VNS3 Network Platform

Forrester Predicts 2020 as the Year of Edge Computing

According to Network World, a new set of predictions from Forrester Research sets 2020 as the year that “propels edge computing into the enterprise technology limelight for good.” The article suggests that this shift will bring telecom companies into a much more prominent role in the cloud market, especially given the increasing availability of edge computing via 5G infrastructure. Multi-vendor solutions and integrated systems that can leverage this new infrastructure are predicted to be in high demand in the near future.

Edge computing is very similar to the Cloud, Fog and Flood concept Patrick Kerpan described on the CohesiveFT Blog back in 2012. We’ve always believed this was the natural future progression of cloud and distributed computing. We’ll be re-publishing some updated discussions of this and similar insights in the coming weeks, including the Cloud, Fog, and Flood post, so stay tuned!

Google Gets Access to Patient Data via Ascension Deal

The New York Times recently revisited an event earlier this year where Google “signed its biggest cloud computing customer in healthcare to date” with Ascension, in a deal that, according to The Wall Street Journal, allows Google to “collect and crunch the detailed personal-health information of millions of people across 21 states.” Google has promised that patient data “cannot and will not be combined with any Google consumer data” and both parties claim the partnership is in full compliance with HIPAA. Ascension is optimistic that Google’s AI capabilities will allow them to “help improve clinical effectiveness as well as patient safety.”

Microsoft Releases Graphcore AI Chip to Azure Customers

Microsoft recently announced the availability of its new Graphcore AI chip, which promises to better “support the calculations that help machines to recognize faces, understand speech, parse language, drive cars, and train robots.” According to a recent article from Wired, many companies “claim that certain image-processing tasks work many times faster on Graphcore’s chips” and are praising the programmability of the chips. Graphcore plans to increase adoption and usability via their own software framework, Poplar, “which allows existing AI programs to be ported to its hardware.”

Enterprise Cloud Prefers Hybrid-Cloud Deployments

In a recent Yahoo! Finance article , Nutanix, Inc. revealed the results of an Enterprise Cloud Index survey, which suggest that 85% of respondents favored a hybrid-cloud deployment as their ideal operating model. The article highlights some key findings from the report, emphasizing the flexibility and agility offered by hybrid-cloud deployments:

1. Apps are migrating away from the public cloud back to on-premises infrastructures.
2. Security remains the biggest factor impacting enterprises’ future cloud strategies.
3. IT professionals deem the hybrid cloud the most secure of all the IT operating models.
4. Nearly a quarter (23.5%) of respondents currently aren’t leveraging any cloud technology today.
5. Enterprises are striving to integrate cloud computing with their digital transformation goals. Nearly three-quarters (72%) of 2019 respondents said digital transformation was driving their cloud implementations, and 64% said that digital transformation was the top business priority in their organizations.

The report emphasizes that “hybrid cloud will continue to be the best option for enterprises, enabling them to securely meet modernization and agility requirements for workloads.”

AWS re:Invent 2019 is Almost Here!

If you’re as excited as we are for re:Invent 2019 than you’re probably also counting down the days. As 2020 shapes up to be a very impactful year for the cloud, hybrid-cloud, and edge computing, we’re intrigued to see what AWS has in store for all of us. If you are joining us as attendees this year please don’t hesitate to contact us beforehand!

TSA Releases Cloud Strategy 2.0

TSA’s Cloud Strategy 2.0 was released recently, “[calling] for a mix of public and private cloud” to properly deal with both sensitive and transactional data. According to Nextgov: “the most significant principle” of this strategy “requires TSA programs to only purchase agency-approved cloud services.” Although “the document does not provide details on TSA’s preferred procurement strategies,” the document did detail clearance criteria for potential cloud products:

• Its security posture must be certified by the Federal Risk and Authorization Management Program, or FedRAMP
• It must have an open architecture in order to avoid lock-in to a closed set of vendors
• It must be capable of integrating with multiple clouds, platforms, and infrastructures

According to FedScoop, “the agency will first consider software-as-a-service (SaaS) solutions and then infrastructure- and platform-as-a-service alternatives.”

Investigating Worldwide VPN Vulnerabilities

The NCSC published an alert describing “vulnerabilities [that] exist in several SSL VPN products which allow an attacker to retrieve arbitrary files, including those containing authentication credentials.” The alert claims that “an attacker can use these stolen credentials to connect to the VPN and change configuration settings, or connect to further internal infrastructure.” The list of “highest-impact vulnerabilities known to be exploited by APTs” are as follows:

Pulse Connect Secure:

• CVE-2019-11510 : Pre-auth arbitrary file reading
• CVE-2019-11539: Post-auth command injection

Fortinet:

• CVE-2018-13379: Pre-auth arbitrary file reading
• CVE-2018-13382: Allows an unauthenticated attacker to change the password of an SSL VPN web portal user.
• CVE-2018-13383: Post-auth heap overflow. This allows an attacker to gain a shell running on the router.

Palo Alto:

• CVE-2019-1579: Palo Alto Networks GlobalProtect Portal

The NCSC recommends the following steps to “mitigate these vulnerabilities”

1. Apply the latest security patches released by vendors
2. Reset authentication credentials associated with affected VPNs and accounts connecting through them

How Much is Google’s Cloud Really Worth?

Barron’s recently published an article discussing a Deutsche Bank valuation of Google’s Cloud offering. Two Deutsche Bank analysts “place a 15 times revenue multiple on GCP” and “find that the total Google Cloud business is worth about $225 billion.” This valuation is presented in contrast to the market’s current valuation of the Google Cloud business at “zero” and might cause investors to rethink their GOOGL share valuation. The analysts are particularly optimistic about Tom Kurian’s continued positive influence on the success of Google Cloud.

The Cloud-Native and Serverless Future is Now

In an articlewritten for Forbes by Eugene Khazin, Principal and Co-Founder at Prime TSR, calls our attention to the fact that Amazon has “[started] an initiative to re-train 100,000 peopleacross their organization” as a clear sign that “cloud-native and serverless are the future” and the future is now. The article attributes the success of digital transformations to leveraging cloud-native data to “[build] a data-driven culture that includes self-service analytics as part of the company DNA.” This cultural transformation necessitates not only “[training] employees for a new way to build software” but emphasizes the importance of technological, programming, and analytical knowledge in other areas of the business.

AWS re:Invent 2019 Reserved Seating Opens Soon!

Here’s a friendly reminder for those of you joining us at AWS re:Invent 2019 that reserved seating for sessions opens this coming Tuesday, October 15, 2019. As you probably know, sessions tend to fill up pretty quickly so make sure to take a look at the se s sion schedule and pick out your favorites beforehand! If you have any questions about re:Invent, we recommend taking a look at the “ 2019 AWS re:Invent Ultimate Guide ” published by a re:Invent regular from A Cloud Guru. If you are planning to join us at re:Invent this year and would like to meet with our team we encourage you to contact usand let us know!

Feature Release of VNS3 Controller 4.8.0

We are very excited to announce the 4.8.2 release of our VNS3 controller! Version 4.8 includes a new API for dynamically configuring traffic monitoring on VNS3 as well as custom webhook alerts for real-time alerts on your network. Cloud meta-data was integrated to improve security of default passwords and adapter/address discovery. Enhancements were also made to the API system and time access URLs from our 4.6.1 release. This latest version of our VNS3 controller is currently available in the AWSand Azuremarketplaces. Please check out the release notesfor a full list of features and optimizations, and keep an eye out for upcoming feature-focused video briefs!

McAfee Reports Only 1% of Cloud Misconfigurations Are Caught

A recent survey from McAfee “[demonstrates] that 99 percent of IaaS misconfigurations go unnoticed.” The survey of 1,000 enterprise organizations worldwide exposed cloud misconfigurations as the dominant threat to network security. According to Yahoo Finance , “IaaS breaches don’t look like your typical malware incident, instead leveraging native features of cloud infrastructure to land the attack, expand to adjacent cloud instances, and exfiltrate sensitive data.”

According to Yahoo Finance, the key findings of the report are:

• Cloud-Native Breaches are not like the typical malware-based attacks of the past, instead capitalizing on misconfigured, native features of the cloud
• Only one percent of misconfiguration incidents in IaaS are known—companies claim they average 37 per month, when in reality they experience 3,500
• Data loss prevention incidents in IaaS increased 248 percent YoY

In light of this report, TechRepublic suggests the following:

• Build IaaS configuration auditing into your CI/CD process
• Evaluate your IaaS security practice using framework like Land-Expand-Exfiltrate
• Invest in cloud-native security tools, and training for security teams

In both cases, the emphasis here is on increasing communication and understanding relative to this new type of Cloud Native Breaches (CNB) and the potential vulnerabilities created by cloud misconfigurations. Designing a network with as simple (not simplistic) approach to cloud security that is easy to implement and maintain (see VNS3) is essential to avoiding a misconfiguration.

5G Potential for India and Huawei

With the deployment of 5G spectrum-based trials on the horizon for India, The Economic Times released an articlediscussing Huawei’s potential involvement in the project being under renewed scrutiny. Huawei brings “more than 2,500 standard essential patents for 5G” to the table and is “[advocating] to the industry to sign [a] ‘no backdoor’ agreement with the Indian government” as it works to solidify its official participation in the project.

Published on the same day by Forbes is an articlewritten by Andy Purdy, CEO of Huawei Technologies USA, titled “Why 5G Can Be More Secure Than 4G.” The article is optimistic about the security of 5G, reassuring readers that “5G maintains a clear separation between RAN and core” even though “some 5G applications do push computing power to the network edge.”

Department of Defense Embraces Zero Trust Model

The US Department of Defense released an articleurging users to “Assume Networks are Compromised.” The article supports the trend towards implementing a zero trust model as opposed to a “perimeter defense model.” When faced with the reality that “there is no secure system,” microsegmentation of your network can provide a lattice of security within a network that prevents an intruder’s ability to freely traverse a compromised network.

Edge Computing Considerations

In a Forbes articlediscussing edge computing, especially as it relates to the possibilities of 5G networks, Irina Farooq from Kinetica lays out “5 strategies for leveraging edge computing for enterprise applications.” These strategies are: focus on the application use cases, understand your options, make explicit decisions about security, privacy, and governance, develop the right data and machine learning strategy, and be prepared to learn and adapt. The article emphasizes informed, careful, and explicit decision-making when it comes to “[processing] data close to the end user.”

Concerning CapitalOne’s Security Breach

The news about the CapitalOne security breach has been covered media outlets all over from the traditional to the security and tech-focused. AWS and CapitalOne have agreed that this was not the result of a cloud specific issue but a misconfiguration on a web application firewall (WAF). Given the public disclosures by the accused, we have more information on this breach than normal. Social media posts and websites mentioned in the criminal complaint suggest a Server Side Request Forgery (SSRF) was used. While not a new exploit, SSRF is likely to get more attention in the coming days along with AWS Metadata Service and AWS IAM Roles.

AWS Expands into the Middle East

Werner Vogels recently announcedthat AWS has now successfully launched three new Availability Zones in the Middle East (Bahrain), creating new innovation opportunities for all manner of organizations in the region. AWS continues to devote resources towards expanding their network into new regions, with Indonesia, Italy, and South Africa on the radar in the next few years. Significant investments also continue to be made in the education, training, and certification programs. Increased service availability, increased access to training, new use cases and solutions, and new developer insight should prove to fuel some creative innovations in the not-so-distant future.

Airlines Taking off into the Cloud

According to a recent articlefrom ZDNet, ATPCO, the company who “has collected and distributed fare and fare-related data for the airline and travel industry” for more than 50 years, has taken its automation journey to the AWS cloud. When you factor in the more than 1600 data elements the company provides airlines into the equation, the move to the cloud seemed to be the only cost-effective and efficient way to manage, automate, and fully leverage this increasing pool of data. Exposing a new industry to the capabilities of big data, blockchain, machine learning, and real-time data could create some interesting new innovations in pricing and business models for airlines.

Google Brings VMware to Their Cloud

Google continues to follow AWS when improving their cloud offering. In this instance they too are bringing a “VMware in cloud” solution to market. According to Forbes, this VMware solution (powered by CloudSimple) will be available later this year. This move by Google is yet another step in closing the gap between their cloud and others. Slowly but surely Google will look to combine this partnered growth with the addition of new and competitive features within their cloud offering in order to increase service usage and solve new use cases.

Freeing Your Data via Native Cloud Infrastructure

AWS Community Day | Midwest is Coming to Chicago!

Cohesive Networks is excited to be participating in AWS Community Day | Midwest in Chicago this month! The event will feature a keynote on Community & Cloud by Calvin Hendryx-Parker, as well as ‘Lightning Talks’ concerning “Building an HA enterprise search engine on ECS” (Jack Schlederer), “Cloud HSM: Frustration as a Service” (Paul Kuliniewicz), “Running Containers in AWS – Learn about ECS, EKS and Fargate” (Andrew May), and more! If you’re in the midwest we’d love to see you at the event! Click here to register.

Report on Insecure Enterprise IoT Networks

Zscaler released a report on the security of IoT networks finding a shocking 91.5% of traffic to be unencrypted. This of course leaves these networks vulnerable to network sniffing and Man-in-the-middle attacks. IoT adoption and connected device ubiquity is accelerating, in some cases at the expense of following security best practices. Regulation for IoT is looming , with some legislation already proposed. Zscaler recommends the following in securing your IoT networks:

1. Change the default credentials for your connected devices
2. Build network isolation into your IoT networks to prevent lateral traffic between devices, using firewalls to lockdown inbound and outbound traffic
3. Restrict access to IoT devices from external networks and lock down unnecessary ports
4. Apply regular security and firmware updates to your devices and secure your network traffic
5. Deploy a solution to your IoT network for visibility into all IoT devices on the network

Google Network Outage: Jun 02, 19

This past Sunday Google’s Network experienced “ a disruption ” that “caused slow performance and elevated error rates on several Google services, including Google Cloud Platform, YouTube, Gmail, Google Drive and others.” As Google put it , the issue was caused by “a configuration change” that was “incorrectly applied” at a larger scale than intended, limiting various regions’ use of their potential network capacity. The foundation of Google’s resiliency is and has been their ability to learn from these events and successfully automate the prevention of similar events from occurring down the road.

Some takeaways:

1. Build network and permission segmentation into your infrastructure and configuration deployments. Deployments should have temporary access to only the environment resources they need.
2. Monitor expected resource allocations. This level of visibility reduces response time.
3. For enterprises that require high resiliency, failover built with a multi-cloud approach might be required to prevent any downtime.

LabCorp Discloses Further Information on AMCA Breach

In a continuation of the Quest Diagnostics Breach narrative, LabCorp filed this week with the U.S. Securities and Exchange Commission claiming that “personal and financial data on some 7.7 million consumers were exposed by a breach at a third-party billing collections firm” – KrebsonSecurity. This is likely the first of many disclosures by companies similarly impacted by the breach, raising questions about whether or not PCI-DSS regulations were followed or HIPAA laws were broken. The seriousness of the breach is compounded by how long the breach persisted and the fact that it was only discovered by a third-party compliance firm ( Gemini Advisory) and not the AMCA. The AMCA has provided very little info thus far as to where the systems in question are run, whether they’re cloud systems, ‘on-prem’ PaaS, or otherwise.

PSA: Patch Your CISCO Devices