Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Comments
Lockheed Martin-Led Consortium Builds Secure 'System Of Systems'
Threaded  |  Newest First  |  Oldest First
RyanSepe
RyanSepe,
User Rank: Ninja
7/29/2015 | 9:45:49 AM
De-elevation of Super User Access
Does this mean that Super User access would be provided and removed based on specific need? If so, I think this is the only way to adhere to the "least privilege" principle completely.
Dr.T
Dr.T,
User Rank: Ninja
7/29/2015 | 10:59:40 AM
Re: De-elevation of Super User Access
Main idea should be the fact that there is no super user. You get permission based on the need you have and that is given temporary.
RyanSepe
RyanSepe,
User Rank: Ninja
7/29/2015 | 11:08:03 AM
Re: De-elevation of Super User Access
Sorry if my first post didn't phrase as such but that was the point behind my statement. Permanent elevation is quite common and not a good security practice.
SgS125
SgS125,
User Rank: Ninja
7/29/2015 | 10:26:51 AM
Gee so it's just like a mainframe running RACF in 1984
Finally we are back to the days when the system has real security!
Kelly Jackson Higgins
Kelly Jackson Higgins,
User Rank: Strategist
7/29/2015 | 10:40:47 AM
Re: Gee so it's just like a mainframe running RACF in 1984
Mainframe nostalgia, for sure. 
Dr.T
Dr.T,
User Rank: Ninja
7/29/2015 | 11:03:16 AM
Re: Gee so it's just like a mainframe running RACF in 1984
I like the idea of having a dump terminal for the users and locking down everting else in the back end, however security is about balance of CIA: Confidentiality, Integrity and Availability 
Dr.T
Dr.T,
User Rank: Ninja
7/29/2015 | 11:01:25 AM
Re: Gee so it's just like a mainframe running RACF in 1984
I hear you. At the same time there was always security vulnerabilities as you know.
SgS125
SgS125,
User Rank: Ninja
7/29/2015 | 11:04:42 AM
Re: Gee so it's just like a mainframe running RACF in 1984
yes, we had a guy that could look over your shoulder at your 3270 terminal , on the closed network, running proprietary protocols, encrypted with simple routines.  That guy could read your screen.

Other than that, the no wireless, no terminal that was not explicitly defined to the system approach worked quite well.
Dr.T
Dr.T,
User Rank: Ninja
7/29/2015 | 10:57:53 AM
Multilevel security
 

Multilevel security should be about multi-layer security. When individuals need to go to next level they get permission otherwise they could not proceed. This is one of the good approach when it comes best practices on secure network and system design.
Dr.T
Dr.T,
User Rank: Ninja
7/29/2015 | 11:05:43 AM
Systems of systems
I wonder how they would be securing systems of systems while they are having hard time to secure a single system. Noting is ever be perfect when it comes to security, all we are doing minimizing the risk.
Kelly Jackson Higgins
Kelly Jackson Higgins,
User Rank: Strategist
7/29/2015 | 11:12:17 AM
Re: Systems of systems
Great point. Nothing is bulletproof when it comes to advanced attackers. Interestingly, this is approach has the blessing of an intel agency. But then again, NSA got 0wned by Snowden.


Edge-DRsplash-10-edge-articles
I Smell a RAT! New Cybersecurity Threats for the Crypto Industry
David Trepp, Partner, IT Assurance with accounting and advisory firm BPM LLP,  7/9/2021
News
Attacks on Kaseya Servers Led to Ransomware in Less Than 2 Hours
Robert Lemos, Contributing Writer,  7/7/2021
Commentary
It's in the Game (but It Shouldn't Be)
Tal Memran, Cybersecurity Expert, CYE,  7/9/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Creating an Effective Incident Response Plan
Security teams are realizing their organizations will experience a cyber incident at some point. An effective incident response plan that takes into account their specific requirements and has been tested is critical. This issue of Tech Insights also includes: -a look at the newly signed cyber-incident law, -how organizations can apply behavioral psychology to incident response, -and an overview of the Open Cybersecurity Schema Framework.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2022-43705
PUBLISHED: 2022-11-27
In Botan before 2.19.3, it is possible to forge OCSP responses due to a certificate verification error. This issue was introduced in Botan 1.11.34 (November 2016).
CVE-2022-45934
PUBLISHED: 2022-11-27
An issue was discovered in the Linux kernel through 6.0.10. l2cap_config_req in net/bluetooth/l2cap_core.c has an integer wraparound via L2CAP_CONF_REQ packets.
CVE-2022-45931
PUBLISHED: 2022-11-27
A SQL injection issue was discovered in AAA in OpenDaylight (ODL) before 0.16.5. The aaa-idm-store-h2/src/main/java/org/opendaylight/aaa/datastore/h2/UserStore.java deleteUser function is affected when the API interface /auth/v1/users/ is used.
CVE-2022-45932
PUBLISHED: 2022-11-27
A SQL injection issue was discovered in AAA in OpenDaylight (ODL) before 0.16.5. The aaa-idm-store-h2/src/main/java/org/opendaylight/aaa/datastore/h2/RoleStore.java deleteRole function is affected when the API interface /auth/v1/roles/ is used.
CVE-2022-45933
PUBLISHED: 2022-11-27
KubeView through 0.1.31 allows attackers to obtain control of a Kubernetes cluster because api/scrape/kube-system does not require authentication, and retrieves certificate files that can be used for authentication as kube-admin. NOTE: the vendor's position is that KubeView was a "fun side proj...