Sennheiser Debacle: The Consequences of Poorly Secured Certificates

kdobieski

Thu, 11/29/2018 10:22

The Sennheiser software in question was used to set up and manage softphones that allow users to make phone calls on a computer instead of using a physical phone. To do this, the company needed its headphones and speaker phones to work seamlessly with computer. And the way they did that was by establishing an encrypted Websocket with a browser. That process involved installing a self-signed TLS certificate in the operating system’s trust store, the central place where browser-trusted root CA certificates are stored.

The vulnerability occurred in version 7.3 of the HeadSetup app, where the self-signed root certificate was installed in a way that allowed the private cryptographic key to accessible. According to Ars Technica , “Because the key was identical for all installations of the software, hackers could use the root certificate to generate forged TLS certificates that impersonated any HTTPS website on the Internet. Although the self-signed certificates were blatant forgeries, they will be accepted as authentic on computers that store the poorly secured certificate root. Even worse, a forgery defense known as certificate pinning would do nothing to detect the hack.”

The blunder of headphone software installing root CA certificates is serious, the real story is that the power of machine identities is not well understood except by hackers,” warns Kevin Bocek, vice president of security strategy and threat intelligence at Venafi. “A certificate installed by default as a root CA for headphone software can easily enable ANY machine, website, cloud to appear trusted. These techniques are used every day by malware and trojans to making malicious sites. And developers aren’t learning from previous mistakes made by the largest vendors like Dell and Lenovo.”

Kevin goes on to remind us all that machine identities are often overlooked, or simply back-burnered, in security processes. And the results are serious enough to call attention to this negligence. “Machine identities like TLS keys and certificates are powerful weapons in the hands of cyber criminals and must be protect and their use treated as weapons. Global 5000 security and development teams must take this problem seriously.”

How actively is your organization managing its trust stores?

Related posts

Scott Carter

I recently wrote a blog for The SSL Store about the hazards of improperly using of self-signed certificates. But little did I know that I would see such an egregious example so soon after publishing that blog .

Researchers at German cyber-security firm Secorvo revealed that German software developer Sennheiser had inadvertently installed two self-signed root Certificate Authority (CA) certificates into the trust stores of users’ computers, but also included the private keys in a format that could be easily extracted.

With access to a self-signed root certificate and the corresponding key, attackers can carry out man-in-the-middle attacks to impersonate any website on the Internet. And we’re talking all major websites here. Ars Technica cautions, “The software developer’s mistake means that malicious third-parties can extract the private keys from the two applications and use them to issue forged certificates to spoof legitimate websites and software publishers for years to come.” In fact, since the root certificates are not set to expire until 2027, that’s quite a while.

Find out.

Explore now.

Recent Articles By Author

OCSP Must-Staple; Revocation Solution How Policies Prevent Peril for Machine Identities Why Banks Should Encrypt for Security Rather than Compliance More from kdobieski

*** This is a Security Bloggers Network syndicated blog from Rss blog authored bykdobieski. Read the original post at: https://www.venafi.com/blog/sennheiser-debacle-consequences-poorly-secured-certificates

I originally posted this on the originally unsecure platform, facebook . I should edit this for grammar, but I just wanted to bang it out, because you know... job/work.

I cannot stand #comcast, no one that knows me finds this surprising, I'm forever ranting about them. The fact that Comcast is the only option for so many people is ridiculously sad. My job requires me to be on the internet constantly, I do a lot of security research and general research.

Today, I found the most horrific thing a security nerd can find. Comcast is FORCING all unencrypted traffic through Comcast proxy servers. I don't have a choice, I wasn't asked, or notified (I'm sure the TOS that's 938429 pages long mentioned it). This enables Comcast to inject anything they want into your unencrypted web browsing.

If you want to see technical details about what these jackholes are doing, see here: https://gist.github.com/bdmorin/7bd16b34cf75c0f6dd56155301793c4d

I tested a popular website, tvmaze.com (a http only website) with and without a VPN on, and the difference in HTML delivered was comcast HTML injection, which included 3rd party asset calls, analytics tracking, etc.

I want to protect my entire network (including all those people in my home) against this kind of absolutely unacceptable spying, however it gets fugly, because as cord cutters, we use streaming services, and Netflix and Hulu are NOT VPN friendly. These services actively block VPNs because viewers can appear to be in a different geological location (ODIN FORBID YOU NOT BEING AN AUTHORIZED AREA), so if I run my whole house through a VPN, then we won't be able to use streaming services.

I've been considering deploying a local forced proxy for any port 80 traffic to be forced through a VPN connection at MY gateway and not comcast's. Nearly every streaming service uses HTTPs, so this wouldn't diddle with streaming services.

The point of this rant is to SHAME comcast, not that they care in the least about consumers. You may constantly see ads for VPNs as you browse online, and these are the reasons why, you absolutely CANNOT trust your local service provider when it hijacks your content and modifies it before it gets to you. Ask China what it's like to have all your traffic monitored and modified before it gets to you. Comcast could potentially change anything before you have a chance to read the original version. If Comcast obtains a CA that browers accept, they would then be able to hijack your HTTPS connections, which is ABSOLUTELY concievable at this point.

Websites that use web application firewall services like Cloudflare are also subjected to this kind of risk. Cloudflare inspects all traffic to and from source servers, so it's a single point that could modify, track, and potentially block content. If a BlackHat were to compromise Cloudflare, thousands of ecommerce businesses could be at risk of having traffic snooped. Same with Comcast, if (AND WHEN) they are compromised, they could modify YOUR traffic so that you're seeing what someone else wants you to see.

Trust no one. Especially worthless corporations like Comcast.

In linux, a non-privileged user by default can only open 1024 files on a machine. This includes handles to log files, but also local sockets, TCP ports, ... everything's a file and the usage is limited, as a system protection.

Normally, we can increase the amount of processes a particular user can open by increasing the system limits. This is configured in /etc/security/limits.d/ .

For instance, this allows the user john to open up to 10.000 files.

You would assume that once configured, this would apply to all the commands that run as the user john . Alas, that's not the case if you use supervisord to run a process.

Take the following supervisor job for instance:

This would add a job to supervisor to always keep the task /usr/bin/php /path/to/script.php running as the user john , and if it were to crash or stop, it would automatically restart it.

However, if we were to inspect the actual limits being enforced on that process, we'd find the following.

The process has a soft-limit of 1024 files and a hard limit of 4096, despite an increase in the amount of files it can open in our limits.d directory.

The reason is that supervisord has a setting of its own, minfds , that it uses to set the amount of files it can open. And that setting gets inherited by all the children that supervisord spawns, so it overrides any setting you may set in limits.d .

Its default value is set to 1024 and can be increased so anything you'd like (or need).

You'll find this file on /etc/supervisor/supervisord.conf on Debian or Ubuntu systems. Either add or modify the minfds parameter, restart supervisord (which will restart all your spawned jobs, too) and you'll notice the limits have actually been increased.

Even if there is a negative outcome, training leads and organizations should not be worried, yet. Just like in school, these simulations are just that, simulations or quizzes. They are designed to prepare users for the real test or a potential attack or phishing lure from a threat actor.

A single failed quiz typically doesn’t lead to a full flop, but repeated ones certainly can. This week we’re going to take a look at some of the logic and benefits that come from failed phishing simulations, and why it’s not the end of the world.

Fail once, shame on them.

Fail twice, shame on you.

Simulated phish is designed to fool the recipient, and depending on who is creating it, they truly can be some of the most crafty, targeted lures out there. However, if your users are repeatedly clicking on the links or attachments within a lure that is a sign that your training program is not effective. When this occurs it’s important to get to the root of the issue:

If your training only occurs once or twice a year, there is a greater chance that a user will fail a simulation. Keep in mind that simulations are not a training tool, but a testing tool , designed to reinforce information from security awareness training. This can also be a symptom of why users are not retaining the information as well.

Then, there is also the slight possibility that your training lead happened to create such a diabolical simulation that people clicked on it anyways. If either of these situations occurs, there is some good news to take from all of this, starting with plugging holes in your training program.

Phishing simulations come in many different forms, and if you are pulling one from a library of existing ones there is a possibility that it doesn’t have a specific focus. In other words, a simulation is just that, a simulation. When sending or creating a simulation, it should reinforce information and learnings from the most recent training. However, if the training you have in place also focuses on the big picture, shoves a bunch of information between one and four sessions, and was completed months ago, none of that matters.

To a training lead, this should raise a red flag and highlight a few gaps in the program such as:

During most employees onboarding process they are required to take some form of security awareness training. Then each year following they get a refresher, sometimes with the same exact training materials, to check the box again. In these situations, and really most others, users simply do not take security awareness training seriously.

They see examples of phishing lures with horribly broken English, they roll their eyes at the gamification and terrible misuses of pop culture, and they of course, try to shove it all in while doing actual work at the same time. In some cases those long training videos just play behind their work, occasionally getting the alt+tab switch to move it forward. Think these users take the training seriously? Of course not.

What happens when they fail a phishing simulation though? Typically they run through the 9 stages of grief in about five minutes, ending with a few choice words for the training lead. There is a bit of shame and embarrassment that tends to linger though, and that is when you strike like a cobra.

The users will take the training seriously, and that is exactly when you issue them point of failure training. This training will highlight the information they need to avoid a failed simulation in the future and that they shouldn’t let their guard down. From here, users should start to improve, and that means so should your tactics.

As users improve, so should your tactics. Training leads need to think like threat actors. That means sending phish out at times when users may only be on their mobile device, use information and subject lines that are personal to them, and ultimately act as a targeted attack or spear phishing.

Did they fail after you kicked things up a notch? See earlier tips, but also understand that pushing users to their limits with security awareness training, adjusting the tactics and distribution vectors, and terrorizing them a bit is all in the spirit of protecting the enterprise.

Every organization needs some form of security awareness training and also technology to protect the perimeter of the business. If ever there was an easy button to increase the budget around either element, even with a persuasive argument prior, results from phishing simulations will certainly drive the point home.

As tactics improve and the training program is strengthened, businesses need to focus on the bigger picture. There is no denying that human error is often the easiest to blame when it comes to security breaches, but that’s just another sign of ineffective training.

A strong training program should be designed to encourage users not to just ignore what appears to be spam or suspicious, but actively reports it to the security team as quickly as possible. In doing so, the security team can more rapidly mitigate the threat, which in turn a less trained user may attempt to interact with. Empowering well-trained users to act as an extension of the security team should be one of your primary goals, but the other elements mentioned in this article need to be in play before that expectation should be made.

Artificial intelligence software that can learn and improve human decision-making is transforming business. All sorts of companies are looking to AI to gain an edge over competitors. Unfortunately, everyone is racing to piece together an AI framework, sometimes forging alliances with software vendors that don’t prioritize security―clearly a risky proposition.

