Comments on: Cloud Computing Security: (Orchestral) Maneuvers In the Dark? http://www.rationalsurvivability.com/blog/?p=1031 Hoff's Ramblings about Information Survivability, Information Centricity, Risk Management and Disruptive Innovation. Oh, I have a fondness for virtualization and cloud computing security, too... Thu, 09 Sep 2010 02:54:50 +0000 hourly 1 http://wordpress.org/?v=3.0.1 By: The Four Horsemen Of the Virtualization (and Cloud) Security Apocalypse… | Portable Digital Video Recorder http://www.rationalsurvivability.com/blog/?p=1031&cpage=1#comment-45776 The Four Horsemen Of the Virtualization (and Cloud) Security Apocalypse… | Portable Digital Video Recorder Sun, 25 Apr 2010 16:51:25 +0000 http://www.rationalsurvivability.com/blog/?p=1031#comment-45776 [...] Cloud Computing Security: (Orchestral) Maneuvers In the Dark? (rationalsurvivability.com) [...] [...] Cloud Computing Security: (Orchestral) Maneuvers In the Dark? (rationalsurvivability.com) [...]

Like or Dislike: Thumb up 0 Thumb down 0

]]> By: The Four Horsemen Of the Virtualization (and Cloud) Security Apocalypse… | Rational Survivability http://www.rationalsurvivability.com/blog/?p=1031&cpage=1#comment-45768 The Four Horsemen Of the Virtualization (and Cloud) Security Apocalypse… | Rational Survivability Sun, 25 Apr 2010 15:25:08 +0000 http://www.rationalsurvivability.com/blog/?p=1031#comment-45768 [...] Cloud Computing Security: (Orchestral) Maneuvers In the Dark? (rationalsurvivability.com) [...] [...] Cloud Computing Security: (Orchestral) Maneuvers In the Dark? (rationalsurvivability.com) [...]

Like or Dislike: Thumb up 0 Thumb down 0

]]> By: Incomplete Thought: The Other Side Of Cloud – Where The (Wild) Infrastructure Things Are… | Rational Survivability http://www.rationalsurvivability.com/blog/?p=1031&cpage=1#comment-40055 Incomplete Thought: The Other Side Of Cloud – Where The (Wild) Infrastructure Things Are… | Rational Survivability Wed, 10 Mar 2010 01:21:13 +0000 http://www.rationalsurvivability.com/blog/?p=1031#comment-40055 [...] Cloud Computing Security: (Orchestral) Maneuvers In the Dark? (rationalsurvivability.com) [...] [...] Cloud Computing Security: (Orchestral) Maneuvers In the Dark? (rationalsurvivability.com) [...]

Like or Dislike: Thumb up 0 Thumb down 0

]]> By: Comments on the PwC/TSB Debate: The cloud/thin computing will fundamentally change the nature of cyber security… | Rational Survivability http://www.rationalsurvivability.com/blog/?p=1031&cpage=1#comment-38139 Comments on the PwC/TSB Debate: The cloud/thin computing will fundamentally change the nature of cyber security… | Rational Survivability Wed, 17 Feb 2010 04:35:11 +0000 http://www.rationalsurvivability.com/blog/?p=1031#comment-38139 [...] Cloud Computing Security: (Orchestral) Maneuvers In the Dark? (rationalsurvivability.com) [...] [...] Cloud Computing Security: (Orchestral) Maneuvers In the Dark? (rationalsurvivability.com) [...]

Like or Dislike: Thumb up 0 Thumb down 0

]]> By: Roland Dobbins http://www.rationalsurvivability.com/blog/?p=1031&cpage=1#comment-4880 Roland Dobbins Tue, 16 Jun 2009 14:18:30 +0000 http://www.rationalsurvivability.com/blog/?p=1031#comment-4880 <a href="#comment-4877" rel="nofollow">@Roland Dobbins </a> Grrr - no, <a href="http://www.rationalsurvivability.com/blog/?p=815&cpage=1#comment-4875" rel="nofollow">this one</a>. I suck at HTML. ;> @Roland Dobbins

Grrr – no, this one. I suck at HTML.

;>

Like or Dislike: Thumb up 0 Thumb down 0

]]> By: Roland Dobbins http://www.rationalsurvivability.com/blog/?p=1031&cpage=1#comment-4877 Roland Dobbins Tue, 16 Jun 2009 13:59:31 +0000 http://www.rationalsurvivability.com/blog/?p=1031#comment-4877 <a href="#comment-4876" rel="nofollow">@Roland Dobbins </a> The post to which I attemped to link is <a href="http://www.rationalsurvivability.com/blog/?p=815&cpage=1#comment-4875" rel="nofollow">this one</a>. @Roland Dobbins

The post to which I attemped to link is this one.

Like or Dislike: Thumb up 0 Thumb down 0

]]> By: Roland Dobbins http://www.rationalsurvivability.com/blog/?p=1031&cpage=1#comment-4876 Roland Dobbins Tue, 16 Jun 2009 13:58:32 +0000 http://www.rationalsurvivability.com/blog/?p=1031#comment-4876 Moving stuff around dynamically via routing tricks, via DNS tricks (i.e., GSLB-type things), et. al., can and have been done; they can provide some temporary relief in some circumstances, but absolutely, the attackers will note the change and adjust accordingly. See this post for more commentary in this arena: IF-MAP is somewhat interesting, but there are already existing information interchange formats in the control and management planes which aren't being leveraged to their fullest - NetFlow, IPFIX/PSAMP, flow-spec, and even basic techniques making use of BGP such as S/RTBH and QPPB. DNS architecture is a particular sore point, as time and time again DNS ends up being the weak link in the chain, followed by a lack of deployment of even the most basic network infrastructure BCPs such as BCP84 via ACLs/uRPF/QPPB, S/RTBH, iACLs, rACLs, CoPP, et. al. Situational awareness is an area in which huge improvements in network detection/classification/traceback are required; you can't mitigate that which you can't see or understand. NetFlow (and later, IPFIX/PSAMP) telemetry is key to scalable network visibility, and both statistical and behavioral NetFlow-based anomaly-detection are extremely important. [Full disclosure; I work for a company which develops commercial NetFlow-based anomaly-detection systems. That being said, I strongly advocate starting out with open-source tools, moving to commercial tools when additional capabilities are required above and beyond what the open-source tools provide, and after gaining operational experience using open-source tools.] Moving stuff around dynamically via routing tricks, via DNS tricks (i.e., GSLB-type things), et. al., can and have been done; they can provide some temporary relief in some circumstances, but absolutely, the attackers will note the change and adjust accordingly.

See this post for more commentary in this arena:

IF-MAP is somewhat interesting, but there are already existing information interchange formats in the control and management planes which aren’t being leveraged to their fullest – NetFlow, IPFIX/PSAMP, flow-spec, and even basic techniques making use of BGP such as S/RTBH and QPPB. DNS architecture is a particular sore point, as time and time again DNS ends up being the weak link in the chain, followed by a lack of deployment of even the most basic network infrastructure BCPs such as BCP84 via ACLs/uRPF/QPPB, S/RTBH, iACLs, rACLs, CoPP, et. al.

Situational awareness is an area in which huge improvements in network detection/classification/traceback are required; you can’t mitigate that which you can’t see or understand. NetFlow (and later, IPFIX/PSAMP) telemetry is key to scalable network visibility, and both statistical and behavioral NetFlow-based anomaly-detection are extremely important.

[Full disclosure; I work for a company which develops commercial NetFlow-based anomaly-detection systems. That being said, I strongly advocate starting out with open-source tools, moving to commercial tools when additional capabilities are required above and beyond what the open-source tools provide, and after gaining operational experience using open-source tools.]

Like or Dislike: Thumb up 0 Thumb down 0

]]> By: Virtualization Management | UK Not Sold On Cloud Computing | Tek-Tools http://www.rationalsurvivability.com/blog/?p=1031&cpage=1#comment-4841 Virtualization Management | UK Not Sold On Cloud Computing | Tek-Tools Mon, 15 Jun 2009 11:13:06 +0000 http://www.rationalsurvivability.com/blog/?p=1031#comment-4841 [...] Rational Survivability » Cloud Computing Security: (Orchestral … - Last week Kevin L. Jackson wrote an insightful article titled: Cloud Computing: The Dawn of Maneuver Warfare in IT Security. I enjoyed Kevin’s piece but struggled with how I could respond: cheerleader or pundit. … [...] [...] Rational Survivability » Cloud Computing Security: (Orchestral … – Last week Kevin L. Jackson wrote an insightful article titled: Cloud Computing: The Dawn of Maneuver Warfare in IT Security. I enjoyed Kevin’s piece but struggled with how I could respond: cheerleader or pundit. … [...]

Like or Dislike: Thumb up 0 Thumb down 0

]]> By: David O'Berry http://www.rationalsurvivability.com/blog/?p=1031&cpage=1#comment-4833 David O'Berry Mon, 15 Jun 2009 05:28:02 +0000 http://www.rationalsurvivability.com/blog/?p=1031#comment-4833 Great clarification and that thought pattern is an exciting one to me Kevin based on technologies like CUDA/Stream Processing and standards for security data exchange like IF-MAP. I do believe we have to get to that morphing tactical cloud as well as take that concept to the endpoint in many situations to develop an overall enhanced visibility posture thereby increasing the chance at resilience if not outright mitigation. Good stuff. -David Great clarification and that thought pattern is an exciting one to me Kevin based on technologies like CUDA/Stream Processing and standards for security data exchange like IF-MAP. I do believe we have to get to that morphing tactical cloud as well as take that concept to the endpoint in many situations to develop an overall enhanced visibility posture thereby increasing the chance at resilience if not outright mitigation.

Good stuff.

