Perimeter
6/15/2010
11:09 AM
Connect Directly
RSS
E-Mail
50%
50%

There's A Recipe For That

Back in the dark ages when I was a programmer, I became horribly fascinated with a tool called make. It was a tool for dealing with the complexities of, well, making finished executable code.

Back in the dark ages when I was a programmer, I became horribly fascinated with a tool called make. It was a tool for dealing with the complexities of, well, making finished executable code.The basic unit of executable code in those days (and these days, too, to some extent) was the .exe file, but putting an .exe file together meant compiling source code into object code and then connecting the object code with code libraries containing lots of other bits of object code coming from lots of other source code files. The key point here is that it kept track of dependencies. If something changed in one of the libraries, then it knew enough to know that anything that used those libraries needed to be reconnected with the newer version.

Make didn't know the dependencies by magic, of course. Nor did it know where to copy the various intermediate and final products of the work it initiated. Nor did it do any of the actual work of compiling or linking. You had to tell it all of this stuff by writing it all down in a thing called, none too surprisingly, a "make file."

It was a recipe designed to deal with complexities that were too hard to remember. And there could potentially be a great many complexities. The projects I was working on back in the '90s involved dozens of programmers, hundreds of separate modules, and something on the order of a half million lines of source code written in a few different programming languages.

Pretty much at the exact same time I was getting pretty good at vast and complex make files that relied on other monster make files and so on, the use of make files as a comprehensive solution was being undercut. Rather than linking in objects from libraries and the like, the new paradigm in applications was for the objects to be called up at run time on the system where the application was ultimately deployed. In the case of Windows, what was called up was a Dynamic Link Library, or DLL. In this brave new world, your application had to be smart enough to check whether a given DLL function was the correct version. Microsoft had an amusing propensity for releasing DLLs that had different functionality but the same version number, so the entire exercise had a charming futility about it.

But more to the point, the problem of getting the right versions of things working together at the same time had shifted. It was no longer a programming task that could be handled beforehand by the program developer, but was rather a task that had to be handled by whomever managed the target production system. Keeping the versioning right was now the job of the sysadmin.

By now, the sysadmin job is just that much more complex. Even in a relatively controlled environment where there aren't that many moving parts, getting things configured properly is tough going. Sysadmins are trying to deal with this, in part, by creating something called "devops." Like the make utility of old, devops is in large part about using tools to create programs (real programs, not scripts) that deal with elements of the production network environment as programmable objects.

Devops is at its core not really primarily focused on security. Its aim is to create automation of operations. But it has profound security implications when you consider how often misconfigured applications and components play a role in breaches. Remember that in the first Verizon Business Data Breach Investigations report that 62 percent of breaches were attributed to significant internal errors that either directly or indirectly contributed to a breach. By and large, we're talking about misconfigurations here.

To be honest, it's not entirely clear what the overlap is between commercial security configuration monitors, like BigFix, and open-source devops tools, like Puppet and Chef, but that's something I hope to explore during the next few weeks. Until then, here are a few thoughts from Jesse Robbins, the guy behind Chef, over at gocsi.com.

CSI Director Robert Richardson likes a good recipe fine but a good meal even better. Reach him at Robert.richardson@ubm.com.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
Partner Perspectives
What's This?
In a digital world inundated with advanced security threats, Intel Security seeks to transform how we live and work to keep our information secure. Through hardware and software development, Intel Security delivers robust solutions that integrate security into every layer of every digital device. In combining the security expertise of McAfee with the innovation, performance, and trust of Intel, this vision becomes a reality.

As we rely on technology to enhance our everyday and business life, we must too consider the security of the intellectual property and confidential data that is housed on these devices. As we increase the number of devices we use, we increase the number of gateways and opportunity for security threats. Intel Security takes the “security connected” approach to ensure that every device is secure, and that all security solutions are seamlessly integrated.
Featured Writers
White Papers
Cartoon
Current Issue
Dark Reading's October Tech Digest
Fast data analysis can stymie attacks and strengthen enterprise security. Does your team have the data smarts?
Flash Poll
Title Partner’s Role in Perimeter Security
Title Partner’s Role in Perimeter Security
Considering how prevalent third-party attacks are, we need to ask hard questions about how partners and suppliers are safeguarding systems and data.
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-3366
Published: 2014-10-31
SQL injection vulnerability in the administrative web interface in Cisco Unified Communications Manager allows remote authenticated users to execute arbitrary SQL commands via a crafted response, aka Bug ID CSCup88089.

CVE-2014-3372
Published: 2014-10-31
Multiple cross-site scripting (XSS) vulnerabilities in the CCM reports interface in the Server in Cisco Unified Communications Manager allow remote attackers to inject arbitrary web script or HTML via unspecified parameters, aka Bug ID CSCuq90589.

CVE-2014-3373
Published: 2014-10-31
Multiple cross-site scripting (XSS) vulnerabilities in the CCM Dialed Number Analyzer interface in the Server in Cisco Unified Communications Manager allow remote attackers to inject arbitrary web script or HTML via unspecified parameters, aka Bug ID CSCup92550.

CVE-2014-3374
Published: 2014-10-31
Multiple cross-site scripting (XSS) vulnerabilities in the CCM admin interface in the Server in Cisco Unified Communications Manager allow remote attackers to inject arbitrary web script or HTML via unspecified parameters, aka Bug ID CSCuq90582.

CVE-2014-3375
Published: 2014-10-31
Multiple cross-site scripting (XSS) vulnerabilities in the CCM Service interface in the Server in Cisco Unified Communications Manager allow remote attackers to inject arbitrary web script or HTML via unspecified parameters, aka Bug ID CSCuq90597.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Follow Dark Reading editors into the field as they talk with noted experts from the security world.