Quantcast
Channel: CodeSection,代码区,网络安全 - CodeSec
Viewing all 12749 articles
Browse latest View live

On the first day of Christmas, Microsoft gave to me... an emergency out-of-band ...

$
0
0

Microsoft today emitted an emergency security patch for a flaw in Internet Explorer that hackers are exploiting in the wild to hijack computers.

The vulnerability, CVE-2018-8653 , is a remote-code execution hole in the browser's scripting engine.

Visiting a malicious website with a vulnerable version of IE is enough to be potentially infected by spyware, ransomware or some other software nasty so check windows Update and install any available patches as soon as you can. Any injected code will run with the privileges of the logged-in user, which is why browsing the web using Internet Explorer as an administrator is like scratching an itch with a loaded gun.

According to Redmond:

A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user.

An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. If the current user is logged on with administrative user rights, an attacker who successfully exploited the vulnerability could take control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.

In a web-based attack scenario, an attacker could host a specially crafted website that is designed to exploit the vulnerability through Internet Explorer and then convince a user to view the website, for example, by sending an email.

While exploit code for the bug has not been publicly disclosed, it is being leveraged in the wild to attack victims, according to Microsoft, hence why the patches are being flung out today out-of-band, rather than waiting for January's Patch Tuesday to come round. Clement Lecigne of Google’s Threat Analysis Group is credited for uncovered the flaw.

Internet Explorer 9 to 11 on Windows 7 to 10, Server 2008 to 2019, and RT 8.1 are affected, though the server editions run IE in a restricted mode that should thwart attacks via this vulnerability.

One workaround, if you want to hold off on installing patches immediately, is to disable access to JScript.dll using the commands listed by Microsoft in its above-linked advisory. That will force IE to use Jscript9.dll, which is not affected by the flaw. Any websites that rely on Jscript.dll will break, though.

A possible alternative is to not use Internet Explorer, of course.


Privacy Futures: Fed-up Consumers Take Their Data Back

$
0
0

In 2019, usable security will become the new buzzword and signal a rejection of the argument that there must be a trade-off between convenience and security and privacy.

According to a recent Pew survey , two-thirds of Americans do not believe current laws are doing enough to protect their privacy, and six out of 10 respondents would like greater autonomy over their personal data. In an even more surprising turn of events, leadership at several leading tech companies― among them Apple CEO Tim Cook ― are now encouraging smarter government regulation and data privacy laws. These shifts indicate a growing awareness and concern within the United States around data privacy and data protection.

In 2019, I predict constituents across the US will seek even greater data protection legislation from their representatives. In the aftermath of the recent Marriott data breach, for example, several members of Congress demanded cybersecurity legislation focusing on consumer protection and privacy, among them, Senator Mark Warner (D-Va.) who asked for "laws that require data minimization, ensuring companies do not keep sensitive data that they no longer need …. and data security laws that ensure companies account for security costs rather than making their consumers shoulder the burden and harms resulting from these lapses."

Battle Royale: Authoritarian vs. Democratic

While the US has been, for the most part, sitting on the sidelines over the past few years, we've seen a steady march toward greater data localization laws that foreshadow a global battle over data security and privacy. On the one hand are authoritarian regimes that are implementing data localization policies to enable greater government access to both personally identifiable information and intellectual property. This digital authoritarianism includes Internet controls and restrictions, integrating disinformation, and limiting individual data access through various forms of censorship. One the other are the democratic nations that are using legislation such as the European Union's General Data Protection Regulation (GDPR), which favor the rights of the individual over government access to the data of private citizens.

Russia, for instance, recently announced greater oversight and harsher fines to existing data laws, which include requiring government access to encryption keys and storing Russian users' personal data in Russia. But Russia is not alone. According to Freedom House's Freedom of the Net , this form of digital authoritarianism is the most dominant trend, coinciding with eight consecutive years of rising global Internet censorship.

Conversely, GDPR and now the California Consumer Privacy Act (CCPA) represent the emergence of more democratic models that focus on individual data protection and provide a counterweight to digital authoritarianism. Given these global trends― coupled with constituent pressure― the US will find it increasingly difficult to maintain its current patchwork of industry and state-specific approaches to cybersecurity and data protection. Expect to see the US step off the bench and put some skin in the game.

2019: The Year of Security UX?

While the United States will inevitably see additional forms of data protection legislation introduced in 2019, given the stagnation of current cybersecurity legislation in Congress and the nonstop mega-breaches, the public likely will not be satisfied to sit back and wait and see if legislation gets passed. In the last few weeks of 2018, the recent Marriott mega-breach , the National Republican Congressional Committee email hack

, and the

Facebook email dump

have served as constant reminders about the magnitude of this problem. Given the confluence of corporate breaches, proliferation of attackers, and the global diffusion of surveillance and censorship, individuals want to take back control and gain agency in their own data protection.

The security industry notoriously lacks usability and often blames the user as the weakest link and source of all security problems. But in 2019, users will revolt against this and demand greater, more intuitive individual control over their data. The movement toward usable security will also drive security professionals to work closely with social scientists and user experience experts to ensure that incentive structures and human-computer interaction match those for the broader population of product users and consumers. Usable security will become the new buzzword and signal a rejection of the argument that there must be a trade-off between convenience and security and privacy. The public will demand both convenience and data protection, and there will finally be some progress toward true democratization of security for the masses.

Zero Trust Security Protects Businesses while Enabling Growth

$
0
0

Many companies have their own applications, internal domains, and local area network (LAN). But when it comes to business applications, organizations are increasingly dependent on cloud-based resources. These may include email servers, customer relationship management (CRM) software, or other applications. However, when access to internal machines by external users is necessary, the most common solutions are centered on virtual private networks (VPNs).

VPNs provide remote access from machines to networks, and between networks ― but when it comes to security, VPNs are not an ideal solution. User access needs to be controlled to keep VPNs secure. For example, a firewall behind a VPN can be used to create rules that block access to different machines and subnetworks from varying origins. Additionally, to ensure high availability that keeps businesses up and running, add-on services that guarantee zero downtime are a necessity.

Companies using cloud-based apps and resources or data centers in multiple geographic locations need well-defined perimeters and backup systems. They also need to invest in ongoing system updates. A lack of internal resources or solid technology growth plan can derail best efforts and create substantial security risks. The good news is that external networking and security vendors can provide cost-effective solutions to help business entities grow in a clean, easy-to-manage, and secure way.

Akamai is well-known for its content delivery network (CDN) and products that improve performance, customer experience, and conversion. Akamai enterprise solutions are designed to position our customers for sustainable growth and offer the increased security necessary for today’s digital transformation consistent with the zero trust security model.

In 2010, as applications began to migrate from data centers to the cloud, Forrester defined zero trust architecture for IT security. This transition has meant users access applications from everywhere, using many different types of systems, which is how the zero trust model of “never trust and always verify” was born. At Akamai, we believe the best growth strategies for web and cloud-based computing include improved security measures that save companies time and effort while reducing organizational infrastructure complexity. By providing secure, high-performing user experiences on any device, from any location, the Akamai Intelligent Edge Platform reaches globally and delivers locally, offering unmatched reliability, security, and visibility into business conducted online.

Seamlessly transition to a world of cloud applications

Secure Internet Gateway (SIG) platforms can help enterprises make the shift to a globally distributed digital ecosystem, where the Internet becomes the corporate network. SIG platforms are scalable and cloud-native, and consolidate security gateway functions that can be consumed as a service. They can be set up in minutes, versus the hours and days of training classes and certifications associated with legacy solutions. SIG provides DNS security with optional URL inspection and payload analysis that can be activated by pointing the DNS to our recursive DNS in the cloud. With our world network of PoPs, companies can be protected at all layers (including DNS, content filtering, and payload analysis) with a simple configuration that takes about five minutes to set up ― keeping users safe, both on and off the corporate network. SIG detects any attempt of infection in the first point of the chain via DNS requests, and works to help machines stay infection-free from malware, phishing, or command-and-control (CnC) software. In addition, while viewing the DNS protocol, Akamai’s solutions are designed to prevent DNS attacks like domain generation algorithms (DGA), fast flux, DNS exfiltration, and other techniques that typical security products don’t investigate.

Defense in depth, security at scale

Our Cloud Security Intelligence is Akamai Big Data, where patterns, lists, and security measures are contained. Thanks to the visibility into Internet traffic through our CDN, third-party feeds, logs from other customers, and public data via registrar and WHOIS, detections are updated continuously. This vastly reduces false positives and improves the detection of zero-day advanced threats. An added benefit includes an indicator of compromise (IOC) for any domain an organization may want to test, along with a historical timeline of that domain.

Proactive protection against zero-day malware

Enterprise Threat Protector is a powerful monitoring system with open APIs that are customizable to the distinct needs of any enterprise. The solution is designed to provide companies quick-to-deploy and easy-to-manage cloud-based protection against the impact of complex targeted threats such as malware, ransomware, phishing, and DNS-based data exfiltration.

Application access redefined: secure, simple, fast

Akamai’s cloud-based Enterprise Application Access (EAA) provides multi-factor authentication to increase security when a user logs in, and single sign-on (SSO) to avoid redundancy of credential introduction when accessing multiple applications. Based in the Cloud Identity-Aware Proxy (Cloud IAP) architecture of zero trust, EAA provides remote access to applications, increasing security without the use of VPNs, or costly new hardware or software. EAA consists of a worldwide network of servers that contain the intelligence to provide authentication, acting as an identity provider (IdP) while providing a portal for remote user access to specific applications. EAA Connector software is installed to talk to internal applications and communicate via callouts with Transport Layer Security (TLS) to the EAA cloud servers. This communication mechanism makes it possible to close firewalls to any inbound traffic, while the connector creates outgoing connections to the cloud server. Remote users only need to open a browser and enter the URL of the application they need to access. EAA wraps the applications in a Secure Sockets Layer (SSL) for a secure connection for both the outside user and the enterprise.

The Akamai Intelligent Edge

When you’re ready to make your jump to the cloud ― or are looking to switch to a truly seamless digital transformation ― consider Akamai’s suite of easy-to-use, nonintrusive solutions. Our intelligent edge platform surrounds everything, from the enterprise to the cloud, so your business and customers can be fast, smart, and secure.

*** This is a Security Bloggers Network syndicated blog from The Akamai Blog authored byMaria Ramirez. Read the original post at: http://feedproxy.google.com/~r/TheAkamaiBlog/~3/FLG_xS6u8I0/zero-trust-security-protects-businesses-while-enabling-growth.html

Patched Click2Gov Flaw Still Afflicting Local Govs

$
0
0

A vulnerability in a popular municipality payment software, Click2Gov, has left hundreds of thousands of civilian payment cards compromised and the hacks are ongoing, a new report found.

Continual breaches of the vulnerable software have led to the compromise of at least 294,929 payment cards across the country earning the criminals behind the breach at least $1.7 million, Gemini Advisory said on Tuesday.

Making matters worse, the software was patched in 2017 yet the breaches are still continuing, in part due to municipalities that have not updated, Stas Alforov, director of research and development at Gemini Advisory , told Threatpost.

“Many municipalities are not doing their job of patching the systems or keeping regular, system administrator tasks,” he said.


