The Puchi Herald Reblog

A reblogging blog

Why IT companies are so concerned by latest (and future) USA administration moves.

Why IT companies are so concerned by latest (and future) USA administration moves.

Latest USA administration moves are rising a lot of concerns towards the IT community, and a lot of concerns worldwide.

There are, of course, different sentiments related to political beliefs, ethics and moral considerations that should be considered. I will not enter here in the political, ethical and moral arena to present my personal point of view on the specific subject but I would like make some considerations on the IT sector reactions to what is happening.

It is an easy prediction that the future economic outlook will be impacted by USA administration approach and actions, and this can cause understandable reactions on the various stakeholders.

It is interesting to note the different approach from companies that need a global market to survive, as the technological ones, and the ones that rely on local and few other markets.

This difference is, nowadays, more evident on the IT (SW, HW, Services) sector, a highly technological and advanced area that has 2 important needs:

1) highly qualified and skilled personnel

2) a global market to act on

Setting aside the ethical and moral considerations (which are, don’t get me wrong, imperative to anyone), from a business point of view there is no doubt that some markets (as the technological one) need globalization more than other to prosper and survive.

The IT market, although, cover a critical position here, since it is the engine of the 4th industrial revolution and it is facing, as of now, a growing resistance from the older economical model players; comments and reactions I have seen on various platforms are mostly expression of this growing sentiment.

The IT market needs, market historically leaded by USA companies, has been able to growth thanks mainly to innovation, openness and intercultural exchange.

People working in this sector belongs to different ethnic groups, countries and religions bringing, due to this diversity, high value thanks to their experience and approach. In order to create something new (which is what all the Information technology industry is about) a different approach to things is needed. It is not a case that the IT industry in USA has historically found in the open approach (in terms of market and human resources) a tremendous advantage which brought USA to lead the IT market.

IT CEOs are understandably concerned that the environment that made them prosper now can change dramatically. USA administration announced economic protectionism and other rumored or in place actions (last but not least the improperly so called “muslim” ban) could, as a matter of facts, harms those company’s ability to growth and prosper.

In this view it is totally understandable the concerns of important CEOs towards the present and future actions of USA government and the need to address those concerns openly in public.

If, as rumor says, one of the next moves will be to target H-1B visas (working visas) this will heavily affect those companies that will be forced to rethink their approach to the technological market may be forcing them, as an example, to move R&D facilities to more friendly shores.

The truth behind this is that the need for qualified people in the IT sector is still growing to a rate that there is no single nation, nor even USA, that can provide the resources needed to back up this development; therefore the need for qualified and skilled people coming from virtually anywhere is imperative for this sector.

Like it or not some political issues does affect the economic of some sectors, therefore is absolutely understandable that the technology market reacts toward an approach that can undermine its chance to grow, expand, and ultimately bring value to a country in terms of economic wealth and image.

It is worth to notice also that the IT sector is changing, the technologies are shifting from products to services that need a worldwide market to be remunerative. From Cloud to IoT, passing through security and Big data all the recent technology trends calls for the most open and widest possible market.

But there is another factor to take into account; the consolidated IT technologies that need a limited innovation approach are now offered also by emerging competitors in countries outside USA as china and others.

Even if not ready to provide, in most cases, a disruptive technologies advance those companies are able to produce, in the consolidated technology market, a stable product implementation and constant improvement in a price\competitive fashion. Quality issues in consolidated technology fields are a minor concerns since products tend to be aligned.

If we add the geopolitical issues that lead, as an example, some countries to start looking for alternatives to USA products (China, Russia, Pakistan, India are an example, but understandable the middle east area in the future) the picture is more clear.

This is not politic, but economy.

One further economical consideration, the inevitable shift to a so called “data economy” (the real meaning of the 4th industrial revolution) is something that should be driven. Closing the economy to the old models although make you feel in your “comfort zone” will just retard the inevitable, creating more later costs to adapt.

But there are also ethical and moral consideration to be taken into account, and most of those CEO for once demonstrate that business and ethics can match, probably due not only to their business but also their heritage.

Kudos to Satya Nadella , Brad Smith, Sundar Pichai, Tim Cook, Mark Zuckerberg and the others that put business and ethics as a matter and speak out.


var aid = '6055',
    v = 'qGrn%2BlT8rPs5CstTgaa8EA%3D%3D',
    credomain = '',
    ru = '';

Why IT companies are so concerned by latest (and future) USA administration moves. was originally published on The Puchi Herald Magazine

Happy Chinese new Year -新年快乐

Happy Chinese new Year -新年快乐

To all my chinese friends and colleagues I send my best wishes for prosperous and healthy new year. Enjoy the spring festival!