-David

Like or Dislike: Thumb up 0 Thumb down 0

]]> By: Kevin L.Jackson http://www.rationalsurvivability.com/blog/?p=1031&cpage=1#comment-4832 Kevin L.Jackson Mon, 15 Jun 2009 04:51:27 +0000 http://www.rationalsurvivability.com/blog/?p=1031#comment-4832 Excellent! This is just the type of dialog I'd hoped for. I would, however, like to say that my focus is on the use of cloud computing in the DoD, DHS and Intelligence communities. For the foreseeable future, I expect these organization to deploy private clouds where their would be more flexibility in IP addresses, hostnames and communications conduits. Those environment should also have the network visibility required to execute such coordinated actions. I also expect this technology will lead to "tactical clouds" that would link network resources in an adhoc manner in order to increase capabilities for a limited time in a specific geographic area. I am definitely guilty of mixing tenses and will need to watch that the next time. Excellent! This is just the type of dialog I’d hoped for. I would, however, like to say that my focus is on the use of cloud computing in the DoD, DHS and Intelligence communities. For the foreseeable future, I expect these organization to deploy private clouds where their would be more flexibility in IP addresses, hostnames and communications conduits. Those environment should also have the network visibility required to execute such coordinated actions. I also expect this technology will lead to “tactical clouds” that would link network resources in an adhoc manner in order to increase capabilities for a limited time in a specific geographic area. I am definitely guilty of mixing tenses and will need to watch that the next time.

Like or Dislike: Thumb up 0 Thumb down 0

]]> By: beaker http://www.rationalsurvivability.com/blog/?p=1031&cpage=1#comment-4831 beaker Mon, 15 Jun 2009 03:53:10 +0000 http://www.rationalsurvivability.com/blog/?p=1031#comment-4831 <a href="#comment-4830" rel="nofollow">@David O’Berry </a> I enjoy reading Kevin's writings and I am impressed with his networking (human,) especially given his interactions with folks like Vivek Kundra. This is why it's important to ensure the messaging surrounding "Cloud," especially in the federal sector sets the appropriate expectations. With Cyberwar this and funding that, we can and should be spending our time and money on things that have the most bang for the buck. For the most part, as it relates to security -- and even in the realm of Cloud -- that means those boring things Kevin described in the beginning of his article. Cloud doesn't change the need, just the application. /Hoff @David O’Berry

I enjoy reading Kevin’s writings and I am impressed with his networking (human,) especially given his interactions with folks like Vivek Kundra. This is why it’s important to ensure the messaging surrounding “Cloud,” especially in the federal sector sets the appropriate expectations.

With Cyberwar this and funding that, we can and should be spending our time and money on things that have the most bang for the buck. For the most part, as it relates to security — and even in the realm of Cloud — that means those boring things Kevin described in the beginning of his article.

Cloud doesn’t change the need, just the application.

/Hoff

Like or Dislike: Thumb up 0 Thumb down 0

]]> By: David O'Berry http://www.rationalsurvivability.com/blog/?p=1031&cpage=1#comment-4830 David O'Berry Mon, 15 Jun 2009 03:40:58 +0000 http://www.rationalsurvivability.com/blog/?p=1031#comment-4830 I definitely appreciate his enthusiasm but as you point out, I get very worried when someone mixes things up a bit through accidental tense changes or wording and gives a picture like what Mr. Jackson did in that piece. I do believe that eventually you can use virtualization technology to create a silver buckshot approach to security instead of always relying on a serial silver bullet mentality but not in the manner he puts forth. It's possible he is simply talking about overwhelming response to an attack through a brute force means which, while I applaud in theory, is not something we can legitimately even attempt right now without huge distributed bot-net type grids of our own. That simply does not exist in most situations and in fact even were it accurate or feasible to attempt to implement now, most Government organizations are going the opposite way in an attempt to reduce the surface area of attack space. DOS, while noisy and a pain, is probably on the lower end of many folks worries right now as attack vectors go. -David I definitely appreciate his enthusiasm but as you point out, I get very worried when someone mixes things up a bit through accidental tense changes or wording and gives a picture like what Mr. Jackson did in that piece.

I do believe that eventually you can use virtualization technology to create a silver buckshot approach to security instead of always relying on a serial silver bullet mentality but not in the manner he puts forth.

It’s possible he is simply talking about overwhelming response to an attack through a brute force means which, while I applaud in theory, is not something we can legitimately even attempt right now without huge distributed bot-net type grids of our own. That simply does not exist in most situations and in fact even were it accurate or feasible to attempt to implement now, most Government organizations are going the opposite way in an attempt to reduce the surface area of attack space. DOS, while noisy and a pain, is probably on the lower end of many folks worries right now as attack vectors go.

-David

Like or Dislike: Thumb up 0 Thumb down 0

]]> By: Krish http://www.rationalsurvivability.com/blog/?p=1031&cpage=1#comment-4813 Krish Sun, 14 Jun 2009 18:44:30 +0000 http://www.rationalsurvivability.com/blog/?p=1031#comment-4813 When I read Kevin's article, I also thought that moving the resources to deflect attacks was not making sense because the resource will either be attached to an IP address or a hostname or, in some cases, a domain name or subdomain name. Then, I thought I am missing something and shut myself up :-). When I read Kevin’s article, I also thought that moving the resources to deflect attacks was not making sense because the resource will either be attached to an IP address or a hostname or, in some cases, a domain name or subdomain name. Then, I thought I am missing something and shut myself up :-) .

Like or Dislike: Thumb up 0 Thumb down 0

]]>