Patched Click2Gov Flaw Still Afflicting Local Govs

Click to expand

Click2Gov is a popular software solution used by local governments for receiving parking tickets or taxes. The software was developed by Superion, which has since merged with other companies to form a new company called CentralSquare Technologies in July 2018. According to Risk Based Security, there appears to be between 600 to 6,000 installations of Click2Gov indexed.

CentralSquare Technologies did not return a request for comment.

The breach stems back to 2017, when Superion first released a statement confirming that malicious activity was detected on customers’ computer networks.

Essentially, the attack was rooted in a compromised Click2Gov webserver, said FireEye in a report .An attacker was able to install a web shell, SJavaWebManage, and then upload a tool that allowed them to parse log files, retrieve payment card information and remove all log entries.


Patched Click2Gov Flaw Still Afflicting Local Govs

Click to expand

In a June 2018 statement on the matter, Superion said it has deployed the necessary patch to its software. It added it assisted customers in the application of patches related to a “third-party component.”

“At this time, we have no evidence showing that it is unsafe to make payments utilizing Click2Gov on hosted or secure on-premise networks with recommended patches and configuration,” the company said . “Superion does not control our customers’ networks, so we recommend citizens contact their municipality or county if they have any questions related to security.”

However, despite this patch, “Superion acknowledged directly to Gemini Advisory that despite broad patch deployment the system remains vulnerable for an unknown reason,” researchers said.

That could be because local governments have not updated their systems leading them to become compromised. Another option is that hackers have uncovered another undetected vulnerability in the software, which has yet to be patched, Alforov told Threatpost.

Regardless, just in the past 30 days, researchers identified over 12,283 compromised payment cards associated with the Click2Gov breach. Researchers were able to track these cards as they were uploaded for sale on the Dark Web (with an average price of $10 per card).

Overall, there were 46 confirmed impacted local governments including Saint Petersburg, Florida (on October 2) Bakersfield, California (November 14), and Ames, Iowa (December 2). The most Click2Gov-related breach was of Pompano Beach, FL (yet to be disclosed publicly), researchers said.

Alforov said that impacted municipalities should reach out to CentralSquare for assistance:

“Users who are directed to pay through the Click2Gov system [should] identify alternative means of making payments until the system threat has been eliminated,” according to Gemini Advisory’s post. “Moreover, all local municipalities that utilize the Click2Gov software should confirm that the software is up-to-date and fully patched, and contact CentralSquare immediately if assistance is needed. Gemini Advisory is monitoring the development of the Click2Gov incident closely, and in the case that new victims are identified, all clients will be notified accordingly.”

Ensuring Security Posture In A Multi Cloud World: A NSX(mas) Carol

$
0
0

Holidays are a great time of year to take a moment and reflect. In 2018 at VMware Networking & Security, we’ve had yet another exciting year for us―we’re very proud of many achievements. For example, NSX now being deployed by 82% of Fortune 100 companies is a substantial industry adoption data point. But rather than focus on those numbers, I wanted to take a moment to highlight one of our biggest accomplishments this year (in my opinion). Oh, and in case you missed some of those 2018 highlights, you can catch a replay of Tom Gillis’ keynote Building the Network of the Future with the Virtual Cloud Network from VMWorld US 2018.

NSX Past
Ensuring Security Posture In A Multi Cloud World: A NSX(mas) Carol

Earlier this year (the end of April to be precise), at Dell Technologies World, we had our external launch of the Virtual Cloud Network . The problem statement was simple: our customers were embarking on a digital transformation journey in their respective lines of business and with those efforts came challenges around a new level of networking complexity. Their goal within their organizations was to move from centralized data centers to hyper-distributed centers of applications and data, typically spanning multiple locations, multiple geos, and most likely of them all, multiple clouds. To address this challenge, the network must evolve to deliver an everything-to-everything connected architecture across private data centers, public clouds, telecommunications networks, branches, and mobile endpoints.

On the surface, some folks may have perceived the launch to be nothing more than just some product rebranding. Admittedly, while we did welcome some new/existing products into the NSX family (which was covered in ourlaunch blog) the Virtual Cloud Network was way less about the products and product pitch, and in my opinion, way more about the acknowledgement of execution around a strategy and vision for networking and security here at VMware. Two years ago I would never have been able to post the slide below because it was marked “internal” and “confidential” in large red lettering. But to bring this point home, especially for you customers out there who have been through an NSX update or roadmap session, hopefully you can vouch for us and confirm: this is the image of what we used to talk about as roadmap:


Ensuring Security Posture In A Multi Cloud World: A NSX(mas) Carol
NSX Present

Fast forward to today and voilà,we have the Virtual Cloud Network, powered by NSX, delivering multi-cloud networking, security, and management capabilities, which provide a common operating model from the data center to the cloud to the edge. Last week was Security Field Day in Palo Alto, CA. and some of our team from the Networking and Security Business Unit were asked to present. In the giving spirit of the holiday season, one gift we want to bring to you readers to kick off 2019, is a new demo focused on the networking and security of hybrid cloud applications.

What exactly does that mean? In a nutshell, the following demo will showcase how NSX is able to provide micro-segmentation for an EMR application that has components running in both an on premises data center and in the public cloud.


Ensuring Security Posture In A Multi Cloud World: A NSX(mas) Carol
As many of you know, NSX Data Center provides security and network capabilities for many different types of workloads customers have in their environments (virtual machines, containers, bare metal servers). NSX Data Center provides a consistent security policy across all of these different platforms, protected through the NSX Data Center Distributed Firewall interface.

For workloads that exist in native public clouds or VMware cloud partner destinations, NSX Cloud extends native cloud functionalities to NSX Data Center to provide native cloud workloads these similar security policies. These security policies can all be managed regardless of location and with similar capabilities that typical on-prem workloads are already accustomed to. More information on NSX Cloud can be foundhere, but we’re very proud to highlight that the product is the only solution to be featured in both the AWS Solution Space & Azure Marketplace .

Let’s now see how NSX Data Center and NSX Cloud provide these security and networking policies, and how easy it is to apply and verify that a customer workload is receiving the same security posture consistently, regardless of its location, either on or off premises. But first, let’s take a peek at our simple demo application:


Ensuring Security Posture In A Multi Cloud World: A NSX(mas) Carol
Web Tier 3 Virtual Machines (two servers in DFW Datacenter, one server in Azure) Database Tier 1 Virtual Machine (in DFW Datacenter) The entire application is front-ended with a NSX Load Balancer

We have done our best to break the demo down into five simple steps.

Cloud Services Manager Configuration Verify NSX Manager Configuration Verify and modify NSX Firewall Test EMR App Verify NSX Load Balancing

Without further ado, our NSX Cross Cloud Networking and Security demo:

This demo is also available in a self-paced click-through format, alongside a number of other demos and external resources, available on our Networking and Security demo www.vcndemo.com website.

NSX Yet to Come
Ensuring Security Posture In A Multi Cloud World: A NSX(mas) Carol

What’s next? Customers choose to #RunNSX because it delivers network and security services closest to the application no matter where the application resides. Expect us to continue to deliver on this simple yet powerful design principle, and while I can’t disclose all of our upcoming announcements in a “futures” section (or my future here at VMware will be shorter than everyone’s January gym attendance), just know that we have planned some really cool new and exciting announcements in 2019! And while you are hopefully enjoying some holiday relaxation time, give yourself the gift of learning. Try our Hands On Labs for all the NSX platform solutions, which are available at http://labs.hol.vmware.com/

Shop online securely this holiday season

$
0
0

This post is presented by Dashlane .

Christmas season used to mean spending days dashing between stores to rack up presents for loved ones. Now it means buying online from people and companies all over the country, maybe even the planet.

Online shopping is the norm now, so protecting your credit card information involves more than covering the keypad as you enter your PIN at the cashier’s stand. To avoid losing your payment information this shopping season, the best line of defense is a good password manager.

Dashlane offers an intuitive, powerful, multifunctional password manager that offers easy tools for tracking and updating your online security.

‘Tis the season to get secure

Using a password manager is a great idea no matter the season. But since online fraud spikes by more than 20 percent during the holiday season , it’s an especially good time to start. It doesn’t matter how much time you spend online, or how little exposure to risk you think you have. There are few better or easier ways to get a serious boost in security.

Using a password manager like Dashlane removes opportunities for data to be stolen or lost. It wrangles all of your many account logins under a single master password. And you can stash your credit and debit card info in Dashlane’s secure vault, too ― where it can be autofilled on every shopping website you’ll use.

If you’ve fallen into the bad habit of reusing the same password on multiple sites ― a definite no-no, according to security experts ― Dashlane also makes it simple to turn things around. Dashlane can generate a unique, super-secure password for every website you log into. So no matter how many accounts you use, you won’t need to worry about forgetting one of your logins.

Dashlane security alerts keep you informed

Plus, if there’s ever a site-wide security breach that exposes millions of users’ data ( unthinkable, right ?), the incident will generate an alert that prompts you to change your credentials for that site. So, next time a heavy hitter like Amazon, Etsy, Walmart or some other shopping hub loses control of its users’ passwords and other confidential info, you can take action to minimize the breach’s impact on you.

Dashlane actually has its roots in shopping. Its developers originally conceived it to make checkout lines faster. Since online shopping took over, Dashlane kept up with the many ways online activity can be slowed down or undermined by the typical password login process and data entry process for payments in online checkouts.

Dashlane will even save your online shopping receipts, so it’s a great buying buddy.

Keep security simple

The words “online security” can sound technical and complicated. But the best approaches to online security are just the opposite.

After opening a free Dashlane account, the Password Changer feature walks you through the simple process of automatically updating any weak passwords you might be using on compatible websites. With your passwords reset, logging into any compatible site takes just one click.

Web forms and credit card numbers are just as easy to fill out, all backed by two-factor authentication for extra security. You can set Dashlane to authenticate upon each login, or just when connecting a new device.

With Dashlane, everything is contained in a straightforward, eye-pleasing dashboard. From there, you can manage security on any device, whether it’s the passwords on your Mac’s Safari browser or Face ID logins via your iPhone XS. Dashlane also offers robust desktop and iOS apps for managing all your passwords. And now that iOS 12 is out, you can take advantage of Apple’s latest security tweaks , which make using password managers like Dashlane easier than ever on iPhones and iPads.

Dashlane also gives you an overall perspective of your online security. Dashlane’s Security Dashboard serves up an easy-to-understand score that reveals your weaknesses. Better yet, it offers concrete steps you can take to fortify your online payment security.

Start using Dashlane today for free

For all the reasons and more, Dashlane is the official password manager of Cult of Mac . And it can be your password manager, too ― at no cost!

The free version of Dashlane lets you store up to 50 passwords on one device. You also get instant form and payment autofill functionality that will make online shopping safer and better. Plus, if one of the online stores you use suffers a data breach, you’ll get that crucial Dashlane security alert so you can make any necessary changes.

If you want to use Dashlane across all your devices, you’ll pay just $4.99 a month to sync your passwords and other data across all your devices. That’s well worth the peace of mind that comes from a meaningful layer of extra security, especially at transaction-heavy times like the holidays.

The list of people to shop for is overwhelming enough. Why add a long list of passwords to remember?

