Eliana Willis

Damage caused by advanced exploits, such as Log4Shell and Spring4Shell, has been widely documented. These came out of nowhere and seemingly crippled many organizations. This happened despite record cybersecurity industry budgets that will clear $146B in 2022. This post from Palo Alto Networks highlights that, based on telemetry, the company observed more than 125 million hits that had the associated packet capture that triggered the signature. It certainly begs the question of why breaches are becoming more common and more damaging despite security spending at an all-time high. The answer to this lies in the approach many businesses have taken to threat protection. Traditional security is based on perceived best-of-breed products being used for specific functions. For example, firewalls protect the network, EDR protects endpoints, CASB protects the cloud, and so on. Most of these tools do a great job within their domains, but the reality is that exploits are not limited to one specific domain, so the silo-like nature of security creates many blind spots.Point products can’t see the end-to-end threat landscapeFor example, EDR tools are meant to find threats on endpoints, and they are effective at that specific task but have no visibility outside the endpoint. So if the breach occurred elsewhere, there is no way of knowing where and when. This is why so many EDR tools are excellent at detection but poor in response. The same can be said with firewalls that generally know everything that’s happening on a network but have no insight into an endpoint or many cloud services.Solving this problem lies in embracing the concept of XDR. Definitionally, I want to be clear that the X in XDR means “all” versus “eXtended,” the latter of which has been pushed by many of the point product vendors. Security pros need to understand that an upgraded EDR or SIEM tool is not XDR; it is merely a legacy tool with a little more visibility. XDR is the way forward for security True XDR is about taking data across the end-to-end infrastructure and correlating the information to find exploits and threats. This would allow for an exploit to be quickly identified and tracked across the infrastructure so all infected devices can be identified. While it’s impractical to assume that an organization would purchase all its infrastructure from a single vendor, I do believe that organizations should look to consolidate a minimum of network, endpoint and cloud security from a single vendor and treat that as the foundational platform for XDR. This would ensure that the vendor interoperates with other security providers to ingest the necessary data. Another benefit of XDR is that it provides a single source of truth across all security functions, which is vastly different from traditional security – where the security team has multiple tools, each with its own set of data and insights. The only way one could correlate the information is to do it manually, which is impossible today, given the massive amount of security data being collected. People can’t work fast enough, but an XDR solution, powered by artificial intelligence, can provide insights to a range of security analysts.XDR meets the needs of different security roles A good visualization of the value of XDR is depicted on Palo Alto Networks’ Log4j Incident Response Simulation page. It features three different SOC roles and how XDR can aid their jobs.  Specifically, the site does a deep dive on the following functions: Guy, the Threat Hunter: His job is to hunt for sophisticated attacks and those difficult to find low, slow threats that fly under the radar of traditional security tools. His job is to find unusual activities and other anomalies that are indicators of compromise. Cortex XDR makes threat hunting easier as it correlates data across endpoints, network, cloud and identity. Guy can then use an advanced XQL query language to aggregate, visualize and filter results that can quickly identify affected assets. Peter, the Tier 2 SOC Analyst: His function is to monitor, prioritize and investigate alerts. His work is used to resolve incidents and remediate threats. The problem is that most SOC tools provide far too many false positives making the information useless. This is why it’s my belief that the traditional SIEM needs a major overhaul. XDR uses machine learning and behavioral analytics to uncover advanced zero-day threats. Many SIEMS claim to do this, but most are just basic rules-based engines that need continual updating. With XDR, the investigation of the threats is accelerated by grouping-related alerts into incidents, and then the root cause is revealed through cross-data insights. Kasey, Director of Vulnerability Management: Her job is to discover, analyze the application, system, network and other IT vulnerabilities, and then assess and prioritize risk. Once that analysis is done, patching and resolving vulnerabilities can be performed. This is difficult, if not impossible, to do with point products because there is no way to understand the impact of a threat across systems. XDR can be combined with other tools, such as attack-surface management (ASM), to find and mitigate software vulnerable to Log4J and other exploits across the organization.In summary, I’ll go back to a conversation I had with a CISO a few months ago who told me that he finally understood that best of breed everywhere does not lead to best-in-class threat protection. In fact, the average of 30+ security vendors that businesses use today creates a management mess and leads to suboptimal protection. The path forward must be XDR, because it’s the only way to correlate historically siloed data to find threats and quickly remediate them before they cripple the business. 

A good resource for security professionals, particularly Palo Alto Networks customers, is the upcoming Palo Alto Networks Symphony 2022, on May 18 and 19. While this is a vendor event, it’s filled with information on how to revamp security operations to keep them in line with current trends. More

on May 2, 2022

| Topic: Web3

In its quest to make “Web3 available to everyone,” the Core team behind the newly-formed Cortex App said Monday that it’s introducing a new Web3 content network for launch in June. It will “bring Web2 functionality, such as social posts and blogs, into a decentralized and user-owned Web3.” This is the same group who launched free “.hmn” domain names on the Polygon protocol earlier this year.

Cortex Network, according to the release on Monday, will afford users new levels of control and privacy for themselves and their content. What’s more, the network will enable new ways to collaborate and define payment models for NFTs and content. “In the Cortex Network, each page (URL), will be a wallet address where a user could receive tokens for their content, or send out tokens as well,” Leonard Kish, co-founder of Cortex App told ZDNet. “Each page will essentially be a store for data and a store for NFTs or other tokens,” he said.How it worksThe Cortex Network will act like a proof-of-stake blockchain, whereby publishers stake so-called CRTX tokens to validate user updates and then publish them over the Polygon network. A new kind of index, known as HDIndex, will create a hash that will act as an on-chain proof and a lookup to content updates. The press release claims that “when publishing on the Cortex Network, users will own their content as they control updates with their keys.”The goal for the Cortex Network is to simplify Web3 publishing, making it easier for current Web2 publishers to migrate to a user-owned Web3 content network.

Networking

The Network is based on a network architecture in which batches of updates (known as “commits”) contribute to a local state of content which, in turn, becomes part of the globally verifiable localized consensus. What all that means is that each commit contributes to a globally verifiable state for content with a complete history of the content at a particular web address. “In the Cortex system, URLs and crypto addresses are nearly synonymous as part of a human-readable namespace for keys that act as lookups to content,” according to the press release. Kish notes that when it comes to new ways to collaborate and define payment models for NFTs, the NFT domains (such as “kish.hmn”) and subdomains (“leo.kish.hmn”) on where the content lives are fully transferable, so an NFT can have a full story. And when transferred, that story (the content) can move with the NFT domain as well. “We are working on several ways to expand how NFTs work and the kinds of value they can transmit, and this is one,” Kish said. “Others are coming as well.”Barriers to break downPrice, complexity, scalability and consistency are four obstacles in the Web3 publishing progress, and the Cortex Content Network intends to overcome them. The Network will act as a “complete stack to enable not only a fast and reliable decentralized content environment for Web3, but scalable as well,” according to the Cortex App blog.  Further work is needed before the Network is ready for prime time. “We are working with partners now on testing elements of the network, but we don’t have an exact date,” Kish said. “We do expect to be able to provide an exact date for launch in the month of June.” More

Written by

Jason Perlow, Senior Technology Editor

Jason Perlow
Senior Technology Editor

Jason Perlow is a technologist with over two decades of experience integrating large heterogeneous multi-vendor computing environments in Fortune 500 companies. His expressed views do not necessarily represent those of his employer, The Linux Foundation.

Full Bio

While on vacation, I considered my response to Elon Musk buying Twitter and whether it would differ from the kneejerk analysis we already have. As a general rule, when I write about subjects related to technology, I try to take a different angle than what is already covered. So I’m not going to take the “Let’s all quit Twitter” viewpoint, or “Elon Musk should be prohibited from buying Twitter” standpoint, or even the “Twitter is going to hell in a neoconservative handbasket” perspective.But we should examine why we care about Twitter at all. It serves an important function, as an instantaneous publicly viewable broadcast message bus, for individuals, brands, governments, and everything in-between. But it also has many weaknesses, including that it is not a public good — it is a corporation, and if Elon Musk gets his way, it will be again a privately owned one.

Therefore, short of government policies limiting its powers, how Twitter is run, its overall technology vision and its enforced policies will always reflect its ownership and designated management. This is also true of Facebook and its various internet properties, although their basic functionality is different and much broader in scope than Twitter.If Twitter is to be owned by Elon Musk, there will be a change of leadership and potentially ethical direction in terms of what content and what influencing entities will be permitted on the platform. We can debate endlessly about what systemic changes will occur under Musk and whether they will be good or bad. But the world outside Twitter will always be in a state of flux, as governments and leaders come and go, as does what the public feels is ethically permissible to be broadcasted versus what is unethical or repugnant.This is why I believe that microblogging – the generic term for the type of service that Twitter is — needs to be a fundamental part of the Internet’s infrastructure, much in the same way that SMTP email, DNS, and the Web are. And in the same way that those services are standardized, from a protocol standpoint, via organizations such as the ISO, ANSI, Ecma, and IEC.I don’t know how many Twitter-like services we need, whether it is a dozen, a hundred, or a thousand. Or tens of thousands. But is clear that there are many types of voices on Twitter, all of which are competing to be heard and are subject to unknown algorithms that determine whose voices are surfaced and when. But suppose a community of voices is vocal enough or wants to amplify itself. In that case, it should be able to host its own microblogging platform if it is permitted in the country where it chooses to home itself and has the resources to do so. Also: Forget the algorithm: Here’s what really makes Twitter uniqueIt doesn’t matter whether it is a government entity, the academic and scientific community, a vertical industry, or any group of people that decides it wants its own platform — a reason to form a microblogging community requires a viewpoint, a common objective, what have you.Assume that we can create an international standard for a microblogging protocol and API, which determines client/server connectivity. Assume the open source community can create microblogging server infrastructure, clients, and APIs. How do we get them the needed visibility?I believe it is possible to have directory and federation services that would allow all of these to be registered, much like we have registrars for domains. This would allow microblogging clients or systems that can connect to the API to have unified “feeds” of these platforms, including exchanging posts and conversations, much like discussion threads that cross-post within USENET.This is not to say that all microblogging platforms will have an intelligent or thoughtful conversation — but rather, it would be easier to find the ones that do if they are federated under a common set of protocols. This would have the effect of, over time, evening out the “signal to noise ratio” as more and more microblogging platforms emerge and become discoverable. The quality of conversation would increase, while the insanity that often takes over Twitter would be reduced.This is a vision for how we can create a more decentralized (and therefore less susceptible to capture by any one entity, government, or otherwise) social media platform. A platform where people can voluntarily associate themselves with like-minded individuals.Blockchain technologies and other content provenance and authentication technologies, such as C2PA, could ensure transactional and referential integrity between systems and prove ownership of posted content. Various open authentication mechanisms, which have already been standardized on other platforms, such as Google ID, Microsoft ID, Facebook, and yes, Apple, Amazon, and Twitter, could be used for single sign-on. Accounts could be created and consolidated on these platforms, including allowing accounts from one system to participate in another via trust relationships. This is possible, but it requires a community of people who see value in decentralization. Who will build this? I don’t know. But if we don’t, somebody else will, and they may not have our best interests in mind.Also: No, Elon, Twitter will never be a platform for ‘Free Speech’Having a distributed network of dozens, thousands, and tens of thousands of microblogging platforms raises its own issues. How a platform or an individual gets “canceled” from another and which platforms continue to allow such objectionable content will be endlessly debated. A new form of politics will be involved when a specific group or account engages in behavior another community finds objectionable.Will offending accounts and platforms be suspended, with trust relationships severed? Will the platforms change their terms of service to disallow certain speech or behavior not in line with their values? If we don’t start down this path towards decentralization and alternative networks for communication, we will never find out.The benefits here outweigh the negatives, as again, we would not depend on the whims of a single entity as to how it adjudicates conflict. Nor are we limiting ourselves to a single nation, company, or even a single management philosophy. We take back control of the internet from those few who wish to manipulate us and hold the keys to our platforms. We would get to run our communities the way we want — and we will fail quickly when we create environments that do not provide the functionality, atmosphere, and value sets that its users want and succeed when we do.I believe that this is the next step in the evolution of the internet, and it starts with you. You can be part of the solution by helping to create these communities or platform providers. You can use your skills in software development, system administration, design, user experience, or business to make this happen.The time is now. Let’s build a better internet together.

Social Networking More