The sprint to build the most competitive AI platform invariably involves partnering with organizations that integrate or make software. So, even if you’re managing your own security effectively, minimizing risk demands similar levels of vigilance from your software partners. It’s a delicate balance―like a dance where each partner has to match or anticipate the other’s next move.

In the pre-cloud days, vendors would build software and hand it over to their customers, leaving them responsible to manage it, regardless of whether they had the necessary expertise in that particular area. In today’s SaaS era, the vendor manages the software, which requires a strong partnership and deep trust between customer and SaaS provider. For the partnership to succeed in the long term, both parties must be linked by trust and transparency, and having a third party audit your vendor’s processes and confirm that their security practices meet or exceed industry standards is key to building both.

Databricks is committed to security first. From day one, we built Databricks as an enterprise software company with a security-first mindset. We’ve created a culture of security best practices, and we work closely with third-party organizations to provide outside-in testing and validation.

We back up our commitment with our technology , earning our customers’ trust by ensuring that our development teams apply industry-leading security practices. We have multiple certifications and rigorous third-party testing and validation, along with regular audits ensuring constant transparency .

Technology built with a security-first mindset

We’ve built many facets of security natively into our data platform, including encryption, identity management, role-based access control, data governance, and compliance standards.

We also take your existing security tools investments into account, with the goal of meeting you where you are. This gives you a range of integrations and controls for your existing security tools, including support for your current identity access management solution using SAML 2.0 and SCIM to simplify setting up and managing accounts on the Databricks platform.

Our security-first mindset extends beyond data access to the architecture itself, with hard segregation between Databricks data and controls planes, leaving the data where it is so we can’t access it. Customers can choose between single or multi-tenant control planes depending on the level of sophistication needed.

Security-minded teams, you can trust

Earning our customers’ trust is our top priority, and we’re committed to fostering security-minded development teams. Through rigorous developer training and ongoing education―and application of security best practices―our development team keeps Databricks solutions bulletproof when it comes to security.

As part of our commitment to maintaining our customers’ trust and helping them mitigate risk, we also:

Finally, our low engineering attrition rates contribute to continuity and adherence to security best practices.

Transparency through third-party validation

In addition to maintaining the highest level of data security through industry-leading best practices, we also work with independent, PCAOB-registered firms to audit our program regularly and attest to our certifications. We take transparency seriously and make sure our customers understand clearly the intricacies of our platform by making available detailed architectural documentation.

We meet the unique compliance needs of highly regulated industries. We are in compliance with standards such as ISO 27001, SOC 2 Type 2, and HIPAA, along with validation by third-party penetration testing. Our certifications allow us to serve customers in regulated industries, including the Financial Industry Regulatory Authority (FINRA), Sanford Health, and Shell―along with highly sensitive government agencies.

We’re unique in our ability to support customers with GDPR compliance, particularly those using data lakes to store sensitive data that might be subject to a data subject request (DSR). Databricks is also architected so you’re always in control of where your data resides.

We are in the process of completing our Privacy Shield certification and have certified services under SOC 2 Type II and ISO 27001 . We also recently attested to ISO 27018, the internationally recognized industry-standard approach for protecting personal data in the cloud.

Security is an increasingly critical part of AI initiatives, which means you need to partner with an organization that doesn’t take security shortcuts. Databricks is committed to being your partner over the long haul, with security deeply embedded in our culture.

Our goal should not be to merely accept zero trust but gain the visibility required to establish real trust.

The term "zero trust" was coined by Forrester in 2010. The concept was also central to the BeyondCorp architecture that Google was designing around the same time. Traditionally, companies assumed their corporate networks were secure. Google provocatively stated that the corporate network was no more secure than the public Internet and that every organization needed a security architecture that did not take trust for granted. Forrester described it less as myth-busting about network security and more as a necessary framework for data and computing outside the perimeter.

Whether corporate networks are secure or not, it is true that the traditional arbiters of trust ― next-gen firewalls, VPNs, web gateways, network access control, network data loss prevention, locked-down PCs ― have minimal value outside the perimeter. This is a growing issue because all new enterprise application innovations happen in the cloud, not on-premises, so a company that cannot compute outside the perimeter will rapidly get left behind.

Every company must find its answer to the zero-trust problem.

What Is Zero Trust, Really?

Because traditional security solutions provide minimal visibility outside the perimeter, organizations have a rapidly growing blind spot as data spreads across an information fabric that spans mobile endpoints and cloud services.

Our goal should not be to merely accept zero trust but to gain the visibility required to be able to establish trust in what otherwise would be a zero-trust world. Without trust, you cannot enable your users. Without enablement, they cannot do their jobs. The challenge is to enable them with the services they need without putting your business data at risk.

Every company must implement a new model of trust.

Is User Trust Enough?

User trust is an essential element of the modern trust model. It is necessary, but not sufficient. The reason is that a trusted user in an untrusted environment should not have access to company data. Context matters.

Here's an example: Let's say I owe you $1,000. We can decide where to meet so I can give you that money. We can meet at my home or we can meet on a street corner in a dangerous part of town. You, the person standing across from me, are still the same, trusted individual. But my willingness to hand you that money should absolutely be different in those two environments. In one, the transaction will be successful. In the other, you'll likely get mugged within a block. User trust is not enough. Context is critical to establish trust in a zero-trust world.

3 Steps to Get Started

Like almost everything else in security, starting with basic hygiene and establishing a foundational process and architecture are the most important steps:

Establishing True Trust

True trust is the combination of user trust with contextual trust: OS, device, app, network, time, location. Establishing true trust in a zero-trust world as the centerpiece of an automated compliance model gives users the freedom they need to get on with their work without losing company data.

Black Hat Europe returns to London Dec. 3-6, 2018, with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier security solutions, and service providers in the Business Hall. Click for information on the conference and to register.

Ojas Rege is Chief Strategy Officer at MobileIron. His perspective on enterprise mobility has been covered by Bloomberg, CIO Magazine, Financial Times, Forbes, Reuters, and many other publications. He coined the term "Mobile First" on TechCrunch in 2007, one week after the ...View Full Bio

It seems like hardly has one cyber-threat appeared before many variants of it soon follow, affecting both individuals and corporations alike. But this is no coincidence: One of the key ways the cyber-attacker is able to act is by looking for vulnerabilities and weaknesses in the lines of defenses that are set up, and one threat often opens the door for another.

Many organizations simply think that by deploying the latest security technologies, they will be immune from any form of cyber-attack. However, this is far from the truth. What they fail to understand is that apart from implementing these tools, their entire IT Infrastructure needs to be thoroughly tested from the inside out.

How can this be done? Probably one of the best ways to do this is through what is known as penetration (pen) testing. In this kind of analysis, a team of experienced IT professionals actually behave like a real cyber-attacker, but within legal and ethical bounds.

The team’s primary goal is to launch just about any kind of attack that is imaginable in an effort to discover any unknown security gaps and weaknesses. Their findings are then summarized into a comprehensive report, supported with solutions as to how these vulnerabilities can be fixed.

Because of the dynamic nature of the cyber-threat landscape, the demand for pentesting is quite high, and is expected to be so into the coming future.

Becoming a penetration tester requires a mixture of both quantitative and qualitative skills. For example, he or she has to decipher the complex reports that are output by the pentesting tools, as well as having the patience to work very long hours and at odd times.

It takes years of experience to be a fully qualified pentester, and this particular individual must be able to keep with the latest trends and happenings in this field. In any job interview situation, you could be potentially asked just about question imaginable as it relates to pentesting. For instance, they could run the gamut from what pentesting means to what tool you should use in a particular situation to even what kind of cyber-attack you would launch and why.

In this article, we will review the top 30 questions you could face in a potential interview for a pentesting job, as well as useful additional information to help you succeed at your interview.

This group of questions will cover the basics of penetration testing, focused on the following areas:

Let’s ask the people in the know. Cloudflare.com says the following: “Penetration testing (or pentesting) is a security exercise where a cybersecurity expert attempts to find and exploit vulnerabilities in a computer system. The purpose of this simulated attack is to identify any weak spots in a system’s defenses which attackers could take advantage of.”

The main purpose of a pentest is to conduct a “deep dive” into the IT Infrastructure of a business or a corporation with the primary intention of gaining access to any (and if possible, all) of the electronic based assets that exist. It is important to note that the goal of the pentester is not to attempt to strike a hard blow right at the very beginning; rather, they escalate the intensity of the cyber-attack over a period of time.

The goals are as follows:

With vulnerability testing, one is simply scanning for any weaknesses that may reside in any component of the IT Infrastructure. In a pentest, a full-scale cyber-attack or series of cyber-attacks is launched with explicit permission from the client (or whoever is requesting it) in order to specifically find any types or kinds of gaps that have not yet been discovered by the IT security staff.

The three types are as follows:

Black-Box Testing

In some instances, the cyber-attacker may know nothing about their intended target. So in an effort to try to break through the lines of defense, the cyber-attacker will carry an all-out attack, also known as a brute-force Attack. In a black-box scenario, the pentester will not have any knowledge whatsoever about the target(s) they are going to hit. As a result, this kind of pentest can take a very long time to conduct, and automated tools are heavily relied upon. This kind of exercise is also known as a trial-and-error approach.

White-Box Testing

This kind of pentest is also known as clear-box testing. In these instances, the pentester has advanced knowledge to some degree about the Web application that they are about to hit and its underlying source code. This kind of attack takes a shorter amount of time to launch when compared to the black-box test.

Gray-Box Testing

This kind of pentesting is a combination of both of black-box and white-box testing. This simply means that the pentester has some advanced knowledge on the targets they plan to attack. This kind of exercise requires both the use of automated and manual tools. When compared to the other two tests, this one offers the highest chances of discovering unknown security holes and weaknesses.

The teams are as follows:

The functionalities of these three teams can be described as follows:

The Red Team

This group of pentesters acts like the actual cyber-attack. That means this team is the one that launches the actual threat, in order to break down the lines of defense of the business or corporation and attempt to further exploit any weaknesses that are discovered.

The Blue Team

These are the pentesters that act like the actual IT staff in an organization. Their main objective is to thwart any cyber-attacks that are launched by the Red Team. They assume a mindset of being proactive as well as maintaining a strong sense of security consciousness.

The Purple Team

This is a combination of both the Red Team and the Blue Team. For example, they have the security arsenal that is used by the Blue Team and possess a working knowledge of what the Red Team is planning to attack. It is the primary job of the Purple Team to help out both these teams out. Because of that, the pentesters of the Purple team cannot be biased in any regard and have to maintain a neutral point of view.

There is no doubt that in the cybersecurity field, there an endless number of certs one can pursue. But if a pentester is to be recognized as the top in their field, the following certs are a must-have:

The C-suite can understand results when they are explained to them in terms of financial impact. Thus, a pentesting report should also include a risk analysis which demonstrates the benefit versus the cost of any of the vulnerabilities that are discovered and not fixed. It should also have financial calculations demonstrating the impacts of a security breach.

