Tag Archives: security

Black Duck Software, Features

Securing Visibility into Open Source Code

Yellow road sign with a blue sky and white clouds: open sourceThe Internet runs on open source code. Linux, Apache Tomcat, OpenSSL, MySQL, Drupal and WordPress are built on open source. Everyone, every day, uses applications that are either open source or include open source code; commercial applications typically have only 65 per cent custom code. Development teams can easily use 100 or more open source libraries, frameworks tools and code snippets, when building an application.

The widespread use of open source code to reduce development times and costs makes application security more challenging. That’s because the bulk of the code contained in any given application is often not written by the team that developed or maintain it. For example, the 10 million lines of code incorporated in the GM Volt’s control systems include open source components. Car manufacturers like GM are increasingly taking an open source approach because it gives them broader control of their software platforms and the ability to tailor features to suit their customers.

Whether for the Internet, the automotive industry, or for any software package, the need for secure open source code has never been greater, but CISOs and the teams they manage are losing visibility into the use of open source during the software development process.

Using open source code is not a problem in itself, but not knowing what open source is being used is dangerous, particularly when many components and libraries contain security flaws. The majority of companies exercise little control over the external code used within their software projects. Even those that do have some form of secure software development lifecycle tend to only apply it to the code they write themselves – 67 per cent of companies do not monitor their open source code for security vulnerabilities.

The Path to Better Code

Development frameworks and newer programming languages make it much easier for developers to avoid introducing common security vulnerabilities such as cross-site scripting and SLQ injection. But developers still need to understand the different types of data an application handles and how to properly protect that data. For example, session IDs are just as sensitive as passwords, but are often not given the same level of attention. Access control is notoriously tricky to implement well, and most developers would benefit from additional training to avoid common mistakes.

Mike

Mike Pittenger, VP of Product Strategy at Black Duck Software

Developers need to fully understand how the latest libraries and components work before using them, so that these elements are integrated and used correctly within their projects. One reason people feel safe using the OpenSSL library and take the quality of its code for granted is its FIPS 140-2 certificate. But in the case of the Heartbleed vulnerability, the Heartbleed protocol is outside the scope of FIPS. Development teams may have read the documentation covering secure use of OpenSSL call functions and routines, but how many realised that the entire codebase was not certified?

Automated testing tools will certainly improve the overall quality of in-house developed code. But CISOs must also ensure the quality of an application’s code sourced from elsewhere, including proper control over the use of open source code.

Maintaining an inventory of third-party code through a spreadsheet simply doesn’t work, particularly with a large, distributed team. For example, the spreadsheet method can’t detect whether a developer has pulled in an old version of an approved component, or added new, unapproved ones. It doesn’t ensure that the relevant security mailing lists are monitored or that someone is checking for new releases, updates, and fixes. Worst of all, it makes it impossible for anyone to get a full sense of an application’s true level of exposure.

Know Your Code

Developing secure software means knowing where the code within an application comes from, that it has been approved, and that the latest updates and fixes have been applied, not just before the application is released, but throughout its supported life.

While using open source code makes business sense for efficiency and cost reasons, open source can undermine security efforts if it isn’t well managed. Given the complexity of today’s applications, the management of the software development lifecycle needs to be automated wherever possible to allow developers to remain agile enough to keep pace, while reducing the introduction and occurrence of security vulnerabilities.

For agile development teams to mitigate security risks from open source software, they must have visibility into the open source components they use, select components without known vulnerabilities, and continually monitor those components throughout the application lifecycle.

Written by Mike Pittenger, VP of Product Strategy at Black Duck Software.

cloud policy, data protection, Free Trade, News & Analysis, Policy and Regulation, Privacy

BSA releases rankings of global cloud policies – UK drops and US rises on leader board

A racehorse and jockey in a horse raceThe BSA | The Software Alliance has released its global ranking of cloud computing policies, assessing the cloud readiness and policies of the world’s 24 leading ICT economies, with the UK dropping down the leader board.