Price:Free (with premium options)

Download from: Dashlane

The Crux of Bayesian Statistics

$
0
0

If you are in some field that has data (which is a lot of fields these days), you will have undoubtly encountered the term Bayesian statistics at some point. When I first encountered it, I did what most people probably do. I googled “What is Bayesian statistics?”. After reading through some resources and getting through the idiosynatric terms/concepts (e.g. conjugate priors, posteriors, Markov Chain Monte Carlo), I still went away not really understanding what was so important about Bayesian statistics.

It wasn’t until I took the course “ Introduction to Bayesian statistics using BUGS” (offered by the MRC Biostatisics Unit from the University of Cambridge) did an “Ah ha” moment hit me. Suddenly, it became clear to me what the hype was all about. Once I got the “crux” of it, I felt like this set me up for the rest of Bayesian thinking. As such, I hope to be able to share this same “Ah ha” moment I had in this post.

I’m all ‘bout that uncertainty, ‘bout that uncertainty, no certainity

That was my lame and sad attempt at trying to come up with some catching section name (inspired by Meghan Trainor’s “All About That Bass” ) to describe the crux of Bayesian statistics.


The Crux of Bayesian Statistics

But joking aside, the one concept that is fundamental to Bayesian statistics is that it’s all about representing uncertainty about an unknown quantity. To illustrate this, imagine I had a coin and I asked you what is the probability that the coin gives a head if I flip it? You most likely guessed 0.5, which is a reasonable guess given your prior knowledge on how coins work. But what if I told you that I got this coin from a magic shop? You’ll probably have some doubts that it is 0.5 now. It could be anything now. Maybe it’s a trick coin that always gives you head (i.e. 1 probability) ? Or maybe it always gives you a tail (i.e. 0 probability)? Or maybe it is biased towards towards some value (e.g. 0.75 probability). The point is there is some uncertainty in your estimation of this unknown quantity.

So let’s say I wanted to flip this coin n times. We can represent the number of expected heads ( $r_{n}$ ) as follows:

$$r_{n} \sim Binomial(\theta, n)$$

Here we are just saying that the ( $r_{n}$ ) is distributed as a binomial distribution, which is parameterized by $\theta$ (probability of getting a head) and $n$ (number of flips/trials).

Now let’s consider the following question:

$$P(\theta_{1} < \theta < \theta_{2} | n, r_{n})$$

Verbosely put, what’s the probability that this coin gives a head ( $\theta$ ) is between $\theta_{1}$ and $\theta_{2}$ given you have $n$ flips and $r_{n}$ heads. In classical/frequentist statistics, this question actually makes no sense. This is because in classical statistics, parameters (unknown quantities) are fixed and have no uncertainty in their value; They are either that value or they are not. But in a Bayesian world, we are never completely certain about any estimations. As such, all estimations of an unknown quantity (e.g. the probability that a coin gives a head) have some degree of uncertain.

How do we represent these uncertainities?

We have just learned that it’s all about the uncertainty in our estimations. So how do we actually represent these uncertainities? They are expressed as a probability distributions . For instance, imagine you had the following probability distribution:

library("magrittr") library("ggplot2") library("glue") data.frame(x = c(0, 1)) %>% ggplot(aes(x)) + stat_function(fun = dbeta, n = 101, args = list(shape1 = 5, shape2 = 5)) + ylim(c(0, 2.8)) + xlab(expression("Probability of a head ("*theta*")")) + ylab("Density") + ggtitle( expression("Uncertainity of a coin's probability of a head ("*theta*")") ) + # Credible interval arrow geom_segment( aes(x = 0.26, xend = 0.74, y = 0.75, yend = 0.75), arrow = arrow(length = unit(0.2, "cm")) ) + geom_segment( aes(x = 0.74, xend = 0.26, y = 0.75, yend = 0.75), arrow = arrow(length = unit(0.2, "cm")) ) + geom_label(aes(x = 0.5, y = 0.9, label = "90% credible interval")) + # 95% area < 0.75 geom_segment( aes(x = 0.74, xend = 0.125, y = 0.05, yend = 0.05), arrow = arrow(length = unit(0.2, "cm")) ) + geom_label(aes(x = 0.5, y = 0.2, label = "95% area < 0.75")) + # MAP value geom_segment( aes(x = 0.6, xend = 0.5, y = 2.6, yend = 2.5), arrow = arrow(length = unit(0.2, "cm")) ) + geom_label(aes(x = 0.73, y = 2.6, label = "Most likely value"))


The Crux of Bayesian Statistics

The x-axis represents the plausible values that $\theta$ could take. The y-axis represents the “confidence” (this isn’t entirely accurate in mathematical terms, but will suffice for this example) that the probability of a head takes this value. By expressing our uncertainty as a probability distribution, we get these benefits:

The x value with the highest density peak represents the most likely value. In this case, that would be 0.5. Credible intervals (CI) can be formed. For instance, [0.25 - 0.75] forms a 90% CI that tells us we are 90% confident that the parameter is in this interval. This is quite different from a confidence interval in classical statistics, which is actually quite a counter-inituitive statistic ( see my “How do I Interpret a Confidence Interval?” post ). No “p-value” calculations. Just calculate the relevant tail areas. For instance, what is $P(\theta) < 0.75$ ? We just look at the area left of 0.75, which ends up being 0.95 of the total area. So we can say there is a 95% chance of $P(\theta) < 0.75$ . There is a technique called Bayesian inference that allows us to adapt the distribution in light of additional evidence ( see my “How to Do Bayesian Inference 101” post ). This ultimately means we can update our estimation of our quantity when we get more data while still accounting for our prior information on the quantity. post for more details on this) Where do these probability distributions for representing uncertainty come from?

While you could theoreticaly make your own probability distributions, in practice people use established probability distributions (e.g. beta, normal). For instance, here are 6 different beta distributions:

library("tibble") library("cowplot") library("glue") # Cowplot overrides the default ggplot2 theme. This sets it back to the default # theme. theme_set(theme_grey()) beta_params_df <- tribble( ~ beta_distr_num, ~ shape1, ~ shape2, 1, 0.5, 0.5, 2, 1, 1, 3, 5, 1, 4, 5, 5, 5, 5, 20, 6, 50, 200 ) #' Plots a beta distribution #' #' @param in_data List of arguments for the beta density function (dbeta) #' @return ggplot plot plot_beta <- function(in_data) { # Create aliases for easier reference below cur_shape_1 <- in_data[["shape1"]] cur_shape_2 <- in_data[["shape2"]] data.frame(x = c(0, 1)) %>% ggplot(aes(x)) + stat_function( fun = dbeta, n = 101, args = list(shape1 = cur_shape_1, shape2 = cur_shape_2) ) + ylab("Density") + xlab("Probability of a head") + ggtitle(glue("Beta({cur_shape_1}, {cur_shape_2})")) } beta_plots <- split(beta_params_df, seq_len(nrow(beta_params_df))) %>% lapply(plot_beta) plot_grid( plotlist = beta_plots, ncol = 3, nrow = 2, labels = LETTERS[1:6], align = "v" )
The Crux of Bayesian Statistics

Each of these beta distributions represents a different prior knowledge. For instance, Beta(0.5, 0.5) represents a belief that the coin always gives heads or tails. Beta(1, 1) represents a global uncertainty in that the probability of a head could be any value (this is often referred to as an uniform prior). Beta(50, 200) represents a strong belief that the probability is 0.2 for getting a head.

Which type of distribution (e.g. beta, normal) depends on the type data you are modeling.

So what do I do with this uncertainty probability distribution?

If we go back to the original scenario with the coin and recall this equation representing the number of expected heads:

$$r_{n} \sim Binomial(\theta, n)$$

Rather than having our $\theta$ value as a single point estimate, we have it represented as a probability distribution representing all possible estimates with associated levels of uncertainity. This is effectively what Bayesian statisticans mean when they say setting a prior on a uncertain parameter. In this case, we will use a beta distribution as our prior.

Heads Up! It's worth noting that in theory you can use any distribution. However in practice, certain prior distributions are used for specific models because it makes the math easier. These are called conjugate priors. I won't go into the details in this post, but is worth knowing this if you come across this term.

So what we will literally do here is substitute the beta distribution into the binomial distribution (this forms what is called a beta-binomial) and then we can generate some expected outcomes. As you might guess, the shape of your beta will influence your expected outcomes. For instance, here we test the different effects of the 6 beta distributions on the distribution of the expected number of heads if we were to flip a coin 20 times across 1000 simulations (i.e. Monte Carlo simulation):

set.seed(1) library("dplyr") plot_prior_prediction_distr <- function(in_data) { # Create aliases for easier reference below cur_shape_1 <- in_data[["shape1"]] cur_shape_2 <- in_data[["shape2"]] num_sims <- 1000 num_trials <- 20 thetas <- rbeta(num_sims, shape1 = cur_shape_1, shape = cur_shape_2) coin_flip_df <- tibble( trial_no = seq_len(num_sims), theta = thetas, heads = rbinom(num_sims, num_trials, thetas) ) %>% mutate(heads = factor(heads, levels = 0:num_trials)) prior_p <- plot_beta(in_data) predictive_p <- coin_flip_df %>% ggplot(aes(x = heads)) + geom_bar() + xlab("Number of heads") + ylab("Number of simulations") + # So that the x-scale includes 0 - num_trials so that we can compare across # plots scale_x_discrete(drop = FALSE) plot_grid(prior_p, predictive_p, nrow = 2) } beta_predictive_plots <- split(beta_params_df, seq_len(nrow(beta_params_df))) %>% lapply(plot_prior_prediction_distr) plot_grid( plotlist = beta_predictive_plots, ncol = 3, nrow = 2, labels = LETTERS[1:6], align = "v")
The Crux of Bayesian Statistics

In each panel, the top plot is the beta prior distribution representing the uncertainty in your $\theta$ parameter for your binomial. Then the bottom plot is approximate beta-binomial distribution of heads you would get if you use the corresponding beta prior (its an approximation because we are running a Monte Carlo simulation to estimate the distribution). This bottom plot is formally called a prior predictive distribution. As you can see, the bottom plots end up following the shape of the beta prior, which is actually what you would expect.

Conclusions

You’ve made it to the end of the post! Hopefully this post helped illuminate the key concept of Bayesian statistics. Remember that it is all about representing uncertainty regarding an unknown quantity. This uncertainty is expression as a probability distribution and ultimately impacts your expected outcome. As probability distributions are used, this is what makes Bayesian statistics fundamentally probabilistic.

References Introduction to Bayesian statistics using BUGS

EOS是黑客的提款机?

$
0
0

EOS是黑客的提款机?

