SMTP, FTP, Diameter, and RADIUS. Organizations can control almost every element of the protocols they’re deploying.
  • DDoS prevention capabilities: An integrated architecture enables organizations to combine traditional firewall layers 3 and 4 with application layers 5 through 7.
  • DDoS mitigations: The BIG-IP system protects UDP, TCP, SIP, DNS, HTTP, SSL, and other network attack targets while delivering uninterrupted service for legitimate connections.
  • SSL termination: Offload computationally intensive SSL to the BIG-IP system and gain visibility into potentially harmful encrypted payloads.
  • Dynamic threat mitigation: iRules provide a flexible way to enforce protocol functions on both standard and emerging or custom protocols. With iRules, organizations can create a zero day dynamic security context to react to vulnerabilities for which an associated patch has not yet been released.
  • Resource cloaking and content security: Prevent leaks of error codes and sensitive content.

F5 BIG-IP LTM has numerous security features so Internet data centers can deliver applications while protecting the infrastructure that supports their clients and, BIG-IP is now ICSA Certified as a Network Firewall.

ps

Resources:

Technorati Tags: F5, big-ip, virtualization, cloud computing, Pete Silva, security, icsa, iApp, compliance, network firewall, internet, TMOS, big-ip, vCMP

Connect with Peter: Connect with F5:
o_linkedin[1] o_rss[1] o_facebook[1] o_twitter[1]   o_facebook[1] o_twitter[1] o_slideshare[1] o_youtube[1]

Tuesday, January 17, 2012 #


1 if by land, 2 of by sea, 0 if by IP

I know I’ve said this before but it sure seems like almost daily there is a security breach somewhere.  Over the years, the thought process has changed from prevent all attacks to, it is inevitable that we will be breached.  The massive number of attacks occurring daily makes it a statistical reality.  Now organizations are looking for the right solution (both technology and practice) to quickly detect a breach, stop it, identify what occurred and what data may have been compromised.  Over the last couple of days various entities have had their security breached.

As you are probably already aware either due to the headlines or a direct note in your email inbox, Zappos, a popular online shoe site, was compromised exposing information on 24 million customers.  While a good bit of info was taken, like usernames, passwords, addresses, email and other identifiable information, Zappos claims that the stored credit card information was apparently spared due to being encrypted.  There are still many details that are unknown like how it occurred and how long it had been exposed but all users are being required to change their passwords immediately.  Users might also want to change similar passwords on other websites since I’m sure the criminals are already trying those stolen passwords around the web.  These days it's entirely too easy to use information from one hack in many others.  It doesn't even matter if passwords were compromised.  Your can change your password, but the make and model of your first car, and your mother's maiden name can't be changed.  Yet, online service providers continue to rely on these relatively weak forms of secondary authentication.  The interesting thing is Zappos is/was apparently PCI-DSS compliant, proving once again, PCI compliance is a first step, not the goal.  Being PCI compliance does not mean that one is secure and this also underscores importance of using WAF like BIG-IP ASM.  And if it was not a web app that was owned on the server in Kentucky, then Section 6.6 is irrelevant.  But again, all the details are still to be uncovered and as far as I know, no-one has claimed responsibility.

Overseas, there is an ongoing cyber-war between a Saudi (reported) hacker and Israel.  0xOmar, as news articles have identified him, claims to have posted details of 400,000 Israeli-owned credit cards and Israel’s main credit card companies have admitted that 20,000 cards have been exposed.  Along the way, he has also attacked the Tel Aviv Stock Exchange and Bank Massad.  In an interesting and potentially scary turn of events, a group of Israeli hackers, IDF-Team, took down the Saudi Stock Exchange (Tadawul) and the Abu Dhabi Securities Exchange (ADX) as a counter-attack.  Another Israeli hacker going by Hannibal claims to have 30 million Arab e-mail addresses, complete with passwords (including Facebook passwords), and says he’s received e-mails not only from potential victims but from officials in France and other countries asking him to stop.  This cyber-conflict is escalating.

In a very different type of breach, you’ve probably also seen the cruise ship laying on it’s side a mere 200 yards from the Italian shore.  While not necessarily a data security story, it is still a human security story that, so far, has been attributed to human error – like many data security breaches.  Like many data breach victims, people put their trust in another entity.  Their internal risk-analysis tells them that it is relatively safe and the probability of disaster is low.  But when people make bad decisions which seems the case in this situation, many others are put at greater risk.

Put on your virtual life vests, 2012 is gonna be a ride.

ps

References:

Technorati Tags: F5, cyber-crime, trojan, Pete Silva, security, business, education, technology, application delivery, cruise, cyber war, ddos, hackers, iPhone, web, internet, security, breach, privacy, PCI-DSS,

Connect with Peter: Connect with F5:
o_linkedin[1] o_rss[1] o_facebook[1] o_twitter[1]   o_facebook[1] o_twitter[1] o_slideshare[1] o_youtube[1]

Tuesday, January 10, 2012 #


Want to provide Cloud services to the federal government?  Then you’ll have to adhere to almost 170 security controls under the recently announced Federal Risk and Authorization Management Program.  The program, set to go live in June, is designed to analyze/audit cloud computing providers for federal government agencies, expedite security clearances for cloud providers and foster the adoption of cloud computing by the Federal government.  FedRAMP is meant to provide a baseline for low to moderate risk systems and is based on the NIST cyber-security Special Publication 800-53 Revision 3.  FedRAMP provides an overall checklist for handling risks associated with Web services that would have a limited, or serious impact on government operations if disrupted.  Cloud providers must implement these security controls to be authorized to provide cloud services to federal agencies.  The government will forbid federal agencies from using a cloud service provider unless the vendor can prove that a FedRAMP-accredited third-party organization has verified and validated the security controls.  Once approved, the cloud vendor would not need to be ‘re-evaluated’ by every government entity that might be interested in their solution.  There may be instances where additional controls are added by agencies to address specific needs.

Independent, third-party auditors are tasked with testing each product/solution for compliance which is intended to save agencies from doing their own risk management assessment.  Details of the auditing process are expected early next month but includes a System Security Plan that clarifies how the requirements of each security control will be met within a cloud computing environment. Within the plan, each control must detail the solutions being deployed such as devices, documents and processes; the responsibilities of providers and government customer to implement the plan; the timing of implementation; and how solution satisfies controls. A Security Assessment Plan details how each control implementation will be assessed and tested to ensure it meets the requirements and the Security Assessment Report explains the issues, findings, and recommendations from the security control assessments detailed in the security assessment plan.  Ultimately, each provider must establish means of preventing unauthorized users from hacking the cloud service.

The regulations allow the contractor to determine which elements of the cloud must be backed up and how frequently. Three backups are required, one available online.  All government information stored on a provider's servers must be encrypted.  When the data is in transit, providers must use a "hardened or alarmed carrier protective distribution system," which detects intrusions, if not using encryption.  Since cloud services may span many geographic areas with various people in the mix, providers must develop measures to guard their operations against supply chain threats.  Also, vendors must disclose all the services they outsource and obtain the board's approval to contract out services in the future.

More details of the FedRAMP program will be available from the General Services Administration by February 8th, but they have already started accepting applications for third party assessment vendors.

ps

Resources:

Technorati Tags: F5, federal government, integration, cloud computing, Pete Silva, security, business, fedramp, technology, nist, cloud, compliance, regulations, web, internet

Connect with Peter: Connect with F5:
o_linkedin[1] o_rss[1] o_facebook[1] o_twitter[1]   o_facebook[1] o_twitter[1] o_slideshare[1] o_youtube[1]

Wednesday, January 04, 2012 #


After just being bombarded with the endless options of gifts for your loved ones, a simple reminder that the next blitz is just around the corner.  And you are a target.  2011 started relatively tame for breaches but when hacktivism and a few other entities decided to take hold, it became a massive year for lost data.  From retail to healthcare to government to schools to financial institutions – no one was immune.  Household names like Sony, RSA, Lockheed and Sega were all hit.   Privacy Rights Clearinghouse reports that 535 security breaches in 2011 exposed 30 million sensitive records to identity thieves and other rip-off artists.  Since 2005, 543 million records have been breached – almost double the US population and about 7% of the entire world’s population.  Looking at the entire Privacy Rights Clearinghouse list is staggering both in numbers and names. 