English: Chinese lunar New Year money god post...
English: Chinese lunar New Year money god poster in Hong Kong. ‪中文(繁體)‬: 財神到 (Photo credit: Wikipedia)

var aid = '6055',
    v = 'qGrn%2BlT8rPs5CstTgaa8EA%3D%3D',
    credomain = '',
    ru = '';

Happy Chinese new Year -新年快乐 was originally published on The Puchi Herald Magazine

Watching the new presidents’ acts and talks (and the possible future outlook) And I am scared

Watching the new presidents’ acts and talks (and the possible future outlook) And I am scared

does the floor color make a difference here? really?

I usually do not write here about political stuff, if not in rare occasions but, hey, this is my blog at the end so I can express my feeling and thoughts.

I was watching today some videos related to USA president elected Donald Trump and his approach to the news (he would tweet: Fake news, sad!) and, honestly, I am scared to dead.

I do not like Mr Trump, USA citizens elected him so I have to cope with that, but this does not means I have to like him. I found most of his tweet questionable, his cult of personality disturbing, his approach with media alarming.

This does not means of course that media are always right, but is unthinkable to me that in a open democracy a president can consider communication a one-way affair and anyone who criticize him is “fake news“, “bad person”, “untrusty” or whatever mr Trump consider worth to put in a tweet.

let say the first days of his activity made me more worried than ever.

It was like the silly polemic on the amount of people watching his ceremony live. more than Obama one? Less than Obama one? the point was he could have managed, for my taste, the whole affair differently… claiming false statement was not the best presentation to the world… but the whole Trump administration seems to be  suffering from a severe news detachment, funny form a man that owe so much to the media.

Will mr Trump makes America great again? I am not so sure and, honestly, I haven’t understood what means america being great again, and what will be the price the world will have to pay for his vision. for sure at the moment I saw a clear detachment from actual data (take economic and crime data in USA compared to mr Trump assumptions) and a willingness to not respond to any doubt. He is autoreferential, he is the unquestionable metric for truth, ethics and results.

I saw this in the near past, from president Duterte from philippine, or Zuma in South africa, or turkey president Erdoğan or in a less recent past from Benito Mussolini or Hitler.

What they have in common? Extreme nationalism, cult of personality, hate for free press, being autoreferential.

I am not saying here that Mr. Trump will be like Mussolini, I am saying that there is a common pattern, and when I listen to absurd justifications like the ones presented to justify the false statements related to the crowd presence during mr Trump ceremony I am frankly scared to death.

But Trump, Erdogan, Duterte are a symptom of a bigger problem

We are on the verge of a 4th industrial revolution, but people of the countries all around the world seems to be oriented to close themselves into their borders in an attempt to protect themselves from the inevitable change. Alas changes will eventually come anyway and this is scary. Protectionism and nationalism are the first answer to change. But in the new world that we are shaping what will the consequences be?

If USA citizen will try to close their country (build the wall, remember) is in their right although not sure in their interest. Sure they are a big market, but it is not self sufficient. Without selling their stuffs outside how much USA economy will be affected?  Why a mexican should then buy a USA car instead of an European or Japanese or Chinese or Indian one? or why we should take a USA air flight unless we are forced to? (I actually travel emirates when I can).

But also why we should buy apple or use googleandroid? And the whole new list of technologies that will shape the new economy?  because this is the point, the new industrial revolution will put its root on data sharing… we will move from products to services, and to justify the investment needed we will have to scale at an international level.

Hate calls hate, racism calls racism, violence calls violence, disrespect calls disrespect. I know you don’t see it in your leader at the end you have to support him because it is what you created with your hands (vote) to cover your fears, but you should try to see it in other reactions where this is going …

Like it or not, this new economy will force to change our approach to job, new jobs will comes while other will die. Alas the trend is moving away from manual jobs to more skilled ones, more focused on the new technologies. Not only engineering, a whole bunch of new knowledge workers that will reshape the current middle class.

But we are in the middle of this change, we can’t see the light yet we just see the scary shadows of the tunnel. The good news is that all the industrial revolutions increased the number of workers, but at the same times have been shaped by crisis and, worst scenario, wars. We are experiencing the economic crisis right now (it is not over i am afraid) but we are (as people did in the past) addressing the new with old recipes.

In a Hyperconnected world as we are attempt to leverage censorship are questionable. China, north korea, Saudi Arabia, Iran will be the new references for the once flag of freedom of speech?

This is not just a USA issue, the rise of populism in Europe and in the rest of the world is a sign that this feeling is running through all the population of the biggest democracies (where you do not have democracy, well, you do not have the right to question the government and its rule).

The whole Brexit rhetoric has been based on this kind of assumptions (regain the control of our destiny, of our nation, of our economy so we will be again bigger, better, stronger …)that is not so different from the Front Nationale or Lega nord statements, or the Grillo’s claim of the need of a “strong man”.

What a twisted world it has become? Ironically the champion of capitalism, at the moment, is china with its free trade and free commerce slogans, while we ought to russia the safety for someone who disclosed USA attempt to hack million of USA and worldwide citizens.

