US Senator Throws Penalty Flag at Microsoft
February 26, 2021
JEDI foul? I am not sure. The bright yellow flag has been lofted and it is beginning its descent. One player has a look of disbelief, “A foul. You think I did a chop block?” That’s the image that went through my mental machinery as I read “US Senator claims Microsoft Failed to Fix Cloud Holes before SolarWinds Hack.”
The write up asserts:
Microsoft Corp’s failure to fix known problems with its cloud software facilitated the massive SolarWinds hack that compromised at least nine federal government agencies, according to security experts and the office of US Senator Ron Wyden. A vulnerability first publicly revealed by researchers in 2017 allows hackers to fake the identity of authorized employees to gain access to customers’ cloud services. The technique was one of many used in the SolarWinds hack.
The year 2017. I recall that was the time the DarkCyber research team began yammering about use of the wonderful Microsoft software update system, access control policies, and business processes to allow estimable Microsoft-friendly software to run. The idea was seamless, smooth, quick, and flawless interaction among users, software, the cloud, and assorted components. Fast. Efficient. Absolutely.
The elected official is quoted as saying:
The federal government spends billions on Microsoft software. It should be cautious about spending any more before we find out why the company didn’t warn the government about the hacking technique that the Russians used, which Microsoft had known about since at least 2017.
The write up points out that Microsoft does not agree with the senator’s observations. In the subsequent testimony (you can view it at this link), one of the top dog Microsoft professionals pointed out “only about 15 percent of the victims in the Solar Winds campaign were hurt via Golden SAML.” SAML is a a security assertion markup language. The golden part? Maybe it is the idea that a user or process signs on. If okayed somewhere in the system, the user or process is definitely okay again. Fast. Efficient.
The “golden” it turns out is a hack. Get into the SAML approved system, and bingo. Users, processes, whatever are good to go. Get administrator credentials and become an authorizing and verifying service and the bad actor owns the system. The idea is that a bad actor can pump out green light credentials and do many interesting things. Hey, being authorized and trusted is a wonderful thing, right?
Back to JEDI? Is the senator confident that the Department of Defense has not been compromised? What happens if the JEDI system is penetrated by foreign actors as the DoD wide system is being assembled, deployed, and operated? Does the vulnerability still exist in live systems?
These are good questions? I am not sure the answers are as well crafted.
Stephen E Arnold, February 27, 2021
What’s a Golden SAML?
What Threats Does Cyber Security Software Thwart?
February 19, 2021
I asked myself this question, “What threats does cyber security software thwart?” The SolarWinds’ misstep went undetected for months, maybe a year or more. I read “France Agency ANSSI Links Russia’s Sandworm APT to Attacks on Hosting Providers.” Reuters ran a short news item as well. You can read the report via this link. I don’t want to wade through the cyber security jargon in this post. Instead I want to highlight one fact: The “intrusions” dated back to 2017. Okay, this is another time block in which cyber security systems operated and failed to detect the malicious behavior.
The vector of attack was software used by Centreon. What’s Centreon do?
What’s ANSSI?
The French National Agency for the Security of Information Systems or Agence nationale de la sécurité des systèmes d’information.
What’s Centreon? LinkedIn says:
Centreon is a global provider of business-aware IT monitoring for always-on operations and performance excellence. The company’s holistic, AIOps-ready platform is designed for today’s complex, distributed hybrid cloud infrastructures. Privately held, Centreon was founded in 2005 as an open source software framework. Today, Centreon is trusted by organizations of all sizes across a wide range of public and private sectors. Centreon is headquartered in Paris and Toronto, with sales offices in Geneva, Luxembourg and Toulouse.
What’s Hub One?
It is a subsidiary of Aéroports de Paris. Hub One provides high speed radio networks and services to outfits like Air France and the French government.
What’s an APT?
An advanced persistent threat. The idea is that malware is inside a system or software and is able to remain undetected while it follows instructions from a bad actor.
Now back to the 2017 date.
The point is that current cyber security systems may not be able to provide the defenses which marketers tout.
We’re talking years which strikes me as very SolarWinds-like. Then there is the persistent question: What’s up with the commercial cyber security systems?
Stephen E Arnold, February 19, 2021
Microsoft: Technical Excellence Translates to More Excellencerness
February 18, 2021
I found the Microsoft explanation of the SolarWinds’ misstep interesting. CBS circulated some of the information in the interview in “SolarWinds: How Russian Spies Hacked the Justice, State, Treasury, Energy and Commerce Departments.” The point that Windows’ security systems did not detect the spoofing, modifying, and running of Microsoft software was skipped over in my opinion. I loved this statement by Brad Smith, one of the senior executives at the Redmond giant:
When we analyzed everything that we saw at Microsoft, we asked ourselves how many engineers have probably worked on these attacks. And the answer we came to was, well, certainly more than 1,000.
Then failing to detect the breach which seems to have exploited the fascinating Microsoft software update methods:
I think that when you look at the sophistication of this attacker there’s an asymmetric advantage for somebody playing offense.
Okay, “certainly.” Okay, 1,000.
What if SolarWinds’ misstep was not the largest and most sophisticated hack? Is it possible that an insider or a contractor working from home in another country provided the credentials? What if piggybacking on the wild and wonderful Windows’ update system and method was a cottage industry among some bad actors? What if the idea for the malware was a result of carelessness and assumptions about the “security” of how Microsoft and its partners conducted routine business? What if the bad actors used open source software and some commercial reverse engineering tools, information on hacker forums, and trial and error? Does one need a 1,000 engineers? Microsoft may need that many engineers, but in my experience gained in rural Kentucky, a handful of clever individuals could have made the solar fires burn more brightly. Who can manage 1,000 hackers? I am not sure nation states can get 1,000 cyber warriors to a single conference center at one time or get most to read their email, file reports, and coordinate their code. Some may suggest Russia, China, North Korea, or Iran can do these managerial things in a successful way. Not I. The simplest explanation is often the correct one. Insider, opportunism, and a small team makes more sense to me.
Let me shift gears.
What about the spoofing, modifying, and running of Microsoft software for months, maybe a year, maybe more without detecting the intrusion?
I noted “A Vulnerability in Windows Defender Went Unnoticed for 12 Years.” That write up asserts:
A critical bug in Windows Defender went undetected by both attackers and defenders for some 12 years, before finally being patched last fall. The vulnerability in Microsoft’s built-in antivirus software could have allowed hackers to overwrite files or execute malicious code—if the bug had been found. Let’s be clear—12 years is a long time when it comes to the life cycle of a mainstream operating system, and it’s a heck of a long time for such a critical vulnerability to hide.
Sure, let’s be clear. Microsoft talks security. It issues techno-marketing posts like its late January explanation of the SolarWinds’ misstep which I reported on in the DarkCyber video news program on February 9, 2021.
But perhaps more pointed questions should be asked. I don’t want to know about Team featuritis. I don’t want to know why I should not install certain Windows 10 updates or accept updates like the mandatory update KB4023057. I don’t want to know about folding mobile phones. Nope. None of those things.
I want TV interviewers, CBS “real news” writers, and Microsoft to move beyond marketing chatter, hollow assurances, and techno-babble. Oh, I forgot. The election, Covid, and the Azure cloud JEDI thing. I, like others, need their priorities readjusted.
How many employees and partners told Brad Smith, “You were great in the 60 Minutes interview? Lots I would wager.
Stephen E Arnold, February 18, 2021
Amazon: Putting Eyes on Humans
February 17, 2021
Amazon may have a new driver at the controls of the Bezos bulldozer, but the big orange machine keeps pushing monitoring technology. “Amazon’s Driver Monitoring App Is an Invasive Nightmare” does not like the system the online bookstore uses to keep an eye on human delivery drivers. The write up states:
Mentor is made by eDriving, which describes the app on its website as a “smartphone-based solution that collects and analyzes driver behaviors most predictive of crash risk and helps remediate risky behavior by providing engaging, interactive micro-training modules delivered directly to the driver in the smartphone app.”
From my tumble down shack in rural Kentucky, the Bezos bulldozer seems to be using technology from an outfit called eDriving. There are several options available to the online bookstore. Amazon can continue to pay eDriving. Amazon can clone the system. Amazon can acquire the company, people, or technology.
Based on my on-going research into Amazon’s surveillance capabilities, the enhanced cameras, the online hook to the AWS mothership, and the use of third-parties to nudge monitoring forward is still in its early days. Amazon moves slowly and in a low profile way. Most law enforcement and intelligence organizations observe Amazon the way a tourist does a turtle in the Galapagos: Check out where the turtle is after breakfast and then note that the darned thing moved behind a rock a few fee away by noon. No big deal. Turtles move, right? Turtles are not gazelles, right?
Several observations:
- Amazon chugs along in a sprightly manner behind the curtain separating public use of a system like Mentor
- Amazon time makes it difficult for some observers to note significant change in a system or technology
- The trick to figuring out where Amazon is headed in surveillance systems is to step back and observe the suite of systems.
What does one learn?
How about Amazon as the plumbing for many of the widely used policeware and intelware systems? Who knew that Palantir Technologies is a good Amazon customer? Maybe not IBM which inked a deal with the chipper Denver based “ride ‘em cowboy” policeware firm.
How useful would Amazon’s monitoring technology be if connected to a Palantir content intake system? My guess is that it would be quite useful, and it would require the Amazon cloud to work. What’s that mean for cloud competitors like Google, IBM, and Microsoft?
Amazon’s policeware and intelware approach is a lock in dream. Where could a Mentor-type system be useful to investigators?
Sorry. I can’t think of a single use case. Ho ho ho.
Stephen E Arnold, February 17, 2021
IBM Watson: Learn How to Build a Recommendation Engine with Watson NLP
February 17, 2021
I came across this IBM free lesson: “Build a Recommendation Engine with Watson Natural Language Understanding.”
The preliminary set up, according to the write up, takes about an hour. Once that hour has been invested, the IBM Watson Knowledge Studio service will allow you to whip up your own recommendation engine. Plus, with Watson, the system will understand what humans write.
What are the preliminary steps? No big deal. Get an IBM cloud account, then navigate to the IBM Cloud console. Pick a pricing plan. Just choose “free” otherwise the lesson is free, not building the recommendation solution, you silly goose.) Then follow the steps for provisioning a Watson Knowledge Studio instance. Choose “free” again.
Next you have an opportunity to work through six additio0nal steps:
- Define entity types and subtypes
- Create “Relation Types”
- Collect documents that describe your domain language
- Annotate Documents
- Generate a Machine Learning Model
- Deploy model to Natural Language Understanding service.
The system seems to enjoy documents which are no larger than 2,000 words, preferable smaller. And the documents must be in ASCII, PDF, DOC, and HTML. The IBM information says Zip files are supported, but zip files can contain non text objects and long text documents. (That’s why people zip long text files, right?) The student can also upload documents in the UIMA CAS XMI format. If you are not familiar with this file format, you can get oriented by looking at documents like this.)
Once you have worked through steps one through five (obviously without making an error), you will need you Natural Language Understanding API Key which “is located at The Natural Language Understanding API Key and URL can be found by navigating to your Watson Natural Language Understanding instance page and looking in the Credentials section.”
No problem.
But what if the customer support system relies on voice? What if the customer is asked to upload a screenshot or a file containing data displayed when a fault occurs? What if the customer has paid for “premier” support which features a Zoom session? What if the person who wants to learn about Watson recommendation engine for a small trucking company?
Good questions. You may want to set aside some time to work through steps one through five which encapsulate some specialized college courses and hands-on experience with smart software, search, indexing, etc.
Perhaps hiring an IBM partner to set up the system and walk you through its quirks and features is a more practical solution.
On the other hand, check out Amazon’s off the shelf machine learning systems.
Stephen E Arnold, February 17, 2021
Is Business Intelligence the New Silver Bullet for Managers Who Want to Be Even More Intelligent?
February 15, 2021
Survey results from an outfit called Reveal contains some interesting market data. “Demand for Business Intelligence Solutions Increases by 41 Percent” provides some data about the sample size (120 developers and information technology Napoleons) but zero information about how these individuals were selected, the confidence level Reveal considers just peachy for the analysis, and other now old fashioned facets of a “survey” once taught in Statistics 101. Those YouTube videos about survey methods are good enough, thank you.
Here is one of the findings from the study:
A 41 percent increase in demand for business intelligence solutions in 2020.
Okay, financial, social, and political excitement, the Covid Rona thing, and the implosion of once boring business sectors like airlines, real estate, and local small businesses.
Business intelligence to the rescue with real time analyses of data, predictive analytics, and nifty charts and graphs.
Were there other findings from this remarkably amusing sample? Absolutely. To wit:
- 50 percent had budgets chopped
- 23 percent had projects killed
- 14 percent lost staff and funding.
Popular buzzwords include the aforementioned predictive analytics, edge analytics which I assume means cloud based services like Amazon AWS, and “natural learning” which I possibly machine learning, AI, et al.
Net net: Let’s bet on business intelligence. Better, faster, and cheaper. Plus, managers will be able to make better decisions based on actionable intelligence. Sounds good, right?
Stephen E Arnold, February 15, 2021
Where Did You Say “Put the Semantic Layer”?
February 10, 2021
Eager to add value to their pricey cloud data-warehouses, cloud vendors are making a case for processing analytics right on their platforms. Providers of independent analytics platforms note such an approach falls short for the many companies that have data in multiple places. VentureBeat reports, “Contest for Control Over the Semantic Layer for Analytics Begins in Earnest.” Writer Michael Vizard tells us:
“Naturally, providers of analytics and business intelligence (BI) applications are treating data warehouses as another source from which to pull data. Snowflake, however, is making a case for processing analytics in its data warehouse. For example, in addition to processing data locally within its in-memory server, Alteryx is now allowing end users to process data directly in the Snowflake cloud. At the same time, however, startups that enable end users to process data using a semantic layer that spans multiple clouds are emerging. A case in point is Kyligence, a provider of an analytics platform for Big Data based on open source Apache Kylin software.”
Alteryx itself acknowledges the limitations of data-analysis solutions that reside on one cloudy platform. The write-up reports:
“Alteryx remains committed to a hybrid cloud strategy, chief marketing officer Sharmila Mulligan said. Most organizations will have data that resides both in multiple clouds and on-premises for years to come. The idea that all of an organization’s data will reside in a single data warehouse in the cloud is fanciful, Mulligan said. ‘Data is always going to exist in multiple platforms,’ she said. ‘Most organizations are going to wind up with multiple data warehouses.’”
Kyligence is one firm working to capitalize on that decentralization. Its analytics platform pulls data from multiple platforms in an online analytical processing database. The company has raised nearly $50 million, and is releasing an enterprise edition of Apache Kylin that will run on AWS and Azure. It remains to be seen whether data warehouses can convince companies to process data on their platforms, but the push is clearly part of the current trend—the pursuit of a never-ending flow of data.
Cynthia Murrell, February 10, 2021
IBM Acknowledges That Palantir Technologies Is Winning the Battle for Policeware and Intelware
February 9, 2021
I read “Palantir Surges on Deal to Offer Software through IBM.” Yep, the new IBM has apparently accepted reality: Its i2 Analysts Notebook products aren’t the powerhouses they were when Mike Hunter’s company was the go-to policeware and intelware product.
According to the “real” news outfit Bloomberg:
Palantir Technologies Inc. and International Business Machines Corp.are uniting in a partnership that will dramatically expand the reachof Palantir’s sales force while making IBM’s ownartificial-intelligence software easier for non-technical customers touse…
Why? The write up reveals:
Without providing a time frame, Thomas [IBM wizard] said he expects the partnershipto help boost IBM’s customers using AI to 80% from its current 20%. Palantir Chief Operating Officer Shyam Sankar said the technical fitwith IBM and its reach are part of his company’s long-term effort tofinally ramp sales. In addition to commercial customers, governmentcontracts have surged both in number and size during the pandemic. “This is the biggest [partnership] we’ve announced — expectmore,” Sankar said. He said he expects to triple Palantir’sdirect-sales team to about 100 this year, a significant hike for acompany whose management once prided itself on not employing a singlesalesperson.
A couple of minor points:
- Anyone remember the litigation between Palantir and i2 about intellectual property? Of course not.
- What Palantir executives were named in the i2 litigation? (This is a really good question by the way?)
- Do the Palantir solutions generate really happy licensees?
- How do the former i2 professionals perceive this tie up?
- How will the deal impact Palantir’s present cloud services providers?
These are questions which “real” news entities do not ask or answer.
Stephen E Arnold, February 9, 2021
Post SolarWinds: Let Smart Software Do Security
February 9, 2021
Forty-one percent of IT leaders would suggest cybersecurity pros get their resumes ready, according to a recent survey. ZDNet reports, “AI Set to Replace Humans in Cybersecurity by 2030, Says Trend Micro Survey.” Writer Eileen Brown summarizes:
“[Trend Micro’s] predictions report, Turning the Tide, forecasts that remote and cloud-based systems will be ruthlessly targeted in 2021. The research was compiled from interviews with 500 IT directors and managers, CIOs and CTOs and does not look good for their career prospects. Only 9% of respondents were confident that AI would definitely not replace their job within the next decade. In fact, nearly a third (32%) said they thought the technology would eventually work to completely automate all cybersecurity, with little need for human intervention. Almost one in five (19%) believe that attackers using AI to enhance their arsenal will be commonplace by 2025. Around a quarter (24%) of IT leaders polled also claimed that by 2030, data access will be tied to biometric or DNA data, making unauthorised access impossible. In the shorter term, respondents also predicted the following outcomes would happen by 2025. They predict that most organisations will have significantly reduced investment in property as remote working becomes the norm (22%). Nationwide 5G will have entirely transformed network and security infrastructure (21%), and security will be self-managing and automated using AI (15%). However, attackers using AI to enhance their arsenal will be commonplace (19%).”
Trend Micro’s Bharat Mistry cautions that AI is most valuable when combined with human expertise, suggesting companies not jettison their human resources so readily. Since cyberattacks will continue to be a growing concern, the report recommends companies pay close attention to security best practices and patch management programs. It is also wise to train workers on security for work performed outside the office and the importance of avoiding doing business on personal devices.
Global cybersecurity firm Trend Micro offers protection for its clients’ users, networks, and cloud environments. Founded back in 1988, the company is based in Tokyo.
One question: If flawed humans create the smart security AI, won’t that have the same blindspots?
Cynthia Murrell, February 9, 2021
Oracle: Looking Like an AARP Magazine Cover Shot
February 9, 2021
Oracle used to be a game changing name in the tech industry, but now it has become an industry standard and, for lack of better terms, old. Oracle might be old, but the company continues to release reliable technology. They recently updated Oracle Database 21c to operate on Oracle Cloud. Channel Life comments on the upgrade consisting of over 200 improvements in the article: “Oracle Releases New Version Of Converged Database.”
One of the top new features for the Oracle Database 21c is the availability of the Oracle APEX Application Development. The Oracle APEX combined with Oracle Cloud offers developers a browser-based, low-code cloud environment to create apps. Other new features include native JSON data type representation, immutable blockchain tables, AutoML for in-database machine learning, persistent memory support, in-database javascript, tiger performance graph models, database in-memory automation, and Sharding automation. Sharding automation is a nifty tool that:
“Native Database Sharding delivers hyperscale performance and availability while enabling global enterprises to meet data sovereignty and data privacy regulations. Data shards share no hardware or software and can reside on-premises or in the cloud. To simplify the design and use of sharding, Database 21c includes a Sharding Advisor Tool that assesses a database schema plus its workload characteristics and then provides a sharded database design optimised for performance, scalability, and availability. Backup and Recovery across shards is also automated.”
These updates are great refreshers for the Oracle Database 21c. The only problem with some of these features is that AWS added them a few years ago. Does Oracle stand a chance competing against AWS on a factor other than price?
Whitney Grace, February 9, 2021
-
- Subscribe to Beyond Search
Feature archive
News archive
-