It might not get better any time soon.  Since mobile devices have become fixed appendages and continue to dominate many areas of our lives (phone, entertainment, email, GPS, banking, work, etc), the crooks will look for more ways to infiltrate that love affair.  I suspect that mobile financial (payment/banking) apps will get a lot of attention this year as will malware laced apps.  Our health information is also at risk.  Medical records are being digitized.  A 2009 stimulus bill included incentives for doctors and hospitals who embrace electronic health records.  The CDC saw a 12% increase from last year – now 57% of office-based physicians use electronic health records.  The inadvertent result is that the number of reported breaches is up 32% this year according to Ponemon Institute.  That cost the health care industry somewhere in the neighborhood of $6.5 Billion.  Now you might think that you have less control over a health provider’s systems than your own mobile device.  While mostly true, close to half of those case involved a lost or stolen phone or personal computer.  Some sort of human element involved. 

It is really up to each of us to practice safe computing and, if you’re knowledgeable, share insight with those who are not tech savvy.  Yes, you can be the most cautious internet citizen and still be a victim due to someone else’s mistake, oversight or vulnerability.  Even so, it is still important to be aware and do what you can.  For centuries we’ve been physically protecting our property, neighbors, towns, identity and anything else important to us.  At times, the thieves, enemies and otherwise unwanted still got in and created havoc.  Advances and admissions, plus the value of whatever needed protection kept the battle going.  It continues today in the digital universe.

ps

References

Technorati Tags: F5, banking, trojan, Pete Silva, security, business, education, technology, application delivery, ipad, cloud, context-aware, mobile, iPhone, web, internet, security, android, privacy, smartphone, 

Connect with Peter: Connect with F5:
o_linkedin[1] o_rss[1] o_facebook[1] o_twitter[1]   o_facebook[1] o_twitter[1] o_slideshare[1] o_youtube[1]

Tuesday, December 20, 2011 #


It’s that time of year when we gift and re-gift.  And the perfect opportunity to re-post, re-purpose and re-use my 2011 blog entries.  If you missed any of the approximately 50 blogs, 11 audio whitepapers or 47 videos, here they are wrapped in one simple entry.  I read somewhere that lists in blogs are good. 

Have a Safe and Happy New Year.

And a couple special holiday themed entries from years past.

ps

Technorati Tags: blog, social media, 2011, f5, statistics, big-ip, web traffic, digital media, mobile device, analytics, video

Connect with Peter: Connect with F5:
o_linkedin[1] o_rss[1] o_facebook[1] o_twitter[1]   o_facebook[1] o_twitter[1] o_slideshare[1] o_youtube[1]

Thursday, December 15, 2011 #


Over the last couple weeks, we’ve been rolling out a series of short Security Vignette videos about various IT security challenges.  We’ve posted them to the F5News blog account but also wanted to share in case you missed them.  If we were going to sum up the role of security in corporate IT today we'd have to say it's to "be prepared." This series looks at many of those security concerns which can be addressed proactively, before they are exploited or become a fire drill.

  • clip_image002 F5 Security Vignette: Proactive Security - The F5 Security Vignette series looks at various security concerns, vulnerabilities and attacks which can cause headaches for Corporate IT and the business integrity overall. This video covers SSL Certificates.
  • clip_image002[1] F5 Security Vignette: DNSSEC Wrapping - The dirty little secret of the Internet is how insecure DNS really is. The good news is, there's a solution -- DNSSEC. It secures the DNS query and response process.
  • clip_image002[2] F5 Security Vignette: Hacktivism Attack – DDoS and other targeted attacks.
  • clip_image002[3] F5 Security Vignette: SSL Renegotiation - The premise of the SSL Renegotiation DOS attack is simple: "An SSL/TLS handshake requires at least 10 times more processing power on the server than on the client". If a client machine and server machine were equal in RSA processing power, the client could overwhelm the server by sending ten times as many SSL handshake requests as the server could service. The counter measure against the attacks was to write an iRule to limit renegotiation requests to 5 per minute per session.
  • clip_image002[4] F5 Security Vignette: Credit Card iRule - The consequences of exposing hundreds of thousands of customer credit card numbers is unthinkable. Fines, lawsuits, damaged brand -- the effects can be catastrophic. Even if it was accidental, the effect would be the same.
  • clip_image002[5] F5 Security Vignette: Apache HTTP RANGE Vulnerability - When we hear about an Apache vulnerability, it gets our attention. In this case the issue was the way Apache handles HTTP RANGE headers, which are used to request individual sub-ranges of a given response, instead of the entire response. The problem is that responding to an HTTP RANGE request is computationally expensive. A simple iRule fixes this.
  • clip_image002[5] F5 Security Vignette: iHealth - Security is a never ending battle. The bad guys advance, we counter, they cross over ... you're just never done.  To give our side an edge we do a lot of research.
  • clip_image004 Security is our Job
  • clip_image006  F5 YouTube Feed

