August 2023 Summaries

Accidental cloud misconfigurations are a significant security threat, accounting for 7-15% of data breaches, as highlighted in reports like the 2023 Verizon DBIR and IBM Cost of a Data Breach. This threat arises from factors such as lack of familiarity with cloud technologies, inconsistent changes due to non-template processes, complex cloud implementations, and misinterpretation of configurations, often involving system/cloud admins and developers/engineers. Vulnerabilities include excessive IAM privileges, exposed or insecure data storage, limited encryption, and suboptimal authentication methods. Effective mitigation strategies encompass data encryption at rest and in transit, implementing cloud security posture management (CSPM) solutions, enforcing consistent CI/CD processes, detailed logging, monitoring for unusual behavior, deploying data loss prevention (DLP) solutions, and applying strict access control policies, including two-factor authentication (2FA). The rapidly evolving cloud security domain demands continuous dedication and adaptability to protect sensitive data from breaches, with encryption playing a crucial role in safeguarding against unauthorized access.

In a podcast episode, Shane engages with Tamás Henning, the Senior Director of Security Engineering at Circle, a financial technology firm leveraging digital currencies and blockchain for various applications. Henning, who has a background spanning roles at Skype, Microsoft, Roblox, and Facebook's blockchain initiative, discusses the intertwined nature of privacy and security, emphasizing that trust is foundational to both. He highlights the evolution of security from a policing function to a business enabler, suggesting that security teams should aim to facilitate business success while managing risk. Henning also notes the advanced security mindset in the web3 ecosystem compared to traditional web2 spaces, attributing this to the immediate financial risks and vulnerabilities inherent in blockchain technologies. He expresses enthusiasm for emerging technologies that integrate web3, security, and threat intelligence, seeing potential in startups that could revolutionize compliance through code. Henning admires the collaborative efforts of security communities, especially in crises like Log4J, and lauds the proactive approach of Microsoft's Security Response Center in preventing global cyber threats.

The blog entry explores supply chain attacks, a type of cybersecurity threat where attackers compromise a single source to gain access to multiple targets by moving laterally. These attacks are typically orchestrated by sophisticated external attackers, such as organized cybercrime syndicates or nation-state actors, who exploit vulnerabilities like inadequate logging and monitoring, misuse of existing accounts, and lack of data encryption. Key attack vectors include remote administrative management capabilities. To mitigate these risks, the blog suggests implementing vendor due diligence, emergency access control, secured log archival, data encryption, backup safeguards, detailed logging, and monitoring. An incident response plan is also recommended, emphasizing the importance of encryption in protecting sensitive information. The text is part of a series on threat models, with future installments addressing threats from accidental cloud misconfiguration.

In a conversation with Developer Advocate Liz Moy on the Decrypt podcast, nmbile Technical Lead Ines Kenova shares her unconventional journey from a non-technical co-founder to a software engineer and technical lead. Ines discusses the challenges she faced when transitioning to tech, including the overwhelming nature of learning programming concepts and the importance of perseverance, motivation, and problem-solving skills. She emphasizes the value of understanding one's motivations for being in tech and the significance of security in the software development lifecycle, advocating for integrating security practices into CI/CD processes. Ines also highlights the importance of continuous learning, sharing her teaching experiences in Python and the common challenges her students face, such as understanding loops and object-oriented programming. Despite the initial struggles, she encourages trying different roles within tech, acknowledging that preferences may evolve over time, and she lauds the collaborative nature of the tech industry, where knowledge sharing is prevalent.

Multi-party computation (MPC) is a category of algorithms that allows computations on private data across multiple devices while maintaining data privacy, gaining attention in an era focused on privacy concerns. Despite its potential and early successful application in scenarios like the 2008 Danish Sugar Beet Auction, MPC's adoption remains limited due to its complexity, difficulty in implementation, and challenges in debugging and reliability. Most applications use centralized servers and legal agreements for privacy, as they offer a simpler path than MPC. Although MPC has seen successful implementations in blockchain and private set intersection (PSI) for password security, these cases are exceptions and not representative of widespread adoption. The future of MPC is uncertain, as it faces significant obstacles, but its application in niche areas suggests potential growth if technological and business model challenges can be overcome.

Evervault has launched several new features and updates, including AI Privacy and Relay Redaction, to enhance data security when integrating with third-party LLMs like OpenAI. AI Privacy uses Relay Redaction to automatically redact sensitive data such as e-PHI/PII before sending it to third parties, ensuring secure data handling without compromising AI output. The new Decrypt API provides customers with greater flexibility by allowing one-off decryptions of encrypted data, facilitating new workflows, and is accessible across all SDKs and as a REST API. Additionally, Evervault has improved the deployment process for Cages to eliminate downtime and has extended support to mobile SDKs for iOS and Android. The company's CEO, Shane, and DevRel Lead, Liz, have launched a podcast titled "Decrypt," where they discuss data security and development trends with industry experts. An upcoming special podcast episode will feature Evervault's design team, offering insights into their creative processes, with listeners encouraged to submit questions for the designers.

Threat modeling is a proactive security strategy that involves understanding a system's intricacies, identifying vulnerabilities, and prioritizing potential threats to devise mitigation plans, aiming to adopt a secure-by-design approach from a project's inception. This blog post, the first in a five-part series, explores threats such as malicious insiders, supply chain attacks, and accidental cloud misconfigurations, using a typical cloud-based stack that handles sensitive data in an internet-facing application. The focus is on insider threats, particularly disgruntled internal users with malicious intent, who can misuse access to sensitive data like health and credit card information. Identified vulnerabilities include overly permissive access and lack of monitoring, while mitigation strategies emphasize strict access control, two-factor authentication, data encryption, logging, monitoring, and regular auditing. These measures, alongside documenting policies and developing incident response plans, help safeguard against insider threats, protect sensitive information, and maintain organizational integrity.