EOS是币圈的王者荣耀还是私募诈骗?我只能说是币圈营销最好的项目之一,从创始人天才BM到项目的口碑效应,一出生就风华正茂,也是国内拥有最多追随者的项目。

EOS可谓高开低走。项目从私募开始,宝二爷、薛蛮子等大佬振臂高呼,大家担心错过下一个比特币,纷纷入场。自从今年6月EOS主网草草上线,又碰到熊市,一路从高峰跌落到低谷,且不断破新低,目前价格在2.4美元左右,腰斩近80%。

这个夏天,留在我印象的是EOS各大节点的竞选,竞争异常激烈。EOS网络依赖的是21个节点,还有100个备用节点,节点享受每年增发的奖励。现在在EOS区块链浏览器可以看到167个获得奖励节点中,134处于亏损状态,占比80%以上。

前不久,BM在电报群发声,他打算打破自己原来的设计,找到解决隐私性和终极扩容的方法,他似乎要开启新项目。言论一出,EOS存在的底层智能合约漏洞暴露在众目睽睽之下,加上之前的安全问题让EOS的光芒黯淡了不少。

今年5月29日,360团队表示经验证,其中部分漏洞可以在EOS节点上远程执行任意代码,即可以通过远程攻击,直接控制和接管EOS上运行的所有节点。29日凌晨,漏洞公布前,360已第一时间将该类漏洞上报EOS官方,并协助其修复安全隐患。

EOS中的游戏频繁遭遇黑客袭击。9月10日,由于开发团队的疏忽,基于EOS的一款游戏遭受黑客攻击,损失44427.4302个EOS;11月8日,EOS 又一款游戏遭遇了黑客攻击;12月1日,EOS的一款游戏合约黑客发起211次攻击,损失10,569.346个EOS。

此外,据统计近一个月内,最少有5款EOS游戏遭到了黑客类似攻击。曾经也出现过一款游戏被黑客连续攻击的现象,这款游戏在8月一经推出,受到网友的追捧,在9月被黑客攻击损失了4.2万个EOS,到了10月被黑客攻击了三次,随后又损失了14万个EOS。最严重的时候,在EOS平台上出现过被黑客攻击直接导致被迫暂停运营的现象。

虽然现在很多人说,EOS开发的DAPP超过一半是游戏和博彩类,项目类型单一。这和互联网的早期很类似,最早应用的是博彩和游戏类。如果博彩和游戏类的项目应用成功,其它类型的应用会增多,这不是什么大问题。

如果我们把EOS比作一条高速公路的话,那么各类黑客的攻击应用就像在高速上跑的土匪,你就是想在这条高速上跑的快就得先解决这个问题。所以比起项目单一,更应该重视智能合约漏洞,要不然真变成黑客的“提款机”。

来源:币老哥

本文由布洛克专栏作者发布,不代表布洛克观点,版权归作者所有

――TheEnd――

关注“布洛克科技”


EOS是黑客的提款机?

10 Most-Popular Identity Posts in 2018

$
0
0

Time flies when you are having fun. It's December already and we are getting ready to wrap up this year. 2018 was a prolific year for the Auth0 blog: we published more than 200 posts (:scream:) where we tackled a diverse amount of topics: frontend and backend technologies, data breaches, GDPR, Cybersecurity, Company Culture, and of course, Identity.

We believe looking back is key to look ahead. That is why this week, we are going to take a look back at the best and most impactful posts we have published in 2018.

One article wouldn't be enough to review this amazing year, that's why we have decided to split this year in review into 3 parts:Developer Posts,Security Posts, and Identity Posts.

Without much further ado, here's the roundup of our 10 most-popular Identity posts this year!


10 Most-Popular Identity Posts in 2018
Auth0's 10 Most-Popular Identity Posts in 2018 The following posts are not listed in any particular order. An Overview of Open Standards 3 IAM Examples to Support Digital Transformation A Look at The Draft for JWT Best Current Practices Introduction to Web Authentication: The New W3C Spec How To Have a Successful IDM Project How To Have a Successful IDM Project (Part 2) On The Nature of OAuth2’s Scopes Hashing Passwords: One-Way Road to Security Adding Salt to Hashing: A Better Way to Store Passwords How Utilities Can Use CIAM to Avoid 3 Common Problems 1. An Overview of Open Standards

In this overview, we will go over what open standards are and why they matter. We will also go over the top open standards used for identity including OAuth 2, OpenID Connect, JWT, and SAML. Open standards are important to understand but one can easily get overwhelmed by the technical specifications.


10 Most-Popular Identity Posts in 2018
2. 3 IAM Examples to Support Digital Transformation

From basic website authentication to implementing an OpenID Connect server and API authentication: This article covers 3 IAM examples to support your Digital Transformation.


10 Most-Popular Identity Posts in 2018
3. A Look at The Draft for JWT Best Current Practices

In this post, we will take a look at the draft for the JWT Best Current Practices document. This document describes common pitfalls and attacks related to the use of JWTs, and how to implement mitigations against them. Read on!


10 Most-Popular Identity Posts in 2018
4. Introduction to Web Authentication: The New W3C Spec

Web Authentication brings a stronger authentication mechanism to the masses by defining an API that both authenticators and web browsers can implement. Learn why Google, Paypal, Mozilla, and others back it up.


10 Most-Popular Identity Posts in 2018
5. How To Have a Successful IDM Project

Learn how to create a realistic project plan to have a good Identity Management project deployment.


10 Most-Popular Identity Posts in 2018
6. How To Have a Successful IDM Project (Part 2)

Learn how to plan for failures and changes in your identity project.


10 Most-Popular Identity Posts in 2018
7. On The Nature of OAuth2’s Scopes

Auth0 Principal Architect and Identity expert Vittorio Bertocci on why using OAuth2 scopes in every authorization scenario is not a good idea.


10 Most-Popular Identity Posts in 2018
8. Hashing Passwords: One-Way Road to Security

A strong password storage strategy is critical to mitigating data breaches that put the reputation of any organization in danger. Hashing is the foundation of secure password storage.


10 Most-Popular Identity Posts in 2018
9. Adding Salt to Hashing: A Better Way to Store Passwords

A salt is added to the hashing process to force their uniqueness, increase their complexity without increasing user requirements, and to mitigate password attacks like rainbow tables


10 Most-Popular Identity Posts in 2018
10. How Utilities Can Use CIAM to Avoid 3 Common Problems

Customer identity and management technology helps utilities reshape how they interact with users, improve their services, and tighten security.


10 Most-Popular Identity Posts in 2018
What's Next?

We are already preparing our content pipeline for 2019. Identity and digital transformation are key areas that will keep businesses evolving to tackle challenges around privacy, usability, growth, and sociopolitical policies. We are committed to keep our content relevant to these changes and offer effective solutions through our products and services.

We'd like to take this opportunity to thank all of our readers for their consistent support and feedback. Is there anything that you'd like us to cover in 2019? Any particular identity topic or trend? Please let us know in the comments below or through social media ( Twitter , LinkedIn ). As always, you can subscribe to our newsletter to receive a weekly digest of our blog content.

Happy Holiday Season!

About Auth0

Auth0, a global leader in Identity-as-a-Service (IDaaS), provides thousands of enterprise customers with a Universal Identity Platform for their web, mobile, IoT, and internal applications. Its extensible platform seamlessly authenticates and secures more than 1.5B logins per month, making it loved by developers and trusted by global enterprises. The company's U.S. headquarters in Bellevue, WA, and additional offices in Buenos Aires, London, Tokyo, and Sydney, support its customers that are located in 70+ countries.

For more information, visithttps://auth0.com or follow @auth0 on Twitter .

SimMNSA has been granted Security Approval by the Global Positioning System Dire ...

$
0
0

PLEASANT GROVE, Utah (BUSINESS WIRE) Spirent Federal Systems, the nation’s leading provider of GPS/GNSS test equipment, announced today that their new M-Code solution, SimMNSA, has been granted Security Approval by the Global Positioning System Directorate. They are the first and only company to provide this highly anticipated solution for simulating classified GPS signals, and are currently taking orders.


SimMNSA has been granted Security Approval by the Global Positioning System Dire ...

In 2017, Spirent Federal Systems partnered with Rockwell Collins to develop new software that will use the Modernized Navstar Security Algorithm (MNSA). This new approach of M-Code simulation adds to Spirent Federal’s portfolio of classified signal simulation solutions, and will be available to authorized users of the GSS9000 series simulators. Ellen Hall, CEO of Spirent Federal Systems said, “With the increased focus on M-Code by the GPS Directorate, we are pleased that our team has paved the way in the development of SimMNSA. It was a great challenge to get to this point, but we are excited about what we have accomplished.”

This new test solution continues Spirent Federal Systems history of innovation and being first to market with M-Code simulation software. Spirent’s GPS/GNSS solutions have supported numerous government, military, and DoD programs over 30 years.

For more details, please reach out to us directly at gnssinfo@spirentfederal.com or 801-785-1448.

https://www.spirentfederal.com/gps/products/simmnsa/overview/

About Spirent Federal Systems

Spirent Federal Systems was formed in July 2001 by Spirent Communications as a wholly owned subsidiary and U.S. proxy company. Spirent Federal markets and sells Spirent Communications’ products in North America. The company also provides value-added features and ongoing customer support. Spirent Federal Systems is headquartered in Pleasant Grove, UT., with support and sales offices throughout the US.

About Spirent

Spirent Communications plc. (LSE: SPT) offers test, measurement, analytics, and assurance solutions for next-generation devices and networks. The company provides products, services and information for high-speed Ethernet, positioning and mobile network infrastructure markets, with expanding focus on service assurance, cybersecurity and 5G. Spirent is accelerating the transition of connected devices, network equipment and applications from development labs to the operational network, as it continues to innovate toward fully-automated testing and autonomous service assurance solutions. For more information, please visit www.spirent.com .

Any product roadmap information provided above is for informational purposes only and is subject to change. No contractual commitments are being made.

Contacts

Jeff Martin

Spirent Federal Systems

VP of Business Development and Sales

801-787-1207

jeff.martin@spirentfederal.com
SimMNSA has been granted Security Approval by the Global Positioning System Dire ...
Do you think you can beat this Sweet post? If so, you may have what it takes to become a Sweetcode contributor...Learn More.

Attack Campaign Targets Financial Firms Via Old But Reliable Tricks

$
0
0

Among other tried-and-true cyberattack methods, the attackers hosted malware on the Google Cloud Storage service domain storage.googleapis.com to mask their activity.

An ongoing targeted attack campaign against financial institutions demonstrates how older and well-trodden hacking methods still remain effective.

Since August, a group of attackers have usedJava-based remote access Trojans, phishing emails, and zip-compressed files - and hosted their malware on popular cloud services - to target employees at banks and other financial institutions,according to a report released this week by Menlo Security.

The attackers write their initial infectors in Java and Visual Basic, and customize versions of popular malware frameworks to steal account information, the company says .

"A lot of these attacks are stealing credit card information, they also steal accounts and steal money directly from the accounts," says Vinay Pidathala, director of research at Menlo Security, a Web security firm. "They can inject code directly into the pages to infect account holders, and they can put a keylogger, along with taking screenshots."

That these older tactics work should not be a surprise. Attackers still use these techniques because they work. In 2017, for example, 93% of breaches had a phishing e-mail component, according to the 2018 Verizon Data Breach Investigations Report (DBIR). While only 4% of recipients clicked the malicious link in a phishing e-mail on average, only a single person needs to let in the attacker.

Menlo Security found in its research that 4,600 phishing sites use legitimate hosting services. In the latest campaign, the attackers used storage.googleapis.com to host their malicious payload.

"Attackers are increasingly using popular domains to host their attacks," Pidathala says. "It's an easy way around being blocked by security software, because these sites are on a known good list."

Rise of the jRATs

Another common technique is using Adobe Flash or Oracle's Java as an initial infector. While personal computers have tried to move away from these ubiquitous runtime agents, for malware writers the write-once-run-anywhere technology allows a single file can run on Mac systems as well as windows.

The capability has resulted in consistent efforts to infect systems using malware written in those languages. More than a year ago, security firms warned that Java-based remote access trojans, or jRATs, were targeting business users using attachments that appeared to be communications from the Internal Revenue Service (IRS) or a purchase order, according to an April 2017 analysis by security firm Zscaler.

"The jRAT payload is capable of receiving commands from a C&C server, downloading and executing arbitrary payloads on the victim's machine," writes Zscaler security researcher Sameer Pail. "It also has the ability to spy on the victim by silently activating the camera and taking pictures."

Java-based RATs allow attackers to initiate an attack and download specific executables, depending on the operating system encountered. As Macs become an increasing part of the corporate world, such flexibility is key , experts say.

"More and more enterprises are using Macs, and with one JAR file you can design an attack that can infect both platforms," says Menlo Security's Pidathala. "Java is still installed on a significant number of computers around the world."

Old But Modified RATs

The attackers also used well-known remote access Trojans: Houdini and qRAT. Both are modular, so attackers are able to customize their payloads and add capabilities through a modular architecture.

Menlo Security's Pidathala argues that such RATs are more useful than automated botnets because attackers can easily tailor their attack to attempt to bypass the victim's defenses.

"It is a RAT, so it is very flexible because it is modular―it can do lateral movement, or it can do reconnaissance, just by updating its modules," he says. "Going forward, the concept of botnets, meaning malware that has automated functionality to steal specific things, will die down in favor of more malware that can be customized to the attackers' needs."

Better Together: Partnering with Okta

$
0
0

Better Together: Partnering with Okta

Every day, nearly 10 million valid credentials fall into the hands of criminals, fueling massive amounts of fraud. Shape’s new partnership with Okta aims to eliminate this fraud by providing Okta customers an invisible layer of defense against bots, credential stuffing attacks, and account takeover attempts. By implementing both solutions, businesses can have the very best in both identity and security to protect their workforces and consumers.

Businesses trust Okta for identity services across both single sign-on (SSO) and customer identity and access management (CIAM) portals. Shape’s partnership with Okta enhances security in both cases:

For Okta’s enterprise SSO customers, adding Shape provides a powerful, invisible layer of defense. Large credential breaches often include valid employee credentials. With Okta and Shape installed together, criminals will be further prevented from performing credential stuffingattacks using those stolen usernames and passwords.

For Okta’s CIAM customers, deploying Shape increases security without adding friction to the user experience. Shape enables businesses to eliminate CAPTCHAs and other consumer-unfriendly security measures on login pages while also preventing fraudulent account registrations.

The Okta and Shape partnership extends across all major touch points: web, mobile, and APIs. To learn more about using Shape to enhance your Okta SSO and customer portals,contact Shape or your Okta representative.

Scientists claim better security with biological encryption keys

$
0
0

Researchers at Pennsylvania State University claim to have achieved better security by using human T cells to create encryption keys, and say these keys are extremely difficult to reverse engineer.

The team photographed a random two-dimensional array of T cells in solution. digitised the image by creating pixels on it and marked the pixels as "ones" and the empty spaces as "zeros", the website Phys.org reported .

The researchers ― assistant professor of engineering science and mechanics Saptarshi Das, graduate student in engineering science and mechanics Akhil Dodda, graduate student in electrical engineering Akshay Wali and postdoctoral fellow in engineering science and mechanic Yang Wu ― said this approach to creating encryption keys could not be cloned or reverse engineered.

Said Das: "Currently, encryption is done with mathematical algorithms that are called one-way functions. These are easy to create in one direction, but very difficult to do in the opposite direction.

"However, now that computers are becoming more powerful and quantum computing is on the horizon, using encryption that relies on its effectiveness because it is monumentally time-consuming to decrypt won't fly anymore."

The team used living cells because they can be kept around for a long time and, as they move around, can be photographed repeatedly to create new encryption keys.

They are using 2000 T cells per key at the moment and said in a recent paper that even if someone knew the mechanism for key generation ― including cell type, cell density, key generation rate and key sampling instance ― it was not possible to breach the system using that information.

Said Wali: "We need something secure, and biological species-encrypted security systems will keep our data safe and secure everywhere and any time."

REASON TO CHOOSE TENDA MESH WIFI

Our Mesh WiFi system MW3 is the first in Australia market with price below AUD$200 for a set of three.

Best valued product

Strong signal covering up to 300m2 for MW3 and 500m2 for MW6

Aesthetically pleasing and light weigh (blend into any room deco)

Wireline backhauls supported

Product units are pre-paired and easy to setup

Not requiring phone number or email address to set up

Wall penetration (better than other similar brands)

Seamless WiFi roaming

User friendly app with controls to setup a guest network, parental controls for disabling groups of devices you allocate to individuals, QoS and more

CLICK FOR MORE INFO!

LEARN HOW TO REDUCE YOUR RISK OF A CYBER ATTACK

Australia is a cyber espionage hot spot.

As we automate, script and move to the cloud, more and more businesses are reliant on infrastructure that has the high potential to be exposed to risk.

It only takes one awry email to expose an accounts’ payable process, and for cyber attackers to cost a business thousands of dollars.

In the free white paper ‘6 Steps to Improve your Business Cyber Security’ you’ll learn some simple steps you should be taking to prevent devastating and malicious cyber attacks from destroying your business.

Cyber security can no longer be ignored, in this white paper you’ll learn:

How does business security get breached?

What can it cost to get it wrong?

6 actionable tips

DOWNLOAD NOW!

ExtraHop is Named to Wealthfront’s 2019 Career-Launching Companies List

$
0
0

Security and Performance Analytics Company Makes Its Fourth Consecutive Appearance on Prestigious List

SEATTLE (BUSINESS WIRE) lt;a href=”https://twitter.com/hashtag/Extrahop?src=hash” target=”_blank”gt;#Extrahoplt;/agt; ExtraHop, the leader in analytics for security and performance management, today announced that it has been named to the 2019 Wealthfront Career-Launching Companies List. This is the fourth consecutive appearance on the list for ExtraHop, and recognizes the company’s commitment to career development and innovation.


ExtraHop is Named to Wealthfront’s 2019 Career-Launching Companies List

Each year Wealthfront develops the list with input from 14 of the industry’s premier venture capital firms. To qualify for the list of United States-based mid-sized companies with momentum, a company must be privately held, have a revenue run rate by year end of between $20 million and $300 million, be on a trajectory to grow at a rate in excess of 50 percent for at least the next three or four years, and have compelling unit economics.

“Setting yourself up for a successful career is one of the most important things you can do to achieve financial success,” said Andy Rachleff, CEO of Wealthfront. “Publishing this list of ideal places to start your career is one of the many unique things Wealthfront does as a financial advisor to radically improve our clients’ financial outcomes.”

“ExtraHop sets itself apart from other companies in that we strike a unique balance between bold initiatives and operational excellence,” said Sheryl Loeffler, Vice President of Human Resources at ExtraHop. “Our employees learn how to take smart risks and put in the hard work and commitment to make them successful, and I believe that this is a skill that will carry them through their careers. This is why it’s such an honor to once again be named to Wealthfront’s annual list of Career-Launching Companies. It affirms not only our strong growth and success, but also our approach to fostering the next generation of technology leaders.”

For more information about Wealthfront’s 2019 Career-Launching Company List, visit: https://blog.wealthfront.com/career-launching-companies-list

For more information on careers at ExtraHop, visit our Careers Page at: www.extrahop.com/company/careers/

About ExtraHop

ExtraHop is the leader in analytics and investigation for the hybrid enterprise. We apply real-time analytics and advanced machine learning to every business transaction to deliver unprecedented visibility, definitive insights, and immediate answers that enable security and IT teams to act with confidence. The world’s leading organizations trust ExtraHop to support core digital business initiatives like security, IT modernization, and application service delivery. Hundreds of global ExtraHop customers , including Sony, Microsoft, Adobe, and DIRECTV, already use ExtraHop to accelerate their digital businesses. To experience the power of ExtraHop, explore our interactive online demo . Connect with us on Twitter and LinkedIn .

Contacts

Mentha Benek

ExtraHop

206-787-8417

pr@extrahop.com
ExtraHop is Named to Wealthfront’s 2019 Career-Launching Companies List
Do you think you can beat this Sweet post? If so, you may have what it takes to become a Sweetcode contributor...Learn More.

BUF早餐铺 | 微软发布 Windows Sandbox;新型恶意软件可从 Twitter 表情包隐藏的代码中 ...

$
0
0

各位Buffer早上好,今天是2018年12月20日星期四。今天的早餐铺内容有:微软发布针对专业版和企业版 windows 10 的 Windows Sandbox;新型恶意软件可从 Twitter 表情包隐藏的代码中获取指令;AV-TEST给出了适用于Android的最佳安全应用程序名单;大规模伪装成Apple Store 付款收据的 Apple ID 钓鱼攻击出现;捷克认为华为设备对国家安全构成威胁,华为:请提出证据;华为未来五年将投资20亿美元强化网络安全,增加人员和实验室设施。


BUF早餐铺 | 微软发布 Windows Sandbox;新型恶意软件可从 Twitter 表情包隐藏的代码中 ...

以下请看详细内容:

微软发布针对专业版和企业版 Windows 10 的 Windows Sandbox
BUF早餐铺 | 微软发布 Windows Sandbox;新型恶意软件可从 Twitter 表情包隐藏的代码中 ...
微软针对专业版和企业版 Windows 10 发布了一个轻量级的桌面环境 Windows Sandbox,以安全运行可执行文件。Windows Sandbox 是一个隔离的临时桌面环境,用户可以放心地运行不信任的应用程序,不用担心会对主机系统造成影响。安装在 Windows Sandbox 中的应用只会留在 Sandbox 里,一旦 Sandbox 关闭,里面的所有文件都将会永久删除。用户要想启用 Windows Sandbox,首先要有 Windows 10 Pro 或 Enterprise build 18305 或更高的系统版本,还需要在 BIOS 里启用虚拟化功能(物理机器),然后打开 Windows Features 寻找到 Windows Sandbox,打开开始菜单寻找到 Windows Sandbox 运行。[来源: microsoft ] 新型恶意软件可从 Twitter 表情包隐藏的代码中获取指令
BUF早餐铺 | 微软发布 Windows Sandbox;新型恶意软件可从 Twitter 表情包隐藏的代码中 ...
安全研究人员近期发现了一种新型恶意软件,可以从 Twitter 表情包隐藏的代码中获取指令。这个恶意软件跟大多数原始的远程访问特洛伊木马(RAT)一样,会暗中感染存在漏洞的计算机,对屏幕进行截图并从受感染的系统中盗取其他数据,并发回到恶意软件的命令和控制服务器。这个恶意软件把 Twitter 用作与其控制中枢进行通信的渠道。木后攻击者推送的推文中使用隐写术在表情包图像中隐藏了“/print”指令,让恶意软件截取受感染计算机的屏幕图像。然后,恶意软件会从发布在 Pastebin 的一则帖子中获取命令和控制服务器所在的地址,把屏幕截图发送过去。研究人员还表示,发布到 Twitter 的表情包中可能包含了其他指令,比如获取当前运行应用和进程列表的“/processos”,盗取用户剪贴板内容的“/clip”,以及从特定文件夹检索文件名的“/docs”。目前,恶意攻击者所使用的 Twitter 账户已经遭到 Twitter 永久冻结。[来源: securityaffairs ] AV-TEST给出了适用于Android的最佳安全应用程序名单 防病毒测试实验室AV-TEST最近评估了20种针对Android的移动安全产品性能。2018年11月进行的研究,在三个不同领域测试了每个产品,即保护,可用性和功能。每项产品在每次测试中的性能最高可获得6分。趋势科技移动安全,腾讯WeSecure,赛门铁克诺顿移动安全,Sophos移动安全,迈克菲移动安全,卡巴斯基实验室安卓互联网安全,G数据互联网安全和Bitdefender移动安全获得了最高分13分。这些针对Android的安全应用程序中的每一个都获得了最多六点保护和可用性,以及一点功能。相比之下,谷歌的Play Protect已经整合到Google Play商店中,在获得零点保护,4.5分可用性以及0分功能得分之后,获得了4.5分的最低分。这是唯一未能获得AV-TEST认证的解决方案。[来源: cnbeta ] 大规模伪装成Apple Store 付款收据的 Apple ID 钓鱼攻击出现 研究人员发现,有一大批钓鱼攻击假借 Apple Store 支付确认邮件窃取 Apple ID。这些钓鱼邮件正文很短,PDF 附件伪装成 Apple Store 中某个 APP 的支付确认单,并提醒受害者“如果没授权购买,就点击链接”,这些链接都是经过处理的短链接,无法看出网址来源。一旦受害者点击链接,就会跳转到新的页面。页面要求受害者使用 Apple ID 登录页面。如果受害者上当登录,就会看到提示:“由于安全原因,此 Apple ID 已经被锁定。若想继续登录,需要先解锁。”而解锁页面则要求受害者输入全名、地址、电话号码、社会安全号码、出生日期、付款信息、驾驶执照号码或护照号码等。如果这一步受害者还没产生怀疑,那么个人隐私信息就会被攻击者获取。这样的方式骗过了很多人,影响范围较大。[来源: bleepingcomputer ] 捷克认为华为设备对国家安全构成威胁,华为:请提出证据 捷克National Cyber and Information Security Agency (NCISA)总监Dusan Navratil表示,中国法例要求当地私人公司与情机关合作,因此使用其生产的软硬件可能对国家安全构成威胁,所以处理敏感数据的部门应该小心处理有关威胁。Navratil表示在关键信息基础设施中的系统管理员,无论是在国家部门或是私营部门,都应采取“适常措施”来应对这个威胁。华为发言人随后否认有关指控,表示其产品不会对国家安全构成威胁。该公司发言人促请NCISA提出证据,否则不要破坏华为的可信性。[来源: cnbeta ] 华为未来五年将投资20亿美元强化网络安全,增加人员和实验室设施 据国外媒体报道,华为周二表示,将在未来五年内投入20亿美元加强网络安全(cybersecurity),在这方面增加更多人员和升级实验室设施。目前该公司面临对其网络设备相关风险的担忧。华为在其东莞园区举行的记者会上做出上述表示,有20多位国际记者到场。华为轮值董事长胡厚]还介绍,华为已获得逾25份第五代移动通讯(5G)商业合同,略高于11月宣布的22份。[来源: kejixun ]

*AngelaY 整理,转载请注明来自 CodeSec.Net


Integrating Sysdig Secure with Atlassian Bamboo CI/CD

$
0
0

In this blog post we are going to cover how to perform Docker image scanning on Atlassian’s Bamboo CI/CD platform usingSysdig Secure. Container images with security vulnerabilities or not compliant with the security policies that you define within Sysdig Secure will be stopped, breaking the build pipeline before being pushed to your Docker registry.

What is the Atlassian Bamboo CI/CD platform?

Atlassian Bamboo is a continuous integration and delivery server integrated with Atlassian software development and collaboration platform. Some of the features that distinguish Bamboo from similar CI/CD tools are its native integration with other Atlassian products (like Jira project management and issue tracker), improved support for Git workflows (branching and merging) and flexible scalability of worker nodes using ephemeral Amazon EC2 virtual machines.

Build #container #security in you #CICD pipeline with @Atlassian Bamboo and @Sysdig Secure image scanning.

Click to tweet

Bamboo organizes the build pipeline with a hierarchy of Projects, Plans, Stages, Jobs and Tasks .

A project is a “namespace” containing different plans. The plan is composed of multiple stages that will be executed sequentially. Each stage is in turn composed of several jobs that can run in parallel, these jobs are the basic unit of work scheduled in the worker nodes. Finally, each job is composed of a series of tasks that will be executed sequentially in the scheduled worker node.


Integrating Sysdig Secure with Atlassian Bamboo CI/CD

To summarize:

The plan is the high level sequence of actions (stages) that you want to execute. The job is the basic schedulable unit of work that gets assigned to a worker. N jobs get executed in N workers and thus, can be parallelized. A job itself is a sequence of tasks, like executing a script or running a Docker container. Container security in your CI/CD pipeline: shift left your security and fail fast

Like most things in IT, the earlier you detect container security issues, the easier they are to fix without any further consequences.

Embedding container security in your build pipeline is a best practice for several reasons:

The vulnerabilities will never reach your production clusters, or even worse, a client environment. You can adopt a secure-by-default approach when you know any image available in your Docker container registry has already passed all the security policies you have defined for your organization, as opposed to manually check compliance after-the-fact. The original container builder will be (almost) instantly informed, when the developer still has all the context. The issue will be substantially easier to fix this way than if found by any other person months later…

Sysdig Secure offers a full featured container image scanning service, among many other container security features like run-time threat detection, forensics, compliance and auditing. Let’s see how we can make Sysdig Secure image scanning service work together with Atlassian Bamboo.

Bamboo CI/CD pipeline image scanning with Sysdig Secure

Following a practical example we are going to demonstrate how to integrate these two platforms with a very straightforward process.

We will start by creating a new Project containing a Plan, which basically means naming them, writing the corresponding description, configuring access credentials for users, etc:


Integrating Sysdig Secure with Atlassian Bamboo CI/CD

Next, we will create an environment for the plan.

First, we need to configure the repository that is going to contain the Dockerfile together with other build variables and artifacts:


Integrating Sysdig Secure with Atlassian Bamboo CI/CD

You might configure other environment variables you need from the Variables tab.


Integrating Sysdig Secure with Atlassian Bamboo CI/CD

From the Global Bamboo settings (top-right gear icon, linked repositories) you can configure any credentials you require to access your source repository, like GitHub and your container image registry, DockerHub for example.

Next, we will configure this plan to trigger automatically whenever there is a change in the repository:


Integrating Sysdig Secure with Atlassian Bamboo CI/CD
Configuring the CI/CD pipeline

We are now ready to create a Stage containing the different tasks:


Integrating Sysdig Secure with Atlassian Bamboo CI/CD
Source code checkout: cloning the supporting repository that contains the Dockerfile and other build variables. Retrieve build variables: We use a simple shell script to populate a properties.txt file with key-value pairs. Extracting, for example, the container name and version that we want to build. As you can see in the example below, we extract some basic information from the Dockerfile we have cloned in the first step.
Integrating Sysdig Secure with Atlassian Bamboo CI/CD
Inject Bamboo variables: Using the properties file, we transform the key-value pairs into build context variables that we can use later in the pipeline. Build the Docker image: At this step we are ready to start the build. We will select Build a Docker image in Command , and we will configure a staging image registry where we can upload the image.
Integrating Sysdig Secure with Atlassian Bamboo CI/CD
Upload the candidate image: This will push the resulting image to the staging registry, so the container image scanner can retrieve it and analyze it. Scan image with Sysdig Secure: Finally, we are going to trigger the image scan. Bamboo allows you to run a container as a task, so we have bundled all the Sysdig Secure client software in a container. You just need to pass the name of the image to scan and your Sysdig Secure API credentials as environment variables.

The variables we are using in this case are:

IMAGE_TO_SCAN="sysdigregistrydemo/${bamboo.git.name}:${bamboo.git.version}" SYSDIG_SECURE_TOKEN=${bamboo.SYSDIG_SECURE_TOKEN}

Two of the variables were extracted by our simple shell script, the secure token is an environment variable in this case.


Integrating Sysdig Secure with Atlassian Bamboo CI/CD

If the scanning finds any vulnerabilities in the image (including custom policies that you may have defined, like specific checks on the Dockerfile, for example not running the process as root, or whitelist/blacklist certains packages or libraries like not installing SSH), the whole plan will fail and the last step will never get executed.

Upload the approved image: If the last step is completed successfully, we can upload the Docker image to the production Docker registry and make it available for our organization and production infrastructure and clusters.

Let’s trigger a build uploading to our configured source code repository the following Dockerfile:

FROM debian:stretch
LABEL version="0.2"
LABEL name="user-audit"
RUN apt-get update
RUN apt-get install -y apt-transport-https curl gnupg2 cron nano openssh-server
RUN curl -s https://packages.cloud.google.com/apt/doc/apt-key.gpg | apt-key add -
RUN touch /etc/apt/sources.list.d/kubernetes.list
RUN echo "deb http://apt.kubernetes.io/ kubernetes-xenial main" | tee -a /etc/apt/sources.list.d/kubernetes.list
RUN apt-get update
RUN apt-get install -y kubectl
EXPOSE 22
RUN crontab -l | { cat; echo "05 11 * * * /root/wp-deploy.sh"; } | crontab -
RUN crontab -l | { cat; echo "06 11 * * 1,4 /root/nginx-crashloop.sh"; } | crontab -
COPY Dockerfile /
ENTRYPOINT ["sshd","-D"]

Uh-oh! It seems that Sysdig Secure container image scanner found something wrong:


Integrating Sysdig Secure with Atlassian Bamboo CI/CD

Within Sysdig Secure you can see the full report including the policy evaluation and why it failed:


Integrating Sysdig Secure with Atlassian Bamboo CI/CD

Seems that our image is exposing port 22. Also contains a vulnerable version of the libidn11 library. Now we know what happened, why the build failed and how to fix it.

Conclusions

Integrating your security policy early in your CI/CD pipeline will prevent known software vulnerabilities to be deployed in production and you will enforce best security practices within your build pipeline, before those containers ever run in production.

Thanks to the native Docker compatibility in Atlassian Bamboo and the Sysdig Secure container image scanning API, making them both work together is a breeze. Find any software vulnerabilities, check for container security best practices, Dockerfile contents, whitelist or blacklist specific packages or 3rd party libraries installed manually like Java JAR/WAR files, or package managers like npm, pip or gem, even for software licenses with Sysdig Secure. Fail fast, inform the container author right away to address it quickly and create a secure-by-default container security policy.

