The website of the OpenSSL project, which provides a widely-used SSL/TLS implementation, was breached on 29th December and defaced (OpenSSL.org announcement). This defacement only affected the website of the project, however. The OpenSSL project has since checked the cryptographic hashes of the OpenSSL source code and confirmed that the source code has not been modified or compromised in any way. A compromise of the source code could result in a backdoor or other vulnerability being introduced. This is an important point since the Debian release of OpenSSL in 2006 had a bug which weakened the random number generator (wikipedia). However, the most worrying development of this breach is the way that the website was compromised, which was through the virtualization infrastructure of their hosting provider IndIT Hosting.
Whilst there are many potential avenues of attack against a website, what makes this attack notable is that instead of attacking the website directly, they attacked the hosting infrastructure of the website itself. In this case, it was the Virtual Machine hosting infrastructure operated by the openssl.org hosting provider. VMWare, whose products were used to host the OpenSSL website issued the following statement:
Read More »
It’s December and the 2013 cyber security news cycle has just about run its course. We’ve seen more and increasingly virulent attacks, continued “innovation” by adversaries, and a minor revival of distributed denial of services (DDOS) actions perpetrated by hacktivists and other socio-politically motived actors.
Against this, Cisco stood up tall in recognizing the importance of strong security as both an ingredient baked into all Cisco products, services, and solutions, and a growing understanding of how to use the network to identify, share information about, and defeat threats to IT assets and value generation processes. I can also look back at 2013 as the year that we made internal compliance with the Cisco Secure Development Lifecycle (CSDL) process a stop-ship-grade requirement for all new Cisco products and development projects. Read More »
Tags: asr, CSDL, CSO, cyber security, DDoS, John Stewart, security
With the adoption of the Internet of Things and Internet of Everything, advances in mobility and next-generation Wi-Fi are driving faster speeds, higher signal quality and more reliable connectivity. With the upcoming ratification of the two waves of the 802.11ac Wi-Fi standard, how are emerging Wi-Fi models creating new security features that are defining the next-generation Wi-Fi experience?
Next Generation Wi-Fi Models
Migration to the 5 GHz-only 802.11ac is quickly becoming a reality. In a recent article by Lisa Phifer, Chris Spain, Vice President of Product Marketing for Cisco’s Wireless Networking Group, discusses more about how this migration will drive a shift in mobile device support for 5 GHz. “An increasing percentage of new mobile devices provide dual-band capability, and they generally prefer the less congested 5 GHz band,” Spain said. New Wi-Fi models, like those listed below, can help drive mobile devices to the 5GHz band:
Read More »
Tags: 11ac, Cisco, CiscoMobility, connected mobile experiences, future of mobility, mobility, network, security, wi-fi, wifi, wireless
Language is a powerful tool.
With acronyms like ACL, IPS/IDS, and APT*, the security world has created its own language, acronyms, and catchphrases. In our industry, sometimes the meaning of more commonly used words can cause misunderstandings. For example, is a hacker a bad actor or a well-intentioned individual? Are all software bugs also security vulnerabilities? Can the terms feature, bug, and backdoor be used interchangeably?
A feature, a bug, or a backdoor might look like the same thing to some, but they are not. Imprecision in this area can breed misunderstandings. I believe that there are two key differences between a feature, a bug, and a backdoor: intent and transparency. Read More »
Tags: Backdoors, Bugs, features, intent, security, transparency
Most recently ESG/Vormetric came out with a threat report that highlighted the increase in insider threats & the significance to augment perimeter and host-based security. The rationale behind the increase was that more people are accessing the network, increase cloud and network traffic are making it difficult to isolate the problem.
Almost 50% of the organizations believe they are vulnerable to insider attacks and have or plan to invest dollars.
This is alarming!
The top methods noted for these insider threat vulnerabilities were abuse of access by privileged users, contractors, and other employees. Security professionals are finding it quite difficult to monitor the users, traffic, ports, etc to identify and mitigate insider threats. They must glean this information from multiple sources and many times need to translate the data. For example, “whose IP address is this and why is Mary from finance, who is supposed to be on vacation, downloading data from the payroll server?” This process slows the resolution time. The criticality of this type of contextual information is enormous to remediate quickly.
Security needs to be pervasive and consistent to manage these inside threats—so how does one do this? Integrate security into your infrastructure (wireless, wired, VPN)! Once security is woven into your infrastructure it provides the visibility and clarity to respond in a timely manner with a high degree of efficacy and is not dependent on distinct and isolated ingress points.
Read More »
Tags: insider threats, Lancope, network traffic, secure access, security, SIEM, vulnerabilities, webinar