Akamai Diversity
Home > Web Security

Recently in Web Security Category

What's Your Favorite Security Conference?

I've been participating in an ongoing, online panel hosted by the Information Security Buzz website. The latest question is, "Based on your experience and knowledge, what would you say is the BEST Information Security event to attend and why?"

6 More Great Security Podcasts

Tuesday, I wrote a post about five security podcasts worth your time. This is a sequel post, directing you toward six more great podcasts that'll make you smarter and better informed about all things InfoSec.

Always a rich source of real-time security monitoring, the Sans Internet Storm Center's podcasts offer quick status checks on threats around the Internet. There's the longer ISC Podcast and the shorter, more frequent Stormcast.
Risk Science is a community-driven podcast to promote the greater understanding and applicability of risk management strategy and practices through active research, discussions, and interviews. Along the way we hope that, with our listeners, we can discover the tools and approaches that we can use to tackle the many issues and challenges we will be facing as an industry.
Features Sophos experts and Naked Security writers Chester Wisniewski and Paul Ducklin. It's produced weekly in a quarter-hour format, and gives you an informative and entertaining take on the latest security news.
Hosted by two former federal agents who investigated computer crime, this is a technology podcast covering computer security, crime and forensics topics.
The Hacker News Network Podcast takes a weekly look at the news and views that shape the information security industry and the internet underground. It's hosted by Space Rogue.
A great podcast series that coincides with the annual FIRST conference.
Thumbnail image for Podcast-RSS.jpg

DDoS, as simple as your ABC's

DDoS tool kits, and DDoS-for-hire along with some bitcoins, anonymous email, a TOR connection and a sense of purpose, has made it trivial for individuals, hacktivist collectives and cyber criminals to launch an effective DDoS attack.

6 Security Podcasts Worth Your Time

Though we have our own show called the Akamai Security Podcast and spend a lot of time promoting it in this blog, there are many other security podcasts worth your time. What follows are six favorites.

1.) Liquidmatrix Podcast

Akamai Security Advocate Dave Lewis hosts this podcast with James Arlen, Matt Johansen and Ben Sapiro.

2.) Network Security Podcast

London-based Akamai Security Advocate Martin McKeay hosts one of the longest-running and most popular podcasts in the industry.

3.) Southern Fried Security Podcast

Join Andy Willingham, Martin Fisher, and Steve Ragan as they discuss information security, news, and interview interesting folks. They focus on the operational and leadership aspects of information security using a distinctly southern viewpoint.

4.) Exotic Liability

Chris Nickerson and Ryan Jones tackle a wide range of security topics in this podcast. Here's how they describe it: Exotic Liability will push you into the new generation of Security. On your own or by force, Chris Nickerson and Ryan Jones will be bringing you the best content from the TOP/ middle and Sewers of the Security industry. No more firewall admins speculating about how attacks happen, these are the pros or even the bad guys. These are the people that make Security tick. If you are tired of the old solutions and rhetoric, join in.

5.) PaulDotCom's Security Weekly

Arguably one of the most popular podcasts on the Internet, Paul Asadoorian and crew live stream the show for video as well as audio. Regular guests include Tenable Security's Jack Daniel.

6.) Risky Business Podcast

Patrick Gray takes a "lighthearted" look at information security news and features.


PLXsert Eyes Spike in SNMP Reflection DDoS Attacks

Akamai's Prolexic Security Engineering Response Team (PLXsert) has seen a significant resurgence in the use of Simple Network Management Protocol (SNMP) reflection attacks this past month.

In an advisory, PLXsert said these DDoS attacks abuse the SNMP protocol, which is commonly supported by network devices such as printers, switches, firewalls and routers.

More Bricks of Security Enlightenment

Akamai Security Advocate Dave Lewis (@gattaca on Twitter) continues his prolific blogging on CSOonline. He has also begun writing for Forbes. What follows are his posts so far for May 2014. We begin with his inaugural Forbes column.

Public Research Docs: The List So Far

Akamai InfoSec has slowly been making its security advisories public. What follows is a list of what has been released so far. 

These can be found in the security research section of the Akamai Security microsite.
Despite the time and inconvenience caused to the industry by Heartbleed, its impact does provide some impetus for examining the underlying certificate hierarchy. (As an historical example, in the wake of CA certificate misissuances, the industry looked at one set of flaws: how any one of the many trusted CAs can issue certificates for any site, even if the owner of that site hasn't requested them to do so; that link is also a quick primer on the certificate hierarchy.)
Three years later, one outcome of the uncertainty around Heartbleed - that any certificate on an OpenSSL server *might* have been compromised - is the mass revocation of thousands of otherwise valid certificates.  But, as Adam Langley has pointed out, the revocation process hasn't really worked well for years, and it isn't about to start working any better now.
Revocation is Hard
The core of the problem is that revocation wasn't designed for an epochal event like this; it's never really had the scalability to deal with more than a small number of actively revoked certificates.  The original revocation model was organized around each CA publishing a certificate revocation list (CRL): the list of all non-expired certs the CA would like to revoke.  In theory, a user's browser should download the CRL before trusting the certificate presented to it, and check that the presented certificate isn't on the CRL.  In practice, most don't.  Partly because HTTPS isn't really a standalone protocol: it is the HTTP protocol tunneled over the TLS protocol.  The signaling between these two protocols is limited, and so the revocation check must happen inside the TLS startup, making it a performance challenge for the web, as a browser waits for a CA response before it continues communicating with a web server.
CRLs are a problem not only for the browser, which has to pull the entire CRL when it visits a website, but also for the CA, which has to deliver the entire CRL when a user visits one site.  This led to the development of the online certificate status protocol (OCSP).  OCSP allows a browser to ask a CA "Is this specific cert still good?" and get an answer "That certificate is still good (and you may cache this message for 60 minutes)."  Unfortunately, while OCSP is a huge step forward from CRLs, it still leaves in place the need to not only trust *all* of the possible CAs, but also make a real-time call to one during the initial HTTPS connection.  As Adam notes, the closest thing we have in the near term to operationally "revocable" certs might be OCSP-Must-Staple, in which the OCSP response (signed by the CA) is actually sent to the browser from the HTTPS server alongside the server's certificate.
One Possible Future
A different option entirely might be to move to DANE (DNSSEC Assertion of Named Entities).  In DANE, an enterprise places a record which specifies the exact certificate (or set of certificates, or CA which can issue certificates) which is valid for a  given hostname into its DNS zone file.  This record is then signed with DNSSEC, and a client would then only trust that specific certificate for that hostname. (This is similar to, but slightly more scalable than, Google's certificate pinning initiative.)
DANE puts more trust into the DNSSEC hierarchy, but removes all trust from the CA hierarchy.  That might be the right tradeoff.  Either way, the current system doesn't work and, as Heartbleed has made evident, doesn't meet the web's current or future needs.
(Footnote:  No conversation made herein around Certificate Transparency, or HSTS, both of which are somewhat orthogonal to this problem.)
This entry crossposted at www.csoandy.com.

Web Security Buzz

Each week, we compile a list of headlines trending on social media and distribute it internally via a newsletter called "Web Security Buzz." We recently decided to start running a public version via this blog.

What follows are some of the stories we've been keeping an eye on for the past couple of weeks.

Microsoft's May 2014 Patch Load

Microsoft released it's May 2014 Security Update Tuesday. The latest vulnerabilities to be addressed affect everything from Windows, Internet Explorer and Office to Microsoft Server Software, Productivity Software and the .NET Framework.