Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Comments
Putting Security on Par with DevOps
Newest First  |  Oldest First  |  Threaded View
marys151
50%
50%
marys151,
User Rank: Apprentice
4/8/2019 | 1:23:58 AM
Devops
The technology field, especially DevOps consulting requires an immense professional skill set that equates to relative good job security, it's sites like this that are helping to fill in the gaps.
allankristensen
50%
50%
allankristensen,
User Rank: Author
10/5/2018 | 9:56:27 PM
Re: Identity, Identity, Identity
Identity management is definitely a key part of building a secure public cloud infrastructure, because it's critical to control WHO can log into your public cloud environments as well as being able to ENFORCE secure login methods etc. 

However, the reality is that public cloud configuration drifts continue to happen, why it's equally important to have ongoing user credential configuration monitoring in place to avoid identity configuration drifts, such as MFA authentication not enforced, access keys not rotated, password policies not enforced, unused access keys / user ID's etc.

Furthermore, it's critical to have a solid, and automated user anomaly detection system in place to be able to distinguish between normal and unusual user activities. Public cloud environments are highly dynamic environments, and in today's world suspicious and unusual user activities, such as spinning up computing power for crypto mining activities using a compromised access key, can easily fly under the radar if User Behavior Analytics are not used efficiently to detect and alert on suspicious user activities.

The same applies to vulnerable hosts in public cloud environments. It's critical to have efficient tools in place to detect and alert on vulnerable hosts, but it's even more important to be able to correlate this information with other threat factors such as determining which vulnerable hosts has received traffic from suspicious IP addresses, and for those quickly determine the change history (what was changed and by whom). Correlated information like this will help security teams prioritize and react accordingly.

Last but not least auto-remediation capabilities are important as well, because especially for identity configuration drifts it's critical to be able to respond immediately, and without human involvement.

 

 
lunny
50%
50%
lunny,
User Rank: Strategist
10/3/2018 | 11:49:34 AM
Identity, Identity, Identity
Identity, especially non-human identities (not just the ID), must be understood.  Inventory matters, especially where assets in the cloud are more and more ephemeral and transient than ever.  Who is accessing/doing what, when are they doing it, why are they doing it, where are they doing it?  Are they authorized?  How would a threat actor compromise the identity of an asset, be it the database owner service ID, root on a server, masquerade as a trusted API interface, etc?  The concept of the right person (or non-person entity) being able to do the right thing, in the right place, at the right time, and for the right reasons is where we must start.  Along with that, the converse is important (the WRONG person/thing being able to do it).  A threat actor, especially a well-informed internal threat actor, understands the weak links in this chain and WILL exploit them.  Passwords created and known by human beings make the attacks easy.  Reference Equifax - it wasn't the Struts vulnerability; rather it was too easy to get the administrator credentials to over 50 databases once they climbed in through the bedroom window.  Humans are provably fallible in this regard.  It's not that you don't trust your privileged users, it's that you cannot.  They pick horrible passwords, share them extensively, and rarely, if ever, change them.  That grumbly Linux systems administrator who left the organization a year and a half ago still knows the passwords.  Imagine his or her ability to damage your company if so motivated.

Patching known vulnerabilities matters, monitoring for zero-day indicators matters, anti-virus/anti-malware protection matters.  But at some point, we just run out of fingers to put in the dyke.  Any organization that isn't managing identity well and taking it very seriously is whistling past the graveyard.


7 Truths About BEC Scams
Ericka Chickowski, Contributing Writer,  6/13/2019
DNS Firewalls Could Prevent Billions in Losses to Cybercrime
Curtis Franklin Jr., Senior Editor at Dark Reading,  6/13/2019
10 Notable Security Acquisitions of 2019 (So Far)
Kelly Sheridan, Staff Editor, Dark Reading,  6/15/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Building and Managing an IT Security Operations Program
As cyber threats grow, many organizations are building security operations centers (SOCs) to improve their defenses. In this Tech Digest you will learn tips on how to get the most out of a SOC in your organization - and what to do if you can't afford to build one.
Flash Poll
The State of IT Operations and Cybersecurity Operations
The State of IT Operations and Cybersecurity Operations
Your enterprise's cyber risk may depend upon the relationship between the IT team and the security team. Heres some insight on what's working and what isn't in the data center.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2017-9391
PUBLISHED: 2019-06-17
An issue was discovered on Vera VeraEdge 1.7.19 and Veralite 1.7.481 devices. The device provides UPnP services that are available on port 3480 and can also be accessed via port 80 using the url "/port_3480". It seems that the UPnP services provide "request_image" as one of the s...
CVE-2017-9392
PUBLISHED: 2019-06-17
An issue was discovered on Vera VeraEdge 1.7.19 and Veralite 1.7.481 devices. The device provides UPnP services that are available on port 3480 and can also be accessed via port 80 using the url "/port_3480". It seems that the UPnP services provide "request_image" as one of the s...
CVE-2018-18958
PUBLISHED: 2019-06-17
OPNsense 18.7.x before 18.7.7 has Incorrect Access Control.
CVE-2019-5016
PUBLISHED: 2019-06-17
An exploitable arbitrary memory read vulnerability exists in the KCodes NetUSB.ko kernel module which enables the ReadySHARE Printer functionality of at least two NETGEAR Nighthawk Routers and potentially several other vendors/products. A specially crafted index value can cause an invalid memory rea...
CVE-2019-5017
PUBLISHED: 2019-06-17
An exploitable information disclosure vulnerability exists in the KCodes NetUSB.ko kernel module that enables the ReadySHARE Printer functionality of at least two NETGEAR Nighthawk Routers and potentially several other vendors/products. An unauthenticated, remote attacker can craft and send a packet...