devopsy.kinsta.cloud

Category: IT Security

  • MongoDB, Storj Labs Work to Reduce Data Security Costs

    MongoDB, Storj Labs Work to Reduce Data Security Costs

    MongoDB Inc. and Storj Labs announced today they have jointly created a backup service for the open source MongoDB database that leverages a global network for excess storage capacity.

    Storj Labs has created a Tardigrade Decentralized Cloud Storage Service based on an open source object storage system that is compatible with the S3 application programming interface (API) defined by Amazon Web Services (AWS). That object storage system distributes 80 slices of a file across a subset of thousands of nodes that each contain only a slice of the data required to reconstruct that file when needed. Only 29 of those slices are needed to reconstruct a file, which enables IT teams to secure data without having to manage encryption keys.

    Via a connector from Storj Labs, the Tardigrade Decentralized Cloud Storage Service now can be invoked via MongoDB DevOps Manager, which is made available in the commercially supported enterprise edition of the open source databases provided by MongoDB Inc.

    Storj Labs CEO Ben Golub said the Tardigrade Decentralized Cloud Storage Service provides a less expensive alternative to backup and recovery platforms based on the cloud, as excess capacity on devices ranging from servers to individual desktops is readily available, The challenge has been finding a way to marshal all that excess capacity in a way that makes it simple for IT organizations to consume, he said.

    IT organizations, Golub said, should expect Storj Labs to build additional connectors to databases and other platforms that require a less expensive approach to data protection. In the wake of the economic downturn brought on by the COVID-19 pandemic, he noted, more organizations than ever are open to innovative approaches to reducing storage costs.

    Of course, most IT teams are well-used to employing a range of data protection platforms to back up and recover data. The Tardigrade Decentralized Cloud Storage Service is likely to be viewed as one more option that might find traction at a time when the number and types of databases being deployed across the enterprise continue to expand rapidly. Developers are especially fond of adopting open source document databases that don’t require a database administrator (DBA) to get approval for a license from a central purchasing organization. It’s usually not too long, however, before developers look for help from central IT to manage all those databases, especially after an application is deployed in a production environment.

    Naturally, not all those applications are of equal value, so given the current economic climate, there might be a greater willingness to at the very least experiment with alternative approaches to data protection.

    Regardless of platform, however, the one thing that is clear is data protection alongside the rest of IT infrastructure is being driven more by APIs. As such, responsibility for data protection is also being pushed further left toward DevOps teams, who have the expertise required to continuously automate back up and recover using APIs. That might not always sit well with traditional IT administrators who have been using tools based on graphical user interfaces (GUIs) for decades. Nevertheless, IT times are clearly changing.

  • Fortanix Adds Platform to Manage Confidential Computing on Azure

    Fortanix Adds Platform to Manage Confidential Computing on Azure

    Fortanix today announced that a software-as-a-service (SaaS) platform for managing instances of confidential computing on the Microsoft Azure cloud is now generally available.

    Confidential computing is an emerging approach to encrypting data while it is running in memory. Today encryption is only applied to data at rest. Confidential computing makes it possible to set up secure enclaves for processing encrypted data in memory, which has become an increased source of concern for vulnerabilities in IT environments.

    Faiyaz Shahpurwala, chief product and strategy officer for Fortanix, said Confidential Computing Enclave Manager provides IT teams with a SaaS platform that enables them to provision a confidential computing environment, verify the integrity of those environments and manage the application life cycle for secure enclaves. Applications running on secure enclaves are built using Docker containers and images.

    Fortanix, along with Alibaba, Arm, Baidu, Google Cloud, Huawei, Intel, Microsoft, Red Hat, Swisscom and VMware, is a member of the Confidential Computing Consortium, an arm of The Linux Foundation. Confidential Computing Consortium projects include a Software Guard Extensions (SGX) software development kit (SDK) from Intel, an open source Open Enclave framework that allows developers to build Trusted Execution Environment (TEE) applications using a single enclaving abstraction, and Enarx, a project providing hardware independence for securing applications using TEEs.

    Microsoft earlier this month made available a DCsv2-series of virtual machines (VMs) that provide access to a TEE based on Intel SGX. Fortanix, for its part, already makes available a Fortanix Self-Defending Key Management Service on Azure.

    Shahpurwala said over time most applications will take advantage of trusted computing environments. Most of the initial use cases will focus on applications in which data privacy and securing personally identifiable information (PII) is critically important, he said.