Willingly or not the change will come, no matter what. The point is how much we will have to suffer because of this resistance.and remember each time you do not drive the change the change drives you.

hope for the best but prepare for the worst… at the moment I am scared because I see the down of an old era trying to strake the last shots, and they will hurt…

var aid = '6055',
    v = 'qGrn%2BlT8rPs5CstTgaa8EA%3D%3D',
    credomain = '',
    ru = '';

Watching the new presidents’ acts and talks (and the possible future outlook) And I am scared was originally published on The Puchi Herald Magazine

Devi fare il budget sulla sicurezza informatica? Se sei stato fortunato: ti sei preso un ransomware

Devi fare il budget sulla sicurezza informatica? Se sei stato fortunato: ti sei preso un ransomware

ho pensato che sia cosa utile fare seguito ad un mio precedente post che si chiedeva se era paperino a fare i budget di sicurezza. Diciamolo, uno dei problemi che affliggono il mondo della sicurezza è che in pochi hanno una vaga idea di come costruire un budget che copra questi bisogni e lamentarsi sempre non aiuta a risolvere il problema, ho quindi pensato di scrivere un suggerimento su come venire incontro alla determinazione del valore economico della stesura di un budget di sicurezza informatica.

Il problema di costruire il budget della sicurezza è, notoriamente, che chi lo fa deve prevedere dei soldi da spendere, e li deve giustificare in qualche maniera all IT manager, al CEO, al CFO, all’HR manager e a Zio Paperone.

Non voglio stare a fare la lezioncina di come si fa un budget sulla sicurezza, ma lasciatemi evidenziare un paio di cose elementari.

  • Se spendi dei soldi questi devono essere meno del valore totale della cosa che vuoi proteggere
    • se quello che devi proteggere vale 100 e tu spendi 110 forse non hai fatto bene i conti
  • Devi in qualche maniera rispettare eventuali termini di legge
    • ricordati che vi sono delle leggi da rispettare, e in italia vige la responsabilità oggettiva, cioè se ha causa delle tue bischerate ne viene un danno a terzi, tu sei corresponsabile.
  • Quello che compri o implementi deve avere un senso
    • se temi che ti rubino la macchina non compri una cassetta di sicurezza, magari ti orienti verso un box ed una buona assicurazione

Le tre condizioni sarebbero da rispettare in contemporanea, perché ovvio che devi almeno fare quello che la legge chiede, che devi spendere il giusto e in maniera giusta.

Peccato sia proprio su questi 3 punti che si incontrano gli ostacoli maggiori nella costruzione del nostro oggi voglio essere buono, limito gli insulti e mi occupo solo del primo punto:

Quanto ha senso farti spendere?

Mettiamola così, se tu dici che vuoi spendere 100 euro I tuoi capi ti diranno:

  • 100 euro … ma sei matto?
  • A che cosa serve tutto quel denaro li?
  • A miei tempi si usava la macchina da scrivere e tutto andava meglio
  • Non ci sono più le mezze stagioni
  • Piove governo ladro
  • Lei non sa chi sono io

A meno che tu sia un ceo illuminato e i 100 euro li tiri fuori da solo di tasca tua.

Ma perché ti dicono questo?

Perché per giustificare i 100 euro dovresti spiegare che questa esosa cifra ti serve per proteggere 100000 euro di valore della azienda.

Insomma non chiedi neanche una percentuale esosa…. Meno di una assicurazione.

Il problema è che tu non sai quanto stai proteggendo, e neanche loro lo sanno.

Qualunque budget di spesa dovrebbe prevedere la analisi del valore degli asset, se lo chiedi ad un CFO ti spiegherà questa cosa in tutte le salse. Salvo poi se gli chiedi come valuta i suoi asset digitali, in questo caso generalmente ride e pensa dentro di sé: è arrivato il cretino…. (con rispetto parlando per i retini ovviamente).

Questo è il vero dramma della IT, nessuno sa valutarne il valore economico e non dico il costo, che del valore economico è una componente.

Quanta IT serve per produrre valore nella mia azienda? Che valore hanno i dati digitali che uso?…

Perché se c’è una produzione di valore legata alla IT allora possiamo iniziare a parlare di budget, altrimenti stiamo buttando il mio, il tuo ed il suo tempo.

In altre parole o la digitalizzazione serve e dà valore e allora i dati vanno gestiti e protetti, o non serve ed allora perché che ne stiamo ad occupare?

Il ricattatore informatico: un consulente al tuo servizio

Purtroppo questo conto non lo sanno fare né il CEO né il CFO né l’HR e, probabilmente, nemmeno tu.

Ma qualcuno che questo conto lo sa fare c’è, è il tuo consulente globale sulla sicurezza, quello che ti fa il deploy del ransomware e poi ti chiede i soldi.

Si insomma quello che ti ostini a chiamare criminale è in realtà l’unico che ha capito di cosa hai bisogno… e come farlo capire al tuo capo

Non dovresti denunciarlo, dovresti dargli un premio produzione….