The UK dropped two places in the rankings to ninth, whereas Japan maintained its position at the top of the leader board, and the US improving its position coming in second place. The 24 countries ranked in the research account for roughly 80% of global ICT revenues. Each country is ranked depending on its strengths and weaknesses in seven policy areas; data privacy, security, cybercrime, intellectual property right, support for standards, promotion of free-trade and IT readiness & broadband deployment.

“It’s worrying to see the UK starting to fall behind other faster-moving nations in creating policies which enable cloud innovation,” said Victoria Espinel, CEO of the BSA. “It’s critical for global leading nations like the UK to be on the front-foot in creating robust policy frameworks fit for the digital age to prevent protectionism, so governments, businesses and consumers can benefit from the various benefits cloud computing offers. The report is a wakeup call for all governments to work together to ensure the benefits of the cloud around the globe.”

The UK scored particularly well when it came to intellectual property rights, security and IT readiness, where it ranked fourth, second and first respectively, but badly in the cybercrime valuation, coming in at number 21 out of 24. Within the other areas it hit the middle of the road, and while overall performance was not negative, the UK fell behind due to the speed and efficiency in which other nations are developing their policies.

In the cybercrime section, where the UK was particularly poor, the report highlighted while the UK was in general compatible with the Budapest Convention on Cybercrime, it has not yet implemented laws relating to misuse of devices, as required by Article 6 of the Convention. The report also stated outdated data registration laws are acting as a barrier to some cloud services, as businesses are required to register their data sets with the regulator, which seems to be an unnecessary burden.

Leaderboard

2016 BSA Global Cloud Computing Scorecard – click to enlarge

The US performed favourably across the majority of the ranking categories, particularly on support for industry standards (first), promotion of free trade (first) and IT readiness (third). The US has been recognized by the report as a particular advocate of free trade and harmonization, as well as standardization, as it “continued to remove barriers to international information technology (IT) interoperability”.

Data privacy was the area in which it performed the worst, where it stated there are no single privacy law in the US, as well as numerous policies which have the potential to create a complicated and confusing landscape. Current key sectoral privacy laws include the Federal Trade Commission Act, the Electronic Communications Privacy Act, the Health Insurance Portability and Accountability Act, the Fair Credit Reporting Act and the Telephone Consumer Protection Act.

The report also drew attention to the compatibility between the US with the privacy principles in the EU Data Protection Directive, of which there is little. According to the report “US organizations also have a range of voluntary options to ensure their data protection practices are compatible with the principles in the EU Directive”, though these are not backed up by government policy or legislation. This has been a point of discussion throughout the industry, following Safe Harbour being shot down, and its successor receiving criticism from certain corners of the EU.

Russsia privacy law

Russian Privacy Law – click to enlarge

While the report does outline progress in the development of IT and cloud policies throughout the world, it does also bring attention to several nations who have been demonstrating negative trends. Countries such as China and Russia have implemented policy which could be seen to inhibit the growth of cloud computing within their countries, by limiting the ability of cloud computing service providers to adequately move data across borders.

“The Scorecard shows that countries are eager to welcome cloud computing and its myriad economic benefits, and many of them are creating a favourable regulatory and legal environment,” said Espinel. “Unfortunately, the Scorecard also shows some countries are heading down a path of treating cloud computing as the next frontier of protectionism. The report is a wakeup call for all governments to work together to ensure the benefits of the cloud around the globe.”

Russia for example has implemented a legal requirement that data operators store the personal data of Russian citizens on servers based in Russia, as well as personal data information system (irrelevant of the simplicity of the database) must be certified by the Federal Service for Technical and Export Control (FSTEC). In turn this data can only be used on software and hardware which has also been approved by the FSTEC.

The BSA believes will have a negative impact on the company’s digital economy, stating “The local requirements are not compliant with generally accepted international standards, and Russia does not participate in the Common Criteria Recognition Agreement (CCRA).”

containers, Juniper, News & Analysis

Juniper boosts security capabilities with two new product offerings

Secure cloudJuniper Networks has launched a number of new cloud and virtualised service offerings as part of its software-defined secure networks framework.

The new offerings include a new containerised virtual firewall called cSRX and a multi-core version of the Juniper Networks vSRX. The company claims the new vSRX version is ten times faster than the nearest competitor and creates new possibilities for using agile and flexible virtual firewalls, while cSRX is the first containerized offering for the industry.