    In the meantime, cloud service providers are racing to make available platforms for building and deploying TEE applications. Less clear is to what degree those environments will be integrated with DevOps platforms. The Confidential Computing Enclave Manager provides a management framework from which to begin that process. The Confidential Computing Enclave Manager also provides tools to convert applications to enable them to run on Intel SGX.

    There may come a day when confidential computing makes security a core element of any DevOps process. As such, the idea that there needs to be a distinct approach to DevSecOps may in time fade away as security becomes a series of infrastructure capabilities that are invoked programmatically. As that approach matures, application security would simultaneously evolve to become a natural extension of any quality assurance process.

    Of course, it may be a while before confidential computing is employed pervasively. Not every IT team has made the switch to containers to build applications. However, given all the focus these days on data privacy regulations it’s clear the requirements for protecting data within an IT environment are becoming more stringent with each passing day. The challenge now is finding a way to address those concerns during the entire application lifecycle management process in a way that doesn’t slow down the rate at which applications are being built and deployed.

  • 4 Things to Do When Running the Iot Zoo

    4 Things to Do When Running the Iot Zoo

    Zoos are fascinating places. In just a few acres you can encounter all kinds of interesting, rare and exotic animals from different parts of the world and from different ends of the food chain. But, what keeps the tigers from eating the zebras or even the visitors? Segmentation. Walls, fences, cages and other barriers that keep every critter safe and well behaved. The same concept is vital to the proper security of Internet of Things (IoT) and operational technology (OT) devices. As these devices proliferate, it is segmentation that keeps them all safe and well behaved.

    Here’s what I mean.

    The modern enterprise consists of a huge variety of network-connected devices that play different roles in making the network operate properly, provide services to customers and partners, and that allow employees to do their jobs quickly and efficiently. Once deployed, however, it can be difficult to track and monitor IoT devices—and you can’t manage what you can’t see.

    Using the zoo analogy, if your devices are allowed to roam freely, some will be forgotten and others will act in unexpected ways. There will be unmanageable chaos. But, if the animals are categorized, monitored, segmented and cared for, the zookeeper can keep things operating in an orderly manner.

    If you are among those struggling to keep your IoT and OT device menagerie in line, I have bad news. Your challenges aren’t getting any easier. According to some estimates, there will be between 41.6 billion and 83 billion IoT devices connected to networks by 2025. Those estimates were made before the outbreak of the COVID-19 pandemic. Now that a Pandora’s box of remote work has been opened, there’s a strong chance trends like distributed workforce, manufacturing automation and mobility will result in a sharp acceleration in the use of IoT devices, pushing those numbers higher. Making matters worse, many of those devices will connect to networks unnoticed, unmanaged and unsecured.

    Healthcare is already among the industries feeling the effects of most sharply. Healthcare organizations rely on connected devices to perform their jobs and deliver the highest quality of care possible. It’s not just medical devices like insulin pumps, EKG machines and ventilators. Sophisticated healthcare facilities rely on connected devices for security monitoring and access control, administration, environmental control and IT operations management. The health, security and usage of non-medical devices can impact patient care so, for instance, IP-enabled elevator systems are needed to transport patients while HVAC systems can impact air quality in operating rooms. Protecting and managing IoT and OT devices is especially important in healthcare organizations post COVID-19, as we will be dealing with the aftermath of a surge of new devices being deployed.

    Right now, roughly 15 million IoT devices are being used by healthcare professionals worldwide. Hospitals use an average of 10-15 devices per bed, collecting and communicating highly sensitive protected health information (PHI). It’s no surprise, then, that 82% of healthcare organizations have had their IoT devices targeted. The risk increases when devices used by medical personnel cross from professional to personal use. A tablet used to enter a patient’s PHI and check email makes the network it’s connected to more vulnerable to phishing scams and ransomware. Unfortunately, with hospitals focused on responding to the pandemic, some malicious actors see it as an opportune time to strike.

    What can be done to mitigate the risk? If I ran the IoT zoo, there are four steps I’d take to figure out what was running wild and wrangle everything into its pen.

    Discover and Inventory

    You can’t manage what you can’t see, so complete, real-time discovery of IoT devices is critical. Step four of segmentation is unachievable without proper visibility and classification of devices. The fidelity of visibility and classification of devices is key, and needs to consider ephemeral assets that may go online and be brought up in a different physical or network location. We’ve seen this situation be exacerbated during the COVID-19 pandemic as new network-connected devices are rushed into service. 

    Baseline and Monitor Behavior

    Once you’ve taken inventory, you need to map how devices communicate and with what. Devices use a variety of protocols and communication patterns. Baselining what is normal is crucial to identify when devices start behaving badly. For example, without proper traffic monitoring, we won’t know that the baboons are attacking the pangolins every night. 

    Identify Risks

    With a baseline for recognizing bad behavior, you can identify anomalies that signal potential compromise, high-risk devices such as those running obsolete operating systems and devices with medical or FDA-advisories. The fragile, rare or highly valuable animals can be managed differently than a common “low value” asset, like a sparrow. Look out for solutions that tout their cybersecurity prowess with threat alerts but without providing ways to resolve the issues.  

    Segment and Secure

    Finally, with devices visible and categorized, and associated risks identified, your next step is to secure them. Since you cannot deploy endpoint agents, devices need to be properly secured using appropriate segmentation policies. The key is doing this in an automated manner that is scalable and operationally feasible, and uses the infrastructure that the organization has already invested in—networking products, firewalls and network access controls (NAC).

    And, with apologies to Dr. Seuss, I’ll leave you with a final thought:

    It’s an IoT zoo, said the young CIO, but the people who run it, don’t know what to do. 

    If I ran this zoo, said the young CIO, I’d make a few changes. That’s just what I’d do. 

    The monitors, HVACs and all of that stuff, are not secure or well managed. It’s not good enough! 

    I’d ID and segment, assign policies, too. The old ways just don’t cut it. Time for something new!

  • Three Priorities for IT Operations Continuity During the COVID-19 Pandemic

    Three Priorities for IT Operations Continuity During the COVID-19 Pandemic

    The world has been turned upside down amidst the COVID-19 pandemic, and organizations that are trying to maintain best IT and security practices are faced with new challenges such as sudden remote workforces, increased COVID-19-related phishing and business e-mail compromise scams, and quarantine-imposed travel restrictions. 

    Are you facing disruptions in your workforce, limitations in the supply chain and up-ended disaster plans? You’re not alone. A recent survey, Critical Gaps in Business Continuity Plans: Exclusive Survey Results, reported that 62% of businesses surveyed have business continuity plans, but 48% said their plans only cover emergency operations for two to three weeks.

    With increased limitations affecting enterprises, what are the top three things organizations must prioritize for optimal security and minimal outages to aim for business as usual?

    Consider the Cloud

    If you have been considering the cloud for your IT and information security infrastructure, now might be the right time to explore all your options and make strategic moves. Eighty-three percent of enterprise workloads will be in the cloud this year, according to a recent LogicMonitor cloud study, and security hardware and applications will be no exception to that trend. The cloud can increase your capacity and facilitate remote access to vital business functions, especially now when redundancy and scalability are more important than ever. 

    For example, the cloud could be a temporary solution for a retailer whose existing payment processing infrastructure is overloaded and declining transactions as a result. It doesn’t replace their existing on-premises environment, but it augments it by adding on-demand scalability. This could cover a temporary surge in demand or stand in during a full-blown outage. Do you know whether your existing applications have cloud-based extensibility?

    Quite often, organizations aren’t aware of the cloud capabilities they can already utilize. During times of uncertainty, the cloud can be a good temporary approach and does not have to be a big expenditure. Organizations can pursue the cloud with a low commitment, month-to-month contract, and consider it more permanently at a later date.

    When moving workloads to the cloud, considering security is of paramount importance. Many public cloud providers such as AWS, Azure and Google Cloud Platform offer functions to help secure these workloads and applications, and one gaining a great deal of attention is encryption key management. All major public cloud providers offer methods for their users to self-manage the keys used to encrypt, decrypt, digitally sign,and validate data. This technology is known as Bring Your Own Key (BYOK) and is a high assurance method for letting organizations retain control of their own cryptographic keys even after moving to the cloud.

    Ensure Redundancy

    System failures are not an option in mission-critical environments, and redundancy will offer up backup to increase the reliability of your systems. Given the current COVID-19 situation, do you have backup resources that can continue to process data without interruption? What if your data center is out of service altogether? Do you have another that can keep your infrastructure operational? 

    As an example, let’s look at cryptographic key management. Numerous business applications offload private key storage to purpose-built devices known as hardware security modules (HSM). HSMs are tamper-evident, tamper-responsive servers typically certified to rigorous requirements such as FIPS 140-2 Level 3. A typical information security infrastructure may only have throughput requirements to justify a single encryption HSM that is partitioned to provide services to multiple business applications. But if this single HSM fails or must be taken offline, any application relying on it for cryptographic key management may also become unavailable. 

    In this scenario, the ideal data security infrastructure would comprise multiple HSMs along with at least one centralized management server, split between multiple geographically separated data centers. This example can be extended out to virtually any other type of IT hardware, but it is particularly important for resources representing a single point of failure, where their outage would have cascading impacts throughout your enterprise ecosystem.

    To mitigate these risks, talk to your vendors about data security and redundancy options; you might be surprised at their offerings. And consider more than just individual device outages, too. What if you can’t get into your data center? Taking a hybrid approach to infrastructure design, where you rely on a diverse set of tools to prepare you for a wide range of potential problems, will let you maintain the redundancy and high availability that your users and customers expect.

    Monitor Your Data Centers

    Now is the time to monitor your IT operations even more closely than usual to spot extremes and help with scalability and capacity planning. Can your infrastructure handle the increase of users and transactions? Are you accounting for handling higher volumes that come with an increasingly remote workforce? How would your organization handle a service disruption if you experienced an outage? Closely monitoring your IT and security resources to look for spikes and surges can guard against oversaturation and could help justify offloading workloads to cloud data centers.

    Malicious actors often ramp up their activities in times of crisis, specifically because they know that companies’ focus is otherwise occupied. Automated monitoring can greatly assist in preventing these types of attacks, but only if proper baselines and profiles are established. For example, looking at an enterprise cryptographic ecosystem, if a bank knows its HSMs are validating 10,000 PINs per second on average, and suddenly that number spikes to 100,000 per second, they should immediately investigate. Intelligent monitoring and health-checking technology is designed for these exact types of scenarios, as well as to identify infrastructure health issues so administrators can respond proactively rather than reactively.

    Your organization’s IT infrastructure and data security are depended on to be reliable, and your IT operations continuity effort needs to be prioritized now more than ever. Here’s to keeping your employees, and your IT infrastructure, in good health.

    — Ryan Smith

  • The Linux Foundation Throws Weight Behind Secure Microkernel

    The Linux Foundation Throws Weight Behind Secure Microkernel

    The Linux Foundation announced today it will host the seL4 Foundation, the nonprofit organization established by Data61, an arm of Commonwealth Scientific and Industrial Research Organization (CSIRO) in Australia that has been developing the seL4 microkernel operating system.

    Gernot Heiser, who will serve as chair of the new foundation, said the seL4 is unique in that it is mathematically proven to be secure, which provides a robust foundation on which a new generation of embedded systems can be built to drive, for example, internet of things (IoT) applications.

    Founding members of the seL4 Foundation include Data61, University of New South Wales in Sydney, HENSOLDT Cyber GmbH, Ghost Locomotion Inc., Cog Systems Inc. and DornerWorks Ltd.

    The hosting of the seL4 Foundation is sure to add more fuel to an increasingly fierce debate over the future of operating systems. Advocates of microkernels contend operating systems in terms of functions and size should be kept to an absolute minimum to both ensure security and maximize flexibility.

    Rather than loading functions into the operating system, most functions should be accessed in user space above the operating system. That approach allows organizations to take advantage of a modular architecture to swap capabilities out as they best see fit.

    However, supporters of traditional operating systems such as Linux and Windows contend organizations are better served by operating systems that run the same functions consistently. Linus Torvalds, who oversees the development of the core Linux operating system, has been especially critical of microkernel-based approaches to building operating systems.

    Between those two extremes have emerged containers, which package many of the functions once handled by the operating system into a container alongside application code to make it easier to run containers on multiple variants of operating systems. That shift has subsequently led to increased reliance on lighter-weight operating systems that only provide the basic functions required to run a container.

    Microkernel-based operating systems in time most will likely lend themselves better to many emerging use cases, especially on various emerging edge computing platforms where security is a paramount concern. The smaller the operating system, the less attack surface there is to defend. One of the issues that organizations of all sizes contend with today is the stack of software that needs to be defended is a lot larger than they may absolutely require.

    Of course, it remains to be seen how much momentum The Linux Foundation can generate for the seL4 project, which currently is supported only by a relatively small number of organizations. The degree to which organizations may back seL4 or some other similar initiative may come down to the degree to which they have grown tired of ceding control over what goes into an operating system to either Microsoft or the oligarchy that currently dominates the development of Linux. Regardless of where any organization falls on that spectrum, the one thing that is clear is given the scope of all the other open source projects supported by The Linux Foundation, it’s probable a lot more organizations are about to become a lot more involved in that debate whether they want to or not.

    — Mike Vizard

  • Taming the Shadow IT Beast and Runaway Spend

    Taming the Shadow IT Beast and Runaway Spend

    Do you know how much IT resources your employees are consuming?

    According to research conducted by the Everest Group, shadow IT spending accounts for a whopping 50% or more of the IT budget. Beyond these costs, shadow IT could end up costing you big in terms of a security breach: Gartner estimates that 33% of security attacks will be on shadow IT resources by 2020. Simply put, shadow IT isn’t just an expensive problem to have. It’s a threat to your business.

    You Can’t Blame Developers for Going Rogue

    DevOps and application teams are a key consumer of IT resources in your organization—they’re agile teams who need to get product releases out the door quickly. They need to get the job done, and will provision any resource that will get them there, even if it means going around IT.

    Still, you can’t blame these developers for going rogue: They need the right resources when they need them, and IT, busy responding to multiple tickets while juggling daily fires, can’t always meet those needs in a timely fashion. From a developer’s perspective, though, the fact that IT is firing on all cylinders to do their best doesn’t matter. For them, waiting days for resources may as well be an eternity.

    Giving Your DevOps Teams the Goods

    In a perfect world, DevOps and application teams would get access to the resources they need without the back and forth of ticketing systems, or the complexity of provisioning resources on systems that are totally unfamiliar systems. The latter is especially risky because it can introduce potential security holes that could be exploited by attackers.

    To this end, IT’s ultimate goal should be to enable self-service provisioning for DevOps and application teams. Creating a catalog that only serves up the resources relevant to the requesting team is one option here. Through blueprints, a repeatable way to orchestrate and automate provisioning of resources, this self-service nirvana becomes a reality: IT delivers resources in minutes, not days or weeks, and developers get what they need without putting the organization at financial and operational risk.

    Delivering Self-Service, but with a Safety Net

    Of course, IT wants to be as efficient and agile as possible, though not at the expense of control over cost and compliance. So, while enabling DevOps, IT also needs to monitor and contain cross-cloud spend.

    To accomplish this, IT can set automated quotas and limits, ensuring that user access to AWS resources, memory and more, is tightly controlled. They can also set up controls, such as power scheduling and expiration dates, to further control costs. As a result, VMs can’t be left on gobbling resources over the weekend, and demo environments shut down automatically when no longer used.

    From a security and compliance standpoint, IT can prevent teams from going rogue by determining who can do what. For instance, this could be who can orders servers, workloads and XaaS—along with quotas set for spend and resource usage—to who can approve fulfillment of those orders. This way, resources are never overprovisioned, and a real tally is kept as to exactly who is using which resources across the business.

    Taming the Shadow IT Beast

    With a better handle on cloud spend and resource usage, IT teams can put a dent in the 44% of IaaS compute spend stemming from non-production resources that are accidentally left running, according to ParkMyCloud. At the same time, they can stay on top of security and compliance, while still giving DevOps the tools they need, with orchestration blueprints that automate resource provisioning on a repeated basis. Taming the shadow IT beast, allowing developers to access resources in seconds with a self-service catalog, frees up IT teams to tame all the other beasts they face on a daily basis.

    — Brian J. Kelly

  • How 5G Mobile Networks Will Change IoT Security

    How 5G Mobile Networks Will Change IoT Security

    Depending on your location, you might have noticed a new 5G icon on your cell phone recently. The roll-out of the new 5G mobile network is largely a positive change for consumers and businesses. The fifth generation of cellular networks (hence 5G) purports to be one of the fastest wireless networks ever created.

    This technology claims to provide more efficient interconnectivity, and faster data transfers between people, objects and devices. All good things, right? But what security risks does 5G represent for the modern age?

    Some cybersecurity experts suggest that new vulnerabilities are versions of problems not entirely flushed out from 4G and even 3G networks. This article will attempt to explore some problems and opportunities that IoT security experts need to be aware of, and how savvy enterprises can be proactive about security in the age of 5G.

    Riding the 5G Wave

    A business’s potential is only as great as the technology they elect, as an organization, to adopt and use. One of the first benefits that 5G provides comes from the additional speed that the network provides. 4G posted average download speeds around 20Mbps. With a fully deployed and optimized 5G network, users should expect those download speeds to reach anywhere from 500 to 1,500Mbps. 

    Raw speed is one thing, being able to harness this type of efficiency is another. A Barclays’ poll recently reported that only around 28% of businesses understand 5G or the practical business applications the network offers. 

    Along with the challenges of leveraging the increased speed of the 5G network for business purposes, another important aspect of 5G education involves the security risks associated with faster technology. We suspect that if only 28% of businesses understand the practical applications of a 5G network, the awareness of potential security risks may be a similarly low figure.

    Getting Up to Speed on G Security

    While 5G touts a tighter grip on security, experts in the space will remind us that some of the concerning holes in the security of 4G, and even 3G, networks have been carried over into the rollout of 5G. Give credit where it’s due, the 5G security wins are associated with the encryption process which improves anti-tracking and spoofing features. This means that would-be criminals have a much harder time tracking and manipulating device connections.

    5G is also more software and cloud-focused than previous versions, which allows for better monitoring so threats can be spotted and mitigated more quickly. 

    While this is good for consumers, it’s not a perfect system by any means. “Stingray” devices can still be used to deploy fake base station attacks, which allow attackers to intercept mobile traffic and potentially manipulate data.

    Downgrade Attacks

    Purdue University and the University of Iowa outlined findings from design issues in the 5G protocol that exposed 11 vulnerabilities that may be exploited by bad actors. Five of these discovered vulnerabilities were carried over from 3G and 4G networks. Notably, a “downgrade attack” which essentially reverts the devices to use old mobile data networks. On top of potentially leading to higher wireless bills, this may allow attackers to track calls, texts or browsing habits on devices.

    If a device is forced to operate in a limited-service mode, an article in WIRED explains how IMSI numbers may also become exposed because of a downgrade attack.

    “One purported benefit of 5G is that it protects phone identifiers, like your device’s ‘international mobile subscriber identity,’ to help prevent tracking or targeted attacks,” stated WIRED. “But downgrade attacks like the ones the researchers found can bump your device down to 4G or put it into limited service mode, then force it to send its IMSI number unencrypted. Increasingly, networks use an alternative ID called a Temporary Mobile Subscriber Identity that refreshes periodically to stymie tracking.”

    Tips to Avoid Security Pitfalls in the Age of 5G

    In the age of the fastest speeds ever seen and nearly ubiquitous connectivity because of the rapid adoption of IoT devices, it’s becoming apparent that a zero trust model could help address security concerns with 5G and beyond. 

    This may require additional education to be available for employees, but an increase in security best practices for endpoint users is something that will benefit an organization tremendously. Zero-trust security models continually check the user’s presence and behavior within a network regardless of whether the user is human or machine. 

    It might seem like a great idea, but adopting the model isn’t a change to be taken lightly. A survey conducted by AT&T about 5G security indicated that just 33% of respondents reported they are currently using multi-factor authentication—the road to zero trust will take buy-in from executives and managers. 

    Sharing the Burden of Security

    The 5G rollout does provide built-in security features, but it should not be viewed as the Holy Grail. An organization will benefit from having a comprehensive security model, but that doesn’t mean they need to single-handedly oversee every aspect of that model. 

    5G is a combined effort that involves network operators and enterprises, and shared responsibility is essential for long-term success. Managed service providers should be considered by companies that may be short-staffed, or don’t have the in-house resources to cover other important areas of security, such as ransomware protection.

    Security within a business can’t exist in a silo, it’s a team sport—make sure you’re on the winning side.

    — Marty Puranik

  • 5G Security: Mitigating Threats in the Era of Hyperspeed and Hyperconnectivity

    5G Security: Mitigating Threats in the Era of Hyperspeed and Hyperconnectivity

    5G is one of the hottest industry buzzwords right now, and for good reason. Beyond its ability to deliver massive capacity, it is expected to be one of the fastest and most pervasive technologies of all time, fundamentally changing every sector of the economy.

    In recent years, we’ve lived through 3G and 4G. So what makes this next generation so revolutionary? Put simply, every emerging technology we are collectively excited about—IoT, VR/AR gaming, autonomous cars and smart cities—is enabled through 5G. This is because this next generation of the mobile network will increase the speed of service by extending high bandwidth and connectivity to the edge, a possibility that wasn’t quite there with 4G. 5G will connect everything around us via a network that is 100x faster than our current cellular connection and 10x faster than home broadband service.

    The technology is ready. From a commercial and business perspective, however, 5G implementation is still in its infancy. When it comes to capitalizing on the many use cases 5G offers, what is the holdup? With faster speeds, enormous data capacity, lower latency and more devices connecting and communicating than ever before, the security vulnerabilities are extreme. Given we are in the early stages of 5G deployments, service providers do not even know the full extent of the security concerns; they are just planning for the number of devices joining the network to grow exponentially. With the proliferation of connected personal devices, data privacy concerns have never been higher.

