With the holidays upon us, and the weather in Phoenix at that optimal temperature of 50F warmer than wherever people come from, the migration has begun. The snowbirds are back in Phoenix. And all my relatives want to visit. All pretty much at the same time. As I write this I am recovering from 20 contiguous days of four different groups of friends and relatives staying at my home. Overlapping, I might add. And it was glorious – it was great to see each and every one of them – but I heaved a great sigh of relief when the last party got onto a plane and flew back home. I think I have baked, roasted, toasted, and barbecued every type of food I know how to cook. I’ve been a tour guide across the state – twice over – showing off every interesting place within a three-hour drive. Today’s summary is a toast to all of you who survived Thanksgiving – I am thankful for many things, and I am also thankful this holiday is only once a year.
Paul Ford has a thoughtful piece called I Dreamed of a Perfect Database. It nails down the evolutionary track of many of us, who have long straddled the database and software development worlds. As our needs changed there were grass-roots projects to make new types of databases – that did, well, whatever the heck we needed them to do. Cheaper and faster. More data, or maybe more types of data, or maybe a single specific type of data with functions optimized for it. There were some that performed analytics or cube analysis, and some that offered lightning fast in-memory lookups or graph data. We got self-healing, self-organizing, self-indexing clouds of data nodes, with whatever the heck we wanted sitting on top of them. When the Internet boom hit, Oracle was the database of choice. During this last cloudburst we got 250 flavors of NoSQL. But Paul’s dream is getting closer to reality. When you assemble Hadoop with a stack of add on modules, namely Apache Spark, you get pretty close. Want SQL? OK, you can have it. Or MapReduce. Deep analytics or memory-resident lookups. You want it, you can have it.
The point is that the demands on databases will always be in flux. Performance and scalability have always been core needs, but how we want to use data will continue to morph. The current generation of databases, typically based off Hadoop, are veritable Swiss Army knives, to be formed and customized as we need them. There has never been a better time to be a database developer!
If you run a bug bounty program you know there is a lot more to it than Most people consider when they start. Randy Westergren’s post on his experience with the United Airlines Bug Bounty Program offers some insight into what can happen. For example, when multiple researchers find the same critical flaw, the researchers who do not get paid can – and likely will – go public. Sure, this is bad behavior by the researcher. Your legal team can try to stop it, but you need to plan for this situation before it comes up. Second, it is amazing to me that what in-house developers consider a suitably fast release date for vulnerabilities; but it is often totally unacceptable to the research community. Both are developers by nature, but to one party three months is lightning fast. The other considers that criminally dangerous. You’ll need to set expectations going in. United Airlines was communicative, but in today’s world six months to patch is an eternity. Virtual patching techniques, API gateways, and Continuous Deployment techniques allow many organizations to deal with these issues far more quickly. A bug bounty program is a great way to leverage the community of experts to help you find flaws your in-house team might never discover, but you need to have this effort fully planned out before you start.
On to the Summary:
Webcasts, Podcasts, Outside Writing, and Conferences
- Rich quoted on automotive ‘cyber security’
- Gunnar’s Security Champions Guide to Web Application via Akamai.
Other Securosis Posts
- Incite 12/2/2015: Grateful Habits.
- Summary: Boy in the Bubble.
- Cloud Security Best Practice: Limit Blast Radius with Multiple Accounts.
- The Blame Game.
- Summary: Refurbished.
- Critical Security Capabilities for Cloud Providers.
- Massive, Very Bad Java 0-Day (and, Sigh, Oracle).
Favorite Outside Posts
- Adrian Lane: Microsoft’s New Threat Modeling Tool. This post is a couple weeks old but I forgot to mention it. Microsoft added tools to their threat modeling approach to catch errors earlier in the process. We talk about the need to find vulnerabilities earlier in the process, and MS is helping to do just that.
- Mike Rothman: Think Security is Expensive, Insecurity Costs Much More: It’s a hard thing to justify spending on security; this article makes the point that you should do it right the first time. And I’ll even give Tony a pass for mentioning Ponemon. The general point is good.
- Chris Pepper: Man Uses LifeLock To Track Ex-Wife; Company Didn’t Care
Research Reports and Presentations
- Pragmatic Security for Cloud and Hybrid Networks.
- EMV Migration and the Changing Payments Landscape.
- Network-based Threat Detection.
- Applied Threat Intelligence.
- Endpoint Defense: Essential Practices.
- Cracking the Confusion: Encryption and Tokenization for Data Centers, Servers, and Applications.
- Security and Privacy on the Encrypted Network.
- Monitoring the Hybrid Cloud: Evolving to the CloudSOC.
- Security Best Practices for Amazon Web Services.
- Securing Enterprise Applications.
Top News and Posts
- Mozilla’s Improving Revocation: OCSP Must-Staple and Short-lived Certificates
- Mark Cuban slams SEC for blocking email privacy reform effort
- Java 0-day shocker
- VTech Hack
- Seven Tips for Personal Online Security
- DHS Giving Firms Free Penetration Tests
- Worldwide Cryptography Product Survey
- Criminals steal $4 million in cash with novel ‘reverse ATM’ attack