Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Perimeter

6/15/2010
11:09 AM
50%
50%

There's A Recipe For That

Back in the dark ages when I was a programmer, I became horribly fascinated with a tool called make. It was a tool for dealing with the complexities of, well, making finished executable code.

Back in the dark ages when I was a programmer, I became horribly fascinated with a tool called make. It was a tool for dealing with the complexities of, well, making finished executable code.The basic unit of executable code in those days (and these days, too, to some extent) was the .exe file, but putting an .exe file together meant compiling source code into object code and then connecting the object code with code libraries containing lots of other bits of object code coming from lots of other source code files. The key point here is that it kept track of dependencies. If something changed in one of the libraries, then it knew enough to know that anything that used those libraries needed to be reconnected with the newer version.

Make didn't know the dependencies by magic, of course. Nor did it know where to copy the various intermediate and final products of the work it initiated. Nor did it do any of the actual work of compiling or linking. You had to tell it all of this stuff by writing it all down in a thing called, none too surprisingly, a "make file."

It was a recipe designed to deal with complexities that were too hard to remember. And there could potentially be a great many complexities. The projects I was working on back in the '90s involved dozens of programmers, hundreds of separate modules, and something on the order of a half million lines of source code written in a few different programming languages.

Pretty much at the exact same time I was getting pretty good at vast and complex make files that relied on other monster make files and so on, the use of make files as a comprehensive solution was being undercut. Rather than linking in objects from libraries and the like, the new paradigm in applications was for the objects to be called up at run time on the system where the application was ultimately deployed. In the case of Windows, what was called up was a Dynamic Link Library, or DLL. In this brave new world, your application had to be smart enough to check whether a given DLL function was the correct version. Microsoft had an amusing propensity for releasing DLLs that had different functionality but the same version number, so the entire exercise had a charming futility about it.

But more to the point, the problem of getting the right versions of things working together at the same time had shifted. It was no longer a programming task that could be handled beforehand by the program developer, but was rather a task that had to be handled by whomever managed the target production system. Keeping the versioning right was now the job of the sysadmin.

By now, the sysadmin job is just that much more complex. Even in a relatively controlled environment where there aren't that many moving parts, getting things configured properly is tough going. Sysadmins are trying to deal with this, in part, by creating something called "devops." Like the make utility of old, devops is in large part about using tools to create programs (real programs, not scripts) that deal with elements of the production network environment as programmable objects.

Devops is at its core not really primarily focused on security. Its aim is to create automation of operations. But it has profound security implications when you consider how often misconfigured applications and components play a role in breaches. Remember that in the first Verizon Business Data Breach Investigations report that 62 percent of breaches were attributed to significant internal errors that either directly or indirectly contributed to a breach. By and large, we're talking about misconfigurations here.

To be honest, it's not entirely clear what the overlap is between commercial security configuration monitors, like BigFix, and open-source devops tools, like Puppet and Chef, but that's something I hope to explore during the next few weeks. Until then, here are a few thoughts from Jesse Robbins, the guy behind Chef, over at gocsi.com.

CSI Director Robert Richardson likes a good recipe fine but a good meal even better. Reach him at [email protected]

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Edge-DRsplash-10-edge-articles
7 Old IT Things Every New InfoSec Pro Should Know
Joan Goodchild, Staff Editor,  4/20/2021
News
Cloud-Native Businesses Struggle With Security
Robert Lemos, Contributing Writer,  5/6/2021
Commentary
Defending Against Web Scraping Attacks
Rob Simon, Principal Security Consultant at TrustedSec,  5/7/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-36197
PUBLISHED: 2021-05-13
An improper access control vulnerability has been reported to affect earlier versions of Music Station. If exploited, this vulnerability allows attackers to compromise the security of the software by gaining privileges, reading sensitive information, executing commands, evading detection, etc. This ...
CVE-2020-36198
PUBLISHED: 2021-05-13
A command injection vulnerability has been reported to affect certain versions of Malware Remover. If exploited, this vulnerability allows remote attackers to execute arbitrary commands. This issue affects: QNAP Systems Inc. Malware Remover versions prior to 4.6.1.0. This issue does not affect: QNAP...
CVE-2021-28799
PUBLISHED: 2021-05-13
An improper authorization vulnerability has been reported to affect QNAP NAS running HBS 3 (Hybrid Backup Sync. ) If exploited, the vulnerability allows remote attackers to log in to a device. This issue affects: QNAP Systems Inc. HBS 3 versions prior to v16.0.0415 on QTS 4.5.2; versions prior to v3...
CVE-2021-22155
PUBLISHED: 2021-05-13
An Authentication Bypass vulnerability in the SAML Authentication component of BlackBerry Workspaces Server (deployed with Appliance-X) version(s) 10.1, 9.1 and earlier could allow an attacker to potentially gain access to the application in the context of the targeted user’s acco...
CVE-2021-23134
PUBLISHED: 2021-05-12
Use After Free vulnerability in nfc sockets in the Linux Kernel before 5.12.2 allows local attackers to elevate their privileges. In typical configurations, the issue can only be triggered by a privileged local user with the CAP_NET_RAW capability.