All about Virtualization and Cloud Security | Recent Articles:

In my last blog post I began a conversation about virtual patching. In this post, I’ll further the discussion by talking about why effective virtual patching at the network is so difficult.

The story really begins by considering context, or really, the lack thereof. If a vulnerability exists in an application (a web application, or a browser) there is a certain context associated with the application that is difficult to be aware of at a point outside of the application. The simplest example is a session. A web application may create a session when a user logs-in, destroying the session after a period of inactivity, or when a user logs-out (and when was the last time you logged-out instead of just closing the browser window?).

I am not a partisan of the FUD speeches (FUD = Fear, Uncertainty, Doubt). Today, however, I will pass on the negative side of the speech by sharing with you some thoughts about the tough days we are facing:

1. ”Cyber battle apparently under way in Russia-Ukraine conflict” – remove the word “Cyber”, and this could have been a headline 150 years ago too. Unfortunately we are not talking about the armed conflict the Russians generated in October 1853 under the pretext of protecting the Russian Orthodox people.

I have read quite a bit about virtual patching over the years. Asking Google for a definition and going with one of the first hits I found this reasonable explanation from OWASP:

“A security policy enforcement layer which prevents the exploitation of a known vulnerability.”

Really, it’s something on the network or on an endpoint that inspects traffic, most often HTTP(s) for signs of an attempt to exploit a vulnerability (usually in a web application). 

Things other than web applications can be protected, but robust protocol decoding is important, else trying to find an exploit attempt is like hunting for deeper meaning in a book written in a language you don’t understand. Most often, IDS/IPS and Web Application Firewall vendors talk about virtual patching. Reversing the HTTP stream, it can also be used to protect end-user systems from some exploit attempts.

This post came as a result of a bet I have made recently with one of my colleagues, Shaun Donaldson. The question is if SMB decision makers follow the buying practices of the Enterprise market or not (that process would include information-gathering, analysis and comparing options in a pure “costs vs benefit” model). The wager I can’t disclose, but I can tell you that Shaun is advocating for people being the most rational creatures on Earth;

So let us explore who is right.

Building apps on Amazon Web Services, often led by technical operations (or DevOps) and driven purely by business needs, tends to focus on building and delivering functionality in as little time as possible.  The flexibility and agility available with AWS allows teams to build an app or a business process from conception to production rollout.