Category Archives: Security

Cloud Security: 云安全之合规性:访Flyingpenguin总裁

News from Beijing in Chinabyte.com

比特网Chinabyte11月3日原创 11月2日,2011RSA安全大会信息安全国际论坛在京举行,Flyingpenguin总裁Davi Ottenheimer在会上发表了题为《在云环境中筹划安全》的演讲。泄密、数据完整性丢失、停机对于虚拟环境来说并不陌生,Davi Ottenheimer介绍了组合和衡量各种安全成分的一些新方法,即使是在大型多租户、多层次的安全状况下依旧能满足要求和实现合规性。演讲结束后,就云安全的合规性、从安全角度进行云供应商选择等问题Davi Ottenheime接受了比特网记者的采访。

Or, in other words:

Davi Ottenheimer describes the various security components, mixes and measures of new methods, even in large multi-tenant, multi-layered security situations that still are able to meet regulatory requirements and achieve compliance.

VXLAN Primer

There is a nice summary and introduction to VXLAN on BORGcube. Note the system responsible for encapsulation as that is always a focus area of manipulation. Can a guest probe ARP information on another host, for example, beyond what the local host is meant to reveal?

…you can think of VXLAN as a tunneling scheme with the ESX hosts making up the VXLAN Tunnel End Points (VTEP). The VTEPs are responsible for encapsulating the virtual machine traffic in a VXLAN header as well as stripping it off and presenting the destination virtual machine with the original L2 packet.

VXLAN Example

US Security Experts Bemoan “Colander” Model

Note that some of the most effective armor technology on land and sea uses a porous model.

First, take for example a visionary in World War I realized it’s better to be flexible in order to make breaches quickly disappear (render them ineffective) rather than to try only to prevent them (allow cracks to form in a solid and be exploited). That idea led to self-sealing fuel tanks for aircraft and vehicles.

The US military is still funding research to find ways to use a flexible yet porous membrane to prevent leakage for water tanks as well as fuel. Here is a typical modern breach response study application:

…enable vehicle operation in hostile environments and minimize loss of fuel due to a direct/indirect hit…

Second, another interesting example is a membrane developed on submarines in World War II that can subdue enumeration (e.g. sonar) by an attacker. An anechoic tile is porous enough to allow signals in yet prevent them from a “bounce” back out. Porous sound canceling material also can be found in recording studios.

Anechoic Tile

Third, polytetrafluoroethylene (often known for its use in Gore-Tex) is another great example since it is used to make fabric waterproof yet breathable — porous yet impermeable.

Gore-Tex Schema

I said earlier to take note of the porous model because Wired has offered the following chilling quote in a story called Darpa Begs Hackers: Secure Our Networks, End ‘Season of Darkness’ about the state of American cyber security.

U.S. networks are “as porous as a colander,” Richard Clarke, the former White House counterterrorism chief turned cybersecurity Cassandra, told a packed ballroom.

He says that like being porous is a bad thing. I would rather hear response time is inadequate or that the US needs to develop better tools for the job to distinguish friend from foe (e.g. grapes from water)

Colander in action

Begging hackers to develop a perimeter with no holes, or to imply that a security barrier should never be porous, will trend things worse not better. It would be more effective to spend resources (beg hackers) to help on threat recognition, redirection and response.

A solid perimeter will never be truly solid as history shows time and time againand again.

US Commodore Perry's Ships Breach the Japanese Perimeter in 1853

To retain and protect assets while dispensing/releasing threats, which is exactly what a colander is designed to do (and why a chef uses one), is not an inherently bad model. As the military examples show above there is a long history of developing highly technical colanders that provide an efficient security solution to handle even the highest risk environments.

Running Risks While Running

My favorite quote so far on how to reduce injury when running is from the NYT

The “one best way” isn’t about footwear. It’s about form. Learn to run gently, and you can wear anything.

When is that not true? If gently means less risk, then learn to operate with less risk and you can do anything. Tautologies are fun. But there is a more serious message found in the detail of the story.

The human body can be trained to run and reduce the risk of injury from impact. That training can never be replaced completely just by technology in a shoe. So you are better off learning to run at least some of the time without any shoes because it gives the best feedback and form that will reduce the long-term risks of injury.

We were once the greatest endurance runners on earth. We didn’t have fangs, claws, strength or speed, but the springiness of our legs and our unrivaled ability to cool our bodies by sweating rather than panting enabled humans to chase prey until it dropped from heat exhaustion. Some speculate that collaboration on such hunts led to language, then shared technology. Running arguably made us the masters of the world.

So how did one of our greatest strengths become such a liability? “The data suggests up to 79 percent of all runners are injured every year,” says Stephen Messier, the director of the J. B. Snow Biomechanics Laboratory at Wake Forest University. “What’s more, those figures have been consistent since the 1970s.” Messier is currently 11 months into a study for the U.S. Army and estimates that 40 percent of his 200 subjects will be hurt within a year. “It’s become a serious public health crisis.”

Alternatively, surface areas could be scrutinized better for total impact. The story does not mention that most human history of running predates asphalt and concrete. What’s the cost again of paving everything into an unforgiving solid to support heavy vehicles? Dirt and leaves on the ground now probably look better than ever. But I digress…

Six months after being told he should never run again, [Cucuzzella, a physician, a professor at West Virginia University’s Department of Family Medicine and an Air Force Reserve flight surgeon] finished in 2:28, just four minutes off his personal best.

“It was the beginning of a new life,” Cucuzzella told me. “I couldn’t believe that after a medical education and 20 years of running, so much of what I’d been taught about the body was being turned on its head.”

The article conflates this educational failure with a propaganda campaign by a shoe company.

When a few of Nike’s shoes didn’t fare so well in the 1981 reviews, the company pulled its $1 million advertising contract with Runner’s World. Nike already had started its own magazine, Running, which would publish shoe reviews and commission star writers like Ken Kesey and Hunter S. Thompson.

Of course it gave itself good reviews but that does not answer the question of why anyone believed them.

Just as the shoe reviews were changing, so were the shoes: fear, the greatest of marketing tools, entered the game. Instead of being sold as performance accessories, running shoes were rebranded as safety items, like bike helmets and smoke alarms. Consumers were told they’d get hurt, perhaps for life, if they didn’t buy the “right” shoes.

Oh, security and fear. That seems like the same thing being used to sell barefoot running, but maybe this time the tests will be fair and the data accurate.