    To understand the potentially detrimental threats to personal safety and data privacy, we must first look at specific use cases enabled through this technology.

    The 5G Effect

    5G is more than just faster speeds—it is unlocking some of the most highly sought-after technologies of the decade. This is because low latency, or next-to-nothing lag time, allows a device asking something of the network to get a response almost instantaneously. For VR and AR gaming applications, this means a seamless user experience. And while sensory video games are good fun, these same principles can carry over to more serious applications in hospitals and other medical settings: By using a VR headset and special glove to control a robot arm, for example, a surgeon may have the ability to operate on a patient offsite.

    This extreme scenario offers two major risks: network lags and hacked equipment. An IoT-enabled hospital may have tens of thousands of “things” that could be compromised. Emergency room devices cannot afford to be starved for bandwidth if an admin printer is clogging the network. Any glitch in the network may lead to a slight delay in action, resulting in dangerous consequences. Additionally, with nefarious entries into the network through the high volume of vulnerable endpoints, the attack may have dire repercussions.

    A hospital is just one high-stakes environment. Now consider the IoT devices connected to a 5G network operating all around us—autonomous cars, energy grids, home security systems, etc.—the smallest glitch or endpoint vulnerability could lead to life-threatening situations.

    Many people do not realize 5G and IoT will have a major effect on seemingly innocuous devices such as refrigerators, thermometers and even light bulbs. While 5G will enable users to check on these types of appliances remotely through a simple app, convenience comes with consequence as these devices can also be usurped by malicious characters. It is important to recognize what 5G can enable, but also how it will all come together.

    Preparing for the Next-Gen

    Here are some tips on how enterprises can develop an effective 5G-ready security posture that encompasses the entire network:

    Invest in automation: 5G security poses its own Catch-22; because connections happen faster, attacks and breaches also happen faster and potentially with much more reach. To mitigate threats, 5G security will require actionable insights at scale. To achieve this, organizations need security systems that detect and automatically enforce security policy from endpoints to edge and every cloud in between.

    Scale up and out: To avoid a massive bottleneck, a proper 5G security posture will require upgrades to both physical and virtual infrastructures. Developing a secure architecture and solution that can keep up with the pace and scale of 5G without slowing it down is a large, but necessary, undertaking. The trick is to build in machine learning capabilities so the network can get smarter. Malware must traverse the network, so why not use all the data that the network already produces to fight it? A network that is constantly learning and updating is the only way to operate in the 5G landscape.

    Be proactive: History has shown us that whenever we expand our computing power and connectivity capabilities, we also expand the threat landscape. Not only that but as we continue to increase our dependency on communications networks and technologies to move tremendous amounts of data, there is greater potential for serious disaster should they be compromised. This is not the time to sit back and watch how things unfold, as major security risks are on the line.

    The use cases for 5G are plentiful. If we can conquer the threats, we can conquer anything the technology enables us to do—and the possibilities are endless.

    — Samantha Madrid

  • 5 Password Policies to Up Your Security

    5 Password Policies to Up Your Security

    Complex passwords can save users from being hacked—any IT admin will tell you that. Plus, countless studies and articles on password security have been published about why password policies are vital to online security. Increasing the length of passwords, adding complexity to them and never reusing passwords more than once … these are three examples of smart password policies every person and company should use. After all, stronger passwords contribute to users being safer online. And if users are safer online, then your organization is safer, too. However, your organization’s password policies must be adhered to and enforced for them to protect you from security breaches and hacks.

    Password Policies to Enforce for Greater Online Security

    Password policy enforcement generally refers to a number of different items, including the following five best practices:

    • Length of Password – Perhaps the strongest correlation with password strength is the length of the password. As computers have become more advanced, the amount of time it takes to hack a password has become significantly less. In fact, a password that worked a couple of years ago is a weak password today. Increasing your password length will keep your user’s devices more secure. Many IT admins now advise that passwords be a minimum of 12 characters, but we suggest increasing that to an 18-character minimum.
    • Alphanumeric Characters – Requiring upper and lowercase characters and numbers greatly increases the complexity of the password. Alphanumeric characters also increase the potential combinations of passwords, making it even more difficult for a password, and thus a device or account, to be hacked.
    • Special Characters – To increase the level of password complexity, require special characters in all passwords. This password policy alone adds another 32 characters that can be utilized to strengthen passwords. In combination with alphanumeric characters, each character in a password could have 94 different choices. Better yet, make that password have 18 characters and you have 1.78e119 number of combinations. Word to the wise: It’s more secure to have long passwords with many different character choices rather than just long passwords that contain only letters.
    • Password Aging – If your organization is required to age passwords after, say, 90 days, then you’ll want to leverage this enforcement capability and have all users update their passwords every three months. There is some debate in the security community if password aging does, in fact, increase security, but we’ll leave that debate for a different blog post. As a general rule of thumb: Updating passwords to at least the same length and complexity after a set timeframe can only help to increase online security.
    • Password Lockout – Another security mechanism that we advise adopting is the password lockout. That is, to lock a user out of his or her account after too many incorrect attempts to log in. The password lockout helps prevent hackers from brute-forcing their way into users’ accounts.

    Even in today’s cloud-operating and multi-device world, many IT organizations only leverage password policies if they are under compliance requirements to do so. But enforcing complex passwords by using the best practices listed above is the only way to guarantee your organization is safe from security breaches.

    Of course, you must decide where to enforce the above password policies that require everyone within your organization to use complex passwords. Ideally, there is an automated central system that enforces passwords across your entire infrastructure, including your endpoint devices, servers, applications and networks. A system like this, a directory system, would take the manual work out of enforcing password policies. Modern directory-as-a-service platforms offer the ability to enforce password policies across all devices, applications and your company’s network infrastructure.

    — Greg Keller

  • Achieving Full Disk Encryption and PCI Compliance

    Achieving Full Disk Encryption and PCI Compliance

    Full disk encryption (FDE) is a critical security measure in today’s modern networks. With data security being more critical than ever, many IT admins are wondering how they can enforce full disk encryption across their fleets of cross-platform systems. Many organizations are also subject to compliance regulations including PCI DSS, which require FDE as a part of their compliance requirements.

    What is FDE?

    Full disk encryption locks down a computer’s hard drive when said computer is powered off or at rest. If a computer with FDE enabled is stolen, the only thing the thief will make away with is the hardware; the data on the system will be encrypted and very difficult to acquire.

    FDE programs (BitLocker for Windows, FileVault for Mac) utilize a recovery key as a method of authentication. When a user logs into their FDE-protected system, the drive is unlocked using their associated username and password. But in case a user forgets their password, is locked out or the hard drive needs to be removed and accessed for any reason, an IT admin uses the recovery key to decrypt the drive. Given the crucial nature of recovery keys, IT admins need to store them in escrow; that is, securely stored and categorized in relation to the system it belongs to.

    What is PCI?

    The Payment Card Industry Data Security Standard (PCI DSS) is a compliance regulation that was created to ensure that credit card data is kept secure by companies that handle this critical customer financial information. PCI revolves around securing the cardholder data environment, or CDE, which houses all credit card information that passes through a company under compliance. There are 12 main requirements under PCI regulation, but Requirement 3 deals specifically with data encryption.

    Using FDE for PCI

    At its core, PCI Requirement 3 calls for installing proper security measures to protect data housed in the CDE. It is arguably one of the most important requirements for PCI altogether. FDE is an ideal way to ensure Requirement 3 compliance. By locking down at rest systems, IT admins can prevent unauthorized access due to a stolen laptop or hard drive.

    In regards to encryption, Requirement 3 also demands that cryptographic keys are securely stored and maintained. Using recovery key escrow, IT admins can ensure that only the right people have access to cryptographic keys and also monitor when they’re used for access and who uses them.

    How to Enforce FDE to Achieve PCI Compliance

    When it comes to enforcing FDE across Mac and Windows for PCI compliance, IT admins might find that their options are limited. Many FDE tools on the market are only capable of enforcing either Bitlocker or FileVault—not both. Since many of today’s IT organizations are heterogeneous with regards to system platforms, an FDE solution that can only enforce one or the other simply won’t do and admins would rather not implement multiple solutions to reach the desired end.

    Additionally, IT organizations need their FDE solution to securely store cryptographic recovery keys in escrow. This need limits the list of ideal FDE options even more. At the end of the day, with these requirements, there’s an excellent option that provides IT admins with a low overhead FDE experience suited for PCI compliance. Using JumpCloud’s Policies, IT admins can enforce FDE at scale across their Windows and Mac system fleets, escrowing individual recovery keys safely.

    — Zach DeMeyer