“As the security landscape continues to evolve, it is more important than ever to work together to combat cyber threats,” Kevin Walker, Security CTO at Juniper Networks. “These key additions to our security portfolio will further our Software-Defined Secure Networks vision and greatly benefit our customers. Our products provide the best opportunity to create secure networks through policy, detection and enforcement. We are excited to be releasing the most flexible firewall solutions in the market and continue to showcase our commitment to bringing SDSN to organisations across the globe.”

Juniper believes the faster vSRX offering and the scalability of the containerized cSRX, combined with the higher density of services on the Intel Xeon processor family, will increase an organizations capability to detect threats.

“Juniper Networks is delivering significant scale and total cost of ownership advantages to its customers with the new cSRX, which fundamentally changes how security is deployed and illustrates the power of Software-Defined Secure Networks to provide a holistic network protection paradigm,” Mihir Maniar, VP of Security Product Management at Juniper Networks. “Moreover, with the addition of our 100 Gbps vSRX, our security portfolio is further advancing the industry’s highest performing virtual firewall.”

AWS, Data Transfer, News & Analysis, Public Cloud

AWS launches new features at Chicago Summit

amazon awsAmazon Web Services has launched a number of new features, along with the announcement that AWS Import/Export Snowball is now available in four new regions, including Europe.

Speaking at AWS Chicago Summit, the team announced several updates including new security features, tools which simplify the movement of data around an organizations cloud, platforms for automatically deploying and running apps on Amazon’s cloud infrastructure, testing features, as well as authentication services.

Firstly, the AWS Device Farm Update is a feature, initially introduced last June, which enables customers to test mobile apps on real devices. The service is built on the concept of ‘write once, test everywhere’, enabling developers the chance to test apps in more than 200 unique environments (a variety of carriers, manufacturers, models, operating systems etc.). The update now provides customers with remote access to devices for interactive testing.

Writing on the AWS blog, Jeff Barr, Chief Evangelist at Amazon Web Services said, “you simply open a new session on the desired device, wait (generally a minute or two) until the device is available, and then interact with the device via the AWS Management Console. You can gesture, swipe, and interact with devices in real time directly through your web browser as if the device was on your desk or in your hand. This includes installing and running applications.”

Amazon S3 and Snowball, designed to increase speed of the data migration process, also received attention during the event. The AWS Import/Export Snowball was launched for customers who intend to move larger amounts of data, generally 10 terabytes or more, and has now been beefed up once again. New features for S3 make use of the AWS edge infrastructure to increase speed, and Snowball also has larger-capacity as well as now being available in four new regions.

“Many AWS customers are now using AWS Import/Export Snowball to move large amounts of data in and out of the AWS Cloud,” said Barr. “The original Snowball appliances had a capacity of 50 terabytes. Today we are launching a newer appliance with 80 terabytes of capacity.”

Amazon Kinesis, a service which enables users to manage data that is streamed into the cloud, has been updated to allow users to deploy, run, and scale Elasticsearch in the AWS Cloud, as well interaction with Amazon CloudWatch, its monitoring service.

The Cognito service allows apps to add authentication, user management, and data synchronization without having to write backend code or manage any infrastructure. The ‘Your User Pools’ feature update allows developers to build a user directory that can scale to hundreds of millions of users, to help manage the authentication process.

“Using a user pool gives you detailed control over the sign-up and sign-in aspects of your web and mobile SaaS apps, games, and so forth,” said Barr. “Building and running a directory service at scale is not easy, but is definitely undifferentiated heavy lifting, with the added security burden that comes when you are managing user names, passwords, email addresses, and other sensitive pieces of information. You don’t need to build or run your own directory service when you use Cognito Identity.”

Finally, the Elastic Beanstalk, which automatically deploys and runs apps on Amazon’s cloud infrastructure, has also been updated, by adding support for managed platform updates. Developers are now able to select a maintenance window, and the new feature will update the environment to the latest platform version automatically.

“The updates are installed using an immutable deployment model to ensure that no changes are made to the existing environment until the updated replacement instances are available and deemed healthy (according to the health check that you have configured for the application),” said Barr.

Intel, News & Analysis

Only 13% trust public cloud with sensitive data – Intel survey

Solving problems. Business conceptA survey from Intel has highlighted companies are now becoming more trusting of cloud propositions, though public cloud platforms are still not trusted to secure sensitive data.

The Blue Skies Ahead? The State of Cloud Adoption report stated 77% of the respondents believe their company trusts cloud platforms more than 12 months ago, though only 13% would utilize public offerings for sensitive data. 72% point to compliance as the biggest concern with cloud adoption.

“This is a new era for cloud providers,” said Raj Samani, CTO at Intel Security EMEA. “We are at the tipping point of investment and adoption, expanding rapidly as trust in cloud computing and cloud providers grows. As we enter a phase of wide-scale adoption of cloud computing to support critical applications and services, the question of trust within the cloud becomes imperative. This will become integral into realising the benefits cloud computing can truly offer.”

One area of the survey which could be perceived as a concern is only 35% of the respondents believe C-level executives and senior management understand security risks of the cloud. Industry insiders have told BCN that executives are almost using cloud security as a sound-bite to demonstrate to investors that the board prioritizes technology as a means of driving business innovation, though few could be considered technology orientated or competent.

“The key to secure cloud adoption is ensuring sufficient security controls are integrated from the start so the business can maintain their trust in the cloud,” said Samani. “There is a growing awareness amongst the C-suite of the potential consequences of a data breach. Yet IT must take steps to educate senior management further on the enabling capabilities of the cloud, underlining the importance of always keeping security considerations front of mind.”

“Securing the cloud is a top-down process but getting every employee to follow best practice and behave in a secure manner requires company-wide participation. For example, when faced with many of the cloud threats defined by the Cloud Security Alliance (CSA), IT will absolutely require employee support to ensure data remains secure.”

Contemplate. Business concept illustrationFrom an investment perspective, Infrastructure-as-a-Service (IaaS) continues to lead the way with 81% of respondents highlighting their organization is planning to invest in this area. Security-as-a-Service followed closely with 79%, whereas Platform-as-a-Service (PaaS) and Software-as-a-Service (SaaS) accounted for 69% and 60% respectively. The survey also highlighted respondents expect 80% percent of their IT budgets to be dedicated to cloud computing services in the next 16 months.

While the increased trust in cloud platforms is a positive, it would appear in some circumstances it is a case of blind trust. More than a fifth of IT decision makers are not sure whether unauthorized cloud services are being used within the organization and 13% cannot account for what is currently being stored in the cloud. Shadow IT continues to distress IT departments throughout the industry and the most popular means of dealing with it would appear to be database activity monitoring according to 49% of the respondents.

Shadow IT maybe a concern for the vast majority of companies in the journey to cloud security, but it does lead to the question as to whether conquering shadow IT is possible, and whether 100% secure can ever be a realistic goal. “Faced with a rapidly expanding threat landscape, IT should never consider their infrastructure to be 100% secure,” said Samani. “Attack methods are constantly updated: there is no room for complacency. IT departments must ensure they regularly update and check their security measures, undertaking their due diligence to ensure corporate data remains secure.”

The concept of secure IT would appear to be a growing conversation throughout the ranks within enterprise, though the concrete understanding and commitment behind the sound-bites from executives remains unclear. 100% may well be an unattainable goal however until the concept of secure IT is appreciated completely throughout the organization, from top-to-bottom and bottom-to-top, it would appear companies will be unlikely to utilise cloud platforms for any sensitive data.

News & Analysis

Duo security and Teneo introduce new authentication system for employee mobility

Security concept with padlock icon on digital screenDuo security and Teneo have teamed up to create cloud-based two-factor authentication to simplify employee’s access to work networks through their smart phone.

The new system will enable businesses to deploy a one-tap authentication via smartphones rather than using separate ID key fobs. Teneo will provide the Duo cloud solution to customer organisations worldwide as a managed service, with employees simply downloading the Duo Security mobile app to their

“Duo is an easy step to securing corporate access across all users, in any environment,” said Henry Seddon, VP EMEA at Duo Security. “Easy and effective solutions are key to ensuring trusted access across an entire organisation.”