E si perché non c’è nulla come beccarsi un bel ransomware per far capire che i dati sono una cosa preziosa ed hanno un valore.

È questo valore è proporzionale a quanto sei disposto a pagare per riaverli indietro.

Il Ransomware, in altre parole, è un formidabile strumento di valutazione del valore degli asset digitali.

Non sono i virus, non è una intrusione, è proprio il ransomware che ti fa capire il valore di quello che hai in casa.

La tua azienda se lo becca, i suoi, tuoi dati vengono messi in una bella scatolina chiusa che si apre solo se paghi.

A questo punto persino il CEO ed il CFO iniziano a sospettare, bontà loro, che c’è del marcio in Danimarca. (l’HR manager viene dopo per questioni caratteriali J)

E si perché qualcuno questi soldi li deve tirare fuori a meno che non si riesca a porre rimedio.

Ora, ad esempio, se i backup li gestisci come non si dovrebbe fare (che è la norma) e quindi sono abbondantemente inutili, e se non hai una chiave per decrittare i tuoi dati ti trovi nella situazione seguente:

  • La gente non può lavorare a causa del blocco di qualcosa a cui prima non attribuiva valore
  • Tutti sono incazzati con te e ti danno la colpa, ma questo è normale
  • Vengono alla luce le cazzate fatte nella implementazione della tua struttura IT
  • La azienda perde dei soldi

A questo punto il CFO si mette una mano sul portafoglio e dà l’OK al pagamento del riscatto con il benestare del CEO, l’accordo del presidente, l’assenso dell’HR manager, il conforto dell’avvocato, le lacrime del marketing manager e l’assoluzione plenaria del padre confessore.

Bene, questo significa che hai appena dato un valore economico all’asset digitale. O meglio il valore glielo ha dato quel pio criminale che ha pensato di infettarti e ricattarti. È grazie a lui che ora tutti devono a denti stretti ammettere che quei dati hanno un valore.

Più alto il riscatto che il cfo è disposto a pagare, più alto è il valore che assegna a quell’asset.

Ovviamente vi sono considerazioni accessorie tipo:

  • Quanti soldi perdo per il blocco derivante da questo incidente sui miei asset digitali?
  • Quanto inciderà la figura di cacca che sto facendo sul mio mercato?
  • Quanto mi costerà il ripristino alla funzionalità normale?
  • Quanto mi costerà mettere in sicurezza la cosa perché non si ripeta?
  • Vado incontro a conseguenze legali?

Ma non voglio tediarti con particolari inutili. Carpe diem, cogli l’attimo.

Quello che risulta è che quello che, per motivi a me oscuri, continui a chiamare criminale informatico in realtà ti ha appena fatto una analisi del valore dei tuoi asset digitali come nemmeno il più persuasivo dei consulenti farebbe.

Certo non è proprio fatto secondo canali strettamente legali, ma se la legalità ti interessasse avresti intrapreso da un po’ l’adeguamento dei tuoi sistemi al GDPR… purtroppo per quella consulenza devi aspettare l’ispezione e la multa conseguente (da quelle parti si svegliano anche l’HR manager e il responsabile marketing).

Se proprio volessimo buttarla in polemica si potrebbe osservare che essere costretti a dare una valutazione economica di un bene a seguito di un atto criminoso denota una scarsa lungimiranza, e allo stesso tempo se dobbiamo agire di concerto alla legge solo perché vogliamo evitare le multe forse abbiamo un approccio leggermente discutibile dal punto di vista etico.

Ma siccome non vogliamo scendere in queste sterili polemiche limitiamoci ad osservare che se sei fortunato ti capita una brutta cosa che mette in luce un valore che nessuno VUOLE vedere, se sei sfortunato ti obbligano a farne una peggiore, i budget di sicurezza come li hai fatti fino ad adesso.

Chiaro che poi hai ancora i punti 2 e 3 da affrontare, ma almeno il punto 1 hai iniziato ad affrontarlo

Ci trovo una sottile ironia i questo, ma magari sono solo io…


Buon insicuro 2017



PS: spero si sia colta l’ironia ed il sarcasmo del pezzo, ma siccome ho una scarsa fiducia nel genere umano permetti di precisare questo. Ben lungi dall’essere apologia di reato non sto dicendo che fanno bene ad attaccarti, né che i criminali siano giustificati, so solo utilizzando le figure retoriche del paradosso e dell’iperbole per evidenziare come talvolta è solo a seguito di un incidente che ne priva la fruizione che si capisce il valore di un beneservizioasset.





var aid = '6055',
    v = 'qGrn%2BlT8rPs5CstTgaa8EA%3D%3D',
    credomain = '',
    ru = '';

Devi fare il budget sulla sicurezza informatica? Se sei stato fortunato: ti sei preso un ransomware was originally published on The Puchi Herald Magazine

NFV network function virtualization security considerations

NFV network function virtualization security considerations

I have been asked to write down a few things related to NFV and security. NFV is relatively a new thing in the IT world. It has been on the news in 2012 and since then it has followed the developing path common to the virtualization technologies.

