STE WILLIAMS

Serverless computing, or function-as-a-service (FaaS), is becoming a hot new trend in the developer world. And it’s easy to understand why: It brings the cloud one step closer to true “utility computing.” With FaaS, developers can deploy code for individual functions on a FaaS platform such as AWS Lambda or Microsoft Azure Functions. This is far faster and more efficient than deploying entire applications, and it also enables true utility computing because organizations pay for only the resources used when functions are executed rather than paying for (and managing) an “always-on” underlying infrastructure, as when deploying applications on traditional cloud platforms.

The benefits of serverless computing (such as cost savings, reduced security overhead, and quicker time-to-release) have caused a dramatic rise in its adoption — which is expected to accelerate in the coming years. The security industry is responding to this new paradigm as it has with all other new paradigms since the beginning of Internet computing: by enumerating the various vulnerabilities and threats made possible by serverless computing, and then proposing a list of technologies to combat those vulnerabilities and threats.

This is what I call an “outside-in” approach to security: where organizations allow external threats and compliance requirements to dictate security strategy and spending. They continually switch their focus to the latest threat “flavor of the week,” and throw money at the problem with new technology.

The problems with this approach are well documented. Today’s bloated and unmanageable technology infrastructures are the direct result of outside-in thinking. Along with the cybersecurity skills shortage and budget limitations, these infrastructures cause gaps due to misconfigurations and mismanagement, which opens the door to security incidents.

Against this backdrop, the biggest risks do not come from serverless computing itself; they come from how organizations respond to serverless adoption. Will they inflame the cost and complexity problem by, yet again, taking an outside-in approach to security? Or will they break this cycle with a different approach?

Security from the Inside Out
Fundamentally, cybersecurity isn’t about threats and vulnerabilities. It’s about business risk. The interesting thing about business risk is that it sits at the core of the organization. It is the risk that results from company operations — whether that risk be legal, regulatory, competitive, or operational. This is why the outside-in approach to cybersecurity has been less than successful: Risk lives at the core of the organization, but cybersecurity strategy and spending has been dictated by factors outside of the organization with little, if any, business risk context. This is why we see organizations devoting too many resources to defend against threats that really aren’t major business risks, and too few to those that are.

To break the cycle of outside-in futility, security organizations need to change their approach, so they align with other enterprise risk management functions. And that approach is to turn outside-in on its head, and take an inside-out approach to cybersecurity.

Inside-out security is not based on the external threat landscape; it’s based on an enterprise risk model that defines and prioritizes the relative business risk presented by organizations’ digital operations and initiatives. This model maps to the enterprise business model and enables security professionals to build security strategy and spend aimed at enabling the business rather than protecting against threats.

With this kind of model in place, the adoption of new platforms, such as serverless computing, does not become a life-altering experience. It’s just a function of extending the enterprise risk model to encompass serverless initiatives, so security professionals can understand the potential business risk those initiatives might represent. Typical questions to answer during this analysis include:

• Do the code functions in the cloud represent a source of business risk? Could they lead to business disruption or compliance violations?
• Can the code be compromised and, if it is, what is the maximum damage that could result?
• Can you approximate the monetary value of each code function deployed in the cloud? If so, how do those values compare with the costs associated with trying to implement security at the code level?

As with all digital initiatives, there will be business risks ranging from severe to low level, which will dictate where security organizations need to concentrate their resources. This will prevent organizations from investing scarce time and money in protecting against the typical list of potential threats coming from the security industry marketing machine, and instead focus only managing enterprise risk.

Understanding Risk from the Inside Out
By adopting an inside-out strategy to cybersecurity, organizations can readily adopt new technologies and platforms without introducing undue risk or imposing outsized burdens on the security organization. Think about it like your house — if you live in a high-crime area, you’d be wise to invest in locks and alarm systems. If you live in rural America, you’re probably better served worrying more about termites than you are burglars.

Yes, it’s possible a random burglar might decide to steal your TV, but it’s not worth investing thousands of dollars in alarm systems to prevent what is realistically unlikely to happen, or low-risk. This may be a simplistic example, but it is accurate in relation to today’s cybersecurity best practices. You should invest in a risk-based, programmatic approach and embed that strategy with orchestration and automation so that you are managing security risk in a way that is constantly evolving with technology, people, and process. Just as you should “shift left” on your security priorities and spend based on the neighborhood in which you live, you should do the same based on the risk appetite for your organization. It’s all a matter of understanding your risk — from the inside out.

Related Content:

• The 2019 State of Cloud Security
• ‘Cattle, Not Pets’ the Rise of Security-as-Code
• Vulnerability Leaves Container Images Without Passwords
• Keys for Working with Modern MSSPs

Joe Vadakkan brings more than 18 years of global infrastructure architecture and security experience, focusing on all aspects of cyber and data security to his role of global practice leader, cloud security, for Optiv. Vadakkan’s expertise in information security and IT … View Full Bio

Article source: https://www.darkreading.com/cloud/serverless-computing-from-the-inside-out-/a/d-id/1334970?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Companies have found that they can expand the logical size of their security teams by recruiting white-hat hackers to find vulnerabilities in their applications and networks. Many of these companies pay a bounty for legitimate discoveries and now there’s a list of the most successful bounty programs that use the HackerOne platform for managing the programs.

According to the report, Verizon Media, Uber, Shopify, PayPal, and Twitter are the top five bounty programs, with Verizon Media leading for all-time bounties paid (more than $4 million) and most hackers thanked (1,124).

PayPal took top honors for largest bounty paid ($30,000) while all the companies in the top five ranked in the top five for various categories of activity.

According to HackerOne, its community of more than 300,000 hackers from around the world have earned more than $42 million in bounties as of the end of 2018.

For more, read here.

Dark Reading’s Quick Hits delivers a brief synopsis and summary of the significance of breaking news events. For more information from the original source of the news item, please follow the link provided in this article. View Full Bio

Article source: https://www.darkreading.com/attacks-breaches/verizon-media-uber-paypal-top-list-of-companies-paying-bug-bounties/d/d-id/1335009?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Mozilla has patched a critical vulnerability under active exploit in the Firefox browser. 

Digital currency exchange Coinbase reported the vulnerability to Mozilla after discovering it in use for targeted attacks. According to the Mozilla advisory, the type confusion vulnerability (CVE-2019-11707) “can occur when manipulating JavaScript objects due to issues in Array.pop. This can allow for an exploitable crash.” 

The researcher who discovered the flaw – Samuel Groß of Google Project Zero and Coinbase Security – stated on Twitter: “The bug can be exploited for RCE but would then need a separate sandbox escape. However, most likely it can also be exploited for UXSS which might be enough depending on the attacker’s goals.”

The vulnerability has been fixed in Firefox 67.0.3 and Firefox ESR 60.7.1. Read more here and here.

Dark Reading’s Quick Hits delivers a brief synopsis and summary of the significance of breaking news events. For more information from the original source of the news item, please follow the link provided in this article. View Full Bio

Article source: https://www.darkreading.com/attacks-breaches/critical-firefox-vuln-used-in-targeted-attacks/d/d-id/1335011?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

The European Union’s General Data Protection Regulation (GDPR) has a provision called “Right of Access,” which states individuals have a right to access their personal data. What happens when companies holding this data don’t properly verify identities before handing it over?

This became the crux of a case study by James Pavur, DPhil student at Oxford University, who sought to determine how organizations handle requests for highly sensitive information under the Right of Access. To do this, he used GDPR Subject Access Requests to obtain as much data as possible about his fiancée – with her permission, of course – from more than 150 companies.

Shortly after GDPR went into effect last May, Pavur became curious about how social engineers might be able to exploit the Right of Access. “It seemed companies were in a panic over how to implement GDPR,” he explains. Out of curiosity he sent a few Subject Access Requests, which individuals can make verbally or in writing to ask for access to their information under GDPR.

In these early requests Pavur only asked for his own data from about 20 companies. He found many didn’t ask for sufficient ID before giving it away. Many asked for extensions – GDPR allows 60 days – before sending it because they didn’t have processes in place to handle requests. The initial survey took place in fall of 2018, when GDPR was just getting into full swing, Pavur says.

Phase two came in January, when he decided to do a broader experiment requesting his fiancée’s information. Over three to four months, Pavur submitted requests to businesses across different sizes and industries to obtain a range of sensitive data, from typical sensitive information like addresses and credit card numbers, to more esoteric data like travel itineraries.

He went into the experiment with three types of data: his fiancée’s full name, an old phone number of hers he found online, and a generic email address ([email protected]). All of these, he notes, are things social engineers could easily find. “The threshold for starting the attack was very low,” he says. “Every success increases the credibility of your results in the future.” Pavur requested her personal data using these initial pieces of information; as companies responded with things he asked for, he could tailor future requests to be better.

“I tried to pretend like I didn’t know much about my fiancée,” he continues. “I tried to make it as realistic as possible … tried to not allow my knowledge about her to bias me.”

Compared to the early stages of his experiment, Pavur found when he requested his fiancée’s information, businesses were better at handling the process. Still, the responses were varied, and there wasn’t a consistent way of responding to Subject Access Requests, he says.

“I sort of expected that companies would try to verify the identity by using something they already know,” he says. For example, he thought they might only accept an email address linked to a registered account. “I thought that was the best mechanism for verifying accounts.”

More than 20 out of 150 companies revealed some sort of sensitive information, he found. Pavur was able to get biographical information, passport number, a history of hotels she stayed at; he was also able to verify whether she had accounts with certain businesses, he notes. The means of verifying his fiancée’s identity varied by industry: retail companies asked what her last purchase was; travel companies and airlines asked for passport information.

Interestingly, some companies started out strong with requests for identity verification, then caved when Pavur said he didn’t feel comfortable providing it. One company asked for a passport number to verify identity; when he refused, they accepted a postmarked envelope. Some businesses improved their verification over time, he adds, but mistakes are still being made: a handful of organizations accidentally deleted his fiancée’s account when asked for data. He points to a need for businesses to feel comfortable denying suspicious GDPR requests.

Pavur will be presenting the details of his case study this August at Black Hat USA in a presentation “GDPArrrrr: Using Privacy Laws to Steal Identities.”

Related Content:

• As Cloud Adoption Grows, DLP Remains Key Challenge
• The Evolution of Identity
• 10 Notable Security Acquisitions of 2019 (So Far)
• 7 Truths About BEC Scams

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance Technology, where she covered financial … View Full Bio

Article source: https://www.darkreading.com/endpoint/with-gdprs-right-of-access-who-really-has-access/d/d-id/1335013?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Nearly three years after the Mirai distributed denial-of-service (DDoS) attacks, the danger to corporate networks from insecure consumer Internet of Things (IoT) devices appears to have grown.

Researchers from Avast Software, in collaboration with researchers from University of Illinois Urbana-Champaign and Stanford University, recently analyzed data from 83 million Internet-connected devices in some 16 million homes globally to better understand how they are deployed, as well as how secure they are. Devices scanned included home routers, game consoles, printers, scanners, home IP cameras, and home automation devices, such as smart thermostats. Computers and phones were excluded from the IoT classification in the study.

The research highlights not only the prevalence of IoT devices, but also their inherent vulnerabilities, says Rajarshi Gupta, vice president and head of AI at Avast. 

According to the study, one-third of the homes has at least one IoT device. In North America, the number is double, at 66%. The research shows that one in four homes in North America have three or more IoT devices, and 9% have six or more.

Media devices, such as smart TVs and streaming devices, are by far the most common IoT devices in a majority of geographies. However, beyond that, the types of IoT devices installed in home networks tend to vary widely by region.

For example, Internet-connected home surveillance equipment is the most common IoT device across several parts of Asia; work appliances, like printers, are more prevalent in Africa; and voice and home assistant devices, such as those from Amazon and Google, are substantially more common in North America than anywhere else.

Security Concerns
Disturbingly, millions of the devices in the Avast study have security weaknesses, such as open services, weak default credentials, and vulnerabilities to known attacks. Millions of devices, for instance, are still using obsolete protocols, such as FTP and Telnet, Gupta says. In some parts of Africa, the Middle East, and Southeast Asia, as many as 50% of IoT devices still support FTP, and nearly 40% of home routers in Central Asia use Telnet.

Open and weak HTTP credentials are another major concern with a significant proportion of routers that Avast and the other researchers analyzed. A small number of home routers in the study host publicly accessible services. But more than half (51.2%) that did also had a recently exploited vulnerability on them.

“Millions of IoT devices today still use obsolete protocols like Telnet and FTP, both of which are known to transfer data in plain text,” Gupta notes. “The security implications of this cannot be overstated, and I’d argue that there is absolutely no reason to be using these protocols in 2019.”

The Mirai malware of 2016, for instance, exploited such weaknesses in IoT products to enable attackers to quickly assemble botnets for launching DDoS attacks. There are other concerns, too. Many IoT products that people use at home are found in work environments as well, especially printers, cameras and TVs, Gupta says.

“If a gadget at home is compromised and that employee unknowingly uses their work laptop on the same Wi-Fi, a cyberattacker can infiltrate the computer, too,” he says.

The Avast-sponsored study shows that despite a large number of branded IoT products around the world, the number of manufacturers is surprisingly small.

“There’s a long tail of more than 14,000 IoT manufacturers globally,” he says. “Yet an overwhelming majority of all devices — 94% — are made by the same 100. Half are made by the same 10.”

This market dominance means the onus for building strong privacy and security postures for IoT products rests with a handful of companies.

“Device manufacturers — at the very least, the top 100 — need to incorporate stronger security principles into their software development process,” Gupta says. Consumers, meanwhile, should consider security controls that can observe traffic at the router-level, identify irregular device behavior, and quarantine malicious network flows or infected devices.

Related Content:

• Insecure IoT Devices Pose Physical Threat to General Public
• Peer-to-Peer Vulnerability Exposes Millions of IoT Devices
• New IoT Security Bill: Third Time’s the Charm?
• 7 Malware Families Ready to Ruin Your IoT’s Day

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year … View Full Bio

Article source: https://www.darkreading.com/iot/insecure-home-iot-devices-a-clear-and-present-danger-to-corporate-security/d/d-id/1335002?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

There’s no better place to see cutting-edge technology exploited than Black Hat USA in Las Vegas this October, where there’s an entire track of talks dedicated to the (in)security of hardware, firmware, and embedded devices.

Moving from Hacking IoT Gadgets to Breaking into One of Europe’s Highest Hotel Suites is a great example; it’s a 50-minute Briefing in which you’ll be shown and taught the tools and methods security researchers used to break the Bluetooth LE-based mobile phone key system of a major hotel chain.

You’ll get a full walkthrough of how the researchers worked out how to wirelessly sniff someone entering their room (or just unlocking the elevator) and then reconstruct the needed data to open the door with any BTLE-enabled PC — or even a Raspberry Pi.

BMW fans and car security enthusiasts are advised to check out 0-days Mitigations: Roadways to Exploit and Secure Connected BMW Cars, another 50-minute Briefing in which speakers from BMW Group and Tencent’s Keen Security Lab will share details of how multiple BMW car models were exploited through physical access and a remote approach — without any owner interaction.

This is a great opportunity to be introduced to the system architecture and external attack surfaces of connected cars, and you’ll also learn details about the vulnerabilities (including multiple 0-days) which existed in two vehicle components: the Infotainment System (a.k.a. Head Unit) and the Telematics Control Unit.

All the 4G Modules Could be Hacked is, as you might expect, a promising Briefing from the Baidu Security Lab about how all the 4G modules built into things like vending machines, cars, and advertising screens can be hacked. Now  that the “Internet of Things” is in vogue, this Briefing is a great way for you to get a comprehensive overview of the hardware structure of IoT modules. You’ll also learn their most common vulnerabilities and see how researchers used them to do things like take control of vehicles by attacking their built-in entertainment systems. Don’t miss it!

More details on these exciting Briefings and many more are available now on the Black Hat USA Briefings page, which is regularly updated with new content as we get closer to the event!

Black Hat USA returns to the Mandalay Bay in Las Vegas August 3-8, 2019. For more information on what’s happening at the event and how to register, check out the Black Hat website.

Article source: https://www.darkreading.com/black-hat/come-to-black-hat-usa-for-the-latest-hardware-hacks/d/d-id/1334999?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple