Are Security Professionals Over-Confident in “Defense-in-Depth”?

In late May, NSS Labs released the results of its research on “Correlation of Detection Failures”. In an array of tests which implemented various combinations of layered security technologies, a mere 3% of unique combinations managed to detect all the exploits employed. The published report outlined the testing of the protection effectiveness of next-generation firewalls, intrusion prevention systems, and endpoint protection.

The tests included 37 security products from 24 different vendors and 1,711 exploits. There were 16 IPS, 8 next-generation firewall, and 13 endpoint protection products in the test. Networking products included the Barracuda F900 networking security appliance, Check Point 12600, and the Palo Alto PA5020.

None of the 37 tested products managed to detect all the exploits on their own. Of the 606 combinations possible with two of the security products in the test, only 3 percent of the possibilities detected all the exploits.

The results of these tests raise several concerns about the “holy grail” of defense-in-depth that is so often touted by security professionals. The key question that comes to my mind is: How do enterprises deploy adequate and effective security controls that defend against exploits that are able to circumvent multi-layered defense strategies? Have a look at the report and let me know what you think.

https://www.nsslabs.com/reports/correlation-detection-failures

Migration to IPv6 is Imperative! Or is it?

Compelling Reasons for Developing Countries to Migrate to IPv6

Given that the Internet is now a critical global infrastructure for socio-economic growth and is growing faster in developing countries, there are a number of key rationalizations for IPv6 migration to be accelerated in these nations. A number of these are highlighted below:

1. Many developing countries have made considerable strides in ICT but still trail developed nations as it pertains to Internet access. This ‘digital divide’ can be reduced by extending wireless networking and mobility through the provisioning of a larger address space via IPv6.

2. By expediting the migration of IPv6, governments can deliver enhanced support for public safety networks, as well as reduce the complexity associated with the management of such. These broadband networks better allow emergency services, such as police, fire and emergency medical services, to respond to a wide array of natural, man-made and emerging threats.

3. IPv6 is the ideal platform on which m-Health capabilities can be built. M-Health applications include the application of mobile devices in gathering clinical data, conveyance of health-related data to medical practitioners, researchers, and patients, real-time patient monitoring systems, and remote home care by means of mobile telemedicine.

4. The underlying protocol for smart grid technology is preferably IPv6. Smart grid computing provides monitoring, analysis, control, increased cyber-security and communication capabilities to electrical delivery systems in order to maximize the throughput of the system while reducing the energy consumption.

5. Mobile banking can substantially improve access to banking products – such as savings, deposits and insurance – for lower income demographics. These services provide ways and means for lower income persons to invest in productive assets, expand their businesses and protect their livelihoods. IPv6 has emerged as the preferred platform and is a core component of the wireless Internet architecture (2G, 3G and beyond).

Despite the obvious developmental potential of IPv6 adoption and pervasive Internet networks, a number of challenges will need to be overcome before the aforementioned benefits can be realized.

Key IPv6 Migration Challenges for Developing Countries

Until now, market pressures and fragmented efforts have largely stalled the progress of IPv6 migrations. Furthermore, the absence of a definitive migration strategy has left many developing countries in the lurch as it pertains to reaping the benefits associated with IPv6. Key challenges impacting developing countries are as follows:

1. In the context of international policymaking for IPv6, it has proven an arduous undertaking for developing countries to provide input and voice their concerns. Increased participation at international multi-stakeholder forums like IGF coupled with the creation of local and regional IG forums will serve to negate this non-productive trend. The rationale is that broadening the dialogue will foster greater awareness and allow for more creative inputs and effective solutions.

2. The governments of many developing nations are not demonstrating the steadfast commitment needed to effectuate the transition to IPv6. Governments in developing countries must lead by example through the announcement and support of IPv6 as a fundamental technology to drive national development and economic growth. They should follow this up by setting a realistic deadline for all public agencies to migrate to IPv6.

3. There is little will to make the IPv6 transition right now because of the economic climate, as well as the cost and complexity for service providers / network operators. Still, I maintain ISPs need to stop patching their networks with Carrier-Grade NATs, Content Delivery Networks and Application Level Gateways, and focus on an open, end-to-end Internet system; one that does not have scarcity as an underlying precept.

4. A lack of effective technical coordination by Regional Internet Registries (RIRs) has retarded IPv6 migrations in general. To reverse this unfortunate situation, RIRs need to stop working in isolation and agree on a methodology for moving forward. If the effort is not collaborative on a global scale, then it is doomed to fail. And finally, RIRs also need to just let the IPv4 addresses run out and stop trying to hoard them and prolong the process. The longer the wait, the more diversion will occur across the different RIRs, and then the entire concept of IPv6 transition will be lost.

Solution to NSA overreach – put people in charge of their own data

“In recent years… the public has mostly yawned over the need for a privacy-data discussion. The zeitgeist has evolved to a point where most people know that their daily activities leave countless digital traces. Data collection is like the rain, it will be there, whether we like it or not. This seems especially true when it comes to fighting terrorism.

According to a June 6-9 survey by the Pew Research Center and The Washington Post, a majority of Americans (56 percent) don’t object to the National Security Agency’s (NSA) broad tracking of phone records to find terrorists, which was exposed earlier this month.”

http://www.csmonitor.com/Commentary/Opinion/2013/0611/Solution-to-NSA-overreach-put-people-in-charge-of-their-own-data?nav=90-csm_category-topStories

SnapChat Allows You to Send Messages and Photos that Quickly Disappear

A sore point for many as it pertains to the big data phenomenon is the fact that the notion of privacy is pretty much just that… a notion. We no longer have any control over our personal data that is aggregated and archived whenever we fill out online forms, post our pics on the web, chat with friends or tweet updates on our lives. Enter Snapchat; a mobile phone app that allows you to send messages and photos that disappear quickly into the ‘ether’. I wonder if there’s a sustainable business model for an application like this, especially given the present Internet culture?

http://www.technologyreview.com/featuredstory/513731/temporary-social-media/

The Social Media Wars: Game of Thrones Style!

I think it is fair to say that social networks have become a lot less friendlier in recent times. It was inevitable that social media giants would abolish the open API’s (application program interfaces) that allowed their users to share content across network. This move is seen as necessary for these companies to increasingly monetize their ads and promoted tweets and posts. But while the walled garden approach by Facebook, Twitter and other networks makes perfect business sense, it largely removes the social aspect of their platforms.

The outcome is a splintered ecosystem; one where the ability to communicate with the entire social media landscape at once has been nullified. One where the bridging of gaps between users and companies, and the creation of dynamic and diverse interactions, no longer exists.

However, as the tensions between social media networks have flared up, a parallel industry has emerged. Disgruntled users and organizations are turning to social media management systems, software tools that provide unfettered access to all the large social networks from a single interface (one such company is HootSuite). At the linked URL, HootSuite illustrates the social media wars by transforming Facebook, Twitter, Google, LinkedIn, YouTube, Pinterest and Tumblr in Game of Thrones houses. Quite entertaining!

http://mashable.com/2013/06/02/social-media-game-of-thrones/#:eyJzIjoiZyIsImkiOiIxMTI1NTg4MzA2NTAzOTg2MzU4NTUifQ

Those Billionaires Were Pretty Slick With Their Crude LIE, And We’re Too Thick To Notice

R-A-P-E is illegal, but P-R-O-F-I-T is simply a five letter word. It’s always interesting to see how many lies will be perpetuated, and how many lives will be destroyed in the name of profit. Big oil has been working its media magic on us for years; allowing us to feel secure about our hyper-consumerism with little afterthought to the far-reaching impacts. This short video concisely touches on the mistruths being peddled around fossil fuels and the energy ‘revolution’ that is hydraulic fracturing (fracking).

http://tinyurl.com/k89adqa

Escape Your Search Engine: An Illustrative Definition of the Filter Bubble

Basically our conundrum is this: As larger numbers of individuals get their news and information from personalized feeds similar to Facebook and Google, the more important content becomes obscured. In this environment of information blitzkrieg that we live in, content about issues like economic crash, energy crises, food security or human rights will be overrun by stupid celebrity news reels, non-sensical viral videos, and other techno-garbage. Breaking out of the filter bubble is key to staying in touch with our common problems and defining applicable solutions. See the the hyperlink below for a more illustrative definition of the filter bubble. Hopefully you’ll recognize the negative impacts of it, and decide to consciously break out!

http://dontbubble.us/

Class of 2013: Your Degree Doesn’t Mean Squat

There’s a compelling sense of entitlement among college graduates as it relates to job seeking. Whether it’s the belief that an Ivy League education guarantees a top tier job in a Fortune 500 firm, or that a 4.0 GPA equates to recruiters overwhelming their Inbox and voicemail with job offers, the “class of 2013” appears to be disconnected from the realities of the 21st century workforce. There appears to be little consideration of developing high-level skills. Somewhere along the line, the need for experience seems to have escaped their lopsided reasoning. In this article, Ilya Pozin (Founder of Ciplex. Columnist for Inc, Forbes & LinkedIn. 30 Under 30 Entrepreneur) provides some advice to workforce neophytes on landing that first gig.

http://tinyurl.com/p4oq935

Cross cultural communication

Different cultural contexts bring new communication obstacles to human interactions. Understanding and appreciating cultural diversity is key to effective communication. Developing awareness of different cultures and tolerance are also important in bridging the cultural divide. Thunderbird University has developed the Cultural Orientation Indicator (COI), a self-assessment tool that helps its students and corporate clients understand their own cultural preferences and the preferences of others. This podcast presents some expert perspectives on cross-cultural communication and the COI. Check it out!

http://knowledgenetwork.thunderbird.edu/podcasts/2009/08/05/coi/