|By Lori MacVittie||
|April 15, 2014 08:00 AM EDT||
There are a variety of opinions on the seriousness of Heartbleed being put forth ranging from "it's not the end of the world" to "the sky is falling, duck and cover." Usually the former cites the relatively low percentage of sites impacted by Heartbleed, pegged at about 17% or 500,000 sites by Netcraft. The latter cite the number of consumers impacted, which is a way bigger number to be sure. Sites tracking the impact to users suggest many of the largest sites have potentially been impacted, translating into many millions of users.
And then there’s the impact on gadgets and devices we might not immediately think of being vulnerable. A wide variety of smart phones, IP phones, switches and routers have been identified as being vulnerable. Home internet routers and that nifty system you had put in that lets you mess with your house’s temperature from any device, anywhere are likely impacted. With the Internet of Things connecting more and more devices it’s likely that list will only continue to grow. The growing consensus is that a plurality of the impacted devices will never be updated; leaving organizations that may interact with those devices vulnerable and in need of a mitigating solution that doesn’t rely on updates or changes to the device.
There will be, as everyone scrambles to protect customers and consumers from Heartbleed, a variety of mitigating solutions offered up to address this pesky bug. Network devices will enable organizations with the visibility necessary to detect and reject requests attempting to exploit the vulnerability.
There are a variety of points within the data path where solutions could be put into place to mitigate this (and similar) vulnerabilities. Thus customers must choose the most strategic point in the network at which to deploy their selected mitigation. To choose that point, organizations should ask how the exploit is detected by given solutions. To see why that's needful, consider how the attack works.
How Heartbleed Works
Heartbleed takes advantage of a missing length check in the OpenSSL code handling a relatively innocuous extension to the TSL/SSL protocol (defined in RFC 6520). It comprises two simple messages: a request and a response. The request can be sent be either the client or the server as a means to keep the connection alive. The sender ships off a HeartbeatMessage with a small amount of data, expecting the receiver to send back that same data. What's important about the protocol interaction is that whichever party sends the request determines the length of the response. The sender tells the receiver how much data it's sending - and thus how much should be returned.
Now, the OpenSSL code should be making sure the length the attacker says he's sending is actually what's available. The code, however, does not. It simply trusts the sender and grabs whatever amount of data was specified out of memory. This is how an attacker can access data that's in memory and wind up with all sorts of sensitive data like passwords and private keys.
Because this exploit takes advantage of a vulnerability in encrypted communications, any mitigating solution must be in the path of that communication. That's a given. In that path are three points where this exploit can be mitigated:
1. Client. You can check the client operating system and device type and match that against known usage of the impacted OpenSSL versions. Once detected, the client can be rejected - preventing the offending request from ever being sent in the first place. Rejection of clients based on the possibility they might be an attacker can result in angry legitimate consumers, employees or partners, however.
2. On Request. Inspect client requests and upon discovery of a HeartbeatMessage, reject it. This prevents the request from being forwarding to vulnerable systems and servers.
3. On Response. Inspect responses and upon seeing a HeartbeatMessage response, check its length. If it's greater than a length you feel comfortable with, discard it. This method will prevent attackers from receiving sensitive data, but it should be noted that at the point of discovery, the server - and data - has already been compromised.
Location in the Network Matters
You have to be in communication path to implement these solutions. That means some solutions being put forth are architecturally misplaced to be able to completely mitigate this vulnerability. For example, the firewall landscape is bifurcating and separating inbound (application delivery) and outbound (next generation firewall) duties. That means while next-generation firewalls (NGFW) are capable of the inspection and interaction necessary to detect and mitigate Heartbleed on response, they generally only do so in the outbound use case. That's an important capability, but it won't catch inbound attempts, just outbound. Further complicating the situation is a growing delineation of security responsibilities between inbound and outbound in the firewall market. Growth and scale of security has led to separate inbound and outbound security solutions. NGFW are an outbound solution, generally positioned only as protection for corporate users. They’re intended to protect organizations from malware and malicious code entering the corporate data center by means of its employees accessing infected sites. They aren’t deployed in a position to protect servers and applications on the inbound path. Those that are can provide inbound protection but only on response, which means your servers have already been compromised.
The right place to implement a mitigating solution is one that will afford you the choice of your mitigating solution - or allow all three, if you really want comprehensive coverage. It must be in the data path and have visibility into both the client and the server side of the equation. In most networks, that strategic point of control is the application delivery firewall.
Using the right tool in the right place in the network means you can implement any (or all) of the three mitigating solutions in not only a one place, but in the most effective place. The right tool is not just one that has the right position in the network. It takes visibility and programmability to dig deeply into the network stack and find the data indicative of an attack – intentional or not. The right tool will be able to distinguish between client side and server side traffic and apply the applicable logic. The logic that detects Heartbleed on the client side is different than that of the server side. In the case of the client it must look for a specific message indicating a Heartbeat request or inspecting the client device environment itself. On the server side, it’s checking the size of the response. Each of these cases requires unique code. That means the right tool must have a programmatic environment that can execute with surgical-like precision the logic necessary at the right time – at the time of connection, on request and on response.
The right tool, then, is positioned on the inbound path – in front of vulnerable services – and offers an event-driven, programmatic way to execute the right logic at the right time to detect vulnerable clients, malicious requests and responses carrying unauthorized sensitive data. An F5 ADC offers that event-driven, programmatic interface with iRules and is strategically positioned in the network to support all three mitigation solutions.
Consider again how Heartbleed works and the three mitigation options:
(1) Client. In most network architectures this means it is connecting to an application delivery controller (ADC) that provides load balancing services. When that ADC is F5, it also acts as an application delivery firewall (ADF) and can be programmatically controlled. That means it can inspect the request and, if it's vulnerable, reject the connection.
(2) On Request. Because an ADC sits between the client and server and acts as a proxy, it sees every request and response. It can be programmatically instructed using iRules to inspect those requests and, upon finding a Heartbeat request message, can reject it. It is not necessary to decrypt the request to detect the Heartbeat message.
(3) On Response. As noted, the strategic point of control in which an F5 ADC is deployed in the network means it sees every response, too. It can programmatically inspect responses and if found to be over a specified length, discard it to prevent the attacker from getting a hold of sensitive data.
F5 suggests the "On Request" mitigation for dealing with Heartbleed. This approach minimizes the impact to clients and prevents legitimate requests from being rejected, and further assures that servers are not compromised. Customers have the option, of course, to implement any or all three of these options in order to protect their applications, customers and data as they see fit. F5 supports customer choices in every aspect of application delivery whether related to security, orchestration or architectural model.
At this point, nearly a week after the exposure of Heartbleed, organizations should have a good handle on how it works and what the impact is to their business. There's no question the response to Heartbleed involves server patches and upgrades and the procurement of new keys, with consumer password change processes to come soon thereafter.
In the meantime, servers (and thus customers) remain vulnerable. Organizations should be looking at putting into place a mitigation solution to protect both while longer-term plans are put into action.
No matter which approach you choose, F5 has got you covered.
[Edited: 11:11am PT with new graphic]
Recurring revenue models are great for driving new business in every market sector, but they are complex and need to be effectively managed to maximize profits. How you handle the range of options for pricing, co-terming and proration will ultimately determine the fate of your bottom line. In his session at 15th Cloud Expo, Brendan O'Brien, Co-founder at Aria Systems, session examined: How time impacts recurring revenue How to effectively handle customer plan changes The range of pricing and packaging options to consider
Jan. 28, 2015 09:00 AM EST Reads: 4,148
The Industrial Internet revolution is now underway, enabled by connected machines and billions of devices that communicate and collaborate. The massive amounts of Big Data requiring real-time analysis is flooding legacy IT systems and giving way to cloud environments that can handle the unpredictable workloads. Yet many barriers remain until we can fully realize the opportunities and benefits from the convergence of machines and devices with Big Data and the cloud, including interoperability, data security and privacy.
Jan. 28, 2015 09:00 AM EST Reads: 4,106
Things are being built upon cloud foundations to transform organizations. This CEO Power Panel at 15th Cloud Expo, moderated by Roger Strukhoff, Cloud Expo and @ThingsExpo conference chair, addressed the big issues involving these technologies and, more important, the results they will achieve. Rodney Rogers, chairman and CEO of Virtustream; Brendan O'Brien, co-founder of Aria Systems, Bart Copeland, president and CEO of ActiveState Software; Jim Cowie, chief scientist at Dyn; Dave Wagstaff, VP and chief architect at BSQUARE Corporation; Seth Proctor, CTO of NuoDB, Inc.; and Andris Gailitis, C...
Jan. 28, 2015 09:00 AM EST Reads: 4,110
The 3rd International Internet of @ThingsExpo, co-located with the 16th International Cloud Expo - to be held June 9-11, 2015, at the Javits Center in New York City, NY - announces that its Call for Papers is now open. The Internet of Things (IoT) is the biggest idea since the creation of the Worldwide Web more than 20 years ago.
Jan. 28, 2015 07:00 AM EST Reads: 10,220
Today’s enterprise is being driven by disruptive competitive and human capital requirements to provide enterprise application access through not only desktops, but also mobile devices. To retrofit existing programs across all these devices using traditional programming methods is very costly and time consuming – often prohibitively so. In his session at @ThingsExpo, Jesse Shiah, CEO, President, and Co-Founder of AgilePoint Inc., discussed how you can create applications that run on all mobile devices as well as laptops and desktops using a visual drag-and-drop application – and eForms-buildi...
Jan. 28, 2015 05:00 AM EST Reads: 4,202
The Internet of Things is tied together with a thin strand that is known as time. Coincidentally, at the core of nearly all data analytics is a timestamp. When working with time series data there are a few core principles that everyone should consider, especially across datasets where time is the common boundary. In his session at Internet of @ThingsExpo, Jim Scott, Director of Enterprise Strategy & Architecture at MapR Technologies, discussed single-value, geo-spatial, and log time series data. By focusing on enterprise applications and the data center, he will use OpenTSDB as an example t...
Jan. 28, 2015 02:45 AM EST Reads: 4,713
Scott Jenson leads a project called The Physical Web within the Chrome team at Google. Project members are working to take the scalability and openness of the web and use it to talk to the exponentially exploding range of smart devices. Nearly every company today working on the IoT comes up with the same basic solution: use my server and you'll be fine. But if we really believe there will be trillions of these devices, that just can't scale. We need a system that is open a scalable and by using the URL as a basic building block, we open this up and get the same resilience that the web enjoys.
Jan. 28, 2015 02:00 AM EST Reads: 4,658
Code Halos - aka "digital fingerprints" - are the key organizing principle to understand a) how dumb things become smart and b) how to monetize this dynamic. In his session at @ThingsExpo, Robert Brown, AVP, Center for the Future of Work at Cognizant Technology Solutions, outlined research, analysis and recommendations from his recently published book on this phenomena on the way leading edge organizations like GE and Disney are unlocking the Internet of Things opportunity and what steps your organization should be taking to position itself for the next platform of digital competition.
Jan. 28, 2015 02:00 AM EST Reads: 4,634
SYS-CON Media announced that Splunk, a provider of the leading software platform for real-time Operational Intelligence, has launched an ad campaign on Big Data Journal. Splunk software and cloud services enable organizations to search, monitor, analyze and visualize machine-generated big data coming from websites, applications, servers, networks, sensors and mobile devices. The ads focus on delivering ROI - how improved uptime delivered $6M in annual ROI, improving customer operations by mining large volumes of unstructured data, and how data tracking delivers uptime when it matters most.
Jan. 28, 2015 01:45 AM EST Reads: 5,585
In their session at @ThingsExpo, Shyam Varan Nath, Principal Architect at GE, and Ibrahim Gokcen, who leads GE's advanced IoT analytics, focused on the Internet of Things / Industrial Internet and how to make it operational for business end-users. Learn about the challenges posed by machine and sensor data and how to marry it with enterprise data. They also discussed the tips and tricks to provide the Industrial Internet as an end-user consumable service using Big Data Analytics and Industrial Cloud.
Jan. 28, 2015 01:00 AM EST Reads: 4,338
How do APIs and IoT relate? The answer is not as simple as merely adding an API on top of a dumb device, but rather about understanding the architectural patterns for implementing an IoT fabric. There are typically two or three trends: Exposing the device to a management framework Exposing that management framework to a business centric logic Exposing that business layer and data to end users. This last trend is the IoT stack, which involves a new shift in the separation of what stuff happens, where data lives and where the interface lies. For instance, it's a mix of architectural styles ...
Jan. 28, 2015 12:30 AM EST Reads: 4,700
Almost everyone sees the potential of Internet of Things but how can businesses truly unlock that potential. The key will be in the ability to discover business insight in the midst of an ocean of Big Data generated from billions of embedded devices via Systems of Discover. Businesses will also need to ensure that they can sustain that insight by leveraging the cloud for global reach, scale and elasticity.
Jan. 28, 2015 12:00 AM EST Reads: 5,820
The Internet of Things (IoT) promises to evolve the way the world does business; however, understanding how to apply it to your company can be a mystery. Most people struggle with understanding the potential business uses or tend to get caught up in the technology, resulting in solutions that fail to meet even minimum business goals. In his session at @ThingsExpo, Jesse Shiah, CEO / President / Co-Founder of AgilePoint Inc., showed what is needed to leverage the IoT to transform your business. He discussed opportunities and challenges ahead for the IoT from a market and technical point of vie...
Jan. 27, 2015 06:15 PM EST Reads: 5,381
IoT is still a vague buzzword for many people. In his session at @ThingsExpo, Mike Kavis, Vice President & Principal Cloud Architect at Cloud Technology Partners, discussed the business value of IoT that goes far beyond the general public's perception that IoT is all about wearables and home consumer services. He also discussed how IoT is perceived by investors and how venture capitalist access this space. Other topics discussed were barriers to success, what is new, what is old, and what the future may hold. Mike Kavis is Vice President & Principal Cloud Architect at Cloud Technology Pa...
Jan. 27, 2015 06:15 PM EST Reads: 5,286
The Internet of Things (IoT) is rapidly in the process of breaking from its heretofore relatively obscure enterprise applications (such as plant floor control and supply chain management) and going mainstream into the consumer space. More and more creative folks are interconnecting everyday products such as household items, mobile devices, appliances and cars, and unleashing new and imaginative scenarios. We are seeing a lot of excitement around applications in home automation, personal fitness, and in-car entertainment and this excitement will bleed into other areas. On the commercial side, m...
Jan. 27, 2015 06:00 PM EST Reads: 4,734
Dale Kim is the Director of Industry Solutions at MapR. His background includes a variety of technical and management roles at information technology companies. While his experience includes work with relational databases, much of his career pertains to non-relational data in the areas of search, content management, and NoSQL, and includes senior roles in technical marketing, sales engineering, and support engineering. Dale holds an MBA from Santa Clara University, and a BA in Computer Science from the University of California, Berkeley.
Jan. 27, 2015 06:00 PM EST Reads: 4,991
"People are a lot more knowledgeable about APIs now. There are two types of people who work with APIs - IT people who want to use APIs for something internal and the product managers who want to do something outside APIs for people to connect to them," explained Roberto Medrano, Executive Vice President at SOA Software, in this SYS-CON.tv interview at Cloud Expo, held Nov 4–6, 2014, at the Santa Clara Convention Center in Santa Clara, CA.
Jan. 27, 2015 02:30 PM EST Reads: 4,209
Performance is the intersection of power, agility, control, and choice. If you value performance, and more specifically consistent performance, you need to look beyond simple virtualized compute. Many factors need to be considered to create a truly performant environment. In his General Session at 15th Cloud Expo, Harold Hannon, Sr. Software Architect at SoftLayer, discussed how to take advantage of a multitude of compute options and platform features to make cloud the cornerstone of your online presence.
Jan. 27, 2015 02:15 PM EST Reads: 5,007
An entirely new security model is needed for the Internet of Things, or is it? Can we save some old and tested controls for this new and different environment? In his session at @ThingsExpo, New York's at the Javits Center, Davi Ottenheimer, EMC Senior Director of Trust, reviewed hands-on lessons with IoT devices and reveal a new risk balance you might not expect. Davi Ottenheimer, EMC Senior Director of Trust, has more than nineteen years' experience managing global security operations and assessments, including a decade of leading incident response and digital forensics. He is co-author of t...
Jan. 27, 2015 02:15 PM EST Reads: 4,698
DevOps Summit 2015 New York, co-located with the 16th International Cloud Expo - to be held June 9-11, 2015, at the Javits Center in New York City, NY - announces that it is now accepting Keynote Proposals. The widespread success of cloud computing is driving the DevOps revolution in enterprise IT. Now as never before, development teams must communicate and collaborate in a dynamic, 24/7/365 environment. There is no time to wait for long development cycles that produce software that is obsolete at launch. DevOps may be disruptive, but it is essential.
Jan. 27, 2015 01:15 PM EST Reads: 4,034