Comments on: Mark Masterson’s Brilliant Cloud Security Presentation http://www.rationalsurvivability.com/blog/?p=1010 Hoff's Ramblings about Information Survivability, Information Centricity, Risk Management and Disruptive Innovation. Oh, I have a fondness for virtualization and cloud computing security, too... Thu, 09 Sep 2010 02:54:50 +0000 hourly 1 http://wordpress.org/?v=3.0.1 By: Andrew Hay » Blog Archive » links for 2009-06-12 http://www.rationalsurvivability.com/blog/?p=1010&cpage=1#comment-4710 Andrew Hay » Blog Archive » links for 2009-06-12 Fri, 12 Jun 2009 21:05:05 +0000 http://www.rationalsurvivability.com/blog/?p=1010#comment-4710 [...] Rational Survivability » Mark Masterson’s Brilliant Cloud Security Presentation Chris is right, this is a great presentation. (tags: cloud thinking security) [...] [...] Rational Survivability » Mark Masterson’s Brilliant Cloud Security Presentation Chris is right, this is a great presentation. (tags: cloud thinking security) [...]

Like or Dislike: Thumb up 0 Thumb down 0

]]> By: Gunnar http://www.rationalsurvivability.com/blog/?p=1010&cpage=1#comment-4647 Gunnar Wed, 10 Jun 2009 22:54:52 +0000 http://www.rationalsurvivability.com/blog/?p=1010#comment-4647 My favorite part was "hard problems like federated identity can not be solved with Russellian techniques", federation is likely to be one of the biggest opportunities and threats in the cloud, largely because of naming. Which brings up this: "There are only two hard things in Computer Science: cache invalidation and naming things." -Phil Karlton Also, reminds me of something I remember Dan Geer saying once he got security figured out he would move onto something hard like naming. And finally, "You can't complete authorization in someone else's namespace" -me But federation has been reasonably working well for the last 200 years or so, and so I would not worry too much. My favorite part was “hard problems like federated identity can not be solved with Russellian techniques”, federation is likely to be one of the biggest opportunities and threats in the cloud, largely because of naming. Which brings up this:

“There are only two hard things in Computer Science: cache invalidation and naming things.” -Phil Karlton

Also, reminds me of something I remember Dan Geer saying once he got security figured out he would move onto something hard like naming.

And finally,
“You can’t complete authorization in someone else’s namespace” -me

But federation has been reasonably working well for the last 200 years or so, and so I would not worry too much.

Like or Dislike: Thumb up 0 Thumb down 0

]]> By: Richard Bejtlich http://www.rationalsurvivability.com/blog/?p=1010&cpage=1#comment-4639 Richard Bejtlich Wed, 10 Jun 2009 17:53:03 +0000 http://www.rationalsurvivability.com/blog/?p=1010#comment-4639 Hi Hoff, Take more credit for your work! I didn't see anything special in that presentation. The whole "safe = healthy" idea is hardly novel. Any comparisons to nature fall short because our adversaries are far more intelligent than those in the wild. One other thought: my reaction to the so-called "Healthy" cloud showing multiple data repositories was this -- now I can exploit vulnerabilities or exposures in any one of those three clouds in order to get the same data. Go ahead, add more clouds -- the probability of me find a V or E in the infrastructure as a whole just keeps increasing. By the way, my criticism of the presentation doesn't mean I think 1990s approaches to security are appropriate for the cloud! Hi Hoff,

Take more credit for your work! I didn’t see anything special in that presentation. The whole “safe = healthy” idea is hardly novel. Any comparisons to nature fall short because our adversaries are far more intelligent than those in the wild.

One other thought: my reaction to the so-called “Healthy” cloud showing multiple data repositories was this — now I can exploit vulnerabilities or exposures in any one of those three clouds in order to get the same data. Go ahead, add more clouds — the probability of me find a V or E in the infrastructure as a whole just keeps increasing.

By the way, my criticism of the presentation doesn’t mean I think 1990s approaches to security are appropriate for the cloud!

Like or Dislike: Thumb up 0 Thumb down 0

]]> By: Andreas http://www.rationalsurvivability.com/blog/?p=1010&cpage=1#comment-4637 Andreas Wed, 10 Jun 2009 17:34:42 +0000 http://www.rationalsurvivability.com/blog/?p=1010#comment-4637 This is a great preso indeed. It's interesting how we are moving from a definition of "secure" as a binary variable (like pregnant) to healthy which is really a scalar. A lot of the zombie/botnet stuff is also not as malignant (lower lethality) as stuff in the past. You don't get a BSOD or a corrupted boot block, because after all if the infection kills you then the botnet doesnt make any more money from spamming. See nature: ebola is a crappy virus - it's too lethal for its own good. Flu is the model: exploit and propagate, every season for millenia, without killing too many hosts. This is what the zombies are looking like. In fact, it is amusing to note that today's AV puts a much less subtle load on your CPU that the malware it's chasing! I live with thousands of relatively harmless, symbiotic organisms in my body. If any of them got too strong they would harm me but at low levels I can ignore them. Is that going to be the go-forward model of computer health? Tolerate the mild ones? This is a great preso indeed. It’s interesting how we are moving from a definition of “secure” as a binary variable (like pregnant) to healthy which is really a scalar. A lot of the zombie/botnet stuff is also not as malignant (lower lethality) as stuff in the past. You don’t get a BSOD or a corrupted boot block, because after all if the infection kills you then the botnet doesnt make any more money from spamming. See nature: ebola is a crappy virus – it’s too lethal for its own good. Flu is the model: exploit and propagate, every season for millenia, without killing too many hosts. This is what the zombies are looking like. In fact, it is amusing to note that today’s AV puts a much less subtle load on your CPU that the malware it’s chasing!

I live with thousands of relatively harmless, symbiotic organisms in my body. If any of them got too strong they would harm me but at low levels I can ignore them. Is that going to be the go-forward model of computer health? Tolerate the mild ones?

Like or Dislike: Thumb up 0 Thumb down 0

]]>