Explore real-time threat detection in post-quantum AI inference environments. Learn how to protect against evolving threats and secure model context protocol (mcp) deployments with future-proof security solutions.
The post Real-time threat detection for post-quantum AI inference environments. appeared first on Security Boulevard.
Are Businesses Ready to Trust AI with Their Most Sensitive Data? The discussion around trusting AI with sensitive data is both inevitable and essential. With AI systems increasingly integrated into business processes, the question now revolves around how businesses can ensure that these technologies handle sensitive data responsibly and securely. Understanding the Complexity of Non-Human […]
The post How can businesses trust AI to handle sensitive data appeared first on Entro.
The post How can businesses trust AI to handle sensitive data appeared first on Security Boulevard.
How Can Organizations Effectively Manage Non-Human Identities? Have you ever considered how the digital backbone of your organization is secured when it comes to managing the vast array of Non-Human Identities (NHIs)? With technology continues to evolve at a rapid pace, the complexity of managing these machine identities is becoming increasingly significant across multiple industries. […]
The post Is the security for Non-Human Identities getting better appeared first on Entro.
The post Is the security for Non-Human Identities getting better appeared first on Security Boulevard.
Are You Effectively Managing Non-Human Identities in AI-Driven Cloud Security? Where technology underpins every business function, the security of machine identities—known as Non-Human Identities (NHIs)—has become paramount. But how well are organizations managing these NHIs, especially in AI-driven cloud security? Understanding Non-Human Identities Within Cloud Security Non-Human Identities are essentially digital passports issued to machine […]
The post Can AI-driven cloud security assure full data protection appeared first on Entro.
The post Can AI-driven cloud security assure full data protection appeared first on Security Boulevard.
How Do Machine Identities Shape Cloud Security? What role do machine identities play, particularly within cloud environments? When organizations continue to transform digitally, the focus on securing machine identities, known as Non-Human Identities (NHIs), becomes increasingly paramount. NHIs consist of a “secret”—such as an encrypted password, token, or key—and the permissions granted to that secret. […]
The post What support is available for implementing Agentic AI systems appeared first on Entro.
The post What support is available for implementing Agentic AI systems appeared first on Security Boulevard.
NDSS 2025 - Automated Data Protection For Embedded Systems Via Data Flow Based Compartmentalization
Session 7B: Trusted Hardware and Execution
Authors, Creators & Presenters: Zelun Kong (University of Texas at Dallas), Minkyung Park (University of Texas at Dallas), Le Guan (University of Georgia), Ning Zhang (Washington University in St. Louis), Chung Hwan Kim (University of Texas at Dallas)
PAPER
TZ-DATASHIELD: Automated Data Protection For Embedded Systems Via Data-Flow Based Compartmentalization
As reliance on embedded systems grows in critical domains such as healthcare, industrial automation, and unmanned vehicles, securing the data on micro-controller units (MCUs) becomes increasingly crucial. These systems face significant challenges related to computational power and energy constraints, complicating efforts to maintain the confidentiality and integrity of sensitive data. Previous methods have utilized compartmentalization techniques to protect this sensitive data, yet they remain vulnerable to breaches by strong adversaries exploiting privileged software. In this paper, we introduce TZ-DATASHIELD, a novel LLVM compiler tool that enhances ARM TrustZone with sensitive data flow (SDF) compartmentalization, offering robust protection against strong adversaries in MCU-based systems. We address three primary challenges: the limitations of existing compartment units, inadequate isolation within the Trusted Execution Environment (TEE), and the exposure of shared data to potential attacks. TZ-DATASHIELD addresses these challenges by implementing a fine-grained compartmentalization approach that focuses on sensitive data flow, ensuring data confidentiality and integrity, and developing a novel intra-TEE isolation mechanism that validates compartment access to TEE resources at runtime. Our prototype enables firmware developers to annotate source code to generate TrustZone-ready firmware images automatically. Our evaluation using real-world MCU applications demonstrates that TZ-DATASHIELD achieves up to 80.8% compartment memory and 88.6% ROP gadget reductions within the TEE address space. It incurs an average runtime overhead of 14.7% with CFI and DFI enforcement, and 7.6% without these measures.
ABOUT NDSS
The Network and Distributed System Security Symposium (NDSS) fosters information exchange among researchers and practitioners of network and distributed system security. The target audience includes those interested in practical aspects of network and distributed system security, with a focus on actual system design and implementation. A major goal is to encourage and enable the Internet community to apply, deploy, and advance the state of available security technologies.
Our thanks to the Network and Distributed System Security (NDSS) Symposium for publishing their Creators, Authors and Presenter’s superb NDSS Symposium 2025 Conference content on the Organizations' YouTube Channel.
The post NDSS 2025 – Automated Data Protection For Embedded Systems Via Data Flow Based Compartmentalization appeared first on Security Boulevard.
Welcome to the second installment of this comprehensive annual look at global cybersecurity industry prediction reports from the top security vendors, publications and thought leaders.
The post The Top 26 Security Predictions for 2026 (Part 2) appeared first on Security Boulevard.
How Are Non-Human Identities Changing the Cybersecurity Landscape? What if the biggest vulnerability in your cybersecurity strategy was not a human error but a machine identity left unchecked? Secrets vaulting solutions are increasingly seen as critical components of impenetrable security strategies. In domains like finance, healthcare, travel, and more, the integration of Non-Human Identities (NHIs) […]
The post How impenetrable are secrets vaulting solutions appeared first on Entro.
The post How impenetrable are secrets vaulting solutions appeared first on Security Boulevard.
How Secure Are Your Non-Human Identities? Have you ever wondered how well your organization handles Non-Human Identities (NHIs) within your cybersecurity framework? With technology progresses, so does the complexity of managing machine identities and their associated secrets. These NHIs are crucial for maintaining secure interactions among systems, especially in cloud environments. However, the pressing question […]
The post Are current PAM solutions capable of handling NHIs appeared first on Entro.
The post Are current PAM solutions capable of handling NHIs appeared first on Security Boulevard.
How Can Organizations Implement a Free AI Compliance Strategy Effectively? Are you fully prepared to leverage AI while remaining compliant with regulations? Where enterprises increasingly rely on artificial intelligence, maintaining compliance with regulatory standards is not just essential but also a strategic priority. A robust AI compliance strategy that doesn’t strain budgets is crucial for […]
The post What does a free to implement AI compliance strategy look like appeared first on Entro.
The post What does a free to implement AI compliance strategy look like appeared first on Security Boulevard.
Session 7B: Trusted Hardware and Execution
Authors, Creators & Presenters: Stefan Gast (Graz University of Technology), Hannes Weissteiner (Graz University of Technology), Robin Leander Schröder (Fraunhofer SIT, Darmstadt, Germany and
Fraunhofer Austria, Vienna, Austria), Daniel Gruss (Graz University of Technology) |
PAPER
CounterSEVeillance: Performance-Counter Attacks On AMD SEV-SNP
Confidential virtual machines (VMs) promise higher security by running the VM inside a trusted execution environment (TEE). Recent AMD server processors support confidential VMs with the SEV-SNP processor extension. SEV-SNP provides guarantees for integrity and confidentiality for confidential VMs despite running them in a shared hosting environment. In this paper, we introduce CounterSEVeillance, a new side-channel attack leaking secret-dependent control flow and operand properties from performance counter data. Our attack is the first to exploit performance counter side-channel leakage with single-instruction resolution from SEV-SNP VMs and works on fully patched systems. We systematically analyze performance counter events in SEV-SNP VMs and find that 228 are exposed to a potentially malicious hypervisor. CounterSEVeillance builds on this analysis and records performance counter traces with an instruction-level resolution by single-stepping the victim VM using APIC interrupts in combination with page faults. We match CounterSEVeillance traces against binaries, precisely recovering the outcome of any secret-dependent conditional branch and inferring operand properties. We present four attack case studies, in which we exemplarily showcase concrete exploitable leakage with 6 of the exposed performance counters. First, we use CounterSEVeillance to extract a full RSA-4096 key from a single Mbed TLS signature process in less than 8 minutes. Second, we present the first side-channel attack on TOTP verification running in an AMD SEV-SNP VM, recovering a 6-digit TOTP with only 31.1 guesses on average. Third, we show that CounterSEVeillance can leak the secret key from which the TOTPs are derived from the underlying base32 decoder. Fourth and finally, we show that CounterSEVeillance can also be used to construct a plaintext-checking oracle in a divide-and-surrender-style attack. We conclude that moving an entire VM into a setting with a privileged adversary increases the attack surface, given the vast amounts of code not vetted for this specific security setting.
ABOUT NDSS
The Network and Distributed System Security Symposium (NDSS) fosters information exchange among researchers and practitioners of network and distributed system security. The target audience includes those interested in practical aspects of network and distributed system security, with a focus on actual system design and implementation. A major goal is to encourage and enable the Internet community to apply, deploy, and advance the state of available security technologies.
Our thanks to the Network and Distributed System Security (NDSS) Symposium for publishing their Creators, Authors and Presenter’s superb NDSS Symposium 2025 Conference content on the Organizations' YouTube Channel.
The post NDSS 2025 – CounterSEVeillance: Performance-Counter Attacks On AMD SEV-SNP appeared first on Security Boulevard.
If you’re building fraud prevention, risk scoring, or identity enrichment into a product, your outcomes depend on one thing: the quality of your identity data. A lot of identity data on the market is broad but unverified: raw broker feeds, unvalidated dumps, or stale breach lists. That data creates risk, noise, and wasted engineering time. …
The post What “Verified Identity Data” Means for APIs — and How to Evaluate a Data Partner appeared first on Security Boulevard.
2025 has emerged as one of the most disruptive years for cybersecurity, marked by unprecedented breach volumes, record-breaking credential leaks, and cascading supply-chain failures. Across just 12 months, cyber incidents have impacted governments, healthcare systems, financial institutions, SaaS providers, airlines, retailers, and critical infrastructure, proving that no industry or geography remains insulated. 2025 Global Cybersecurity […]
The post Inside the Biggest Cyber Attacks of 2025 appeared first on Kratikal Blogs.
The post Inside the Biggest Cyber Attacks of 2025 appeared first on Security Boulevard.
New research:
Abstract: Coleoid cephalopods have the most elaborate camouflage system in the animal kingdom. This enables them to hide from or deceive both predators and prey. Most studies have focused on benthic species of octopus and cuttlefish, while studies on squid focused mainly on the chromatophore system for communication. Camouflage adaptations to the substrate while moving has been recently described in the semi-pelagic oval squid (Sepioteuthis lessoniana). Our current study focuses on the same squid’s complex camouflage to substrate in a stationary, motionless position. We observed disruptive, uniform, and mottled chromatic body patterns, and we identified a threshold of contrast between dark and light chromatic components that simplifies the identification of disruptive chromatic body pattern. We found that arm postural components are related to the squid position in the environment, either sitting directly on the substrate or hovering just few centimeters above the substrate. Several of these context-dependent body patterns have not yet been observed in ...
The post Friday Squid Blogging: Squid Camouflage appeared first on Security Boulevard.
How Does a Smart AI System Enhance Managing Secrets in Cybersecurity? Have you ever wondered how a smart AI system revolutionizes the way we manage secrets in cybersecurity? The evolution of technology is as thrilling as it is vital, especially concerning Non-Human Identities (NHIs). NHIs, essentially machine identities, are becoming integral to robust cybersecurity frameworks. […]
The post What makes an AI system smart in managing secrets appeared first on Entro.
The post What makes an AI system smart in managing secrets appeared first on Security Boulevard.
Are Non-Human Identities the Missing Piece in Your Cybersecurity Strategy? How often do we consider the importance of non-human identities (NHIs)? These machine identities are increasingly at the forefront of security strategies, especially for organizations operating in the cloud. By managing NHIs effectively, businesses can bridge the gap between security and R&D teams, creating a […]
The post How can secrets security fit within a tight IT budget appeared first on Entro.
The post How can secrets security fit within a tight IT budget appeared first on Security Boulevard.
Are you effectively addressing the cybersecurity challenges associated with Non-Human Identities (NHIs)? The management of Non-Human Identities (NHIs) has become a critical aspect of cybersecurity strategies. NHIs, or machine identities, are often overlooked despite being the backbone of secure digital operations. They play a pivotal role in industries like financial services, healthcare, and more. With […]
The post How to stay ahead in managing NHIs effectively appeared first on Entro.
The post How to stay ahead in managing NHIs effectively appeared first on Security Boulevard.
How Can Effective NHI Management Contribute to Cloud Compliance? Have you ever wondered how the seamless integration of Non-Human Identities (NHIs) and Secrets Security Management can significantly enhance cloud compliance and make tech leaders more relaxed? With the expansion of digital infrastructure, managing NHIs has become crucial for organizations aiming to secure their cloud environments […]
The post Can cloud compliance make tech leaders feel more relaxed appeared first on Entro.
The post Can cloud compliance make tech leaders feel more relaxed appeared first on Security Boulevard.
Session 7B: Trusted Hardware and Execution
Authors, Creators & Presenters: Ganxiana Yana (Shanghai Jiao Tona Universitv). Chenvana Liu (Shanghai Jiao Tong Universitv). Zhen Huana (Shanghai Jiao Tona Universitv). Guoxina Chen (Shanghail Ganxiang Yang (Shanghai Jiao Tong University), Chenyang Liu (Shanghai Jiao Tong University), Zhen Huang (Shanghai Jiao Tong University), Guoxing Chen (Shanghai Jiao Tong University), Hongfei Fu (Shanghai Jiao Tong University), Yuanyuan Zhang (Shanghai Jiao Tong University), Hao|in Zhu (Shanghai Jiao Tong University
PAPER
A Formal Approach to Multi-Layered Privileges for Enclaves
Trusted Execution Environments (TEE) have been widely adopted as a protection approach for security-critical applications. Although feature extensions have been previously proposed to improve the usability of enclaves, their provision patterns are still confronted with security challenges. This paper presents Palantir, a verifiable multi-layered inter-enclave privilege model for secure feature extensions to enclaves. Specifically, a parent-children inter-enclave relationship, with which a parent enclave is granted two privileged permissions, the Execution Control and Spatial Control, over its children enclaves to facilitate secure feature extensions, is introduced. Moreover, by enabling nesting parent-children relationships, Palantir achieves multi-layered privileges (MLP) that allow feature extensions to be placed in various privilege layers following the Principle of Least Privilege. To prove the security of Palantir, we verified that our privilege model does not break or weaken the security guarantees of enclaves by building and verifying a formal model named TAPinfty. Furthermore, We implemented a prototype of Palantir on Penglai, an open-sourced RISC-V TEE platform.
ABOUT NDSS
The Network and Distributed System Security Symposium (NDSS) fosters information exchange among researchers and practitioners of network and distributed system security. The target audience includes those interested in practical aspects of network and distributed system security, with a focus on actual system design and implementation. A major goal is to encourage and enable the Internet community to apply, deploy, and advance the state of available security technologies.
Our thanks to the Network and Distributed System Security (NDSS) Symposium for publishing their Creators, Authors and Presenter’s superb NDSS Symposium 2025 Conference content on the Organizations' YouTube Channel.
The post NDSS 2025 – A Formal Approach To Multi-Layered Privileges For Enclaves appeared first on Security Boulevard.
In this episode of The Defenders Log, Paul Mockapetris, the architect of DNS, discusses the evolving role of the Domain Name System from a simple directory to a sophisticated security tool. He posits that modern networking requires “making sure DNS doesn’t work when you don’t want it to,” comparing DNS filtering to essential services like spam filters and firewalls.
Key Security ConceptsMockapetris highlights how companies like ThreatSTOP use DNS intelligence to “craft” a network. By utilizing threat feeds, organizations can block traffic based on:
The conversation shifts to the impact of AI, with Mockapetris warning that trillions of automated agents will soon accelerate the scale of spam and network “jabber.” He also critiques the rapid adoption of DNS over HTTPS (DoH), noting that while hyperscalers like Google and Mozilla have improved privacy, they have often removed the network operator’s ability to configure and understand their own traffic.
Finally, the dialogue touches on the tension between centralization and distribution. While entities like Amazon appear centralized, they operate as massive distributed systems internally. Mockapetris and David Redekop conclude that while centralized services offer convenience, maintaining distributed architectures is vital for long-term data sovereignty and network resilience.
Full episode of The Defender’s Log here:
The Architect of the Internet on the Future of Trust | Dr. Paul Mockapetris | Defender's Log
TL;DRView it on YouTube: https://www.youtube.com/watch?v=lgLF8Amm9QE
Listen to the episode on your favourite podcast platform:
Spotify
https://open.spotify.com/episode/6pmeUMvHYqGDTVy7Iogz0l
ADAMnetworks
https://adamnet.works
Paul Mockapetris: One of the things people ask me a lot is, ‘How did you get this important job designing the DNS?’
David Redekop: I think it’s quite staggering how much the internet has grown and how it continues to grow in the domain name space.
Paul Mockapetris: And I said, ‘My day job is making sure that DNS doesn’t work when you don’t want it to.’ That is really the whole tagline.
David Redekop: You know, when I think about the browser being a user agent, it is my agent, and I am to tell my agent what to do.
Paul Mockapetris: There’s lots of ways to decide who you… you know, people say for some reason that DNS is censorship. And I always tell people that the DNS is the result of some of my experiences…
Chapter 1 Video Transcript: Does ThreatSTOP Make Your Network Safer?Paul Mockapetris: Another interesting direction is in my day job. I tell people, ‘Well, my day job is making sure that DNS doesn’t work.’ And they say, ‘What?’ And I said, ‘My day job is making sure that DNS doesn’t work when you don’t want it to is really the whole tagline.’ And that has to do with just basic security. You know, what you want to do is you wouldn’t do email without spam filtering, right? And you probably wouldn’t set up your own network without a firewall. So you have to do the same stuff at the IP and DNS level if you want to have a useful network. So what, you know, what ThreatSTOP does is it provides the raw data and intelligence so you can craft your network. And what that means, for example, is if you come to us and you want to say, ‘We want to make all IP addresses and domain names that are in the part of the Ukraine that the Russians control, we want to not talk to them.’ Okay, because, well, we don’t really want to backhaul their drone traffic or whatever. That’s an extreme example, but there’s lots of commercial companies that just say, ‘Hey, I have a set of customers that I want to deal with.’ You know, maybe that’s geographical because I’m delivering my pies with a limited radius or they go bad, or certainly if I was in the croissant business, that would be it. But there’s lots of looky-loos and there’s lots of people that are just surveying the network and looking for vulnerabilities and so forth. So what we say is that you want to kind of tailor your internet experience, and that means there’s a bunch of domain names that you really don’t want to resolve. You know, one of the things that people do to you, you can use the credit card companies to help your security. And you might say, ‘How does that work?’ Well, one of the things you can do is there’s a threat feed that says, ‘Don’t resolve a domain name if it’s less than seven days old.’ Well, why is that? Well, because if a domain name is registered for fraudulent purposes, it’s probably done with a fraudulent credit card, and the chargeback mechanism will take that domain name away. So if you only deal with domain names that have at least seven days of age on them, then you’re going to spare yourself a lot of threats. Anyway, there’s lots of ways to decide who you want. You know, people say for some reason that DNS is censorship. It’s okay to do IP addresses and it’s okay to do email filtering, but somewhere in between in that layer in between in the stack, it’s censorship. Well, it is if, if somebody is forcing that filter on you. But if you’re just configuring, if you’re running a business and you only want to talk to people that are customers rather than potential attackers, you know, it’s just rational to do that. And that’s something I never thought about way back when. And actually, the thing that’s kind of amusing about that is you can use the DNS to keep track of the parts of the DNS that you don’t want to talk to. So there’s kind of the shadow namespace that’s out there. I can download the zones and the DNS data that various people have about who you shouldn’t talk to or, you know, various other kinds of restrictions. And you use the DNS to keep track of what parts of the DNS you don’t want to have work, which is kind of an interesting application. And this blacklist, you know, distribution by DNS has been going on for over a decade now at both the IP level and the DNS level. And it’s just a way for making a tailored internet that helps you do what you want to do. But I never thought way back when that you’d be doing that. I certainly didn’t think that we’d be using AI. And when you think about AI, you know, it’s going to be… it’s bad enough when you have a few billion users, but, you know, you probably could easily have a trillion agents that are out there jabbering, right? You know, how are they going to do their thing? Because they’re certainly going to do it faster. And you know, how do you think about the mismatch about having all of these agents all of a sudden deciding that they want to talk to you? You know, it’s bad enough with the spam that you get now; it’s going to get worse in the future. I’m sorry, I’ve been rattling on there.
David Redekop: This is exactly what I was hoping for. We don’t give, we don’t listen to voices like yours often enough, often enough in our industry. And I really, I was looking forward to you just speaking the entire time. If I don’t have a single question to ask, that’s, that’s a good thing because that means that your voice and what you think is important ends up getting heard.
Chapter 2 Video Transcript: Does ThreatSTOP Make Your Network Safer?Paul Mockapetris: Another interesting direction is in my day job. I tell people, ‘Well, my day job is making sure that DNS doesn’t work.’ And they say, ‘What?’ And I said, ‘My day job is making sure that DNS doesn’t work when you don’t want it to is really the whole tagline.’ And that has to do with just basic security. You know, what you want to do is you wouldn’t do email without spam filtering, right? And you probably wouldn’t set up your own network without a firewall. So you have to do the same stuff at the IP and DNS level if you want to have a useful network.
So what, you know, what ThreatSTOP does is it provides the raw data and intelligence so you can craft your network. And what that means, for example, is if you come to us and you want to say, ‘We want to make all IP addresses and domain names that are in the part of the Ukraine that the Russians control, we want to not talk to them.’ Okay, because, well, we don’t really want to backhaul their drone traffic or whatever. That’s an extreme example, but there’s lots of commercial companies that just say, ‘Hey, I have a set of customers that I want to deal with.’ You know, maybe that’s geographical because I’m delivering my pies with a limited radius or they go bad, or certainly if I was in the croissant business, that would be it.
But there’s lots of looky-loos and there’s lots of people that are just surveying the network and looking for vulnerabilities and so forth. So what we say is that you want to kind of tailor your internet experience, and that means there’s a bunch of domain names that you really don’t want to resolve. You know, one of the things that people do to you, you can use the credit card companies to help your security. And you might say, ‘How does that work?’ Well, one of the things you can do is there’s a threat feed that says, ‘Don’t resolve a domain name if it’s less than seven days old.’ Well, why is that? Well, because if a domain name is registered for fraudulent purposes, it’s probably done with a fraudulent credit card, and the chargeback mechanism will take that domain name away. So if you only deal with domain names that have at least seven days of age on them, then you’re going to spare yourself a lot of threats.
Anyway, there’s lots of ways to decide who you want. You know, people say for some reason that DNS is censorship. It’s okay to do IP addresses and it’s okay to do email filtering, but somewhere in between in that layer in between in the stack, it’s censorship. Well, it is if, if somebody is forcing that filter on you. But if you’re just configuring, if you’re running a business and you only want to talk to people that are customers rather than potential attackers, you know, it’s just rational to do that. And that’s something I never thought about way back when.
And actually, the thing that’s kind of amusing about that is you can use the DNS to keep track of the parts of the DNS that you don’t want to talk to. So there’s kind of the shadow namespace that’s out there. I can download the zones and the DNS data that various people have about who you shouldn’t talk to or, you know, various other kinds of restrictions. And you use the DNS to keep track of what parts of the DNS you don’t want to have work, which is kind of an interesting application.
And this blacklist, you know, distribution by DNS has been going on for over a decade now at both the IP level and the DNS level. And it’s just a way for making a tailored internet that helps you do what you want to do. But I never thought way back when that you’d be doing that. I certainly didn’t think that we’d be using AI. And when you think about AI, you know, it’s going to be… it’s bad enough when you have a few billion users, but, you know, you probably could easily have a trillion agents that are out there jabbering, right? You know, how are they going to do their thing? Because they’re certainly going to do it faster. And you know, how do you think about the mismatch about having all of these agents all of a sudden deciding that they want to talk to you? You know, it’s bad enough with the spam that you get now; it’s going to get worse in the future. I’m sorry, I’ve been rattling on there.
David Redekop: This is exactly what I was hoping for. We don’t give, we don’t listen to voices like yours often enough, often enough in our industry. And I really, I was looking forward to you just speaking the entire time. If I don’t have a single question to ask, that’s, that’s a good thing because that means that your voice and what you think is important ends up getting heard.
Chapter 3 On the Role of DNS and SecurityPaul Mockapetris: "One of the things people ask me a lot is, ‘How did you get this important job designing the DNS?’ Another interesting direction is in my day job—I tell people, ‘Well, my day job is making sure that DNS doesn’t work.’ And they say, ‘What?’ And I said, ‘My day job is making sure that DNS doesn’t work when you don’t want it to.’ That is really the whole tagline.
And that has to do with just basic security. You know, what you want to do is—you wouldn’t do email without spam filtering, right? And you probably wouldn’t set up your own network without a firewall. So you have to do the same stuff at the IP and DNS level if you want to have a useful network.
So what ThreatSTOP does is it provides the raw data and intelligence so you can craft your network. And what that means, for example, is if you come to us and you want to say, ‘We want to make all IP addresses and domain names that are in the part of the Ukraine that the Russians control… we want to not talk to them.’ Okay, because, well, we don’t really want to backhaul their drone traffic or whatever. That’s an extreme example, but there’s lots of commercial companies that just say, ‘Hey, I have a set of customers that I want to deal with.’ You know, maybe that’s geographical because I’m delivering my pies within a limited radius or they go bad—certainly, if I was in the croissant business, that would be it.
But there’s lots of looky-loos and there’s lots of people that are just surveying the network and looking for vulnerabilities and so forth. So what we say is that you want to kind of tailor your internet experience, and that means there’s a bunch of domain names that you really don’t want to resolve.
David Redekop: I think it’s quite staggering how much the internet has grown and how it continues to grow in domain name space. When I think about the browser being a user agent, it is my agent, and I am to tell my agent what to do.
The Philosophy of Control and FilteringPaul Mockapetris: You can use the credit card companies to help your security. And you might say, ‘How does that work?’ Well, one of the things you can do is there’s a threat feed that says, ‘Don’t resolve a domain name if it’s less than seven days old.’ Well, why is that? Well, because if a domain name is registered for fraudulent purposes, it’s probably done with a fraudulent credit card, and the chargeback mechanism will take that domain name away. So if you only deal with domain names that have at least seven days of age on them, then you’re going to spare yourself a lot of threats.
Anyway, there’s lots of ways to decide who you want. You know, people say for some reason that DNS is censorship. It’s okay to do IP addresses and it’s okay to do email filtering, but somewhere in between—in that layer in between in the stack—it’s censorship. Well, it is if somebody is forcing that filter on you. But if you’re just configuring—if you’re running a business and you only want to talk to people that are customers rather than potential attackers—you know, it’s just rational to do that. And that’s something I never thought about way back when.
And actually, the thing that’s kind of amusing about that is you can use the DNS to keep track of the parts of the DNS that you don’t want to talk to. So there’s kind of the shadow namespace that’s out there. I can download the zones and the DNS data that various people have about who you shouldn’t talk to or various other kinds of restrictions. And you use the DNS to keep track of what parts of the DNS you don’t want to have work, which is kind of an interesting application.
This blacklist distribution by DNS has been going on for over a decade now at both the IP level and the DNS level. And it’s just a way for making a tailored internet that helps you do what you want to do. But I never thought way back when that you’d be doing that. I certainly didn’t think that we’d be using AI. And when you think about AI, you know, it’s going to be… it’s bad enough when you have a few billion users, but, you know, you probably could easily have a trillion agents that are out there jabbering, right? You know, how are they going to do their thing? Because they’re certainly going to do it faster. And you know, how do you think about the mismatch about having all of these agents all of a sudden deciding that they want to talk to you? You know, it’s bad enough with the spam that you get now; it’s going to get worse in the future. I’m sorry, I’ve been rattling on there.
DNS over HTTPS (DoH) and User ChoiceDavid Redekop: Paul, I have so many questions lined up since you were speaking, and we don’t have time to get to most of them, so I’ll pick my best shot. One is in the area of DoH. You mentioned earlier about how hyperscalers are the ones that are architecting the future direction, and I noticed that is exactly how DoH was adopted so incredibly fast. It was through the combined effort, as I understand it, between Mozilla with how they implemented quickly in Firefox, and how Cloudflare was one of the first, if not the first, to offer it on their recursive resolver. And that seemed to ruffle a lot of feathers, especially those of us that are in the defensive space. Talk to me about how—give me a broad picture of what your experience was, how we got there, but then also how you feel about DoH today.
Paul Mockapetris: You know, I think that the Microsofts of the world and the Apples of the world owe us a better way to choose what DoH we want to use. You know, people that operate networks would like to be able to understand what the traffic is on their network. You referred to the encrypted connection coming out of my TV set going somewhere and we’re not sure why. Once my TV set gets a camera, I think it’s going to be game over. And why is it ‘quad eight’ and so forth? So I think the question is, there’s an ease of use and it should be easy for me to decide what configurations I’m going to allow. And the design doesn’t make that desirable or possible, and they probably didn’t want to. I mean, they’re optimizing the environment that they want to have.
Centralization vs. DistributionPaul Mockapetris: Sometimes if you want, you can go take a look at—are you familiar with the real-time bidding network?
David Redekop: I am not.
Paul Mockapetris: Okay, so supposing I just popped up the New York Times on my browser here. In the corner of the front page, there’s going to be an ad for something. How did that ad get there? Well, in the background what happened is that the information that’s been collected is sent out to a hundred different organizations to say, ‘Hey, do you want to pay to put an ad in this space?’ And those organizations may just be collecting that information for their own purposes and never want to place an ad, or they may be bidding to put the ad in place. And that’s all done in the background. It’s fascinating to me how all of my information gets exported in milliseconds or microseconds in the background. And it’s kind of the way that a lot of the content that you see gets put up because there’s more ads probably than useful content on what you look at. You just tune it out.
David Redekop: How much of the centralization efforts—some of the ones that you just described—are as a direct result of it making the world faster, and commercial entities have found a way to capitalize on that and make a profit out of delivering a better end-user experience? Without going down to conspiracy theories, how much of it do you think is just a function of economics?
Paul Mockapetris: I mean, you know, people say, ‘Oh, the network is less distributed.’ One of the things is that if you take a look at any of these Amazons or Googles or whatever, their interior is a huge distributed system, right? So the question is: to whom does the benefits of distribution accrue? So Amazon, Akamai, content distribution networks… to the outside world it looks like centralization. In a way it is—it’s sort of like centralization of ownership, although the distribution takes place within that ownership. So it’s a yin and yang.
But at any rate, messaging seems to be the hope of the rebel alliance here. I’m not sure, but they face a lot of the same things. They go, ‘Okay, we can figure out how to do end-to-end messaging between you and I, but what if you’re not online? Where do I store the message so you can pick it up?’ You know, there’s a bunch of those issues.
The Evolution of Network MetricsDavid Redekop: We internally for our own team use the Matrix protocol and host our own, and that’s our way of making sure that we maintain sovereign data custody out of all of the internal messaging. But it’s kind of like the mail systems approach. The reason Gmail—or the reason Google and Microsoft own the bulk of mailboxes around the world—is because it’s easily done, right? With economics, they’ve solved a problem that otherwise requires a tremendous amount of maintenance. I mean, when our Matrix environment needs maintenance, it affects all of us, and so we don’t have the level of uptime as WhatsApp, as Signal, or as Microsoft 365. But the price you pay for distribution isn’t worth it if you don’t attach a value to the distributed architecture. To me, it seems somehow we need to continue to foster the culture of distributed systems being the better long play. Non-distributed systems is a short game versus distributed being a better long game.
Paul Mockapetris: Yeah, if you believe the economics will change—you know, quantum computing or whatever—the engineering changes. A long time ago I read this paper talking about the design of the ARPANET IMPs and how there was a balance between the amount of memory you had, the processing speed, and the link speed. Certainly, the processing speed has gone up, although it’s sort of hit a little bit of a wall. You hear about people building 20 GHz silicon, Moore’s Law, memory size has gone up, and fiber optics—the bandwidth that you have available there has certainly scaled up. So if you design a system to exist 100% optimized for the current settings, well those settings are probably going to change over time. It’s just like the UDP packet size; it’s going to change, isn’t it? Well, I would sort of hope so. It’s kind of funny—remember once upon a time people said, ‘Oh, ATM is going to solve this by having short, fixed-length packets’? And today’s largest Ethernet packets take up less time on the fiber optics than an ATM cell would way back when, because of the length of the bit train in nanoseconds. It’s gotten shorter.
David Redekop: You mentioned about the relationship between memory and process and link speed, and that reminded me of where we are today. When we look at the quality of an internet connection like this call, we’re actually looking for a different set of three, because it’s assumed now that link and process and memory are no longer a limiting factor. And now we’re thinking about packet loss, latency, and jitter as the three key metrics that determine the quality of our call, right?
Paul Mockapetris: Right. Although, as long as we’re riding the ‘more is better’ curve, we’re going to keep driving it.
David Redekop: This is exactly what I was hoping for. We don’t listen to voices like yours often enough in our industry. If I don’t have a single question to ask, that’s a good thing, because it means that your voice and what you think is important ends up getting heard.
1 post - 1 participant
The post TDL 012 | The Architect of the Internet on the Future of Trust appeared first on Security Boulevard.