In this section, we’ll look at some intermediate-level questions about penetration testing concepts. These will focus on the following:

This is a type of cyber-attack where malicious pieces of code, or even scripts, can be covertly injected into trusted websites. These kinds of attacks typically occur when the attacker uses a vulnerable Web-based application to insert the malicious lines of code. This can occur on the client side or the browser side of the application. As a result, when an unsuspecting victim runs this particular application, their computer is infected and can be used to access sensitive information and data. A perfect example of this is the contact form, which is used on many websites. The output that is created when the end user submits their information is often not encoded, nor is it encrypted.

Data packet sniffing is a specific process in which network traffic can be captured ether across the entire IT Infrastructure, or just certain parts of it. Once this has been accomplished, then a deep analysis of the data packets in question can then be made.

For example, if a business or a corporation is hit by a cyber-attack, examining the network traffic and the data packets that were associated with it at the time of the security breach occurred becomes extremely crucial, especially from the standpoint of forensics. Even if no attack is imminent, it is still very crucial for the IT staff to conduct a check on their network traffic in order to determine if there is any sort of anomaly that is present. There are many data packet sniffing tools that are available today, but probably the most widely-used one is Wireshark.

The acronyms stand for the following:

Of course, there are countless numbers of issues that can impact the network infrastructure of an organization, and you probably have your own stories about what you’ve encountered. The following vulnerabilities are some of the most prevalent:

Pentesting techniques fall into these following categories:

They are as follows:

In these particular instances, “Nmap” is the most commonly used tool.

This is a method in which malicious SQL code is inserted into the database or the back end of the Web-based application. These are typically deployed into an entry-level field so that the malicious code can be executed. This kind of attack is used primarily for heavy data-driven applications in which multiple security vulnerabilities can be found and exploited. It should be noted that although SQL injection attacks are primarily used to hit Web-based applications, the attacker can also target the SQL database just by itself as well.

Only one type of key is used in symmetric cryptography, and this key is known as the Private Key. Although the main advantage of this is that this type of system is relatively easy to deploy, the primary disadvantage of it is that if the Private Key falls outside the reach of the sending and receiving parties, the cyber-attacker can easily capture the ciphertext and decrypt it very easily.

With asymmetric cryptography, two keys are used: the Public Key and the Private Key. The advantage of this system is that it offers far greater levels of security as opposed to just using a Private Key, but it requires considerably more processing power resources. An example of an asymmetric cryptography system is Public Key Infrastructure, also known as PKI.

The following characteristics are required:

SSL stands for “Secure Sockets Layer.” This is the de facto standard to keep all Internet connections safe and secure. You will know that a particular website can be safely accessed when it has “HTTPS” in its URL address. SSLs are used most in e-commerce-based applications, in which credit card and other personal information and data is transmitted to the online merchant.

TSL stands for “Transport Layer Security” and is actually a much more updated and advanced version of SSL. It is important to note that with TSL, it can come with three types of encryption:

This section covers advanced-level questions about penetration testing, focusing on the following:

Establishing an SSL/TSL connection works in this fashion:

It is important to note that this entire process can also be referred to as the SSL/TSL Handshake.

The phases are as follows:

This was actually one of the first Public Key protocols to be put into place, and it is a methodology that can be utilized to securely exchange Public Keys over an open network line of communications. A pentest can be done here in order to determine and ascertain any kind of weak/TLS services that are associated with this exchange process.

The following types of controls should be implemented:

This is used to determine exactly the route of where the data packets are exactly going. For example, this method can be used to ascertain if data packets are being maliciously redirected, they take too long to reach their destination, as well as the number of hops it takes for the data packets to go from the point of origination to the point of destination.

This is a type of specific service that can help to perform network-based audits or even automated pentesting of an entire network infrastructure. It can give the pentesting team detailed information and data as to how the cyber-attacker can gain access to your network-based digital assets. It can also be used to help mitigate any form of threat that is launched by a malicious third party.

All types of network infrastructures can be pentested, and up to a thousand total vulnerabilities can be detected with this particular service.

The constructs behind a threat model include the following:

It is also important to note that there are three types of threat models that a pentesting team can use, and they are as follows:

The above is an example of a Digital Asset-Centric Threat Model.

The three types are as follows:

This stands for cross-site request forgery, and it takes advantage of the trust levels that are established in an authenticated user session. For example, in these scenarios, Web-based applications typically do not conduct any form of verification tests that a specific request actually came from an authenticated user; rather, the only form of verification is sent by the particular Web browser that the end user is utilizing. There are two ways to avoid this scenario:

Overall, we’ve looked at some of the interviews that you could be asked if you are applying for a pentesting job. These questions can also be asked of a pentester if they are currently employed in this field.

It is important to keep in mind that although answering these questions will demonstrate to the interviewer your in-depth knowledge of pentesting, it takes other qualitative skills as well in order to become a successful pentester. For instance, you must have the ability to work well with others in a team-oriented fashion and work long hours.

Pentesting also requires you to have a great deal of patience on your part, as it these kinds of exercises do not happen in just one day. A successful pentest can take weeks or even months to accomplish.

Finally, you must also have the ability to take all of the techno-jargon that is associated with the results you have obtained and bring it down to a level that your client can understand and implement. You will be gauged on these qualitative factors as well in your interview.

If you want to review more in-depth pentesting questions, click on the link here . Skillset is a practice exam engine featuring thousands of certification exam questions for security and IT pros. Users benefit from detailed question explanations and exam readiness scores, letting them know exactly when they are ready to sit their exams.

Good luck on your interview!

The international guide is intended to help organizations defend their networks and systems from automated and distributed attacks.

The Council to Secure the Digital Economy (CSDE) and Consumer Technology Association (CTA) today announced the International Anti-Botnet Guide, a new publication intended to help organizations block botnets and other automated, distributed cyberattacks.

USTelecom and the Information Technology Industry Council (ITI) were also involved in building the guide, which is the product of nine months of collaboration. IT stakeholders can use the guide for basic and advanced practices to reference when defending against bots. These aren't mandates or requirements, the guide points out. IT and security leaders can use them according to the circumstances, processes, and teams specific to their organizations.

No single stakeholder controls the connected economy, where bots have been both damaging and expensive. As the number of people, businesses, and devices grow, so does the potential for botnets to drive phishing, ransomware, distributed denial-of-service (DDoS_ attacks, and other digital threats. With the Internet of Things (IoT) poised to reach 20 billion devices by 2020, the global cost of cybercrime could reach trillions of dollars, researchers state in their report. Botnets are a driver of these losses.

"The botnet threat is more severe today than at any previous point in history," researchers point out, referring to threats ranging from the Storm Worm botnet of 2007 to the 2016 Mirai botnet that gained access to nearly 400,000 devices, including video cameras and recorders. While most botnets don't quite reach this scale, smaller attacks can disable websites and services, spread disinformation on social networks, and distribute ransomware.

"A host of bad actors are exploiting a target-rich attack surface," said Robert Mayer, senior vice president of cybersecurity at USTelecom, at an event heldfor the report today. Two elements are needed to "address this plague," he added: government and industry players working together, and all ecosystem stakeholders adopting measures to make the Internet resilient.

It's a threat that poses myriad challenges throughout the IT ecosystem. Report writers argue infrastructure providers could do more to protect customers, and smaller providers need guidance and resources. Increased software security drives bad actors to build more complex exploits. Many connected devices aren't built, configured, or installed with security in mind.

"There is no higher cause we all share than to address the challenges of our digital economy," said Jonathan Spalter, president and CEO at USTelecom. "We understand this is a shared responsibility across our industries ... a compliance-led regulatory model is not going to get us closer to the security that we all seek. This is proof of concept that industry ... is ready to lead."

Dean Garfield, president and CEO of ITI, emphasizes the need to get everyone on the same page sans regulation.

"The threat is asymmetric," he says of botnets, which are constantly evolving. "If you define a solution that's fixed in time, it's unlikely to be as flexible and fluid as the threat."

The botnet mitigation guide breaks its practices down into five types of provider, supplier, and user stakeholders in these categories: infrastructure, software development, devices and device systems, home and small business systems installation, and enterprises.

As an example of the guidance provided in the report, consider its subsection on botnet risk and mitigation among cloud and hosting providers, as part of its infrastructure section: "Because cloud networks are decentralized, they can typically withstand the disruption of numerous network components," experts explain. "This architectural feature makes the cloud more resilient to highly distributed botnets and provides additional mitigation capabilities."

Cloud services offer an added layer of security outside the ISP's infrastructure, they continue, and this protection is increasingly handy as the scale of botnet attacks continues to escalate.

Overall, for infrastructure providers planning to defend against bots, the guide advises first identifying which assets need to be defended and the potential vulnerabilities leaving them exposed. Companies should stay up to date on exploits for each flaw they identify. As for advanced practices, they add, infrastructure providers with access to more resources may have security researchers on hand to analyze heuristics and behaviors to detect malware.

There are additional baseline and advanced practices for signature analysis, heuristic analysis, behavioral analysis, packet sampling, and honeypots under the "Detect Malicious Traffic and Vulnerabilities" section for infrastructure providers, as well as similar levels of guidance for mitigating against distributed threats with filtering, traffic shaping, blackholing, sinkholing, scrubbing, and BGP flowspec. Stakeholders across categories can find similar detailed guidance .

Black Hat Europe returns to London Dec 3-6 2018 with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier security solutions and service providers in the Business Hall. Click for information on the conference and to register.

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial ...View Full Bio

In today’s post GDPR-era, the citizens of most developed countries are regularly reminded by governments, media companies and non-governmental organizations of the importance of complying with the GDPR and other privacy laws. However, little or no attention is paid to the data processing operations in conflict zones. Such zones often do not have any laws protecting confidential and personal information or, if they have such laws, they are unenforceable due to the lack of working governmental institutions.

As a result of the lack of enforceable legal frameworks in conflict zones, criminals and others can easily gain unauthorized access to information that can be used to injure humanitarian workers and other civilians. Hence, the security of information in conflict zones is of vital importance to protect the fundamental rights of the civil population in those areas.

Below, we examine four information security threats that civilians in conflict zones need to address in order to protect the security of their information. Those threats are: forcing individuals to leave their computing devices, blackmailing individuals and their families with the aim to access sensitive data, physical security threats and unlawful interception of communication. Below, we examine these four threats and provide recommendations on how to address them.

In dangerous environments, such as repressive countries and detention facilities, users of computing devices (e.g., cell phones, laptops, tablets) may be forced to leave their computing devices to the guards or armed forces. In this regard, a humanitarian worker noted: “In many places, we are not allowed to have any electronic tools with us. When you go in a prison, you cannot even have your phone with you. You have to leave it at the entrance or at the car.”

Humanitarian workers and others who decide (Read more...)

