Perimeter
6/15/2010
11:09 AM
50%
50%

There's A Recipe For That

Back in the dark ages when I was a programmer, I became horribly fascinated with a tool called make. It was a tool for dealing with the complexities of, well, making finished executable code.

Back in the dark ages when I was a programmer, I became horribly fascinated with a tool called make. It was a tool for dealing with the complexities of, well, making finished executable code.The basic unit of executable code in those days (and these days, too, to some extent) was the .exe file, but putting an .exe file together meant compiling source code into object code and then connecting the object code with code libraries containing lots of other bits of object code coming from lots of other source code files. The key point here is that it kept track of dependencies. If something changed in one of the libraries, then it knew enough to know that anything that used those libraries needed to be reconnected with the newer version.

Make didn't know the dependencies by magic, of course. Nor did it know where to copy the various intermediate and final products of the work it initiated. Nor did it do any of the actual work of compiling or linking. You had to tell it all of this stuff by writing it all down in a thing called, none too surprisingly, a "make file."

It was a recipe designed to deal with complexities that were too hard to remember. And there could potentially be a great many complexities. The projects I was working on back in the '90s involved dozens of programmers, hundreds of separate modules, and something on the order of a half million lines of source code written in a few different programming languages.

Pretty much at the exact same time I was getting pretty good at vast and complex make files that relied on other monster make files and so on, the use of make files as a comprehensive solution was being undercut. Rather than linking in objects from libraries and the like, the new paradigm in applications was for the objects to be called up at run time on the system where the application was ultimately deployed. In the case of Windows, what was called up was a Dynamic Link Library, or DLL. In this brave new world, your application had to be smart enough to check whether a given DLL function was the correct version. Microsoft had an amusing propensity for releasing DLLs that had different functionality but the same version number, so the entire exercise had a charming futility about it.

But more to the point, the problem of getting the right versions of things working together at the same time had shifted. It was no longer a programming task that could be handled beforehand by the program developer, but was rather a task that had to be handled by whomever managed the target production system. Keeping the versioning right was now the job of the sysadmin.

By now, the sysadmin job is just that much more complex. Even in a relatively controlled environment where there aren't that many moving parts, getting things configured properly is tough going. Sysadmins are trying to deal with this, in part, by creating something called "devops." Like the make utility of old, devops is in large part about using tools to create programs (real programs, not scripts) that deal with elements of the production network environment as programmable objects.

Devops is at its core not really primarily focused on security. Its aim is to create automation of operations. But it has profound security implications when you consider how often misconfigured applications and components play a role in breaches. Remember that in the first Verizon Business Data Breach Investigations report that 62 percent of breaches were attributed to significant internal errors that either directly or indirectly contributed to a breach. By and large, we're talking about misconfigurations here.

To be honest, it's not entirely clear what the overlap is between commercial security configuration monitors, like BigFix, and open-source devops tools, like Puppet and Chef, but that's something I hope to explore during the next few weeks. Until then, here are a few thoughts from Jesse Robbins, the guy behind Chef, over at gocsi.com.

CSI Director Robert Richardson likes a good recipe fine but a good meal even better. Reach him at Robert.richardson@ubm.com.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading Tech Digest, Dec. 19, 2014
Software-defined networking can be a net plus for security. The key: Work with the network team to implement gradually, test as you go, and take the opportunity to overhaul your security strategy.
Flash Poll
Title Partner’s Role in Perimeter Security
Title Partner’s Role in Perimeter Security
Considering how prevalent third-party attacks are, we need to ask hard questions about how partners and suppliers are safeguarding systems and data.
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-4440
Published: 2014-12-19
Password Generator (aka Pwgen) before 2.07 generates weak non-tty passwords, which makes it easier for context-dependent attackers to guess the password via a brute-force attack.

CVE-2013-4442
Published: 2014-12-19
Password Generator (aka Pwgen) before 2.07 uses weak pseudo generated numbers when /dev/urandom is unavailable, which makes it easier for context-dependent attackers to guess the numbers.

CVE-2013-7401
Published: 2014-12-19
The parse_request function in request.c in c-icap 0.2.x allows remote attackers to cause a denial of service (crash) via a URI without a " " or "?" character in an ICAP request, as demonstrated by use of the OPTIONS method.

CVE-2014-2026
Published: 2014-12-19
Cross-site scripting (XSS) vulnerability in the search functionality in United Planet Intrexx Professional before 5.2 Online Update 0905 and 6.x before 6.0 Online Update 10 allows remote attackers to inject arbitrary web script or HTML via the request parameter.

CVE-2014-2716
Published: 2014-12-19
Ekahau B4 staff badge tag 5.7 with firmware 1.4.52, Real-Time Location System (RTLS) Controller 6.0.5-FINAL, and Activator 3 reuses the RC4 cipher stream, which makes it easier for remote attackers to obtain plaintext messages via an XOR operation on two ciphertexts.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Join us Wednesday, Dec. 17 at 1 p.m. Eastern Time to hear what employers are really looking for in a chief information security officer -- it may not be what you think.