泰安内外兼施打造网络安全人才高地

$
0
0

原标题:泰安内外兼施打造网络安全人才高地

12月16日,山东省泰安市举行网络空间安全人才培养签约仪式,来自国家部委多个部门的领导,北京邮电大学、北京航空航天大学、北京理工大学、山东大学等多所国家重点学府,以及包括中石化、浪潮、360、TCL集团、梆梆安全、山东特检和山水集团等国内外多家企业负责人汇聚泰安,共议国际网络空间安全人才培养大计。

据了解,此次网络空间安全人才培养签约仪式由中关村可信计算产业联盟主办,山东云天安全大数据技术有限公司、山东云天安全技术有限公司承办,泰安市泰山财金投资集团有限公司、泰安云安园区运营管理有限公司协办。当天,中国工程院院士沈昌祥,泰安市副市长成丽为可信计算院士工作站揭牌。

成丽在致辞时表示,当前网络安全已经上升为国家战略,泰安市抢抓这一机遇,启动建设泰山云安智能小镇,与国家密码局、北邮、北航、360集团等机构开展务实合作。泰安将积极提供最优质的服务、最完善的保障、最良好的环境,与大家携手共进、共创美好未来。这次可信计算院士工作站、中以-网络安全泰山产业园在此落户,为泰安网络安全产业发展打下了坚实的人才基础。泰安将积极创造条件,使更多网络安全项目落户泰安、更多网络安全人才汇聚泰安、更多网络安全技术出自泰安,将泰安市打造成为全国网络安全产业发展的高地。

针对日益严峻的网络空间安全形势,沈昌祥强调,要树立正确的网络安全观,建设完善的网络空间安全人才培养体系。经过长期攻关、军民融合,我国形成了自主创新的可信体系,跨入了可信计算3.0时代。我国可信计算已经成为保卫国家网络空间主权的战略核心技术,已在国家核心系统和关键信息基础设施得到规模化成功应用。面临日益严峻的国际网络空间形势,我们要立足国情,创新驱动,解决网络空间安全人才培养的问题。坚持纵深防御,用可信计算3.0构建网络空间安全主动免疫保障体系,筑牢网络空间安全防线。

泰安市高度重视人才培养,近年来已与北京航空航天大学,北京邮电大学等高校展开务实合作。本次仪式上,山东云天安全技术有限公司董事长李峰分别与齐鲁工业大学网络空间安全学院党委书记王玉立、山东科技大学信息工程学院院长刘纪敏、山东政法学院院长吕涛签署了《校企合作协议》。共同探索网络空间安全人才培养模式,校企合作缓解网络空间安全人才缺口。

为更好地将泰安市打造成为网络安全产业高地,加强国际合作,引进国际先进的创业孵化以及网络空间安全运营经验,泰安旅游经济开发区与以色列国家孵化器建立战略合作,建立“中以-网络安全泰山产业园”。仪式上,以色列利库德集团政治局委员、青年委员会主席、以色列高科技公司和初创公司战略和业务发展顾问戴维沙扬,泰安旅游经济开发区管委会主任孙卫连为“中以-网络安全泰山产业园”揭牌。

本次签约仪式在泰安市云安数梦空间暨云天网络空间安全综合体举行,与会来宾参观了这座刚刚建成的智慧园区,并对云安数梦空间从培训教育、众创孵化、人才汇聚、基金创投、技术引进到安全运营的完整生态圈模式给予了高度肯定。

(责编:易潇、杨波)

Adventures of an Enclave (SGX / TEEs)

$
0
0
Adventures of an Enclave (SGX /TEEs) So what can SGX and TEEs be used for beyond the obviouscases?

Leland Lee


Adventures of an Enclave (SGX / TEEs)
Treasure Map

Imagine a magical piece of hardware that no one can see inside, even if they break it open, that is the promise of Intel SGX and TEEs (Trusted Execution Environments).

Cryptographers for decades have been pushing the limits of secure computation. This is when the computing party is oblivious to the result and underlying data. Example: did Alice or Bob supply a larger number without revealing the underlying numbers to training machine learning models on encrypted data. Some of these problems have been solved, but often times the solutions are neither generalised nor efficient.

Let’s discuss how trusted hardware works, its standard use cases and some more unique ones, before discussing various blockchain projects that use this technology and the future of TEEs.

Note SGX is a subset of TEEs that is currently the most widely used and I use the terms fairly interchangeably throughout the post.

Why PrivateCompute?

Privacy is often valued greatly in particular instances and brushed away on others, let’s give some examples cases where privacy does matter.

Secure lotteries where no one can cheat or rig the numbers , where the code is public and individuals can attest that the lottery is running that code. How to share images for classification by an algorithm if the images are locked under by HIPPA, GDPR and other data privacy controls. Privacy Implementation

Some of the current cryptographic primitives tools available for secure computation include techniques such as fully homomorphic encryption (FHE), secure multiparty computation (sMPC), and Zero Knowledge Proofs (ZKPs). However these techniques are either too specialised (not generalised), too slow, or too computationally expensive to make them practical in a production environment. Systems like SGX provide similar security guarantees but is much faster, cheaper and practical today.


Adventures of an Enclave (SGX / TEEs)
Figure: High level on how SGX works, which is relatively comparable toTEEs. Technicalities

This is how SGX works on a high level, specific implementation details are passed over here.

Code runs in a hardware protected enclave / area [1] separate from OS, which has a private key associated that is secret Enclave can communicate through special channels to the application Use remote attestation to prove that a specific piece of code ran on a suitable enclave producing a specific result (“quote”), whose integrity is verified[2].

With this, a developer can send open sourced code to an enclave, a user can verify that the code running inside the enclave is equivalent to the open sourced code via remote attestations. Users then can inspect the code for any backdoors or unexpected functionality.

Common UseCases

Let’s start with the common and obvious use cases of this technology.

Most Common Use Cases

These use cases that already have fairly common cryptographic constructions for, but can also be done in TEEs. Determining whether Alice or Bob is wealthier without revealing the actual value( Yao’s Millionaire Problem ). Counting votes without revealing the linkability between vote and caster. Generating a random number . Blind auctions where the individuals running the auction are unable to see the bids and also forced to reveal all bids at the end.

Provable erasure

Regret that moment you shared some photos to a former lover? How can you prove that they deleted the photo, the same applies to GDPR, how can one prove that the data is no longer in the database or in someone’s hands who can access it? If the data was stored inside of an enclave, a user can attest that the data has either been deleted within the enclave or that the associated private key of the data has been deleted and the data can no longer be decrypted. Phew if they didn’t take a photo of the photo….

Key Generation

Shamir’s secret sharing is a cryptographic technique that has similar functionality to a multi sig wallet. Generate m shards and n number are necessary to initiate a transaction. However as a precursor it’s necessary to have a public and private key pair, but how can one prove that the key was destroyed and not copied? Here comes the provable erasure attribute of TEEs, generate the public and private key pair inside the enclave, create the shards, then provable delete and not leak the private key.

Private Searches and Encrypted Databases Let’s say there exists a database of restaurants that I want to search, and I do not want to reveal my searches to the owner. Mostly I’m afraid that the owner would sell the data to the paparazzi. Currently there is no easy way of enabling private searching of data with standard cryptographic techniques. However with SGX and TEEs it is possible to search within a dataset that is encrypted by the enclave , without revealing to the operator what one searched for. A similar technique can be used for web searches[ here ][ here ] Provable Search

Initially we wanted private searches, then why all of a sudden would we want to have provable searches? Don’t traditional databases already provide that in their logs? Yes, but let’s say we gave the NSA some viewing keys to a privacy blockchain. (Viewing keys are used to deanonymize the contents of a private transactions in protocols such as Zcash and Monero ). Can we build a system that logs what subset of the keys that were used, with TEEs it is possible to have tamper proof logs, which no other cryptographic system can provide.

Uncommon UseCases

This is where the fun begins, how can we use TEEs in ways that are non intuitive? Some of these ideas are from academic papers, others were conjured up and verified by researchers in the field.

Heart Beats Heart beats are a technique to signify that someone or som

ACMA hits Primus, iSelect with fines over telemarketing

$
0
0

The Australian Communications and Media Authority has fined Primus Telecommunications and iSelect $8400 apiece for telemarketing services to consumers after they had withdrawn their consent. Dodo Services was formally warned for a similar offence.

In a statement, ACMA said the fines and warning came in the wake of investigations into complaints found that each of the three businesses had contacted consumers after they had withdrawn consent to being contacted.

"Telemarketers must have the permission of the consumer involved to call a number on the Do Not Call Register. Calling a number on the Register without consent is breaching the rules," said ACMA chair Nerida O’Loughlin.

"Consumers have the right to withdraw their consent to accept or continue a call at any time. Telemarketers must listen to consumers and take their obligations seriously by removing people from calling lists when asked."

ACMA said a total of $385,200 in infringement notices has been paid to date this year for breaking telemarketing rules.

Penalties for breaches of telemarketing laws include formal warnings, infringement notices or action in the Federal Court.

REASON TO CHOOSE TENDA MESH WIFI

Our Mesh WiFi system MW3 is the first in Australia market with price below AUD$200 for a set of three.

Best valued product

Strong signal covering up to 300m2 for MW3 and 500m2 for MW6

Aesthetically pleasing and light weigh (blend into any room deco)

Wireline backhauls supported

Product units are pre-paired and easy to setup

Not requiring phone number or email address to set up

Wall penetration (better than other similar brands)

Seamless WiFi roaming

User friendly app with controls to setup a guest network, parental controls for disabling groups of devices you allocate to individuals, QoS and more

CLICK FOR MORE INFO!

LEARN HOW TO REDUCE YOUR RISK OF A CYBER ATTACK

Australia is a cyber espionage hot spot.

As we automate, script and move to the cloud, more and more businesses are reliant on infrastructure that has the high potential to be exposed to risk.

It only takes one awry email to expose an accounts’ payable process, and for cyber attackers to cost a business thousands of dollars.

In the free white paper ‘6 Steps to Improve your Business Cyber Security’ you’ll learn some simple steps you should be taking to prevent devastating and malicious cyber attacks from destroying your business.

Cyber security can no longer be ignored, in this white paper you’ll learn:

How does business security get breached?

What can it cost to get it wrong?

6 actionable tips

DOWNLOAD NOW!

石化、冶金、电力、轨交等行业工控系统信息安全隐患分析

$
0
0
摘要

工业控制系统是承载国家经济发展、维护社会稳定的重要基础设施,本文以石化、冶金、电力、轨交等重点行业为出发点,从安全软件选择与管理、配置和补丁管理、边界安全防护等方面,分析工控安全现状以及存在的信息安全隐患。

1引言

随着信息技术的迅猛发展,工业控制系统在控制规模、控制技术和信息共享方面都有巨大的变化,由最初简单控制的封闭系统发展成现在复杂或者先进控制的开放系统,针对工业控制系统的网络攻击事件日益增多,石油化工、冶金、电力、轨道交通、烟草等国家重点行业面临前所未有的网络安全威胁。本文将结合典型行业特点,从网络、控制、应用和数据等方面,对工业控制系统信息安全现状及存在的信息安全隐患进行分析。

2石化行业特点 2.1行业背景

石化行业信息化建设具有较好的基础,企业在管理层的指挥、协调和监控能力,上传下达的实时性、完整性和一致性都有很大提升,相应的网络安全防护情况也有了明显改善。随着石化企业管控一体化的推进,越来越多的工控系统通过信息网连接到互联网上,潜在的安全威胁与之俱增。2017年,中石化发布《关于加强工业控制系统安全防护的指导意见》,从安全配置、边界安全防护、安全监测、风险预警等方面对工控系统提出安全防护要求。

石化行业涉及互联网及集团网、管理网、生产网三层网络架构,包含采油、炼油、输油等生产环节。生产区域一般按照不同的生产工艺,以装置为单位进行生产区域划分,各生产区域内的工业控制系统一般包括:分布式控制系统(DCS)、可编程逻辑控制器(PLC)、安全仪表系统(SIS)、火灾及可燃气体报警系统(FGS)、SCADA系统等。石化行业工业控制系统注重安全、稳定、长期、满负荷、优质的运行,且相互关联、相互依存。

2.2存在的安全隐患

(1)装置品牌众多,安全运维困难。炼化采用DCS,仓储采用PLC,管输采用SCADA系统,各生产区域工控系统的品牌不一,难以统一管理,且控制设备种类繁多、国产化率较低、系统运行维护困难,无法做到安全自主可控。

(2)各层网络间无隔离防护。企业的控制网络系统复杂多样,缺乏必要的安全边界及区域功能划分,过程控制层与数据采集层,先进控制(APC)系统与过程控制网,控制器与操作员站(工程师站),缺少访问控制措施。一旦系统某节点出现病毒、木马等问题,会迅速蔓延至整个网络。

(3)工程师站缺少身份认证机制。工程师站一般情况下只有管理员账户,对操作员站、DCS控制器的组态行为通常缺乏身份认证,由于拥有最高操作权限,可以任意修改控制逻辑和流程,存在对现场设备直接组态的重大隐患。

(4)APC系统本身未加装任何安全防护。在项目工程师安装、调试和修改期间,APC系统需要频繁与外部进行数据交换,感染病毒的风险较高。一旦APC系统出现感染木马、病毒等问题,实时运行的控制系统安全将无法保障。

3冶金行业特点 3.1行业背景

冶金行业信息化程度逐渐提高,但主流控制系统大部分装置是国外品牌,安全自主可控难以实现。随着两化融合的推进,绝大多数工控系统与企业管理信息系统处于同一网络平面,加上内网系统的远程运维需求及对U盘等外设的接入需求,致使工控网络边界安全和内网工业主机安全不受控。2016年,中国钢铁工业协会下发《关于做好防范PLC-Blaster蠕虫病毒工作的通知》,强调广泛应用于钢铁行业的西门子S7系列PLC设备是该病毒的主要攻击目标,潜在威胁极大,需结合自身实际情况组织针对性防范。

3.2存在的安全隐患

(1)生产控制网络及系统未分层、分区。分厂控制网络通常采用同一网段,现场PLC、DCS等重要控制设备缺少安全防护,同时各分厂控制网与骨干环网、生产监控网与办公网之间缺乏隔离防护措施,无法将恶意代码、非法操作等行为控制在安全区域内。

(2)通信协议多样,难以保障数据采集安全。由于控制流程复杂、设备种类繁多,采用的通信协议复杂多样,数据和接口类型千差万别,数据集中管理与维护难度较大,无法保证各采集平台的数据完整性。

(3)缺少安全监测和审计措施。操作和管理人员的技术水平不一、安全意识不足,容易出现越权访问、违规操作等情况,由于系统缺乏对用户操作行为的审计和监控,无法及时发现非法访问、操作异常、恶意攻击等行为,给生产系统埋下极大的安全隐患。

(4)无法对网络安全事件进行报警或追踪。大多数控制系统缺少日志分析与事件报警功能,安全事件发生时,系统不能对网络故障进行预警或报警,且无法追踪和定位事件的源头,针对性安全防护工作也就无从下手。

4电力行业特点 4.1行业背景

电力行业作为工业控制领域信息安全防护建设的先行者,已在信息安全防护建设方面积累了大量经验:电力企业在电力监控系统安全防护体系建设过程中始终坚持自主可控的原则,研究信息隔离与交换、纵向加密认证等多项专用安全防护技术,进而形成了多项信息安全行业技术规范和标准;针对关键产品进行自主研发,并统一组织进行严格测试,保证关键系统的安全自主可控;各电力企业相继建立了信息安全相关组织体系,建成了较为完善的信息安全管理制度,包括信息安全总体安全防护策略、管理办法、信息通报和应急处置制度,涵盖了信息安全活动的主要方面;总结形成了“安全分区、网络专用、横向隔离、纵向认证”的信息安全防护策略,建立了多技术层面的防护体系,做到了物理、网络、终端和数据的多角度、全方面保护。

4.2存在的安全隐患

(1)未建立工业控制主机和设备的安全配置策略。多数工业主机上未安装防病毒或白名单软件,且系统中存在大量USB存储设备使用记录,未通过主机外设安全管理技术手段实施访问控制,工业控制系统关键设备均未采用多因素认证方式。安全设备配置不合理,防火墙规则和路由器配置不当容易引发通信安全风险,访问控制规则配置不正确的防火墙可能许可不必要的网络数据传输,如在企业网和控制网之间进行数据交换,可能导致恶意攻击或恶意代码在系统网络的传播,重要工业数据容易被窃听。

(2)电力系统对时序要求严格,容易出现传输延迟等问题。SCADA和自动化控制系统对受控对象的直接操作具有高度时效性,不允许发生重大延迟和系统震荡,以变电站运作为例,触发电路开关延迟可能导致功率波动甚至停电。如果恶意攻击者频繁发起常见请求,即使防火墙能够阻止未授权的请求,但在数据处理能力不足、带宽受限的情况下,也会引起网络延迟,难以满足传输的实时性要求。

(3)系统各种业务的应用程序缺少验证机制。多数电力工业控制设备缺乏身份验证机制,即便有,大部分也为设备供应商默认的用户名和密码,极易被猜到或破解,一般不会定期更换密码,同时应用系统的资源(如文件、数据库表等)存在被越权使用的风险。对关键设备和组件缺少冗余配置,导致应用程序对故障的检测、处理和恢复能力不足,缺少对程序界面输入内容或是注入攻击的验证,如SQL注入攻击等,系统数据库存在泄漏的风险。

(4)管理信息大区积累大量电力敏感数据,存在泄漏或被篡改的风险。不仅仅是居民的用电数据,个人信息也存储在电力数据库中,电力调度、检修、运维等数据极易被批量查询,从而导出个人敏感信息,缺乏对敏感字符的过滤机制将带来安全风险。同时电力数据通常不进行定期备份,如果发生人为误操作导致数据更改或删除,或是数据库自身出现故障、服务器宕机,数据存储安全性难以保证。

5轨交行业特点 5.1行业背景

随着计算机和网络技术的发展,特别是信号系统信息化的深度集成,CBTC系统产品越来越多地采用通用协议、通用硬件和通用软件,以各种方式与PIS网络、语音广播等其他子系统互联,甚至与公共网络连接,导致病毒、木马等威胁向CBTC系统扩散。一旦CBTC系统出现信息安全问题,将对城市轨道交通的稳定运行和乘客的人身安全产生重大影响。某地轨道交通运营公司在《轨道交通信息安全技术架构》中提出信息安全建设的总体目标为:全面防护、保护重点、专区专用、强化边界,旨在提升信息安全的预警能力、保障能力、检测能力、应急能力和恢复能力。要求以GB/T 22239为基础,以“安全分区、网络专用、三网隔离、分级防护”为原则,在技术层面要求各系统统一技术架构和标准,按相应等级要求建设、实施。

5.2存在的安全隐患

(1)现场环境严苛,网络设备存在被动适应安全隐患。轨交现场的机电一体化设备通常部署在较为苛刻的环境中,传统的网络安全设备难以稳定运行,因此无法保证工业网络及控制系统的信息安全。苛刻的环境条件包括极端的温度、EMC、EMI等,其对传统网络安全设备造成的破坏可能比恶意程序或代码的攻击更为严重。

(2)无线通信安全性亟待加强。信号系统的无线信号是开放的,轨旁无线与列车通信链路采用同一频段,可能出现用户未经授权非法接入信号系统、数据在传输过程中被监听窃取等问题。无线网络的开放性增加了无线设备配置的安全风险,无线网加密机制存在安全隐患。

(3)轨交列控系统存在移动媒介、以太网接口以及设备接入隐患。工业主机大量使用外设接口,安全管理技术手段欠缺,存在USB协议、U盘运行、U盘固件设计隐患;多数交换机、工控机等设备中存在未使用且开放的端口,各种系统及设备接入缺乏访问控制措施。

(4)数据库安全隐患。管理方式不当、操作系统故障及软件故障都会导致轨道交通子系统性能的下降,影响系统的可用性;获得系统控制权限的攻击者可能接触到数据库,缺省密码或弱密码易导致关键控制数据被篡改或者丧失,或列车失去控制,严重甚至导致人员伤亡。

6行业共性问题

(1)未进行安全域划分,安全边界模糊。大多数行业的工控系统各子系统之间没有隔离防护,未根据区域重要性和业务需求对工控网络进行安全区域划分,系统边界不清晰,边界访问控制策略缺失,重要网段和其他网段之间缺少有效的隔离手段,一旦出现网络安全事件,安全威胁无法控制在特定区域内。

(2)操作系统存在漏洞,主机安全防护不足。工程师站和操作员站一般是基于windows平台,包括NT4.0、2000、XP、Win7、Server2003等,考虑到杀毒软件和系统补丁可能对控制系统的稳定运行造成影响,即便安装杀毒软件也存在病毒库过期等问题,因此通常不安装或运行杀毒软件,系统补丁在特殊情况下才进行更新或升级。同时,移动存储介质和软件运行权限管理缺失,控制系统极易感染病毒。

(3)通信协议的安全性考虑不足,容易被攻击者利用。专用的工控通信协议或规约在设计之初一般只考虑通信的实时性和可用性,很少或根本没有考虑安全性问题,例如缺乏强度足够的认证、加密或授权措施等,特别是工控系统中的无线通信协议,更容易受到中间人的窃听和欺骗性攻击。为保证数据传输的实时性,Modbus/TCP、OPC Classic、IEC 60870-5-104、DNP 3.0、Profinet、EtherNet/IP等工控协议多采用明文传输,易于被劫持和修改。

(4)安全策略和管理制度不完善,人员安全意识不足。目前大多数行业尚未形成完整合理的信息安全保障制度和流程,对工控系统规划、设计、建设、运维、评估等阶段的信息安全需求考虑不充分,配套的事件处理流程、人员责任体制、供应链管理机制有所欠缺。同时,缺乏工控安全宣传和培训,对人员安全意识的培养不够重视,工控系统经常会接入各种终端设备,感染病毒、木马等的风险极大,给系统安全可靠运行埋下隐患。

7结语

工业控制系统信息安全事关工业生产运行、国家经济安全和人民生命财产安全,保障系统信息安全是维护工业控制系统稳定运行的重要前提,是开展工业建设的坚实基础。针对不同的工业控制系统信息安全需求及系统运行情况,选择恰当的安全防护措施,全方位地对工业控制系统的安全风险进行分析和评估,才能确保各行业网络的安全、可靠,避免信息安全隐患造成不可预估的损失。

作者简介

甘俊杰(1993-),男,硕士,毕业于北京邮电大学,现就职于中国电子技术标准化研究院,主要从事工业信息安全方面的研究。

夏冀,男,工程师,现就职于中国电子技术标准化研究院信息安全研究中心,主要从事工业信息安全标准研制工作。

李琳,男,博士,现任中国电子技术标准化研究院工程师,工业控制系统安全标准和测评工业和信息化部重点实验室技术总监。

摘自《自动化博览》2018工业控制系统信息安全专刊(第五辑)

声明:本文来自工业安全产业联盟,版权归作者所有。文章内容仅代表作者独立观点,不代表安全内参立场,转载目的在于传递更多信息。如需转载,请联系原作者获取授权。

Viewing all 12749 articles
Browse latest View live