In an episode of “The Twilight Zone” called “Living Doll,” a lifelike doll named Talky Tina turned rogue and terrorized a family. This nightmare scenario of out-of-control toys is sometimes portrayed in sci-fi novels and films ― but are we entering the Twilight Zone with modern-day smart toys?

The Internet of Things (IoT) is touching every aspect of our lives and work. Across our industries, the industrial version of the IoT (sometimes called the IIoT) is growing exponentially, with a predicted market value of over $232 billion by 2023. The consumer marketplace is also growing at pace, with a market worth of around $124 million in the same time span. With values like this, manufacturers are jumping on the IoT bandwagon and adding IoT components to everything from fridges to teddy bears.

The march of progress can be a wonderful thing. It’s exciting, and in the case of the IIoT can bring about improvements in productivity and help make communications smooth across complex global vendor networks. In the case of consumer IoT products, nothing is without its IoT version.

And one area that is embracing the Internet and adding more fun into our toys is the smart toy. Who wouldn’t want a smart teddy like “Smart Toy R ” from Fisher-Price? The teddy can understand your child’s voice and respond to him or her in an intelligent way, making up stories and being a fun furry friend.

But is the promise of such clever toys too good to be true? Will the sweetness of that smart toy under the Christmas tree carry a sting in the tail caused by cybersecurity vulnerabilities?

The Federal Trade Commission (FTC) via the Children’s Online Privacy Protection Rule (COPPA) deals with the protection of personal information of children under 13 years of age. The first privacy case associated with a smart toy was brought to court in January 2018 under the COPPA rules.

The company VTech Electronics, Ltd, who provide a number of smart toys, were held to account under several points. These included not providing a clear privacy policy on its website and being negligent in securing the personal data collected from children. This case will set a precedent for further COPPA-related privacy and security breaches by smart toy companies. Here are some further cases of good toys turning bad:

CloudPets definitely deserved the accolade of “super cute.” They were adorable soft toys and any kid (including big ones) would want to cuddle and play with them. The toy was Internet-enabled, allowing audio messages to be shared between the child and a parent via the Cloud. Unfortunately, poor security has meant that CloudPets are now in CloudPet heaven, as the company has ceased trading.

It turned out that CloudPets leaked the messages of 2 million of their owners, along with personal details and passwords. Security guru Troy Hunt alerted the world to the security issues of CloudPets. During research, Troy found that the CloudPets database was unprotected. Troy also found that various personal data, including children’s voice messages, were stored on an unprotected Amazon S3 bucket.

To be fair, where CloudPets did use passwords (e.g., in the app), hashing was used. However, the company had no password strength rules, allowing single character passwords and even promoting the use of simple 3-character passwords.

Security firm Mnemonic was engaged by the Norwegian Consumer Council to check the security safety of a range of kids’ smartwatches. The analysis found a number of critical security flaws in a number of the watches.

Some of the main concerns included the evident lack of consent to share and process data, showing a fundamental lack of respect for personal information. Most of the watches analyzed collected, transmitted and stored large amounts of personal data, including location data. Some of the watches did not even use basic security techniques such as encryption in transit to protect these data ― which were also often shared with third parties without consent or with the due diligence of their vendor security strategy.

There are, of course, ethical issues around the implementation of AI in our children’s toys. Questions around cognitive development and civil issues, for example: MIT is carrying out interesting work in the area.

Outside of ethical and behavioral issues, a further worry is the dovetailing of AI with security flaws, thus compounding the safety issues. Having natural language processing and machine learning to make toys even more realistic is a goal of manufacturers. This ultra-realism could potentially enhance and augment any security flaws. Imagine a malicious entity hacking a toy that was poorly-protected and talking to a child, with the child being unable to discern between the realistic toy conversation and that of the hacker.

Fortunately, there are initiatives afoot which are attempting to force manufacturers and toy designers to put security first. An FTC initiated working group is being run by the US Commerce Department’s National Telecommunications and Information Administration (NTIA). The group is working to develop guidance around securing IoT devices. In the EU, ENISA has produced guidance “Baseline Security Recommendations for IoT” developed for IoT devices within critical infrastructures but referencing smart toy security vulnerabilities such as the CloudPets example above.

Security is important to everyone and is a civil right, no matter what age you are. The design and development of Internet-connected smart toys should be a priority to ensure the cyber-safety of our children. Rushing out toys to take advantage of seasons like Christmas should not mean that security is an afterthought. We have a civic duty to ensure the safety and uphold the privacy of our children.

The global software industry is massive. Enterprise software alone is predicted to be worth $500 billion a year by 2022. Unless we live entirely off-grid, every part of our lives and work is touched by software.

And like taxes and death, one thing you can be sure of is that software contains bugs. The commercial life cycle for software is such that you need to get software out to market quickly. First-come is first-served in an industry where innovation turns on the head of a needle.

Fast-to-market software means that the industry has had to develop new ways to speed up the development cycle. Agile development techniques and the use of automation in the test part of the development cycle have helped to speed up the time to market. But software bugs seem to never end: You fix one, only to introduce another. If you check out CVE Details data source , which lists the number of recorded software vulnerabilities going back to 1999, you can see that the number of software bugs per year keeps on growing. In 2017, there were 14,714 recorded bugs. To mid-November 2018, this number was 14,917.

Keeping up with testing software is a big job. Even production releases of software have bugs in them ― as anyone running operating system software will attest. Microsoft windows and Mac OS, for example, have regular software updates which are pushed out to anyone running a device with those operating systems installed. Microsoft’s “Patch Tuesday” has even entered the common language of computer users across the world. And while bugs come in all shapes and sizes, some of the most impactful are the security bugs.

It is to this end that the idea of using a bug bounty program to help to test software has become an industry standard. This method helps to help locate those pesky security flaws that slip through the tester’s net.

An engineer at Netscape, Jarrett Ridlinghafer, was the person who originally came up with the idea of a bug bounty program. The idea he proposed was to pay users across the wider user community a reward for finding security flaws in software products. It’s a simple idea, but one that would be used by all of the world’s top software companies.

A bug bounty program works something like this:

Some organizations will run ongoing bug bounty programs, whereas others run them on an ad hoc basis. Examples of bug bounty programs include:

Hack the Pentagon : This was a three-year white/gray-hat hacking initiative, starting in 2016 and run by HackerOne. It was set up to find software vulnerabilities in the Defense Department’s public facing websites. So far, $75,000 has been paid out in rewards.

Facebook Whitehat : The Facebook bug bounty program was started in 2011 to find vulnerabilities across the social platform. It offers a minimum reward of $500; the largest reward to date was $20,000, with over $1 million paid out so far.

Google Vulnerability Reward Program (VRP) : Google set up their bug bounty program in 2010. It is an ongoing program that has varying rewards, dependent on the type and location of the vulnerability found. Rewards range from $100 to $31,337.

Stellar Bug Bounty Program : Stellar is a decentralized protocol built for financial transactions. Stellar is based on a digital currency called a “Lumen.” Hackers are paid with Lumens when they find a vulnerability in the Stellar code or any of their repos. Stellar uses OWASP’s risk rating table to determine the severity of the bug found which translates to the number of points the hacker receives. This varies from 500 to 25,000 (paid in Lumens).

Microsoft Bug Bounty : Microsoft runs a number of bug bounty programs across their suite of products. These change over time as new products and releases come out. Microsoft has some of the best-paid bug bounty rewards on the bug bounty circuit ― amounts offered can be up to $250,000 for a novel exploit. For a reward like this, you do have to put the work in, creating whitepapers on the exploit and being able to demonstrate the innovative novelty of a flaw.

The types of people who take part in bug bounty programs are as varied as the bugs themselves. These folks who find software vulnerabilities and disclose them to the vendor directly are known as “white-hat hackers”. Bu, it isn’t only white-hat hackers that look for vulnerabilities in new releases and software products. The white-hat’s evil twin, the black-hat hacker, is also on the lookout for vulnerabilities to exploit. These vulnerabilities will be sold to the highest bidder, usually other criminals. In the case of the (supposedly) less-evil middle twin, the gray-hat hacker, these vulnerabilities are sold to state actors, such as governments.

In a bug bounty program, the idea of responsible disclosure is encouraged. This is a set of rules of engagement which set out how the white hat hacker should act when they are looking for and find, a security flaw. HackerOne , for example, sets out rules that cover respect, privacy and patience on the part of the hacker. They also have guidelines for security teams on the receiving end of bug finds. These rules include respect for finders and preservation of privacy. There is also a rule which expressly states:

“ Do no harm . Not take unreasonable punitive actions against finders, like making legal threats or referring matters to law enforcement.”

This creates a safe place for white hat hackers to do their important work.

Without the sterling work of the white-hat hacker, our software would be less safe. The white-hat hacker provides a valuable role in modern software development. Without their input, it is unlikely that the large number of software vulnerabilities could be managed well. The financial incentive for the white hats is well worth the outlay and allows organizations who use the hacker community in this way to benefit from the collective mind of experienced security professionals.

【编者按】德国一直很重视网络空间的安全与发展，尤其注重国家网络安全行动的顶层设计。德国网络安全战略侧重于自身网络安全防护能力的提升，同时注重通过有效的国际协调行动促进网络空间的安全。本文围绕德国网络安全战略，从主要内容、行动方案、实现措施、主要特点等方面，重点分析了德国网络安全战略发展及实施情况。

德国是欧洲信息技术最发达的国家，向来重视网络空间的安全与发展，尤其注重国家网络安全行动的顶层设计。为有效应对网络空间的严峻挑战，构建安全的网络环境，促进国家的经济繁荣和社会稳定，德国政府于 2011年推出首份国家网络安全战略，明确网络安全战略的总体目标和保障措施，用以指导和加强国家网络安全建设，并于2016 年发布新版网络安全战略，对国家网络安全建设作出部署。与美国网络安全战略强调攻防能力并重发展不同，德国网络安全战略侧重于自身网络安全防护能力的提升，同时注重通过有效的国际协调行动促进网络空间的安全。

德国政府向来重视信息化建设，自上世纪末以来其通过制定和实施一系列信息化发展战略，推动国家信息化建设取得了快速发展。但随着政府机构、关键基础设施、企业和公民等对信息通信技术和互联网的依赖逐渐增强，德国面临的网络威胁尤其是境内外针对其信息基础设施的网络攻击也日益频繁和复杂。德国政府虽然重视网络安全并且也陆续推出了多项网络威胁应对措施，包括 2001 年组建网络应急预警系统、2005 年出台全国性 IT 安全计划并建立电脑紧急情况应对中心、2008 年批准颇具争议的互联网监管法案等，但随着网络威胁的不断发展变化，这些措施已渐难满足应对挑战的需求。与此同时，同为信息化大国的美国、俄罗斯、法国、英国等已领先德国出台了国家网络安全战略，用以指导和加强国家网络安全建设，防范和遏制网络空间给国家安全带来的威胁。