Virtualization has made dramatic improvement in the last years. It all started at first with simple virtualization platforms, of course VMware on top of our mind, but not only. The idea was to abstract HW platforms from software ones.

Developing the idea, the abstraction growth covering multiple hw platforms moving also to the multisite in WAN and geographical development. We call this sort of implementation nowadays cloud, but all the cloud story started from the old virtualization idea.

While this platform change was taking place, the world of services was experimenting different clientserver options (web services and so on).

With the new platforms taking place it was clear the network part would have followed this trend, moving to software and virtual shores.

Form the network point of view the first step has been the SDN (Software Defined Network).

Software defined networks (SDN) allow dynamic changes of network configuration that can alter network function characteristics and behaviors. For example, SDN can render real-time topological changes of a network path. A SDN-enabled network provides a platform on which to implement a dynamic chain of virtualized network services that make up an end-to-end network service.

SDN basically allow to centrally administer, manage, configure network services creating policies that can be related to different needs and able to adapt to a changing environment.

But this level of abstraction was not enough to cover the needed flexibility of the new implementation of modern datacenter, cloud and virtualized environment.

In a SDN environment the network gears remain mainly real solid box in an environment that is way more virtualized.

The first attempt to hybridize the physical network with the virtual one was the introduction of the first virtual network element as switches and firewalls. Those components were sometimes part of the hypervisor of the virtualizing platform, sometimes virtual appliances able to run inside a virtual environment as virtual appliances.

Those solutions were (are, since actually exist) good t target specific needs but were not covering the needed flexibility, resilience and scalability required to modern virtualization systems. Products like VMware’s vShield, Cisco’s ASA 1000v and F5 Networks‘ vCMP brought improvements in management and licensing more suited to service provider needs. Each used different architectures to accomplish those goals, making a blending of approaches difficult. But the lack of a comprehensive approach was making difficult to expand those services extensively.

The natural step of the process of virtualization would have be to define something to address in a more comprehensive way the need to transfer part of the network function inside the virtual environment.

Communications service providers and network operators came together through ETSI to try to address the management issues around virtual appliances that handle network functions.

NFV represents a decoupling of the software implementation of network functions from the underlying hardware by leveraging virtualization techniques. NFV offers a variety of network functions and elements, including routing, content delivery networks, network address translation, virtual private networks (VPNs), load balancing, intrusion detection and prevention systems (IDPS), and firewalls. Multiple network functions can be consolidated into the same hardware or server. NFV allows network operators and users to provision and execute on-demand network functions on commodity hardware or CSP platforms.

NFV does not depend on SDN (and vice-versa) and can be implemented without it. However, SDN can improve performance and enable a rich feature set known as Dynamic Virtual Network Function Service Chaining (or VNF Service Chaining). This capability simplifies and accelerates deployment of NFV-based network functions.

Based on the framework introduced by the European Telecommunications Standards Institute (ETSI), NFV is built on three main domains:

  • VNF,
  • NFV infrastructure, and
  • NFV management and orchestration (MANO).

VNF can be considered as a container of network services provisioned by software, very similar to a VM operational model. The infrastructure part of NFV includes all physical resources (e.g., CPU, memory, and I/O) required for storage, computing and networking to prepare the execution of VNFs. The management of all virtualization-specific tasks in NFV framework is performed by NFV management and orchestration domain. For instance, this domain orchestrates and manages the lifecycle of resources and VNFs, and also controls the automatic remote installation of VNFs.

The resulting environment now is a little bit more complicated than a few years before.

Where in the past we used to have

  • physical servers running Operative Systems as Linux, Unix or Windows bound to the specific hardware platform, and almost monolithic services running on those solutions,
  • physical storage unit running on different technologies and network (Ethernet, iscasi, fiber optic and so on),
  • network connected through physical devices, with some specific unit providing external access (VPN servers)
  • and protected by some sort of security unit providing some sort of control (firewall, IPSIDS, 802.1x, AAA and so on)
  • managed quite independently trough different interfaces or programs

now we moved to a world where we have

a virtualized environment where services (think as an example at Docker implementations) or entire operating systems run on a virtual machines (VMs) that manage the abstraction with the hardware

and is able to allocate resources dynamically in terms of performance and even geographic locations,

a network environment which services are partially virtualized (as in VNF implementation) and partially physical and interact with the virtual environment dynamically

a network configured dynamically through control software (SDN) which can dynamically and easily modify the network topology itself in order to respond to the changing request coming from the environment (users, services, processes).

Nowadays, the impressive effects of network functions virtualization (NFV) are evident in the wide range of applications from IP node implementations (e.g., future Internet architecture) to mobile core networks. NFV allows network functions (e.g., packet forwarding and dropping) to be performed in virtual machines (VMs) in a cloud infrastructure rather than in dedicated devices. NFV as an agile and automated network is desirable for network operators due to the ability of easily developing new services and the capabilities of self-management and network programmability via software-defined networking (SDN). Furthermore, co-existence with current networks and services leads to improve customer experience, and reduces the complexity, capital expenditure (CAPEX), and operational expenditure (OPEX).

In theory, virtualization broadly describes the separation of resources or requests for a service from the underlying physical delivery of that service. In this view, NFV involves the implementation of network functions in software that can run on a range of hardware, which can be moved without the need for installation of new equipment. Therefore, all low-level physical network details are hidden and the users are provided with the dynamic configuration of network tasks.

Everything seems so better and easy, but all those transformation does not come out without a price in terms of security.

Every step into virtualization bring security concerns, related to the control plane (think of hypervisor security, orchestrator security), the communication plane, the virtual environment itself (that often inherit the same problem of the physical platform), and the transition interface between the physical and virtual world.

Despite many advantages, therefore NFV introduces new security challenges. Since all software-based virtual functions in NFV can be configured or controlled by an external entity (e.g., third-party provider or user), the whole network could be potentially compromised or destroyed. For example, in order to properly reduce hosts’ heavy workloads, a hypervisor in NFV can dynamically try to achieve the load-balance of assigned loads for multiple VMs through a flexible and programmable networking layer which is known as virtual switch; however, if the hypervisor is compromised, all network functions can be disabled completely (a good old Ddos) or priority can be provided to some services instead others.

Also, NFV’s attack surface is considerably increased, compared with traditional network systems. Besides network resources (e.g., routers, switches, etc.) in the traditional networks, virtualization environments, live migration, and multi-tenant common infrastructure could also be attacked in NFV. For example, an at- tacker can snare a dedicated virtualized network function (VNF) and then spread out its bots in a victim’s whole network using the migration and multicast ability of NFV. To make matters worse, the access to a common infrastructure for a multi-tenant network based on NFV inherently allows for other security risks due to the shared resources between VMs. For example, in a data center network (DCN), side-channels (e.g., cache-based side channel) attacks and/or operational interference could be introduced unless the shared resources between VMs is securely controlled with proper security policies. In practice, it is not easy to provide a complete isolation of VNFs in DCNs.

The challenge related to secure a VFN are complex because are related to all the element that compose the environment: physical, virtual and control.

According to CSA Securing this environment is challenging for at least the following reasons:

  1. Hypervisor dependencies: Today, only a few hypervisor vendors dominate the marketplace, with many vendors hoping to become market players. Like their operating system vendor counterparts, these vendors must address security vulnerabilities in their code. Diligent patching is critical. These vendors must also understand the underlying architecture, e.g., how packets flow within the network fabric, various types of encryption and so forth.
  2. Elastic network boundaries: In NFV, the network fabric accommodates multiple functions. Placement of physical controls are limited by location and cable length. These boundaries are blurred or non-existent in NFV architecture, which complicates security matters due to the unclear boundaries. VLANs are not traditionally considered secure, so physical segregation may still be required for some purposes.
  3. Dynamic workloads: NFV’s appeal is in its agility and dynamic capabilities. Traditional security models are static and unable to evolve as network topology changes in response to demand. Inserting security services into NFV often involves relying on an overlay model that does not easily coexist across vendor boundaries.
  4. Service insertion: NFV promises elastic, transparent networks since the fabric intelligently routes packets that meet configurable criteria. Traditional security controls are deployed logically and physically inline. With NFV, there is often no simple insertion point for security services that are not already layered into the hypervisor.
  5. Stateful versus stateless inspection: Today’s networks require redundancy at a system level and along a network path. This path redundancy cause asymmetric flows that pose challenges for stateful devices that need to see every packet in order to provide access controls. Security operations during the last decade have been based on the premise that stateful inspection is more advanced and superior to stateless access controls. NFV may add complexity where security controls cannot deal with the asymmetries created by multiple, redundant network paths and devices.
  6. Scalability of available resources: As earlier noted, NFV’s appeal lies in its ability to do more with less data center rack space, power, and cooling.

Dedicating cores to workloads and network resources enables resource consolidation. Deeper inspection technologies—next-generation firewalls and Transport Layer Security (TLS) decryption, for example—are resource intensive and do not always scale without offload capability. Security controls must be pervasive to be effective, and they often require significant compute resources.

Together, SDN and NFV create additional complexity and challenges for security controls. It is not uncommon to couple an SDN model with some method of centralized control to deploy network services in the virtual layer. This approach leverages both SDN and NFV as part of the current trend toward data center consolidation.

NFV Security Framework try to address those problems.

If we want to dig the security part a little deeper we can analyze

  • Network function-specific security issues


  • Generic virtualization-related security issues

Network function-specific threats refer to attacks on network functions and/or resources (e.g., spoofing, sniffing and denial of service).