ps

Technorati Tags: F5, cyber security, predictions, 2012, Pete Silva, security, mobile, vulnerabilities, crime, social media, hacks, internet, identity theft, F5 News, security, web application security, apache, HTTP, threat mitigation, video

Connect with Peter: Connect with F5:
o_linkedin[1] o_rss[1] o_facebook[1] o_twitter[1]   o_facebook[1] o_twitter[1] o_slideshare[1] o_youtube[1]

Monday, December 12, 2011 #


After just proclaiming, a mere four days ago in The Top 10, Top Predictions for 2012, that I wouldn’t predict anything for 2012 and simply would repurpose other’s predictions, I offer this prognosis.

An area I have been thinking about recently is the availability of IT personnel, or lack thereof in 2012.  It began with a conversation with a F5 colleague and a simple premise:  Information Technology personnel seem to be in demand.  We have read stories to this effect, and even anecdotally realized that times are not that bad for IT careers, despite the financial crisis. Sure, many were laid off from failing startups or collapsing banks a couple years ago, but many seemed to get new jobs rather quickly, and many of us get a few job solicitations every month.

In researching the real statistics on IT unemployment (from Help Desk to System Admins to Developers to Business Analysts), we realized how much of an understatement the premise was:

Dice.com, May, 2011:  3.8% IT unemployment - 65% of hiring managers anticipated hiring more technology professions in 2H 2011, and 49% said they were paying more in salary this year than last year.

Bureau of Labor Statistics, June 2011: 3.3% IT unemployment – Expects IT employment to grow ‘much faster than the average of all occupations’ through 2018. 

Bureau of Labor Statistics, July 9th, 2011: 3.3% IT unemployment - Information Security Analyst unemployment: ZERO.  Network Architect unemployment:  0.2%

Consider that the economy has not really recovered from the crash, and that many companies downsized or went out of business altogether.  5% unemployment is generally considered to be "full employment"; 3.3% is typically unhealthy for business growth.  When our economy gets through this difficult period, where are companies going to find IT workers?  But more specific, what does this mean? 

I think that operating expenses is going to be an increasingly difficult problem for everyone, in every industry.  Besides paying serious money to lure IT people away from other companies, employers are going to start paying serious money to protect the IT resources they already have.  When you are an IT manager, every system you consider for implementation has two costs – the upfront cost, and how much of a resource it will take to manage it, the classic CapEx and OpEx.  If you produce a solution that does not require additional headcount to manage, or actually reduces headcount, you can save OpEx for a lot of companies.  Even if ProductX costs $100k, that's only the price of one IT guy for one year.  And that price is going up day by day.

iApps in BIG-IP v11 is a great step toward reducing OpEx, and evening the bar of who and what knowledge is needed to deploy our solution.  Evening the bar of what skill set is needed is vitally important, because most companies can at least find some System Admins (2.8% unemployment) but may not find a Network Architect or InfoSec guy to implement the apps on the BIG-IP.  The WhiteHat integration with BIG-IP ASM is similarly great, especially to those who implement the solution.   Many organizations are unable to devote enough resources to managing a WAF, plus they can't find the InfoSec personnel anyway since their unemployment rate is ZERO and has been for a few years.  The integration allows those with minimal security experience the ability to build a solid web application security policy.  Often, simply feeling comfortable with an appliance is all that’s needed for IT staff to give it attention.

The coming or currently unfolding (?) IT HR crisis will matter to many organizations over the next few years.  Interestingly, while I was writing this, a tweet arrived asking, ‘@wimremes: random thought : do you (still) rely on recruiters or do you use your own network to find the right people for a job?’  I’m really not sure exactly how it will play out but simply something to think about.

ps

References:

Technorati Tags: F5, cyber security, predictions, 2012, Pete Silva, security, mobile, labor, jobs, social media, staffing, employment, internet, identity theft

Connect with Peter: Connect with F5:
o_linkedin[1] o_rss[1] o_facebook[1] o_twitter[1]   o_facebook[1] o_twitter[1] o_slideshare[1] o_youtube[1]

Thursday, December 08, 2011 #


Around this time of year, almost everyone and their brother put out their annual predictions for the coming year.  So instead of coming up with my own, I figured I’d simply regurgitate what many others are expecting to happen. 

Certainly not an exhaustive list of all the various 2012 predictions including the doomsday and non-doomsday claims but a good swath of what the experts believe is coming.  Wonder if anyone predicted that Targeted attacks increased four-fold in 2011.

ps

Technorati Tags: F5, cyber security, predictions, 2012, Pete Silva, security, mobile, vulnerabilities, crime, social media, hacks, the tube, internet, identity theft

Connect with Peter: Connect with F5:
o_linkedin[1] o_rss[1] o_facebook[1] o_twitter[1]   o_facebook[1] o_twitter[1] o_slideshare[1] o_youtube[1]

Wednesday, December 07, 2011 #


(Originally posted December 07, 2009)

In honor of Pearl Harbor day, I want to share a bit of history you might not know about.  This has nothing to do with technology, security or our awesome BIG-IP solutions but felt compelled to honor both my grandparents and service men/women everywhere today.  I am Hawaiian (1/8th, direct from Kekaulike line), was born there and most of my ancestors lived there while it was still a Monarchy.  My great(s) and present grandparents all were born and raised and some witnessed the destruction that day.  A shell even landed in my grandmother’s backyard while they were at church that Sunday!  Both my grandfathers played a significant role in the days and weeks following the bombing.  One of my grandfathers was a carpenter and lived in Pauoa Valley (O’ahu) which is situated right next to Punchbowl, National Cemetery of the Pacific.  While many equate Honolulu with Diamond Head (or Leahi – Brow of the Tuna – to Hawaiians), Punchbowl is also an old volcano crater that helped create the island.  When my grandfather was a kid they used to play there and he spoke of many fun times running around inside Punchbowl as a youngster. 

600_full_punchbowl1 When Pearl Harbor was hit, many locals were called (and wanted) to help, as you can imagine.  As my grandfather tells it, they needed a place to temporarily put those who had died and Punchbowl was both the closest (about 15 miles), had the space and was known as the ‘Hill of Sacrifice’ to the ancient Hawaiians so it had historical significance.  Being a carpenter and living less than a mile from Punchbowl, he was part of the team that built the wooden caskets for the fallen.  As the days went on and suitable re-locations were not available, they decided to start properly laying to rest those who had perished – right there at Punchbowl, including an uncle of mine.  The Pearl Harbor victims were among the first to be buried there, 776 of them.  About 8 years later, they officially dedicated it as the National Memorial Cemetery of the Pacific – it’s the Arlington for the Pacific Fleet.  Those who have served in the Pacific Fleet actually have their choice of Virginia or Hawaii as their final resting place, as I understand.

My other grandfather, who happened to be a Honolulu Detective at the time, was born in Yokohama (although not Japanese) and had learned Japanese while attending school there.  He moved to the Hawaiian Islands with his parents when he was still a teenager and grew up on the Big Island.  Since he understood Japanese, the US Government had him guard the Japanese consulate when the US declared war.  He really didn’t like the assignment since he had become friends with staff due to being a local police officer and had fond memories of being Japan.  After the attack, there were curfews and blackouts, and my grandfather had to make sure there was still a little illumination but nothing too bright at the consulate.  One evening as he was coving an exposed light bulb with a mimeograph carbon copy he pulled from the garbage, he noticed the backwards Japanese characters of a letter.  As he looked closer, it contained information of about the locations of ships and other munitions stationed at Pearl Harbor, which became a key piece of evidence as they started to piece together what happened.

As the years roll on and those who witnessed the Pearl Harbor attack become memories themselves, I offer these few short stories to the great Internet to file, store and recall whenever someone wonders about all the little back stories of this significant event in our history.

ps

Connect with Peter: Connect with F5:
o_linkedin[1] o_rss[1] o_facebook[1] o_twitter[1]   o_facebook[1] o_twitter[1] o_slideshare[1] o_youtube[1]

Monday, November 28, 2011 #


In 2006, Cablevision was developing a service which allowed customers to record, pause and replay their television content on/from servers located at Cablevision’s data center rather than on the customer’s Digital Video Recorder itself – in the cloud rather than on a local hard drive.  A consortium of U.S. television and copyright holders challenged Cablevision in court arguing that Cablevision’s Remote Storage Digital Video Recorder (RS-DVR) infringed on copyrighted content laws in that, they were making copies of protected works and infringing on exclusive right of reproduction; briefly buffering/storing that content also infringes on exclusive reproduction rights; and by transmitting the data back to the customer, they were infringing on exclusive rights to public performance.  In 2007, a district court found in favor of the copyright owner but in 2008, the decision was reversed by the Second Court of Appeals.  The court clarified that Cablevision was not directly infringing copyright by offering a remote DVR service outside the customer’s home.  Viewers could now record and save authorized TV content on a device within Cablevision’s infrastructure.

This ruling, according to Josh Lerner, Harvard Business School’s Professor of Investment Banking, had a huge impact on U.S. venture capital moving to cloud computing.  A risk was removed.  In Europe, where the ruling had no authority, the venture investments in the cloud were much less.  This is an important economic topic and ruling due to the relationship between venture, innovation and job growth.  The ruling might also be relevant in Australia where Optus is facing the same legal challenge today.  They started a service in July called Optus TV Now that does essentially the same thing as Cablevision’s.  Allowing customers to record and watch the 15 free-to-air stations that are available.  Customers can watch the content directly or over their smartphone or computer via the internet.  In their July announcement they even included, ‘it is a breach of copyright to make a copy of a broadcast other than to record it for your private and domestic use. Optus accepts no responsibility for copyright infringement.’  Well, the owners of the copyright material being stored and retrieved are saying breach, especially the AFL and NRL, the football and rugby leagues.  Optus is saying it’s no different than people recording on a personal DVR at home.  It’ll be interesting to follow this.

Back to the ‘funding the cloud’ story.  Lerner’s study, 'The Impact of Copyright Policy Changes on Venture Capital Investment in Cloud Computing Companies,' he examines the impact and effect of the US Second Circuit Court of Appeals decision.  The authors found that the decision led to additional incremental investment in U.S. cloud computing companies compared to Europe.  Figure 1 of their paper:

vc emea cloud

The same growth did not occur in Europe and in some cases, these types of services have been blocked from even getting to market.  Imagine how much different services from Amazon, Apple and Google would be if the court did not reverse the 2007 ruling. 

ps

Related:

Technorati Tags: F5, costs, integration, cloud computing, Pete Silva, security, business, venture capital, technology, application delivery, cloud, emea, infrastructure 2.0, web, internet

Connect with Peter: Connect with F5:
o_linkedin[1] o_rss[1] o_facebook[1] o_twitter[1]   o_facebook[1] o_twitter[1] o_slideshare[1] o_youtube[1]

Monday, November 21, 2011 #


With the shortened Thanksgiving holiday work week, I had a blog ready but thought I’d just thank all of you for reading, watching and listening to the various pieces of content I produce.  I do appreciate it!

ps

Technorati Tags: blog, social media, comscore, music, statistics, blog traffic, web traffic, digital media, mobile device, analytics, video

Connect with Peter: Connect with F5:
o_linkedin[1] o_rss[1] o_facebook[1] o_twitter[1]   o_facebook[1] o_twitter[1] o_slideshare[1] o_youtube[1]

Links

  
Are you interested in:
Search DevCentral to get answers to your questions.

Blog Stats

Posts:285
Comments:98
Stories:0
Trackbacks:111
  

Tags

  

Post Categories

  Cloud Computing
  Security
  SSL VPN
  Information security
  pci
  PKI
  application attacks
  malware
  mitigation
  client security
  compliance
  notification laws
  social media
  social networks
  twitter
  facebook
  youtube
  digg
  peter silva
  social media stats
  ipv6
  ipv4
  2012
  context
  contextual aware
  user centric
  decision
  game show
  granular
  control
  identity
  cloud security
  virtualization
  sys-con
  cloud expo
  virtual
  glenn brunette
  sun microsystems
  Bruce Schneier
  Schneier on security
  research
  2009
  blog
  2010
  threat
  pci dss
  regulations
  espionage
  pentagon
  crown jewels
  tower of london
  health care
  banking
  prediction
  cybercrime
  cybercrime kits
  dyi
  dnssec
  dummies
  l0pht
  2600
  breach
  privacy
  breaches
  web security
  spam
  trojan
  gogrid
  blogger
  personal
  business
  H1N1 flu
  emergency preparedness
  disaster recovery
  network security
  oracle
  sso
  single sign on
  big-ip
  oracle access manager
  f5
  personal devices
  mobile devices
  mobile security
  windows
  microsoft
  windows 7
  desktop
  games
  gaming
  online games
  DDoS
  scams
  consolidation
  data center
  tech sector
  single purpose
  dedicated
  management
  access security
  policy enforcement
  utm
  processing power
  video
  audio
  multi-media
  dns
  webinar
  interview
  ioactive
  kaminsky
  dan kaminsky
  partner
  rsa
  xml
  splunk
  instructional
  in 5
  education
  training
  idc
  smart city
  smart grid
  infrastructure
  web 2.0
  standards
  inter-cloud
  interoperability
  application mobility
  peering
  confusion
  cloud confusion
  cloud survey
  edge gateway
  v10.1
  history
  words and meanings
  lists
  fun
  patent
  intellectual property
  trade secrets
  confucius
  cloudfucius
  series
  blog series
  a-z
  law
  constitution
  court
  fourth amendment
  gps
  government
  legal
  vmotion
  vmware
  case study
  interop
  v10.2
  database
  csrf
  asm
  adc
  arx
  data manager
  netapp
  storage
  WAN optimization
  application delivery
  optimization
  compression
  whitepaper
  statistics
  cloud research
  cloud stats
  LTM VE
  travel
  firepass
  encryption
  music
  humor
  uptime
  cloud outage
  SLA
  availability
  customer
  vmworld
  yankee group
  sports
  NFL
  performance
  acceleration
  peoplesoft
  rman
  recovery manager
  oow
  openworld
  replication
  integration
  apm
  wi-fi
  numbers
  firepass
  risk
  open source
  authentication
  smart card
  kerberos
  Business Challenges
  evidence
  SSL
  SSL offload
  NIST
  2048-bit
  certificate
  rss
  blog analytics
  web traffic
  e-cards
  hardware
  support
  diagnostics
  iHealth
  apple
  iPhone
  iPad
  iOS
  itunes
  smartphone
  v10.2.1
  citrix
  vdi
  parody
  satire
  entertainment
  andriod
  virus
  google
  mac
  comscore
  ID theft
  social security
  ssn
  synthetic ID theft
  credit report
  data privacy
  cyber threat
  reports
  50 ways
  2011
  trade show
  silva
  emc
  emc world
  ixia
  viprion
  ssl tps
  vCMP
  outtakes
  acting
  theatre
  tokens
  vpn
  remote access
  intrusion 2.0
  toys
  v11
  ajax
  SANS
  devcentral
  whitehat
  sentinel
  waf
  scanner
  grossman
  iApps
  wan op
  file virtualization
  hawaii
  emea
  ipexpo
  london
  UK
  human behavior
  risk managment
  tech center
  secure vault
  fips
  appliance mode
  copyright
  pearl harbor
  Dec 7
  punchbowl
  honolulu
  staffing
  jobs
  irules
  AppSec
  TradSec
  icsa
  v11.1
  community
  

Archives

  

82,243 Members in 102 Countries and Growing!

Join DevCentral Today!

About DevCentral

DevCentral has been a successful, thriving community for many years. We have always strived to bring you the best technical documentation, discussion forums, blogs, media and much more that we can.

So dive in, get familiar with DevCentral. We hope you like it, we hope it makes your job easier, and lets you get that much more power out of the community. To learn more, make sure to check out the Getting Started section. And if you have any problems, or think something could be easier to use, drop us a line to let us know.

Got It !

We've received your comment and transmitted it directly to DevCentral HQ.

Thanks for taking time to let us know what's on your mind. At DevCentral | Community Matters!

Get In Touch With Us

Have questions, suggestions or just want to get something off your chest?

Use our handy form below to Direct Connect with DevCentral Mission Control.

Send Us Feedback       or
Copyright 1996 - 2011 F5 Networks, Inc.

Powered by the DevCentral Crew  |  Privacy Statement   |  Terms Of Use  |  Code of Conduct

Page generated faster than you can blink!