在上述国内国际背景下，德国政府于 2011 年 2 月 23 日授权内政部颁布了首份《德国网络安全战略》。在该战略中，德国政府评估了国家网络安全面临的主要威胁，阐述了国家网络安全战略的现实依据、框架条件、基本原则、战略目标与保障措施等，成为指导德国网络安全建设的纲领性文件。其中采取的措施重点针对保护关键信息基础设施、保护公众和中小企业 IT 系统、保护行政部门 IT 系统、建立国家网络防御中心、成立国家网络安全委员会、有效控制网络犯罪、开展有效协调行动确保欧洲和全球网络安全、采用可靠可信的信息技术、促进联邦政府人才发展，以及建立应对网络攻击的工具等十大领域。

为适应信息技术的快速发展和网络安全威胁的不断演变，德国政府于2016 年 11 月 9 日发布了新版《德国网络安全战略》，用以应对越来越多的针对政府机构、关键基础设施、企业以及公民的网络威胁活动。新版战略延续了首份战略的总体目标，对未来几年网络安全建设进行了细化部署，有效弥补了首份战略中保障措施不够细化的问题，成为德国网络安全行动的新指南。

2011 年网络安全战略从德国实际需求出发，注重网络安全顶层设计，强调国内资源整合与国际合作，并关注战略实施的可持续性，为德国“面向未来的网络安全政策”奠定了基础，保护网络安全和防御网络攻击成为德国的国家级任务。2016 年网络安全战略的颁布实际上是对 2011 年网络安全战略的一个延续和补充，它为德国推进网络安全建设提供了新的战略框架。在新版战略中，德国政府明确指出，2011 年网络安全战略的总体目标仍然存在，换言之，即“大力构建安全的网络空间，促进德国经济、社会的稳定和发展”的战略目标仍然存在。在新版战略中，德国政府重点评估分析了网络威胁新的形势特点，并明确阐述了未来几年网络安全的四大行动方案及其具体措施，主要情况如下：

根据德国政府的评估分析，德国面临的网络威胁形势具有以下特点：第一，技术的不断发展变化，使网络威胁的复杂性日益增加。与此同时，现代社会的数字化也正在增加网络空间的脆弱性和技术滥用的可能性。第二，网络攻击不仅影响网络空间，还可能对社会、经济、政治和公民造成严重损害。例如，针对国家机构的间谍或破坏活动可能严重损害行政当局、武装部队和安全部门的运作，从而对德国的公共安全和秩序产生影响；针对能源网的攻击可能使大部分公共和私人生活陷入停滞；针对银行基础设施或股市的网络攻击可能对整个金融市场构成威胁，并对德国和世界经济产生深远影响。第三，攻击者往往具有犯罪、极端主义 / 恐怖主义、军事或官方背景，境内外潜在攻击者的多样性及其隐藏技术的使用，使得对网络攻击的检测、分析、防御和起诉更加困难。第四，政治、军事冲突常常伴随着低于网络空间武装冲突门槛的网络攻击活动，造成对网络攻击的政治评估和对策决定变得复杂化。第五，网络攻击的数量和质量正在稳步增长，并且经常遇到安全性不足的 IT 系统。第六，国家支持型组织、犯罪集团或个人很容易获得网络攻击工具。特别是在技术先进的恶意程序方面，传统的防护工具往往不再足够。第七，攻击者能够利用技术隐藏网络攻击活动，导致网络攻击及其来源越来越难以被发现。德国政府评估认为，未来几年，德国的国家、经济和社会将受到以上网络威胁形势的严重影响。

未来几年，德国实现网络安全战略目标的四大行动领域及具体行动计划如下：

1、数字化环境中的安全和自主行动。在数字化环境中安全和自主行动是网络安全的重要基石，但这需要适当的可信技术和框架条件。行动计划包括：一是提升全体用户的数字化能力。将数字化素养纳入教育体系，包括学校教育、双元教育、职业培训和普通成人教育，增强用户安全使用 IT 技术的基本知识。二是提高安全意识以抵消数字疏忽。联邦政府将与“德国安全在线（DsiN）e.V.”等倡议团体合作，促进目标群体提高认识；以及由联邦信息技术安全局（BSI）扩大 IT 产品和服务安全漏洞的公开警示等。三是为电子通信及Web 服务创造安全条件。通过易用的加密策略或解决方案实现电子通信和Web 服务的安全保密；增强国家执法和安全机构的解密技术能力，使之与加密技术的发展同步。四是电子身份安全保障。进一步发展安全、易用和先进的在线身份认证技术和方法。五是加强认证及批准――引入 IT 安全“质量标签”。鼓励标准技术制造商为安全的 IT 消费产品引入基本认证程序；加强 IT 产品和服务的质量认证和质量标签，使其安全性更加透明；以及支持扩展欧洲和国际 IT 安全认证协议等。六是保障数字化进程的安全。研究责任适当分配和安全风险要求，例如通过 IT 安全缺陷的产品责任规划和制造商安全规范；以及推动制定国际标准，加强移动数据的跨境安全保护等。七是推进 IT 安全研究。扩展 IT 安全研究计划《数字化世界中的安全自主 2015-2020》，并将之与网络安全战略措施紧密结合；资助现有 IT 安全研究能力中心和联邦国防军大学等加强 IT 和网络安全应用研究，发现、引进和开发新技术。

2、政府与企业的共同努力。政府和企业的信任合作和密切交流是长久确保德国网络安全不可或缺的。未来几年，德国政府与企业加强合作的行动计划包括：一是保护关键基础设施安全，尤其是关键信息基础设施的安全。二是加强对德国企业特别是中小型企业的网络信息安全防护，包括支持企业实现所需的 IT 安全级别等。三是加强德国 IT 产业经济发展。为增强国家 IT 产业竞争力，联邦政府将推广“IT安全德国制造”并扩大对外贸易。在国家关键技术领域，联邦政府将加强与IT 安全产业的合作，包括资助企业与大学、非大学研究机构和商业合作伙伴共同开发新产品和服务等。四是与安全服务提供商合作。联邦政府将利用机会促进有能力和值得信赖的安全服务提供商更多地参与网络安全建设，包括检测网络威胁、处理感染事件、打击网络攻击、保护网络数据、交流 IT 专业知识等。联邦政府还将与网络安全行业的代表一起设计和实施网络安全人员交流计划。五是建立政府与企业的可靠合作平台。该平台将在法律允许范围内，优先促进相关情况信息的信任交换，助力抵御网络攻击。

3、高效可持续的国家网络安全体系。建立先进的网络安全架构，有效联合联邦不同参与者的力量，并密切关注州和地方政府，确保德国在网络空间的安全和自主。行动计划包括：一是进一步发展国家网络防御中心（CyberAZ）。将该中心由单纯的信息交换中心发展为各部门网络安全机构密切合作的协调平台。二是增强现场分析和响应的能力。在 BSI 设立移动事件响应小组（MIRT），在联邦刑事警察局（BKA）设立专门调查组（快速反应部队），在联邦宪法保卫局（BfV）设立移动网络组（Mobile Cyber-Teams）。 三是加强网络空间执法。继续加大打击网络犯罪的力度，加强司法和执法机构人员技术和专业资质的教育培训，并借助新技术促进安全机构的能力提升。四是有效打击网络间谍及破坏活动。加强 BfV 反间谍人员和组织的建设，并加大极端主义和恐怖主义网络攻击的打击力度。五是加强境外网络攻击的预警防范。利用联邦情报局（BND）的网络攻击预警系统加强威胁分析，为启动防御措施提供早期预警。六是建立信息安全技术中心办公室（ZITiS），为国家安全机构提供相关技术支持。七是提升国防军网络安全防御能力。将整合分散的网络安全力量编成新的军事组织。八是加强德国计算机应急响应小组（CERT）建设。由 BSI 推进政府、企业、科研机构所属 CERT 的联合协作，并在联合过程中改进现有的 CERT 结构。九是加强联邦政府的网络安全管理。十是加强联邦政府和各州之间的合作。十一是利用资源加强人员招募和培养，包括各级政府的财政资金以及培训机构与业界的资源。

4、在欧洲及国际网络安全政策中发挥积极作用。数字化时代的跨国网络，只有将国家措施纳入相应的欧洲、区域和国际进程，才能实现高水平的网络安全，德国将继续在欧洲和国际网络安全政策中发挥积极作用。行动计划包括：一是积极制定有效的欧洲网络安全政策。将致力于确保在所有数字化流程中充分解决 IT 安全问题，包括通过基于数据安全的欧洲数据定位政策以及将数据保护纳入欧洲国际数据交换规则等；积极参与数据跨境处理与使用相关法律和技术问题的欧盟试点项目。二是发展北约的网络防御政策。北约需制定其网络防御政策，以适应网络空间安全环境的变化，持续增强抵御网络空间攻击的能力，德国将积极参与这一政策制定的塑造进程。三是积极帮助塑造国际网络安全。将继续在联合国推动关于国际法适用于国家和非国家行为者的辩论；为补充完善国际法规范体系，将参与制定规范、规则、原则和其他关于在网络空间中负责任国家行为的建议；支持联合国维护国际网络空间稳定的行动和增强应对国际网络威胁的能力；以及支持加强监控技术出口管制的国际努力等。四是网络能力构建的双边及区域支持与合作。将支持选定的合作伙伴国家和地区加强其预防性和反应性网络安全能力（网络稳健性和网络恢复能力）。五是加强国际执法。将在国际上打击网络犯罪，将加强跨境执法和联合调查能力，努力改善网络空间跨境执法的国际法律框架，并探索简化和加快请求国际合作伙伴司法协助的方法。

自首份网络安全战略发布以来，德国政府积极通过法律保障、机构设置、网军组建、企业帮扶、人才发展等方面的强化措施，大力推进国家网络安全建设，加快网络安全战略目标的实现进程。

德国政府先后出台了《信息技术安全法》和《改进社交网络执法的法案》（简称《网络执行法》），为加强关键基础设施保护、社交媒体平台监管以及促进国家网络安全战略目标的实现提供了坚强的法律保障。一是《信息技术安全法》。2015 年 7月开始施行，该法案以保护关键基础设施为重点，不仅吸收了德国2011 年网络安全战略中关于关键基础设施的定义，还明确了关键基础设施的保护范围及其运营者的法律责任。法案还通过授权联邦刑事警察局（BKA）可对网络犯罪嫌疑人进行数据拦截和监控，进一步扩大了政府部门的网络监控权限。总体而言，该法案的施行强化了德国联邦政府对关键基础设施的管理，是对德国关键基础设施保护制度的进一步完善，是德国 2011 年网络安全战略的贯彻和延伸。二是《网络执行法》。是德国联邦议会 2017 年 6月 30 日通过的一项针对社交媒体平台的监管法案。该法案强制要求在德国境内符合条件的社交网络平台建立虚假新闻、煽动性言论和仇恨言论等违法信息的投诉与处理机制，并对处理不力、不当者设置最高达 5000 万欧元（约合 5750 万美元）的巨额罚款。该法案在 2017 年 10 月 1日生效，后经 3 个月“缓冲期”的适应整改，于 2018 年1月 1日正式施行。

近年来，德国政府根据网络安全战略先后设立了国家网络安全委员会、国家网络防御中心、信息安全技术中心办公室等网络安全机构，这些机构在战略实施过程中发挥了重要的事务协调与技术支撑作用。一是国家网络安全委员会。该委员会成立于 2011 年 4 月，由联邦政府信息技术专员负责运作，成员包括联邦总理府、联邦政府部门（内政部、国防部、财政部、教育和研究部、司法部、外交部、联邦经济和能源部）以及各联邦州的代表，主要职能是从战略高度和政策层面协调联邦政府部门与私营部门建立并保持合作。该委员会每年举行三次会议。二是国家网络防御中心。成立于 2011 年 4 月的联合机构，主要负责协调优化政府各部门之间的网络安全合作，包括网络威胁的信息交换、评估分析及由此产生的应对策略、行动建议拟订等。该中心由 BSI 领导，联邦宪法保卫局（BfV）、联邦民事保护与灾难救助局（BBK）、联邦情报局、联邦警察（BPOL）、联邦国防军等政府部门共同参与运作。三是信息安全技术中心办公室。成立于 2017 年 4 月的非法人联邦机构，负责为德国安全机构研发网络安全相关工具和技术解决方案，工作领域包括电信监控、数字取证、密码分析和大数据分析。此外，德国还于2012 年由 BSI 与联邦 IT 协会等合作成立“网络安全联盟”，用以推动政府机构与经济界加强合作；2018 年 8 月在内政部下设立“网络安全创新局”，负责推动网络安全技术研发，以减少对美国等其他国家的技术依赖。

德国联邦国防军是较早开始建设网络空间作战力量的军队之一，其中最典型的部门为负责网络空间作战的战略侦察指挥部和负责维护军方通信安全的国防军信息技术中心。除此之外，还有负责部队 IT 系统的国防军信息技术指挥部、负责为军事行动提供地理信息支援保障的国防军地理信息中心、负责部队网络安全的国防军网络安全中心，以及负责计算机网络行动的网络军事行动中心。这些专业机构和部门奠定了德国联邦国防军网络空间作战力量的基础。近年来，随着军事领域遭受的网络攻击日益频繁，为提升联邦国防军的网络空间作战能力，德国联邦国防部根据国家网络安全战略于 2017 年 4 月成立“网络与信息空间司令部”，着手组建负责国防军网络安全的独立军种，国防军原有分散的网络作战力量陆续被整合编入该司令部。新组建“网军”的主要任务包括确保联邦国防军信息系统在国内外的安全运作、加强在网络信息空间的侦察和影响力、支援国防军其他部门完成任务、数字化背景下与其他机构合作维护国家安全，以及加强网络安全设施建设等。值得注意的是，新组建的“网军”设有计算机网络行动部队，现有编制 60 人，未来将扩充至80人，担负包含网络攻击在内的作战任务。根据德国军方设想，“网络与信息空间司令部”预计到 2021 年可“完全做好应战准备”，届时其兵力规模将由组建时的 260 人大幅扩充至 1.35 万士兵和 1500 名文职雇员。

德国认为，国家的网络安全需要强大的 IT 产业经济支持，而中小企业和初创企业则是德国 IT 产业发展的基础。为此，德国近年来积极采取措施帮扶中小型及高科技初创企业发展，用以促进德国 IT 产业经济发展，进而推动网络安全战略目标的实现。一是组建特别工作组帮助中小企业保护 IT 基础设施。为加大对中小企业 IT 基础设施保护的扶持力度，德国联邦经济与科技部（注：2013 年更名为联邦经济和能源部）于 2011 年组建了一支负责 IT 安全的专责小组，负责与业界伙伴合作，采取措施帮助中小企业防护 IT 基础设施安全。二是加强对中小企业数字化重点领域项目的资助。德国联邦经济和能源部 2016 年发布《数字战略 2025》，提出将针对中小型企业数字化投资项目进行资助，同时扩充目前已有的中小企业扶持项目，以满足中小企业不断增长的资金需求。其中，中小型企业数字化投资项目将在 2018 年获得10 亿欧元（约合 11.7 亿美元）的资助；现有的中小型企业创新计划（ZIM）项目、工业社区研究（IGF）项目则可分别获得 7 亿欧元（约合 8.2 亿美元）和 2 亿欧元（约合2.3 亿美元）的扩充资金。 三是启动“加速器”项目帮扶高科技领域初创企业发展。德国和以色列于 2017 年 11月启动首个网络安全领域创新和合作项目“黑森以色列网络安全合作加速器”，该“加速器”由德国夫琅禾费安全信息技术研究所和以色列希伯来大学网络安全研究中心共同建立，目的是吸引德国及以色列的网络领域高端人才共同致力于网络技术、互联网基础设施和软件安全等项目的创新与研发，并为高科技领域的初创企业提供更多进入市场的成功机会。

德国通过加强网络安全与信息化领域人才的招募、培育和使用管理，为推进国家网络安全建设、保障国家网络空间安全提供智力支持。一是积极招募网络人才充实网军。为促进网络空间作战力量的提升，德国联邦国防军注重多渠道引进具有网络信息相关专业才能的人员入职新组建的网络空间作战部队。国防军于 2017 年 4月举办“网络日”活动，特别招募网络信息技术专家，以补缺军队和民兵部队中有关信息技术人才的职位缺口。国防军还为 2017 年 4 月在国防军信息技术指挥部下成立的网络安全中心编配 117 名平民雇员，以配合 185 名士兵更好地保护国防部在网络和信息领域的安全。国防军还计划通过招募地方信息技术人才、调配国防军从事网络的相关人员，为“网络与信息空间司令部”扩充实力。二是政府机构与企业合作培育人才。德国 2016 年网络安全战略强调要扩大政府机构与企业在人才发展上的合作，并建立创新的人员交流模式。据此，德国联邦国防军2018 年 9月与德国最大的电信运营商德国电信公司达成协议，将针对开设信息技术安全培训课程、定期交换专业人员等开展紧密合作。三是施行高效的科研人才管理机制。德国实行以人为本、项目化的人才管理体制和全球人才聘任机制，全球高端人才的引进使德国研究人员国际化比例一直保持较高水平。德国著名科研机构马普学会下属研究所的学术带头人可自主选择研究课题开展研究工作；弗劳恩霍夫协会下属研究所则实行固定岗与流动岗相结合的人员管理方式，对部分科研和技术人员采用合同制，以方便其流动，保证了人才的更迭、进出有序。

New Zealand’s competition enforcement agency the Commerce Commission has released a framwork paper outlining its approach to implementing new provisions under the Telecommunications Act to improve retail service quality for consumers.

The paper, published on Friday, outlines how the Commission plans to gain a better understanding of the retail service quality being provided to consumers, prioritise what it should focus on and “determine the appropriate tools to use, if intervention appears worthwhile”.

“Retail telecommunications is a Commission priority, in particular in the areas of billing, switching, contract terms, and marketing. Parliament has now given us more tools to improve retail service quality and safeguard consumers,” Telecommunications Commissioner Dr Stephen Gale said.

The new provisions, contained in legislation passed by New Zealand’s Parliament on 7 November, require the Commission to monitor aspects of retail service quality including performance, speed and availability, customer service and billing and installation issues, as well as providing information for consumers to help them with their choices of technologies and providers.

The new provisions also allow the Commission to create retail service quality codes―if industry-led codes are inadequate―and require it to periodically review the Telecommunications Dispute Resolution scheme.

Along with the new consumer provisions, the legislstion establishes a price-quality regime for Chorus by setting the maximum price it can earn from its ultra-fast broadband network and the quality of service it must deliver. It also requires Chorus and local fibre companies (Northpower Fibre, Ultrafast Fibre, and Enable Networks) to publicly disclosure information around their revenue, performance, and quality.

“We receive lots of consumer enquiries and complaints about telecommunications providers and have responded over the past few years through Fair Trading Act warnings and prosecutions. The new provisions will help us encourage telcos to compete more on retail service quality, not just on prices,” Dr Gale said.

The Commission says it will publish a paper in early 2019 outlining how it plans to engage with consumers and industry stakeholders to set up the collection of retail service quality data, and will also provide initial thinking on what metrics could be good indicators of retail service quality.

To access a copy of the framework paper click here .

With 4 keynotes + 33 talks + 10 in-depth workshops from world-class speakers, YOW! is your chance to learn more about the latest software trends, practices and technologies and interact with many of the people who created them.

Speakers this year include Anita Sengupta (Rocket Scientist and Sr. VP Engineering at Hyperloop One), Brendan Gregg (Sr. Performance Architect Netflix), Jessica Kerr (Developer, Speaker, Writer and Lead Engineer at Atomist) and Kent Beck (Author Extreme Programming, Test Driven Development).

Register now for YOW! Conference

Sydney 29-30 November

Brisbane 3-4 December

Melbourne 6-7 December

Register now for YOW! Workshops

Sydney 27-28 November

Melbourne 4-5 December

REGISTER NOW!

Australia is a cyber espionage hot spot.

As we automate, script and move to the cloud, more and more businesses are reliant on infrastructure that has the high potential to be exposed to risk.

It only takes one awry email to expose an accounts’ payable process, and for cyber attackers to cost a business thousands of dollars.

In the free white paper ‘6 Steps to Improve your Business Cyber Security’ you’ll learn some simple steps you should be taking to prevent devastating and malicious cyber attacks from destroying your business.

Cyber security can no longer be ignored, in this white paper you’ll learn:

How does business security get breached?

What can it cost to get it wrong?

6 actionable tips

DOWNLOAD NOW!

Nonprofit has published its first-ever evaluation of popular endpoint security tools - measured against its ATT&CK model.

There were no grades, scores, nor rankings, but the official release today by MITRE of the results from its tests of several major endpoint security products could signal a major shift in the testing arena.

MITRE, a nonprofit funded by the US federal government, in its inaugural commercial tests pitted each product against the well-documented attack methods and techniques used by the Chinese nation-state hacking group, APT3 aka Gothic Panda, drawn from MITRE’s widely touted - and open - ATT&CK model.

Endpoint detection and response (EDR) vendors Carbon Black, CrowdStrike, CounterTack, Endgame, Microsoft, RSA, and SentinelOne, played blue team with their products against a red team of experts from MITRE. Unlike traditional third-party product testing in security, the ATT&CK (Adversarial Tactics, Techniques, and Common Knowledge) approach uses open standards, methods - and the vendors perform live defenses with their products.

"It was a collaborative and conversational, versus transactional, model," he says.

MITRE tracks and documents how the tools are tuned and configured, and how they do or don't detect an offensive move by its "APT3" red team, for example. The results get published on MITRE's website for anyone to see and study.

"We really want this to be a collaborative process with the vendors; we want them to be part of the process," says Frank Duff, MITRE's lead engineer for the evaluations program. The goal is both to improve the products as well as share the evaluations publicly so organizations running those tools or shopping for them can get an in-depth look at their capabilities, according to Duff.

MITRE chose APT3's methods of attack, which include credential-harvesting and employing legitimate tools used enterprises to mask their activity. Each step of the attack is documented: how the tool reacted to the attacker using PowerShell to mask privilege-escalation, for example. ATT&CK is based on a repository of adversary tactics and techniques, and is aimed at helping organizations find holes in their defenses: for security vendors, using ATT&CK testing helps spot holes or weaknesses in their products against known attack methods.

The collaborative and open testing setup represents a departure from traditional third-party testing. Vendors and labs traditionally have had an uneasy and sometimes contentious relationship over control of the testing process and parameters. Longtime friction in the security product test space erupted into an ugly legal spat in September, when testing firm NSS Labs filed an antitrust lawsuit against cybersecurity vendors CrowdStrike, ESET, and Symantec as well as the Anti-Malware Testing Standards Organization (AMTSO), over a vendor-backed testing protocol.

The suit claims the three security vendors and the nonprofit AMTSO, of which they and other endpoint security vendors are members, unfairly allow their products to be tested only by organizations that comply with AMTSO's testing protocol standard .

"The whole testing landscape is a real mess," Endgame's Dufresne says. "As a vendor, it's important to be there," however, he says.

NSS Labs, which is a member of AMTSO, was one of a minority of members that voted against the standard earlier this year; the majority of members support it and plan to adopt it. "Our fundamental focus is if a product is good enough to sell, it’s good enough to test. We shouldn’t have to comply to a standard on what and how we can test," Jason Brvenik, chief technology officer at NSS Labs said in an interview with Dark Reading after the suit was filed.

Traditional third-party tests such as those conducted by NSS Labs, AV-Test, and AV-Comparatives, focus mainly on file-based malware, Endgame's Dufresne explains, looking at whether the security product blocks specific malware. "We do participate in those … but they truly miss a huge swath of overall attacker activity."

MITRE’s Duff says there are different security product tests for different purposes. ATT&CK is all about openness and providing context to the evaluation, he says. "All different testing services have their own purpose, value, and approaches. This is our approach and we are hoping it resonates to the public."

Even so, malware-based testing isn't likely to go away. "I think some buyers like to see a number" like those tests provide, Endgame’s Dufresne says.

Greg Sim, CEO of Glasswall Solutions, says third-party testing was overdue for a change. Even when they garner high scores from the anti-malware testing labs, some products continue to fail in real-world attacks, he says. "I think there’s going to be a different model," he says, noting that his firm has run tests with MITRE, which it considers an example of a reputable third party for testing.

Another security vendor executive who requested anonymity says MITRE’s entry into the testing arena came just at the right time. "Emulating tradecraft of a known adversary, nation/state: for us on the vendor side, we’re saying 'hallelujah, they are doing it the right way,'" he says.

MITRE’s new testing service represents new territory for the nonprofit, but that doesn’t mean its federal government work will subside. Vendors pay a fee, which MITRE would not disclose. "MITRE historically has focused on doing testing of solutions for US government customers or sponsors. That role is not going anywhere," Duff notes.

Duff says MITRE hasn't yet set a timeframe for its next series of tests, but the team will pick another APT group to emulate.

"We are just trying to get at the ground truth on these tools," he says.

Kelly Jackson Higgins is Executive Editorat DarkReading.com. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ...View Full Bio

有针对性的攻击是(或应该)是任何地方大型组织的重要关注点。精心设计的攻击分六个阶段进行，显示攻击者如何在目标内进展。

自从有针对性的攻击首次出现在威胁环境中已有好几年了，各种威胁和我们对他们的理解都已经发生了演变和成熟。从那时起我们学到了什么以及发生了什么变化?

在我们开始讨论有针对性攻击的不同组成部分之前，考虑使竞选活动成功的因素也很重要。公司遭到入侵的原因之一是因为他们的前线员工和他们的意识很弱。意思是，人的障碍作为抵御目标攻击的第一道防线是至关重要的。

目标攻击的六个组成部分代表逻辑的、结构化攻击中的不同步骤。然而，现实更加混乱。一旦阶段“完成”，并不意味着没有其他与该阶段相关的活动发生。 一个攻击的多个阶段可能同时进行：例如，在任何目标攻击中发生都会发生C&C通信。攻击者需要控制目标网络中正在进行的任何活动，因此C&C通信量自然会继续在攻击者和任何受损系统之间来回传递。

最好将每个组件视为同一攻击的不同方面。网络的不同部分可能同时面临攻击的不同方面。

这可能会对组织如何响应攻击产生重大影响。不能简单地假设因为在“早期”阶段检测到攻击没有进行“后期”阶段。适当的威胁响应计划应该考虑这个并做出相应的计划。

任何有针对性攻击的第一阶段都涉及收集有关预定目标的信息。然而，大量可用于执行攻击的信息仅限于公司网络。因此，即使攻击已经在进行中，这个阶段也不会停止。从网络内获取的数据有助于提高任何持续攻击的效率。

除了信息之外，发现各个团队之间存在的连接以及扩展到目标组织之外的连接，还可以帮助攻击者确定更多攻击的良好目标。

传统上有针对性的攻击使用鱼叉式网络钓鱼电子邮件来渗透目标组织的网络。虽然这仍然是一种有效的策略，但攻击者已经添加了其他方法来实现这一目标。

这些替代方案包括水坑攻击(即针对目标行业或组织经常访问的网站的攻击)。但是，除了初始入口点之外，攻击者还可以在目标网络中添加其他入口点。可以针对不同的员工或网络段来确保更完整的攻击。

此外，攻击者可以在横向移动过程中不断向各种系统添加后门，这可以作为已经受到攻击的组织的额外切入点。对于攻击者来说，如果检测到并删除了较旧的入口点，这些可能会非常有价值。

为了有效地发起目标攻击，攻击者需要能够有效地控制目标网络中任何受到破坏的计算机。隐藏后门C&C通信的一些方法，但我们最近看到的另一个趋势是内部机器如何充当中间C&C服务器。攻击者将连接到此内部C&C服务器，然后将其传递给组织内的其他受感染计算机。

攻击者不断重复有针对性攻击的横向移动。在此过程中，还会发生一些与其他阶段(例如情报收集)分类的活动。此外，其他系统可能会后门作为额外的受损机器。

横向移动使用合法的系统管理工具来帮助隐藏其活动，并且有三个目标：升级目标网络中的可用权限，在目标网络内执行侦察，以及横向移动到网络内的其他机器。

这个方面可能是有针对性攻击最重复的一个方面; 此外，它也是最全面的，因为此步骤也可以包含目标攻击的其他阶段。进行内部侦察和信息收集，收集的任何“情报”可用于识别横向移动的潜在目标，以及可以找到的任何资产。

成功的针对性攻击是指在其背后的各方需要的情况下可以继续进行的攻击。与其他任何事情一样，攻击者需要对正在进行的攻击进行维护以保持其正常运行。这可以包括使用不同的后门和C&C服务器，或使用补丁来确保其他攻击者无法利用攻击中使用的相同漏洞。

数据泄露是任何有针对性攻击的最终目标。但是，受感染的计算机并不总是包含有价值的信息，而某些系统可能不包含任何值得窃取的信息。

从网络安全解决方案的角度来看，渗透过程可能会“嘈杂”，因为它可能涉及在正常操作过程中无法找到的大量网络流量。攻击者试图“隐藏”泄漏流量的一种尝试是在以受控方式提取数据之前将大量被盗数据传输到组织内的机器。众所周知，在涉及PoS恶意软件的事件中会发生这种情况。

有针对性的攻击是当今任何组织的一个重大问题，并且在可预见的未来将继续如此。对于那些玩防守的人来说，了解威胁形势不断变化以创造必要的适当防御是非常重要的。

Introducing the $12.5 Million Machine Identity Protection Development Fund

Scott Carter

Thu, 11/29/2018 18:11

Venafi created the Fund to accelerate the integration of machine identity intelligence into a wide range of machines in the enterprise and further enhance and expand the machine identity ecosystem. The Fund will allow developers, including consultancies, systems integrators, fast-moving startups, open source developers and cybersecurity vendors to apply for sponsorship. This sponsorship will allow recipients to build integrations that deliver greater visibility, intelligence and automation for Venafi customers across any technology that creates or consumes machine identities.

“Identity is the foundation of security,” notes Jeff Hudson, CEO of Venafi. “The cyber world is made up of machines, and all machines require identities for the cyber world to be secure. As a society, we understand the risks associated with human identity theft very well, and we spend over $8 billion per year protecting human identities. However, most organizations don’t yet understand the risks associated with machine identities and, as a result, spend almost nothing to protect them. This leaves our global digital economy at risk.”

Just as usernames and passwords are used to identify and authenticate humans, machine identities enable the trusted relationships between machines that control the flow of sensitive data. Because machine identities are poorly understood and often unprotected, they are subject to being exploited by cybercriminals. The Venafi Platform protects the machine identities whose underlying technology is cryptographic keys and digital certificates by providing unparalleled visibility, intelligence and automation.

Designed to rapidly accelerate machine identity protection across the ecosystem, the Fund is part of a $100 million round of financing, led by TCV with additional participation from existing investors, QuestMark Partners and NextEquity Partners. “DevOps and IoT are driving growth in the number of machines thanks to cloud computing, virtualization, and the proliferation of connected devices,” notes Jake Reynolds, general partner at TCV. “Venafi is well-positioned to provide the machine identity protection for all enterprise machines, and we look forward to supporting the Venafi team as they continue to scale in this rapidly expanding market.”

With machine identity protection built in to more applications―especially DevOps, multi-cloud, mobile, threat protection, and analytics―Venafi customers will be better equipped to secure their organizations and reduce risk. Venafi customers will be able to take advantage of a growing ecosystem to protect more machine identities for applications that are important today as well as tomorrow. The Fund also helps future-proof Venafi customers’ machine identity protection strategies.

Bridget Hildebrand

Machine identities are exploding across the Global 5000. As a result, attackers are looking to misuse machine identities and their capabilities every day. To counter these potential threats, machine identity protection should be built in to more applications across the security infrastructure―especially DevOps, multi-cloud, mobile, threat protection and analytics.

Venafi is committed to enabling our customers protect their business-critical applications. In support of this effort, we have created a $12.5 million Machine Identity Protection Development Fund. The Fund will sponsor the development of third-party integrations with the Venafi Platform, accelerating the expansion of the Venafi ecosystem.

Attend a livestreaming event on December 13.

Explore now.

Recent Articles By Author

How Safe Are Private Keys in the Cloud? Could Your PKI Deployment Affect Your Organization’s Cybersecurity? Key and Certificate Management vs. Key and Certificate Security―Time for a Change More from Scott Carter

*** This is a Security Bloggers Network syndicated blog from Rss blog authored byScott Carter. Read the original post at: https://www.venafi.com/blog/introducing-125-million-machine-identity-protection-development-fund

TCV Invests in Machine Identity Protection Provider Venafi A Pioneer of a Vital New Category in Cybersecurity

Scott Carter

Thu, 11/29/2018 18:25

At TCV, we’ve been watching the number of machines grow exponentially. It’s not just that IoT (Internet of Things) is connecting physical devices to the internet. It’s the software machines virtual servers, containers, microservices that are proliferating even faster due to cloud computing and the shift to mobile apps. These software machines are now creating machines on their own. Everything we do online involves machines identifying each other before granting access, delivering data, or conducting transactions. If those encrypted connections are not secure, nothing is.

But surprisingly few companies are trying to crack this problem at the necessary scale. Instead, the world poured billions of dollars into securing human identities, while the number of machine identities grew exponentially behind the scenes. When Jeff Hudson came to Venafi in 2010, driving the company’s evolution toward machine identity protection, we saw a great fit with our core investment thesis that continued growth in the digital economy depends on security. Creating the Machine Identity Protection category positions Venafi at the intersection of multiple major tech trends including cybersecurity, the cloud, IoT, SaaS, and DevOps. So we are truly excited to invest in the company and partner with Jeff’s team in scaling Venafi to its full potential.

The company has plenty of momentum, with more than 300 blue-chip customers. With its portfolio of 30 patents, Venafi has lifted machine identity out of the fragmented, nuts-and-bolts phase and elevated it to full solution status. The Venafi platform gives enterprises global visibility into their machine identity risks, generates actionable intelligence for managing them, and automates the processes for addressing them. Early adopters have learned that the Venafi platform transcends and unifies all of the security point solutions out there, from inventorying and policy enforcement to analytics and threat detection. And once customers discover what Venafi can do for them, they want more.

None of this comes as a surprise, because Jeff has a rare combination of strategic vision and disciplined execution. He plays the long game andthat’s why he increased Venafi’s R&D efforts to address a problem most people didn’t see coming: the need to secure encryption not just between people and machines, but between the machines themselves. At TCV, we also witnessed Jeff’s skill in recruiting world-class talent at a time when the supply of engineering talent is getting tight, particularly in the cybersecurity sector.

Jeff and his team recognize the critical role security plays in the digital economy. It’s not just about selling product, it’s about securing connections, data, and commerce. It works with anyone’s cloud and any type of machine. The open, public key infrastructure (PKI) system that underlies internet security has created a horde of “Certificate Authorities” (CAs), to the point that many large companies don’t know how many different CAs they are dependent upon. Venafi dissolves these complexities, giving enterprises a unified, vendor-agnostic, dashboard-driven view of machine identity.

Given the growing risks that all companies and consumers face from cybercriminals, it’s essential that the fragmented security industry find more cohesive solutions, and Venafi is showing a way forward. TCV is excited to come onboard and contribute to the journey.

Jake Reynolds, general partner at TCV

Category-creating companies typically tackle a problem people didn’t know they had, or a problem considered too big to solve. Under CEO Jeff Hudson, Venafi has taken on one of the largest unrecognized problems imaginable: managing the encrypted communications between the machines that run in every organization and the internet. As result, Venafi is defining a new category called Machine Identity Protection.

Attend a livestreaming event on December 13.

Explore now.

Recent Articles By Author

Introducing the $12.5 Million Machine Identity Protection Development Fund How Safe Are Private Keys in the Cloud? Could Your PKI Deployment Affect Your Organization’s Cybersecurity? More from Scott Carter

*** This is a Security Bloggers Network syndicated blog from Rss blog authored byScott Carter. Read the original post at: https://www.venafi.com/blog/tcv-invests-machine-identity-protection-provider-venafi-pioneer-vital-new-category

The objective, code-namedDragonfly, was to build a search engine for China that would censor broad categories of information about human rights, democracy, and peaceful protest. Yonatan Zunger, then a 14-year veteran of Google and one of the leading engineers at the company, was among a small group who had been asked to work on Dragonfly. He was present at some of the early meetings and said he pointed out to executives managing the project that Chinese people could be at risk of interrogation or detention if they were found to have used Google to seek out information banned by the government.

Scott Beaumont, Google's head of operations in China and one of the key architects of Dragonfly, did not view Zunger's concerns as significant enough to merit a change of course, according to four people who worked on the project. Beaumont and other executives then shut out members of the company's security and privacy team from key meetings about the search engine , the four people said, and tried to sideline a privacy review of the plan that sought to address potential human rights abuses. Google's leadership considered Dragonfly so sensitive that they would often communicate only verbally about it and would not take written notes during high-level meetings to reduce the paper trail, two sources said. Only a few hundred of Google's 88,000 workforce were briefed about the censorship plan. Some engineers and other staff who were informed about the project were told that they risked losing their jobs if they dared to discuss it with colleagues who were themselves not working on Dragonfly.

Ask someone how they’d detect whether a SQL Injection vulnerability exists in a web application and they’re likely to suggest putting a single quote into a parameter in the application. Then, if they received an error, they could infer the presence of an SQL Injection vulnerability. Don’t be surprised if you come across someone defining SQL Injection as Single Quote Injection.

In this blog post, we discuss the research on Fragmented SQL Injection where the hackers control two entry points in the same context in order to bypass the authentication form. Let’s take a quick look at the importance of single quotes in SQL injection attacks.

In a system (command interpreter, file system or database management system, for example), characters that have special meanings are called metacharacters. For instance, in the SQL query context, single and double quotes are used as string delimiters. They are used both at the beginning and the end of a string. This is why when a single or double quote is injected into a query, the query breaks and throws an error. Here’s an example of where the quotes are placed in the query.

So, when a single quote is injected into the entry point above, the query interpreter will either complain about invalid syntax or report that it can’t find the quote’s pair at end of the string.

The system will throw an error for the single quote left unpaired at the end of the query. This is only valid for the string context. There is no need to inject single or double quotes into the context below, since the id parameter doesn’t expect a string.

In the example above, in order to perform an SQL injection, you have to input a numeric value, and the following values will then be evaluated as part of the SQL command.

The error returned due to the injection of a single quote may signify that the input from the user was not filtered or sanitized in any way, and that the input contains characters that have special meaning on the database.

Let’s take a look at an instance where the single quote is blacklisted or escaped from the command.

As you see in this example, because the single quote (‘) is escaped with a backslash, the payload does not work as intended by the hacker.

Fragmented SQL Injection (not a term used by its inventor Rodolfo) takes place when two input points are used jointly to bypass the authentication form.

If hackers can control multiple points, and the values from these points are in the same context, they can use fragmented payloads to circumvent blacklists and character limits with this method.

We saw in the examples above that a single quote was injected and then escaped with a backslash (\). In a Fragmented SQL injection, if you use the backslash in the first field, and another SQL command that will return ‘true’ in the second field, you’ll be able to bypass the form. Here’s a demonstration of what happens in the background:

The backslash neutralizes the following single quote. So the value for the username column will end with the single quote that comes right after password = (the end of the gray text). Doing so will eliminate the required password field from the command. Due to the or 1 command, the condition will always return ‘true’. The # (hash) will ignore the rest of the function, and you’ll be able to bypass the login control and login form.

Please note that the blog post we referenced in this article suggests using the htmlentities() function in php to filter inputs, as a way to prevent the attack we described above. If you set the ENT_QUOTES flag, HTML encoding will convert single quotes, double quotes, and tag opening and closing signs, to their corresponding HTML entities. For example, a double quote would be encoded as ‘ &quot ;’.

However, this not the ideal solution, because there are situations where single or double quotes are not required to fulfill an SQL injection attack. In addition to that, some old school techniques like GBK Encoding can be used to bypass preventions like the addslashes() function in PHP and this weakens the overall prevention mechanism.

At Netsparker, we believe that the correct and proper solution to prevent SQL Injection attacks is to use Prepared Statements, otherwise known as Parameterized Queries.

Parameterized Queries allow you to separate the structure of the SQL query from its values. All remaining methods to prevent SQL injection attacks may be bypassed in the near future with neat tricks such as that of Chris Shiflett , and are therefore not reliable.

In PHP, you can use the Parameterized Query technique as illustrated:

For .NET applications, you can use it as illustrated:

Developers still use blacklists to prevent the SQL Injection vulnerability . They do this either manually or using functions designed for this purpose (e.g. addslashes). However, we encounter new tactics in information security every day that attempt to bypass these blacklists. Ultimately, the best way to prevent injection based flaws like SQL Injections is to use a Prepared Statement. This is the only effective way developers can teach the system not to evaluate user controlled parameters as part of the query structure.

windows 32-bit Installer: https://nodejs.org/dist/v10.14.1/node-v10.14.1-x86.msi

Windows 64-bit Installer: https://nodejs.org/dist/v10.14.1/node-v10.14.1-x64.msi

Windows 32-bit Binary: https://nodejs.org/dist/v10.14.1/win-x86/node.exe

Windows 64-bit Binary: https://nodejs.org/dist/v10.14.1/win-x64/node.exe

macOS 64-bit Installer: https://nodejs.org/dist/v10.14.1/node-v10.14.1.pkg

macOS 64-bit Binary: https://nodejs.org/dist/v10.14.1/node-v10.14.1-darwin-x64.tar.gz

linux 64-bit Binary: https://nodejs.org/dist/v10.14.1/node-v10.14.1-linux-x64.tar.xz

Linux PPC LE 64-bit Binary: https://nodejs.org/dist/v10.14.1/node-v10.14.1-linux-ppc64le.tar.xz

Linux s390x 64-bit Binary: https://nodejs.org/dist/v10.14.1/node-v10.14.1-linux-s390x.tar.xz

AIX 64-bit Binary: https://nodejs.org/dist/v10.14.1/node-v10.14.1-aix-ppc64.tar.gz

SunOS 64-bit Binary: https://nodejs.org/dist/v10.14.1/node-v10.14.1-sunos-x64.tar.xz

ARMv6 32-bit Binary: https://nodejs.org/dist/v10.14.1/node-v10.14.1-linux-armv6l.tar.xz

ARMv7 32-bit Binary: https://nodejs.org/dist/v10.14.1/node-v10.14.1-linux-armv7l.tar.xz

ARMv8 64-bit Binary: https://nodejs.org/dist/v10.14.1/node-v10.14.1-linux-arm64.tar.xz

Source Code: https://nodejs.org/dist/v10.14.1/node-v10.14.1.tar.gz

Other release files: https://nodejs.org/dist/v10.14.1/

Documentation: https://nodejs.org/docs/v10.14.1/api/