Duo Security’s two-factor authentication solution works across a wide variety of PCs, Macs, laptops and mobile devices as well as Apple iOS, Google Android and Blackberry operating systems, providing a more flexible two-factor network authentication system.

“Duo Security ties in with Teneo’s ethos of bringing to market smarter software offerings that make business-critical tasks like security simpler and intuitive for IT teams and employees alike,” said Marc Sollars, CTO of Teneo. “Even now, many data security set-ups are difficult and represent a kind of rules-based drag on workplace productivity. Duo Security gives forward-thinking customers a simple way to make network access much easier and beef up their overall network security. This ‘one tap’ authentication will become crucial as today’s businesses become ever-more dependent on mobile devices and applications to compete”

Recent research has highlighted to the community that security continues to be an issue for enterprise, as employees would appear to be indifferent to security protocols. As the employees themselves are seemingly one of the greatest threats to the organization, making any security standards as simple as possible would appear to be a sensible strategy in shoring up an organizations perimeter.

Government, Govies 2016, Parallels Remote Application Server, virtual application and desktop delivery, workspace

Parallels RAS Wins Prestigious Govies Security Award

2016 Govies Government Security Awards honor Parallels Remote Application Server as winner of its Platinum Network Security Award The 2016 Government Security Awards (Govies) honored Parallels Remote Application Server as the winner of its Platinum Award for Network Security at the ISC West Expo, the largest security tradeshow in the United States, which is held […]

The post Parallels RAS Wins Prestigious Govies Security Award appeared first on Parallels Blog.

cloud security, IBM, News & Analysis

IBM Security targets incident response marketplace with Resilient acquisition

security monitoring roomIBM Security has completed the acquisition of Resilient, as part of the company’s expansion in the incident response marketplace. Financial terms of the agreement have not been released.

The company had announced its plans to acquire Resilient in February, alongside the launch of its X-Force Incident Response Services. Resilient’s incident response system allows customers to automate and orchestrate the many processes needed when dealing with cyber incidents. The new services include a remote incident response capability to help clients map how a breach occurred and take action to shut it down.

“The combination of Resilient’s people – top thought leaders in the incident response marketplace – and their technology is a differentiating addition to our security business,” said Marc van Zadelhoff, General Manager at IBM Security. “Our investments in threat detection and prevention have helped us move into a leadership position in the security market. With Resilient, we’re expanding the capabilities we bring to customers, helping them manage the complexities in resolving security incidents, including the coordination of teams, best practices, and reporting.”

The company have claimed by combining Resilient Systems’ Incident Response Platform with IBM’s QRadar Security Intelligence Incident Forensics, BigFix, X-Force Exchange and other Incident Response Services, it will be able to offer increased speed in dealing with threats.

IBM has been quietly building its security business over recent years through various acquisitions and company hires. In the last three years, the company has bought a number of security specific vendors including CrossIdeas, Lighthouse Security Group and Trusteer, the latter was rumoured to be around the $1 billion mark. The company now claims to be the largest cloud and cyber security vendor in the market, exceeding $2 billion in revenue and hiring more than 1000 security professionals in 2015, as well as holding than 3,000 security patents.

“The Resilient team is delighted to be joining IBM Security,” said John Bruce, Resilient’s CEO, “Together, we will be a powerful force helping organizations to manage the evolving security challenges that they face. With the scale of IBM research, development and investment behind us, we’re excited about the possibilities for innovation and to engage with new clients around the world.”

Citrix, cloud security, News & Analysis

Employees are biggest security inhibitor – survey

Cybersecurity2A survey from Citrix and Censuswide has revealed employee negligence and indifference to IT policy is one of the most significant inhibitors to cloud security.

Polling around 2000 IT workers, the results showed respondents have a much more stringent approach to security at home than in work, while older younger employees are more likely to ignore company protocols when using devices and platforms.

“This research demonstrates that despite many individuals being well aware of basic precautions for handling their own personal data, too many are not so conscientious at work,” said Chris Mayers, Chief Security Architect at Citrix. “Employers have a responsibility to provide the tools and safeguards: employees need to use them.  Protecting a company’s digital assets is a two way street.”

The survey highlighted specifically that while 45% of workers are likely to use passwords to secure documents at home, this number drops to 35% at work. In terms of shredding and disposing of important documents, 68% would do this at home, whereas only 40% would do it in the work environment.

Despite security being consistently highlighted as a top concern for decision makers and the board, industry insiders have told BCN the company culture, as opposed to the technical challenges, should be more of a priority. The importance of security is underplayed by employees as they do not appreciate the threat of downloading unauthorized software or using public cloud platforms that are not approved by the IT department.

Our sources highlighted that board members in enterprise are focusing their attention on technology to address security challenges, when very little will change if the culture towards security is not altered, and education programmes are not launched.

The survey results also highlighted there is a much more relaxed approach to security from younger generations. Respondents aged over 55 are more likely to only use work devices with trusted company security software, 59%, compared to 47% of those aged between 25 and 34.

hybrid cloud, Information security, Internet of Things Telecoms, IoT, News & Analysis

Hybrid environments and IoT pose biggest threats to infosec – F5

F5 Forum 2Service providers and enterprises face an insecure networking environment in coming years as more applications, data and services are sent to the cloud, according to networking vendor F5, writes Telecoms.com.

Speaking at the F5 Forum in London, VP of UK and Ireland Keith Bird stressed security is now front and centre not only to the CTO and CEO, but to consumers as intrusion or security breaches regularly make headlines. Bird pointed to the hybrid on-premise/cloud-based environment, in which an increasing number of enterprise and service providers operate, as a huge challenge looming for the information security industry.

“Not so long ago, we looked at just single points of entry. In today’s hybrid world, we’ve got apps in the data centre or in the cloud as SaaS and this is only increasing,” he said. “What we know for sure is that there is no longer a perimeter to the network – that’s totally disappeared.”

“81% of people we recently surveyed said they plan on operating in a hybrid environment, while 20% said they’re now moving over half of their corporate applications to the cloud. Even some of the largest companies in the world are taking up to 90% of their applications to the cloud.”

Given the volume and nature of data being hosted in the cloud, firms are far more accountable and held to tighter information security standards today than they have ever been. The average financial impact of an information security breach is now in the region of $7.2 million, according to F5 research.

“The average cost of a security breach consists of $110,000 lost revenue per hour of downtime – but the effect on a company’s website or application is costing potential business,” said Bird. “The average customer will abandon an attempted session after roughly four seconds of inactivity, so there’s new business being lost as well.”

F5 said of the threats it is seeing at the moment, according to customer surveys, the evolving nature and sophistication of attacks ranks highest, with the internal threat of employee ignorance a close second.

“So what are the top security challenges our customers are seeing?” said Bird. “58% are seeing increasingly sophisticated attacks on their networks, from zero-day to zero-second. 52% were concerned that their own employees don’t realise the impact of not following security policies. Obviously plenty of people said they don’t have enough budget, but that’s not quite the biggest problem facing security departments today.”

F5’s Technical Director Gary Newe, who’s responsible for field systems engineering, said the looming prospect of IoT “scares the bejesus” out of him.

“We’ve all heard about the IoT,” he said before pointing to the connected fridge as a farcically insecure IoT device. “There are 3 billion devices which run Java, which makes it 3 million hackable devices, and that scares the bejesus out of me. This isn’t just a potential impact to the enterprise, but it could have a massive impact on consumers and families. Fitness trackers, for example, just encourage people to give a tonne of data over to companies we don’t know about, and we don’t know how good their security is.”

The scariest bit, Newe emphasised, is the growing knowledge and intelligence of more technically adept youngsters today, and how the rate of technological change will only exacerbate the requirement for a fresh approach to network security.

“Change is coming at a pace, the likes of which we’ve never seen nor ever anticipated,” he said. “We’re building big walls around our networks, but hackers are just walking through the legitimate front doors we’re putting in instead.

“The scariest thing is that the OECD [Organisation for Economic Cooperation and Development] has said the average IQ today is 10 points higher than it was 20 years ago. So teenagers today are smarter than we ever were, they’ve got more compute power than we ever had, and they’re bored. That, to me, is terrifying.”