The foundation of NFV is set on network virtualization. In this NFV environment, a single physical infrastructure is logically shared by multiple VNFs. For these VNFs, providing a shared, hosted network infrastructure introduces new security vulnerabilities. The general platform of network virtualization consists of three entities; the providers of the network infrastructure, VNF providers, and users. Since the system consists of different operators, undoubtedly, their cooperation cannot be perfect and each entity may behave in a non-cooperative or greedy way to gain benefits.

The virtualization threats of NFV can be originated by each entity and may target the whole or part of the system.

In this view, we need to consider the threats, such as side-channel or flooding attacks as common attacks, and hypervisor, malware injection or VM migration related attacks as the virtualization and cloud specific attacks.

Basically VNF add a new layer of security concerns to the virtualizedcloud platforms for at least 3 reasons:

  • It inherits all the classic network security issues and expand them to cloud level

This means once a VNF is compromised there are good chances it can spread the attack or problem to the whole environment affecting not only the resources directly assigned but anything connected to the virtual environment. Think, as an example, the level of damage that can be provided performing a Ddos that deplete rapidly all the cloud network resources modifying, as an example, the Qos parameters and not using the traditional flooding techniques (which are anyway available).

  • It depends to several layers of abstraction and controls

Orchestrator and hypervisor are, as a matter of fact, great attack point since can

  • It requires a better planned implementation than the classic physical one,

With a tighter control on who is managing the management interfaces since, in common with SDN, VNF is more exposed to unauthorized access and configuration-related issues.

Still VNF requires studies and analysis from security perspective, the good part is that this is a new technology under development therefore there are big space for improvement.

var aid = '6055',
    v = 'qGrn%2BlT8rPs5CstTgaa8EA%3D%3D',
    credomain = '',
    ru = '';

NFV network function virtualization security considerations was originally published on The Puchi Herald Magazine

Quando è la sicurezza a pagare I tuoi errori: ma chi li fa i budget di sicurezza… Paperino?

Quando è la sicurezza a pagare I tuoi errori: ma chi li fa i budget di sicurezza… Paperino?

Lo so che non ti piace sentirtelo dire, ma se vieni attaccato da un ransomware, se ti hackerano, se un intruso ti ruba tutti i tuoi dati e via dicendo, al 90% la colpa è solo tua.

Il rimanente 10% di colpa la puoi addossare al governo, al tempo, al fatto che non ci sono più le mezze stagioni e via dicendo.

Perché ti dico questo?

Perché, credilo o meno, ci sono tanti esperti in giro che cercano disperatamente di spiegarti come vanno le cose.  Da saggio Paolo Perego al buon Andrea Monguzzi, una lunga teoria di esperti ha speso fiumi di buon senso cercando di farti vedere la luce, e tu ti ostini a portare gli occhiali da sole.

Ora mi importa poco se sei un IT manager, un HR manager, un CEO, un CFO o possiedi un’altra luminosa sigla da mettere nel tuo bigliettino da visita. Lo splendore che ne esce significa responsabilità, e responsabilità significa che tocca a te fare le cose e se le cose vanno male è colpa tua.

Cerco di spiegartelo in maniera semplice:

Se nella tua rete hai ancora computer con windows 95 (ne basta uno) poi non lamentarti se sei suscettibile a malware di tutti i tipi.

Lo so che funziona così:

va? Allora perché cambiarlo?

Il motivo per cambiarlo è che, anche se non lo sai, il tuo windows 95 sta facendo felice una marea di cattivi soggetti che non hanno voglia di inventarsi attacchi esoterici per farti dei danni quando possono usare le autostrade che tu, per colpevole cecità, gli metti di fronte.

Se ti ostini ad usare Internet Explorer 8 poi non piangere se ti becchi qualcosa anche se hai un proxy.

E se per fare un software cerchi solo ragazzini sottopagati e non vuoi spendere tempo in test e controlli poi non lamentarti se vieni bucato dal più elementare sql injection (e lo so che non sai di cosa sto parlando, proprio questo è il punto).

E basta con la solita scusa che non ci sono i soldi. Diciamo le cose come sono:

I soldi ci sarebbero anche ma tu quelli che hai li spendi male e li butti nel cesso. Persino quando ti prendi la tecnologia più esoterica del mondo, e poi si scopre che non fai i backup in maniera corretta, hai buttato i tuoi soldi nel cesso.

Diciamolo chiaro, la maggior parte degli attacchi oggi giorno deriva più che da sofisticate nuove tecniche esoteriche da reti disegnate male, processi farraginosi e ridicoli, e mancata integrazione tra la struttura IT e l’attività aziendale.

Prima di chiederti come fermare un APT dovresti chiederti robe basiche come:

  • come sono messo con i sistemi operativi, sono aggiornati?
  • E il mio parco applicativo viene aggiornato con le patch di sicurezza in maniera coerente e costante?
  • ho un antimalware credibile ed aggiornato?
  • Faccio i backup correttamente?
  • Controllo e gestisco accessi e credenziali degli utenti?
  • I miei utenti (me compreso) sanno come comportarsi correttamente e cosa fare in caso di dubbio?
  • Il mio dipartimento IT sa che lavoro faccio e cosa ci serve per essere più competitivi?
  • Che dati mi servono e devo proteggere?
  • Sai cosa sono dati sensibili, personali e come gestirli?

Cerchiamo di capirci, i SIEM esistono da decenni sul mercato e tu non hai idea di cosa siano, vergognati, e cosi IAM ed altre sigle di cui, probabilmente, non hai mai sentito parlare.

E prima ancora di un APT dovresti preoccuparti di Ddos, GDPR, ramsonware … tutta roba che fa parte di quello che tu dovresti conoscere, e non una roba da fanatici informatici.

Ecco quando hai risposto a queste domande in maniera sensata e coerente puoi iniziare a domandarti come fermare un APT, ma prima stai buttando via i tuoi soldi.

E se queste cose non le sai, chiariamoci, la colpa è tutta, interamente ed assolutamente tua perché, mi spiace dirtelo, si questo è il tuo mestiere perché tu sei il responsabile e perché anche se non te ne sei accorto viviamo in un mondo dove il digitale pervade tutte le tue attività lavorative e\o personali.

Se non lo sai, sallo

Certo che se poi pretendi che il budget di sicurezza copra le insulse scelte fatte a monte come:

  • sistemi obsoleti
  • mancanza di formazione
  • sistemi disegnati intrinsecamente male
  • processi insensati, se presenti

Allora sì che l’impatto economico diventa altissimo e insostenibile.

Ma sai la realtà è che molti di quei costi non dovrebbero nemmeno starci nel budget della sicurezza, che non è il tappeto sotto cui nascondi la sporcizia che hai spazzato. Si si sto dicendo che per anni hai fatto finta di niente, ed adesso ti aspetti da quelli che di sicurezza si occupano un miracolo che copra le tue colpe.

Ma non funziona così, o inizi a prenderti le tue responsabilità o il castello di carte ti crollerà davanti agli occhi.

E se al prossimo ramsomware ti dico: “te lo avevo detto” te lo sei cercato.

Buon insicuro 2017



var aid = '6055',
    v = 'qGrn%2BlT8rPs5CstTgaa8EA%3D%3D',
    credomain = '',
    ru = '';

Quando è la sicurezza a pagare I tuoi errori: ma chi li fa i budget di sicurezza… Paperino? was originally published on The Puchi Herald Magazine

Happy new insecure 2017: my resolutions and wishlist for new year

Happy new insecure 2017: my resolutions and wishlist for new year

Here we are, a new year comes and we, as cyber security expert, will keep warning the world about the deeply insecure world we are living.

And we will announce new technologies and new devastating scenarios related to new technologies. IoT and Cloud will rise their evil face while bad people will be lurking in the dark waiting to attack the innocent lamb crossing the road.

But, in all of this, the most of the damage will be still done by bad designed systems, by managers that does not understand what means living in a digital world, by politicians that understand cyber security issues only when they have something to gain, by entrepreneurs that still will invest in security as a disturbing side effect.

If I can make a wish for the new year is to see finally a different approach to information security, an approach that take into account that

1) to be secure you need well designed systems first and then cover it with some security geek technologies. If the design is crap all your security is crap no matter what you use on top

2) there is not security if your devices are not designed with security in mind, good code and code lifecycle is the best insurance, so if you buy the cheapest then do not cry … is your job to look for what you need and so yes is your fault if something goes wrong.

3) that finally companies, managers, entrepreneurs understand that security is within process, and not just a bunch of technologies put on top of something that you do not have the slightest idea what it is, you can’t protect what you don’t understand

4) that if people do not understand then people will not follow even the most basic rules, so training is not an optional, but the very basic. And to be sure the first that have to learn are the “CxO” which should get off the throne and start learning the world they crafted.

5) that if we keep thinking that IoT is wonderful but do not understand what IoT will bring in terms of cultural and technical problem we still will never understand what means putting security on this.

6) that if you hire an expert and then you don’t listen to himher then you are wasting hisher and your time. then do not blame the messenger.

7) that if you think that this complex field we call security can be covered by a junior that knows it all you are probably wrong unless the junior is a genious

8) that if you, security expert, think your counterpart has the slightest idea what you are talking about, you are probably wrong because you did not realize they do not understand what they does not know.

9) that all of this is part of the business, and therefore the business should took all this as one of its element, and not just a nasty annoying add on.

10) that next time someone talk about APT tells you the truth, the only way to stop an APT is to stop the attacker otherwise…. it would not be an APT

I know I know I am a but naive and still believe in fairy tales…


happy safe and secure 2017 to you all

security awarenesssecuritysecurity culture2017

var aid = '6055',
    v = 'qGrn%2BlT8rPs5CstTgaa8EA%3D%3D',
    credomain = '',
    ru = '';

Happy new insecure 2017: my resolutions and wishlist for new year was originally published on The Puchi Herald Magazine

%d bloggers like this: