Security

I recently had to go through the mandatory annual training around ethics, security, and handling sensitive data. Like many companies, this training comes in the form of pre-built SCORM courses. I received the following question from KnowBe4, specifically in handling sensitive data. I was going to answer this question by choosing “Find a location with greater privacy and communicate using encrypted messages on a secure connection”. I was so close to clicking the Submit button. Then at the last moment, I changed my mind and chose “Tell the office that for security concerns the call will have to wait until you get to your hotel room.” I clicked the Submit button and waited for the result. ...

This is part 4 in a series of articles. To follow along via code, visit the Github repository. In the last article, I reviewed the template for operational and security risks. Let’s go fix some of them now. Making Unsafe Defaults Safe First, some guard rails are added to the template. Remove the Default attribute from both SSHLocation and HTTPLocation, ensuring that the caller specifies them in the CloudFormation template. That way, if the caller does use 0.0.0.0/0, it is a decision they have made, not the template. ...

This is part 3 in a series of articles. To follow along via code, visit the Github repository. The last article discussed some refactoring use new(-ish) CloudFormation features, which help improve the readability and reduce the template’s file size. This article temporarily moves away from template modifications and focuses on how someone can review a CloudFormation template for security and operational risks. Parameters Let’s start with the Parameters section, because that is going to tell us what dependencies we need to bring into this template from our AWS or organizational environment. ...

This is part 2 in a series of articles. To follow along via code, visit the Github repository. In the last article, I showed how we can improve the operational capabilities of the AlienVault sensor deployment in AWS, simply by adding some automation and formatting changes to the generic CloudFormation template supplied to customers. Let’s further improve the YAML template to make it more readable and less code-heavy by using the newest features of CloudFormation. ...

This is part 1 in a series of articles. To follow along via code, visit the Github repository. I recently needed to review the AlienVault Sensor deployment for AWS and, well, it left me wanting more. Many companies are smart to offer infrastructure-as-code for their appliances. It provides customers with a near one-click deployment model. It also provides customers with insight into what permissions, servers, and resources the appliance will require. The issue with vendor-supplied code is that it needs to apply to a generic customer base; a sort of lowest common denominator scenario where insecure defaults are needed to fit various environments and customers with various skill levels. ...

I have just started reading Tribe of Hackers by Marcus Carey (et al). I already love the format of the book. He takes 14 questions and asks them to prominent people in the field of computer security. Before I start reading the book, though, I want to provide my own answers to his questions and then see how they relate to the others in the book. If there is one myth that you could debunk in cybersecurity, what would it be? I find the biggest myth about computer security is that it is somehow so mysterious and technical that it is difficult to understand. It does often involve deep understanding of computers, but the fundamentals of computer security look very similar to that of traditional security. And with that knowledge, anyone can learn computer security easily by building up their skills from first principles. ...

I am taking the wraps off of my first product ever: Security Awareness for Busy People. Those who know me know that I’m not the type of person to shout my accolades from the rooftops, so this is a bit out of my comfort zone right now. Regardless, I’m proud of my work and I want to share this with the world. Background As I mentioned, this is my first product ever. Throughout my career I have helped other companies build software, maintain secure systems, or train their employees to be better developers/operators/administrators. I have done this as both a full-time employee and as a consultant. I always have these ideas to create products and yet never deliver on them for a couple reasons: ...

A common pattern I see used by Engineering teams when I provide security consulting is them creating Lambda function and hosting their code in their own S3 buckets. This S3 bucket means the Engineering team needs to secure the bucket, which means the following controls are active and maintained: no public S3 access (bucket or object) access logging (logs are sent to yet another bucket!) default encryption of all objects access control and monitoring backups failover region segregation of code written by different departments …and that’s just the start. All of that is tedious and creates security busy-work, not to mention you are still responsible for those code assets. Since AWS is hosting my Lambda function, they can host my code too. Here’s how you do it. ...

A recurring theme in my InfoSec career has been to expose people to how their seemingly-secure practices are actually very insecure. Today I will show one such practice that is quite common. The idea is insidious in that it lulls people into a false sense of security when it takes only a couple minutes to break. This is similar to the security awareness training I provide: I show the audience a physical lock that is heavy and has the words “Secure” engraved in it. Then I show how it can be picked in 8 seconds. Getting over this cognitive barrier – that something isn’t inherently secure just because it looks that way – is tough for people when they first encounter security. ...

At work I recently had to show our risk profile with Github vulnerability alerts and display them in Domo. Github’s APIv3 (REST) doesn’t allow you to query the vulnerability alerts, but APIv4 (GraphQL) does. I found the documentation around gathering those results very opaque due to being in Preview status, so here are some examples for pulling out the data you need. Github Vulnerability Alerts can be enabled in the Settings component of a repository. It will scan the dependencies listed in various package managers (requirements.txt, package.json, etc) and build a dependency graph (super cool!). From there, each dependency is checked for CVEs posted on public vulnerability websites. This is useful information but it is difficult to visualize when you have many (in my case, hundreds) of repositories to watch. ...