devopsy.kinsta.cloud

Tag: hackers

  • Benefits and Challenges of DevSecOps for Business

    Benefits and Challenges of DevSecOps for Business

    Almost every day, there is a new tactic or technique discovered that hackers can use to disrupt a company’s systems, obtain critical data and information or steal money. Often attackers look to exploit vulnerabilities in code to carry out their attacks. Ironically, it’s usually a small piece of code that helps a business perform very simple tasks that can become the root of this serious issue (e.g., logging, report service and glue for application). In fact, it only takes one exploitation, vulnerability or human error to cause a data breach that, on average, costs $4.35 million. Some experts projected that by 2025, these breaches could cost a total of $10.5 trillion. Therefore, CEOs and other corporate executives should reflect on these incidents to ask themselves what would happen if someone entered their systems to exploit code and what it could mean for their company.

    The Problems That a Business Faces

    In traditional development practices, security serves a ‘gating’ function. Security checks are performed prior to releasing an application to production and, if issues are found, security stops rollouts. This can have disastrous ramifications.

    The unknown can be frightening, but that’s where DevSecOps can help. DevSecOps incorporates security into every step of the software development life cycle (SDLC) from requirements to architecture and design, coding, testing, release and deployment. By automating and integrating security practices into the software development life cycle, development teams can react to vulnerabilities sooner, automate security checks and proceed into production with a more reliable and secure product.

    The benefit is felt when a tactical vulnerability is discovered and the DevSecOps practice is already in place to ensure that it can be remediated with limited impact on the business.

    The Business Benefits of DevSecOps and Best Practices

    Streamlining the SDLC and including security checks (often automated) in the process early in the development cycle can identify a problem before it can negatively affect the bottom line of the development effort and the business. Having a vulnerability remediated early in the development cycle is an order of magnitude less expensive than one discovered just prior to production.

    DevSecOps works best in an organization where Agile practices have been adopted to swiftly enable continuous integration, deployment and scalability. The road to streamlining and automating these practices can be long, but when effectively applied, DevSecOps best practices reduce costs for the company and accelerates time to market.

    For DevSecOps to be effective, security must have a seat at the table when requirements are gathered and architectures are planned. This integration of work practices ensures that risks are identified early and can be mitigated well before an application is launched in production.

    Using that same connection with operations, security procedures should be established to feed new vulnerability discoveries into the pipeline for remediation. However, implementing DevSecOps isn’t a magic fix and it won’t happen immediately. But why can it be so hard to implement?

    Overcoming the Challenges of DevSecOps

    There are many difficulties when it comes to implementing DevSecOps. Here are two of them:

    1. Cultural Shift:
    Leading with a DevSecOps approach requires a huge culture shift within the organization that challenges the way many departments operate today. Many employees might find it difficult to drastically change what they’ve been doing for years. Another roadblock is the belief that better protection slows down processes and restricts innovation. Quick code production is a goal for developers who want to meet the demands of businesses, while on the other hand, security teams are focused on making sure the code is secure.

    Thorough training for both security and development experts will help overcome some cultural obstacles but integrating the goals and objectives of both teams will push the adoption of DevSecOps practices. Organizations will begin to see security align to faster time and flexibility of solutions while developers will begin to adopt a security-first mindset.

    2. Complex Tool Integrations:
    Most DevOps toolchains are produced by different vendors. Teams select source code management, continuous integration/delivery (CI/CD), build tools, binary libraries, code review and problem monitoring solutions based on their unique needs. Adding security tools into that pipeline can create a challenge for ensuring the best results for both teams.

    Security analysis in the development pipeline is done with tools that perform software composition analysis (SCA), static application security testing (SAST), and some form of dynamic testing. Integration into the pipeline of these tools is significant and creates difficulties for developers. The developer must know the intent of the scan and what to do with the problems they uncover. It is important that developers have an accurate understanding of where the problem arose and what the issues mean. However, combining and comparing the results and data of many vendors’ resources might be challenging.

    The best course of action would be to consolidate your solutions. This will not only make things simpler for the developer and the organization, but it may also reveal threats that the organization wasn’t previously aware of.

    Overcoming these obstacles is not an easy task, but it is possible. Once a DevSecOps approach is accepted and fully implemented across your company, you can expect code to be developed with fewer bugs and security risks. The cost of deploying code will also eventually decrease, and at a pace that helps the organization maximize its return on investment. Overall, systems created within this process will be significantly more flexible and capable of adjusting to modern-day threats and change in the midst of a digital transformation.

  • Benefits and Challenges of Bug Bounty Programs

    Benefits and Challenges of Bug Bounty Programs

    Trying to get ahead of the bugs and vulnerabilities that cause security breaches and hacks has become an increasingly high priority in recent years across a variety of industries. With a growing cybersecurity skills gap and short-staffed security teams, many organizations are turning to bug bounty programs to expand their breach prevention capabilities beyond their internal teams. 

    How Do Bug Bounty Programs Work? 

    These programs represent reward-driven crowdsourced security testing where ethical hackers that are able to successfully discover (and report) vulnerabilities to companies are rewarded by the organization that was hacked.

    Further classification of bug bounty programs can be split into private and public programs. Public programs allow entire communities of ethical hackers to participate in the program. Usually, these wide-ranging programs can be either time-limited and open-ended. On the other hand, private programs are generally limited to a smaller, hand-selected sub-group of hackers that are scoped to specific targets. These private programs often take place through commercial bounty platforms, where hackers are selected based on their reputation, experience and skills.

    One company that exemplifies the growing bug bounty trend is Microsoft. It has consistently been involved in these types of efforts over the years, and the latest example is its new Xbox Bounty Program. It followed RockstarGames’ decision to make its bug bounty program public, inviting hackers to test its platform for a wider range of vulnerabilities. So what does a successful program look like?

    The Xbox Bounty Program

    The Xbox Bounty Program, for instance, invites gamers, security researchers and others from around the world to help identify vulnerabilities in the Xbox Live network and services, and share them with the Xbox team. Qualified submissions are eligible for bounty rewards of $500 to $20,000. If you find a major bug in an Xbox Live service and report it to them, you could get paid for it.

    The following are examples of vulnerabilities that may lead to one or more of the security impacts Xbox is looking to address: 

    • Cross site scripting (XSS).
    • Cross site request forgery (CSRF).
    • Insecure direct object references.
    • Insecure deserialization.
    • Injection vulnerabilities.
    • Server-side code execution.
    • Significant security misconfiguration (when not caused by user).
    • Demonstrable exploits in third party components.

    Bug Bounty Benefits

    Traditional penetration testing services sometimes generate a culture of fear due to meeting compliance requirements, but bug bounties are different. Bug bounties are about creating a culture of openness, transparency and responsibility.

    People are consistently looking to hack every game console on the market and many applications/websites as well, whether it’s for good or for bad. For organizations like Microsoft, it’s important to bring the dark side over to the light by making hackers ethical with their participation in the bounty programs.

    Ethical hackers help businesses detect vulnerabilities before the bad guys beat them to it. In other words, running a bug bounty program is getting ahead of the game by being proactive and predictive. A bug bounty is an alternative way to detect software and configuration errors that can slip past developers and security teams, and later lead to big problems.

    Bug bounty programs and responsible disclosure programs are extremely beneficial for Microsoft, and organizations in general, because they give curious people a legal and positive way to express their curiosity.

    In a previous life, I was a white hat hacker like this. I never reported anything I found, but if there had been a system in place like a bug bounty, I would’ve taken full advantage. Having these programs in general is great for organizations to find bugs, but it’s also important for them to ensure they are reported. 

    Bug Bounty Challenges

    While bug bounties have numerous benefits as outlined above, it’s also important not to over rely on bug bounty programs. Since these programs are incremental, they don’t eliminate the necessity of securing software development system scans or testing.

    Before diving into the program, it’s also important to define the scope of the bounty program. You must have unquestionable clarity about the authorized conduct framework, and you must decide what proof you’ll require to confirm a hack and how and when people should share that information.

    Bounty program legal rules can sometimes be written poorly as well, allowing hackers to stray outside of the boundaries–despite the potential legal risk. A lot of bug bounty reporters are just shoving their world’s view onto the organization holding the bounty programs. It’s nowhere near the majority, but you see it a lot with younger people.

    It will take advanced planning and agreement with security teams, operations and developers to ensure the procedures are in place to tackle such incidents when they arise. But all in all, the benefits of bug bounty programs significantly outweigh the challenges they pose. Every day around the world there are new breaches grabbing news headlines. Bug bounties are one of the ways to help keep organizations out of those headlines, and continue on the path to a safer digital life.

    — Bryan Becker

  • Server Security: Minimizing Risk in 3 Steps

    Server Security: Minimizing Risk in 3 Steps

    Servers located directly on the internet run one of the highest risks of being compromised. It’s just too easy for hackers to find an open “door” or “window” into those servers and then tap into confidential data, systems and information. Companies can’t afford to put their private information at risk, but an increasing move to cloud-based business solutions inherently increases the risk associated with data.

    The good news is, if your organization leverages cloud infrastructure, there are ways to mitigate the risk.

    It takes vigilance—and constant upkeep—but cloud-based data on internet-based servers can be just as safe and protected as on-premises servers.

    In this post, we highlight three steps you can take to significantly protect your infrastructure from being compromised and ensure that you are properly securing your servers.

    Step 1: Shut Down Access

    As admins install appropriate software packages and applications onto servers, invariably ports are opened and services are enabled. This makes a security breach for a hacker easier and easier. Essentially, the more ports and services you tamper with, the more surface area there is available for hackers.

    Depending upon your architecture, see if you can keep ports open “behind” the firewall in a VPC environment. This helps ensure that the fewest possible ports are opened to the public-facing internet, but you’re still able to accomplish your job. You can also specify which servers or services communicate with your AWS machines if you happen to use them (or with your IaaS provider of choice).

    Step 2: Patch Your Servers

    If you have ports or services that are open publicly, it is imperative that they are patched to ensure you are securing your servers. Admins should be updating patches on their servers as often as new data or systems allow them to, for the most attainable risk-mitigated servers. To make effective patches, there are four main steps you can take:

    1. Stay informed about the most crucial updates to cloud computing (Microsoft releases updates monthly).
    2. Automate your patch process.
    3. Test your patches thoroughly and frequently to maintain the highest level patch and to anticipate any errors in your system that hackers could get around.
    4. Verify that all your patches are functioning as designed (this last step could include periodic scans with Microsoft Baseline Security Analyzer, or another vulnerability assessment tool, to make sure all servers are patched and up to date and/or spot-checking individual machines for proper patches).

    Step 3: Tightly Control User Access

    Finally, consider tightly controlling user access to all of your servers. Ideally, admins have complete control in administering access privileges, both individual and group, so that employees have the access they need to do their jobs and nothing more. This tight control limits the amount of access a hacker would have if one user’s identity was compromised. Limited access acts as an obstacle a hacker has to work around to get to his goal: your data.

    The more granular an IT admin’s user control, the better the overall security for the organization.

    To do this, apply standards of access permissions, authentication and authorization for your IT admins to implement. Double-check that permissions are accurate by checking individual devices and ensuring their permissions are correct. Additionally, implement IT technologies that automatically sync changes in user accounts. The technology you need should work seamlessly with Windows, Macs, Linux and other devices to prevent any terminated user ad hoc access to accounts due to their aberrational device.

    Please note that this is a quick-hitter list. These should be the minimum things that you should be doing. Are all of your ports shut down? All servers patched? Are you sure you have control over everybody accessing your servers?

    There are any number of additional tools, technologies and processes that you could use to help protect your cloud server infrastructure. IaaS is incredibly powerful. Take the steps that you need to take to protect you and your organization from being the next victim.

    — Greg Keller

  • DevOps: Here’s How to Slack Securely

    DevOps: Here’s How to Slack Securely

    With 1.7 million daily active users, it’s clear Slack has come to dominate the team chat world, especially in the tech industry. This, however, means that a fair amount of security is required to ensure that strategic assets remain safe.

    From a security perspective, Slack has done a solid job of keeping its assets on lock, going so far as to score Geoff Belknap from Palantir in 2016 as its chief security officer. The company is also transparent about its approach to security and has dedicated a whole section of its website to it, including interviews with Belknap and others that delve into Slack’s precautions and philosophy around security.

    The company has also certified many of its products to meet strict compliance regulations including FINRA, HIPAA and SOC 2 and 3, which makes it a no-brainer for small teams and enterprises alike.

    So, it’s perfectly possible for companies of all shapes and sizes to lean on Slack for team chat and ops without worrying too much about security. However, no one’s perfect, and Slack’s ubiquity and popularity mean it will always be a target for cybercriminals looking to steal information—that’s basically the nature of being a cloud-based application.

    While, there’s no need to run scared, you do need to be smart about how you use this valuable tool. Here are a few tips for running Slack securely at your organization.

    Use Slack for SecOps

    Slack can be easily used for distributed security alerting, which means every member of your organization can play a role in keeping the business secure.

    Your security operations likely include members of the DevOps team as well as dedicated security folks, and Slack can help all team members integrate security into their workflows seamlessly. DevOps folks may not frequently log in to Threat Stack platform directly. However, any relevant alerts or notifications can be sent to them immediately via Slack, where they can be reviewed and the determination can be made whether further action is needed—all without having to step outside the daily workflow. This means security tasks don’t pose an extra headache, but are just a natural part of the way the company’s operations run.

    Require Two-Factor Authentication

    Slack’s built-in security precautions won’t do you much good unless you actually put them into practice. One great example is two-factor authentication (2FA). It’s up to team owners and admins to require this of their users (otherwise, it will be optional, and most users won’t bother). It is highly advisable you take advantage of this feature, which makes it much more difficult for hackers to tap into your organization’s Slack channels.

    Set Up User Provisioning and Deprovisioning

    Security-minded organizations need to be conscious of and work around insider threats. This also includes employees who have left the company, whether on their own terms or due to an incident.

    To ensure that you do not have any “lurkers” who might be able to take advantage of company information shared on Slack after they have left the company, it’s a good idea to plan ahead for user provisioning and deprovisioning.

    In fact, this should be built into your process for onboarding and offboarding employees, just like it would be for email or any other company asset. If possible, automate the process, so that the moment someone leaves the company, they no longer have access to Slack. To get started, here’s Slack’s guide to provisioning and deprovisioning users.

    Don’t Share Secrets

    Slack is a great place to have secure conversations, which unfortunately can lull some users into a false sense of complete security. “Secure” doesn’t mean you should treat it like it’s watertight; in other words, Slack should never be used to share secrets such as passwords, sensitive customer data or valuable corporate IP—basically, anything that could be considered highly confidential. A good rule of thumb is this: If a piece of information could be dangerous in a hacker’s hands, it doesn’t belong on Slack. Instead, it’s a good idea to use encrypted communication channels, like PGP-enabled email.

    Educate Users

    None of the tips above will do your organization any good if no one knows about them. So make sure that you regularly educate your users about steps they need to take to stay secure while using Slack (such as never sharing passwords there). You should hold user security training whenever new employees come on board, and also make sure to do a refresher now and again with the entire company.

    Additionally, if you change up security protocols around tools like Slack, make sure employees are given a heads up and reminded when new measures go into effect so they know what to expect. Remember: The best offense is a good defense.

    Don’t Slack on Security

    Slack is a great platform with all kinds of benefits for teams. As long as you take the right security precautions, there’s no reason why it can’t be used to its full potential on your team, whether you’re a small shop or a multinational enterprise. As with any other tool, the shared responsibility model is key. Take responsibility for your half of the security equation, and you should be well on your way to a secure Slack implementation.

    — Pete Cheslock

  • Meeting the Need for Speed in Cyber Threat Response

    Meeting the Need for Speed in Cyber Threat Response

    In the very early days of the internet, hackers most likely were “lone wolves.” They might be an unhappy customer, a disgruntled employee or a tech-savvy youth who just wanted to see if he could breach a target’s defenses.

    Occasionally, hackers might aspire to more devious crimes including identity theft, blackmail, theft of trade secrets, exposure of personal information or monetary theft. These types of hackers were annoying, unnerving and potentially dangerous, but they seldom caused widespread damages or serious financial losses. Today, however, cybersecurity professionals face an entirely new group of hackers and an escalating number of attacks—and security strategies and tools have not been able to keep pace.

    The Modern Hackers

    The greatest source of risk comes from well-financed, sophisticated hackers who often are connected to a government that sanctions and supports their activities. These groups constantly refine their already impressive skills and they are patient as well as persistent. They know how to circumvent defenses that rely on signatures or pattern matching, and they are adept at launching attacks that may take months to achieve fruition.

    For example, sophisticated hackers may launch an upstream attack aimed at companies that make the products that others use for security, including SSL certificates and other digital credentials. These credentials are then used to steal money, intellectual data or other information from the group’s real targets. Hackers can also attack in stages, such as first going after information that will give them access to an organization’s network, allowing them to conduct whatever mayhem they want on their own schedule. They may install an encrypted “zero day” attack, for instance, or simply wait until a desirable piece of intellectual property is completed.

    Why Speedy Responses Are Essential

    The longer that a breach goes undetected, the more damage the incident will cause. It is a bit like having an undetected roof leak; the longer the leak allows water to penetrate beneath the roof, the more damage the water will do to the structure.

    Unfortunately, most organizations are not doing a very good job of detecting breaches quickly. In 2014, the Verizon Data Breach Investigations Report revealed that 43 percent of all web application attacks were not discovered for months, and 85 percent of the point-of-sale intrusions went undetected for weeks. Other breaches have gone without detection for years, such as the Excellus breach that lasted 18 months and the allegedly state-sponsored “Project Sauron” attack that was in operation for almost five years.

    When attackers have months or years to access a victim’s network, they have ample opportunity and time to inflict a substantial amount of damage. They can even expand their attack to infiltrate the networks of the original target’s customers or vendors. Interestingly, a study conducted by the Ponemon Institute found that approximately 33 percent of all attacks were not detected for two years — and two-thirds of the attacks were discovered by a third party rather than the compromised organization.

    However, a report issued in June 2016 by the Business Continuity Institute indicates that many organizations are making progress when it comes to responding to cyberattacks. BCI surveyed 369 organizations in 61 countries. Approximately 66 percent reported that they had suffered at least one attack during the previous 12 months, and 15 percent reported that they had suffered 10 or more attacks. Roughly 31 percent claimed that they responded to attacks within an hour, but 19 percent said that they took at least four hours to respond. Approximately 24 percent were hit by a denial-of-service attack, while 45 percent suffered a malware attack; both forms of attack rendered the organization’s network inoperable or contaminated.

    Responding Quickly to Attacks

    Although most cybersecurity professionals know that response time is critical, not all of them understand the best ways to ensure that the speed is there when needed.

    • A speedy response starts with an effective incident response plan. The plan should be based on a thorough assessment of threats, risks and potential failure modes, and it should be updated frequently and available to all parties.
    • “Practice makes perfect.” Response teams should have ample opportunities to practice their tasks through frequent “dry runs.” Instead of wasting time trying to determine what they should do when an attack does happen, they can react reflexively.
    • Automation can greatly reduce the amount of time required to respond to an incident. For example, without automation, if a breach occurs, staff members might have to manually check 5,000 or more endpoints. However, an automation platform can collect, analyze and report on the activity in much less time.
    • Increase visibility across the different domains and systems. A recent survey of IT remediation teams conducted by the SANS Institute revealed that almost half felt that the lack of visibility was their main impediment to an effective, speedy response. Using a security information and event management (SIEM) solution for log aggregation and correlation can increase visibility across organization.

    When the health of your organization is at risk, taking even an hour to respond to an incident can be far too long. Taking a day, a week or a month to detect and respond to a threat can do irreparable damage. With steps in place, organizations can meet their need for speed in addressing cyber threats quickly, to best protect their networks.

    About the Author / Rishi Bhargava

    Rishi Bhargava is co-founder and VP of Marketing for Demisto, a cyber security startup with the mission to make security operations “faster, leaner and smarter.” Prior to founding Demisto, he was vice president and general manager of the Software Defined Datacenter Group at Intel Security, and before Intel, he was vice president of product management for Datacenter and Server security products at McAfee, now part of Intel Security. He has more than a dozen patents in the area of computer security. He holds a BS in Computer Science from Indian Institute of Technology, New Delhi, and a Masters in Computer Science from University of Southern California, Los Angeles.

  • 8 Ways to Focus on Cloud Software Security

    8 Ways to Focus on Cloud Software Security

    Cloud Software Security Examined

    Cloud software security is critically important. Take, for example, health care: Doctors and other healthcare professionals are one of the biggest users of cloud software, yet recent studies demonstrate that more than 15 percent are considered to be operating at a high risk of security breaches, and more than half are operating at a medium risk.

    Security breaches can be devastating to almost any large industry. Companies must take accurate measures to ensure the safety of cloud computing software, as hackers are all too eager to break into a computer system and do what they seem to do best.

    Fortunately, there are a number of ways to increase security of data and apps in the cloud. Increasing cloud software security is almost like an insurance policy that affords valuable protection.

    Taking Steps to Increase Cloud Security

    The first step in building an effective cloud security plan is to conduct a complete internal audit that includes all current cloud providers. All internal security personnel should participate in the auditing process.

    Once the auditing process is complete, companies should take the following measures:

    1. Security personnel must take steps to ensure all company data is correctly encrypted. Having a secure encryption process in place will increase cloud security significantly.
    1. IT and/or security department should create an authentication process, which will help ensure all cloud software, as well as highly confidential internal information and related files, are secure.
    1. All new internal applications should undergo in-house developmental testing. Well-organized developmental testing procedures will guarantee that new applications are secure at the time they are released. This procedure is highly effective and also should increase cloud software security, when done correctly.
    1. Security solutions must be created that accurately scan and store various binary codes. What’s more, security solutions must be created internally. Runtime makes it extremely difficult to detect any security breach or potential vulnerability. Failure to detect or recognize a potential security flaw can prove disastrous for any organization.
    1. Use a web application scanning program for better security and safety. Use a provider that secures and monitors all web applications on a continual basis, as well as multiple scanning on a single platform. Multiple scanning will produce increased accuracy as well as unified results.
    1. Use one platform for all multiple assessment tasks to heighten cloud security. Using one platform will enable security personnel to identify and address an open-source risk quickly.
    1. Utilize streamline compliance centralization tools, which permit access to direct access to applications for compliance. Applications for compliance should include access to PCI controls and CWE. Both PCI and CWE can be used to make sure corporate compliance requirements are being met.
    1. Develop a system of continual compliance., which will monitor the system for any existing vulnerability or security concern. In addition, this unique system will fully access and examine any and all applications before they are released or deployed. Finally, the system of continual compliance will automatically conduct regular searches to identify all web applications that are related to a specific company domain. Any temporary sites also will be searched and properly identified. A continual compliance system is highly effective when properly utilized.

    There are many ways in which cloud software security can be enhanced. It may be a wise decision to consult with a security and compliance specialist. Many large and small organizations are now utilizing the services that security and compliance companies can offer.

    The Importance of Cloud Security Enhancement for Businesses

    In this of age of advanced computer technology it is becoming easier for hackers to access highly sensitive information from just about any organization. It is sad to say, but there are people who have made careers out of computer hacking. Many computer hackers are never brought to justice. Therefore, it is critical that organizations take the necessary steps to protect all computer software as well as sensitive company information that should never be released to the public.

    Having efficient software testing tools is the first step when looking to increase or improve cloud software security. Efficient testing tools will help an organization to better identify any security problem or vulnerability that may be present. If vulnerability is identified, the next step is to fix the problem and prevent additional security breaches in the future.

    Keeping company software and critical files safe must be a No. 1 priority. If critical internal information is compromised, it can cause severe damage that may be irreparable.

    About the Author / Reed Gusmus

    gusmusReed Gusmus the director of Marketing at QASymphony. Gusmus is an award-winning, passionate and innovative B2B marketing leader who excels at prescribing winning strategies for new customer acquisition and revenue-driving solutions for SaaS companies looking to get more from their marketing investment. Connect with him on LinkedIn and Twitter.

  • DEF CON: Where Have All the Black Hats Gone?

    DEF CON: Where Have All the Black Hats Gone?

    DEF CON is one of the most controversial conferences in the world. Only at that annual event have arrests been made, legal threats shut down presentations and zero-day attacks been anted in Texas Hold ’em games.

    The Usual Suspects

    This is a conference of people who grew up like me—people who, at 11 years old, were using IRC (internet chat relay) to share API (application programming interface) documents or download random material such as, “The Anarchist Cookbook.” We were influenced by movies such as, “The Matrix,” and “Hackers,” all the while thinking elite hacks were the cool thing to do. We spent lots of time playing Quake and other games. As we grew up, we may have gotten into trouble building projects using proggies or sharing things we weren’t supposed to share. Most of us grew up using computers to build software and make money. Some of us graduated from college and found great jobs for our skills.

    You start with chat rooms on AOL and dive deeper into IRC. You may meet people playing peer-to-peer games such as Quake. Those people share information, and, before you know it, you’ve downloaded software over peer networks and you’re sharing cracks. This is your hidden world, and your friends are handles with no name, age or location.

    Then one day you decide you’re going to meet all these handles in person at a central location that is easy to get to. You’re going to save up some really good cracks you haven’t shared yet for when you meet them. That, to me, was the adolescent rebellious start to DEF CON.

    Now, as adults, we appreciate the novelty of slipping away into childhood by attending DEF CON to witness new hacks and meet childhood hacker friends. It’s like meeting a bunch of people at your house who haven’t seen each other in a long time or only knew each other through internet chat rooms. It’s a good time to connect; it’s great to feel that energy.

    Going Down the Rabbit Hole

    Hackers are just curious folks who are so bored with all the content they consume that they turn the internet into a playground. Like every playground, there are good guys and bad guys. Sometimes they’re forced to get along. Sometimes they fight. Sometimes they decide to attack a system just because the company that runs it laid off a loved one. Other times they are just playing a friendly game of King of the Hill. You can take it too far and get in trouble or get a wake-up call. Or, you may simply grow out of it. No matter the situation, the curiosity and love for the internet remains with you; that is why DEF CON is attractive.

    DEF CON is white hats teaching black hats and black hats teaching white hats with a lot of gray in between. Everyone gets along and smiles as they watch “The Matrix” or “Hacker Jeopardy” together.

    Distinguishing the Hackers from the Hacks

    I was waiting in line. I always communicate with the people in line and ask them about the conference, current presentations and whether they have had any experience setting up XYZ or running up a large sheet of attacks using cloud networks. At this year’s event, most of the people I ran into looked like “hackers” but had no clue what I was talking about; they just uncomfortably laughed. It’s funny: They were going to presentations to see somebody talk about something highly technical, yet, they didn’t have a clue.

    Lots of folks had badges, hung out and looked as though they were on vacation and decided to check out the conference. This group, I believe, came because the conference was located in a casino in Las Vegas. The whole Vegas thing is probably the top reason why DEF CON attracted larger crowds.

    I noticed I found more competent folk at the Villages—different sections focusing on topics such as packet hacking, car hacking and social engineering. Villages had more unique, specific details on the concept of hacking in certain arenas. I found people were more in-tune and focused here. The Villages were away from the four main presentations rooms, which meant fewer tourist types. The Villages were where you found the passionate hackers.

    White or black, it was a lot of gray. I didn’t see my friends who specialize in network protection for a living using hacker tools maliciously; rather, they were curious to know how the tools work. After Justin got his MitM (man-in-the-middle) attack working, he smiled and looked at me, “Is it this easy!?” Then, “How do we stop this? Is it really just making everything TLS? That can’t be the only way.” So we ran a few Google searches to poke around deeper. When moving around the conference, you saw guys sitting on the ground running these attacks; they were just phishing to add to the wall of sheep.

    Was the guy who got paid to snoop at the Democratic National Convention convention with MitM attacks there? He might or might not have been. He might have been pioneering these attacks and learning from presenters, or he might have been so beyond what is shared at DEF CON that it was a mere novelty to attend. Even with DEF CON making it really easy to go undetected by using cash transactions, it’s still 2016 and surveillance cameras were everywhere—especially in casinos. If you’re looking to keep a low profile, DEF CON is the last place you’d want to be.

    So, I’m going to go out on a limb and say that the white hats and some grays were present with maybe a Sith Lord lurking in disguise. The true black hats were most likely reporting in remotely to their Sith while they observed petty hacks and recruited from a safe distance. Or maybe, just maybe, they were in board shorts acting like a clueless tourist.

    About the Author / Randy Apuzzo

    Randy Apuzzo_Co-founder_CEO_Zesty.ioRandy Apuzzo is founder and CEO of Zesty.io, the SaaS CMS Company. At age 12, Randy was hacking corporate sites and crashing systems for fun. As an adult, he applies his computer science and branding background as an industry visionary, architecting scalable solutions that help companies accelerate and scale their global digital content strategies. He is revered for empowering businesses with technology that grants agility, cost savings, security and increased market share. To connect with Randy, please visit https://www.zesty.io, Facebook/GoZesty, LinkedIn/Zesty-io, @RandyApuzzo and @Zestyio.

  • Cloud Security Tips: How to Prevent Hackers from Breaching Your Cloud

    Cloud Security Tips: How to Prevent Hackers from Breaching Your Cloud

    Recent data system breaches at Oracle and Sage reminds us all that the continuous threat of criminal hacking of cloud security systems is not abating. Rather, it’s becoming routine. Business managers, lawmakers and computing professionals must understand the motivation behind this activity if they want to protect business interests and thwart attacks effectively. Perhaps the biggest challenge is that the hacking community is a diverse and complex universe—a large variety of skilled players and several motivators. Only by understanding the motives of criminal security hackers is it possible to profile computer crimes. With solid profiles and some basic cloud security tips in hand, security professionals can better predict future activity and install the appropriate safeguards.

    Most security professionals are likely to spend much more time analyzing the technical and mechanical aspects of cybercrime than the social and psychological dimensions. Of course, it’s critically important to dissect malware, examine hacker tools and analyze their code. However, if we want to understand the nature of the cyberthreat, security professionals need to act more like criminal investigators. We no longer live in a world of mere glory-seekers and script kiddies. Some very serious thugs are now lurking in virtually every sector. So, it’s critically important to understand their motives and signatures, since these point to their targets and reveal their methods of operation.

    As you consider your business context, it’s important to frequently ask yourself this question: What exactly are the means, motives and opportunities for potential criminal hackers of my business computing systems? Getting a solid answer to this question is the key to identifying your most vulnerable assets and developing a security plan.

    The Sage Breach

    Earlier this month, Sage Inc. announced that hackers, using an internal login, had gained access to sensitive customer information including the names, addresses and bank account information of a few hundred U.K. customers. It’s undetermined at this point whether the hackers gained access to everything needed to cash in on their attack. But the Sage attack is just the latest in a wave of high-profile hackings in recent months, with victims ranging from enterprise IT vendor Oracle to cryptocurrency Bitcoin and even The College Board, creators of the ACT exam.

    According to many IT and computing system analysts, the top three hacker motives are financial, corporate espionage and political activism. In the remainder of this article, we look closely at the financial motive, and then we help you consider the best approaches to securing your cloud computing assets.

    Financial System Hackers

    You’re probably most familiar with this type of hacker, since they cause the most damage and are often featured in the news. The motive here is pretty obvious: make money the easy way, by stealing it. Financial system security hackers range in size from a few lone actors to large cybercrime organizations—often with the backing of conventional criminal organizations. Collectively, these thieves are responsible for extracting billions of dollars from consumers and businesses each year.

    These threats go well beyond the hobbyist community to a very high level of sophistication. All criminal attackers immerse themselves in a complex underground economy: a vast black market in which participants buy and sell toolkits, zero-day exploit code and malware botnet services. Vast quantities of private data and intellectual property are up for sale—highly valuable data that has been stolen from victims. A recent market trend is the sale of web exploit kits such as Blackhole, Nuclear Pack and Phoenix—which they use to automate drive-by download attacks.

    Some financial system hackers are opportunistic and focus on small businesses and consumers. Larger operations go to great lengths to analyze large enterprises and specialize in one or two industry verticals. In a recent attack on the banking and credit card industry, a very organized group was able to pull off a global heist of $45 million in total from an ATM—with an extreme degree of synchronization. These secondary attacks were feasible because of a previously undetected breach of some bank networks and a payment processor company.

    The Next Wake of Hackers

    Malicious hacker attacks are quite common nowadays, and often have tragic and highly disruptive outcomes. And these attacks are also inevitable, as more internet users utilize cloud computing and storage. This raises more concerns about combating the effects of hacking, and it will become increasingly critical in the future. There is ongoing debate as to whether basic cloud security tips are enough to prevent hacking threats. After years of extensive industry debate, it’s been found to be the same problem in a different location. So, if businesses can build reliable security and recovery methods, then cloud computing can be a serious consideration. Most importantly, the freedom, accessibility and collaboration that is available through cloud computing can far outweigh and mitigate the risks to your data security.

    Many cloud computing users assume their data is held safe by the security measures of their cloud vendor. But, hackers use code-cracking algorithms and brute force attacks to acquire passwords, and they can also access data transmissions that lack proper encryption.

    Ask yourself this question: Do you have solid infrastructure, processes and procedures to ensure reliable, high-security backups of your sensitive and business-critical data? If you can’t answer this question with confidence, then we invite you to read on a bit further as we consider various aspects of a top-tier cloud backup service.

    Your cloud backup service should process all data through encryption to ensure that it’s entirely unreadable by unauthorized users. It should only be possible to decrypt your data when you decide to retrieve it. Minimally, this means that data transmission should be done only through the SSL protocol and that strong passwords are necessary for information access and decoding.

    No system is hacker-proof, but the greatest benefit of cloud a backup service is the high-degree of readiness for recovery from a hacking event. Companies that specialize in cloud backup services reduce threats to your data by enabling full recovery of all business-critical data to its original state in just a matter of clicks. These backup companies replicate your cloud data and safeguard it in a separate cloud so that the likelihood of data loss from natural disasters and other threats remains infinitesimally small.

    Modern Cloud Security Tips

    Rock-solid facilities. Today, the best cloud application management solutions have standard built-in backups. Look for a provider that has robust, extreme-security data centers utilizing precise electronic surveillance and multifactor access control systems. The design of its environmental systems is important, also, to minimize the impact of any disruptions to operations. What’s more, multiple geographic locations and extensive redundancy add up to a high degree of resiliency against virtually all failure types, including natural disasters.

    Protection from the bad guys. The best providers not only provide super-strong physical protection for your backup data, but they also lock everything down with extensive network and security monitoring systems. Their systems include essential security measures such as distributed denial of service (DDoS) protection and password brute-force detection on all accounts. Additional security measures can include:

    • Secure access and data transfer – all data access and transfers go through secure HTTP access using SSL.
    • Unique users – identity and access management features to allow you to control the level of access.
    • Encrypted data storage – encrypt your backup data and objects using Advanced Encryption Standard (AES) 256.
    • Security logs – extensive, verbose logs of all activity for all users of an account.
    • Native Support – Native support for multiple platforms and systems including MongoDB, MySQL and Linux/Unix/Windows files.