Welcome!

Microservices Expo Authors: Elizabeth White, Pat Romanski, Liz McMillan, Stackify Blog, Yeshim Deniz

Related Topics: Cloud Security, Java IoT, Microservices Expo, Microsoft Cloud, Containers Expo Blog, @CloudExpo

Cloud Security: Article

Cybersecurity: A Human Problem

It seems that Cyberwar is no longer science fiction. It’s a reality, and we’re in the midst of one.

The latest Cyberattack to hit the news: a worm called Gauss, a relative of Stuxnet, targeted certain Lebanese banks. Kaspersky, a Russian security firm, discovered the attack. On their blog post, the Kaspersky researchers note that “after looking at Stuxnet…, we can say with a high degree of certainty that Gauss comes from the same ‘factory’ or ‘factories.’ All these attack toolkits represent the high end of nation-state sponsored cyber-espionage and cyberwar operations, pretty much defining the meaning of ‘sophisticated malware.’” They go on to say that “this is actually the first time we’ve observed a nation-state cyber-espionage campaign with a banking Trojan component.”

And this after a New York Times article exposed Stuxnet as being a joint US-Israeli covert operation targeting the Iranian nuclear industry, authorized by President G. W. Bush and further authorized by President Obama. The article further suggests that Iran is now mounting its own Cyberwar initiative, a result that the Obama administration understood and feared.

It seems that Cyberwar is no longer science fiction. It’s a reality, and we’re in the midst of one.

Whether you think the Stuxnet and Gauss worms were a good idea or not, this article is not the place to debate moral or ethical questions. Rather, we’re here to help you understand the reality of the situation in order to provide insight. And like it or not, we have a Cyberwar on our hands—and as with other wars, technology defines and constrains the rules of engagement. Yesterday we may have spoken about tanks or guns; today we speak of viruses and worms. But as with traditional machines of war, the human element is every bit as important as the technology, if not more so.

Problem between Keyboard and Chair
Here are some examples of what we’re talking about. When the press heard about the Gauss exploit, they asked the obvious question: who would benefit from attacking Lebanese banks? The obvious answer: anyone interested in the secret financial dealings of Hezbollah, the terrorist organization based in Lebanon. In other words, Israel and the US. The appearance of Gauss led many people across the world to come to a similar conclusion.

Assume for a moment, however, that someone wanted to make Israel and the US look bad, say the Iranians. Could the Iranians have come up with Gauss in order to gain political advantage against Israel and the US? Unlikely, perhaps, but possible. How would we know? After all, if the US and/or Israel were behind Gauss, they could have hidden their motivation simply by expanding the target to banks outside Lebanon. So maybe the fact that Gauss had such a narrow target should suggest that someone was trying to frame the US and Israel?

Here’s another twist: Kaspersky Lab was founded by Eugene Kaspersky, a Russian cryptography expert who learned his trade from the KGB’s cryptography school. Presumably he has substantial ties with Russia’s current secret police as well. Perhaps the Kaspersky report on Gauss was either fictitious or somehow skewed, a dastardly Russian plot of some sort? We have no reason to believe so, but again, how would we know for sure?

Sounds like a Robert Clancy spy novel, and for good reason—subterfuge has been a part of warfare (and in particular, espionage) since the Stone Age. But the problem is, the more we focus on the technology, the less we focus on the human aspects of the Cybersecurity problem. And that lack of focus both makes us more vulnerable, and prevents us from mounting efficacious attacks of our own.

Agile Architecture and Cyberwarfare
In a recent ZapFlash we recommended a “best defense is a good offense” approach: preventing future attacks with agile, self-innovating software. But even the most cutting-edge code is only a part of the story, because it still doesn’t address the human in the system. Targeting people is nothing new in the world of Cyberattacks, of course. Social engineering is becoming increasingly sophisticated as hackers plumb the weaknesses of our all-to-human personalities. Not a day goes by without a phishing attack arriving in our inboxes, not to mention how easy it is to talk people into giving up their passwords. But while social engineering works with individuals, Cyberwar is presumably between countries. How, then, might we go about what we might call political engineering: the analogue to social engineering, only taking place on the global stage? And how do we protect ourselves against such attacks?

The answer to both questions is to focus on how technology-centric actions will influence human beliefs and behavior. Creating a sophisticated computer virus and releasing it may achieve a technical end, the result of the software itself. But it will also likely achieve a variety of human ends, as well: it might arouse suspicion, cause people to shift their priorities or spend money, or it might make someone angry enough to retaliate, for example. Furthermore, these human ends may be more significant and desirable than the actual impact of the software itself.

ZapThink considers the focus on human issues as well as technology to be an aspect of Agile Architecture. We’ve spoken for years about the role governance plays in Agile Architectures like SOA, because governance is a best practice-driven approach for bringing human behavior in line with the goals of the organization. The big win for SOA governance, for example, was leveraging SOA for better organizational governance, rather than simple governance of the SOA initiative. The essential question, therefore, is what architectural practices apply to the human side of the Cybersecurity equation.

Our Cybersecurity example is analogous to SOA governance, although it turns governance inside out: we’re no longer trying to influence human behavior inside our organization, but rather within the world as a whole or some large parts of it. But the lesson is the same: the technology influences human behavior, and furthermore, the human behavior may be more important than the technology behavior. Protecting ourselves from such attacks also places us in the greater context of the political sphere as well.

Playing Defense

Education is the key to protecting yourself and your organization from human-targeted Cyberattacks. Take for example a phishing attack. You receive an email that looks like it’s from your bank. It tells you that, say, a large withdrawal was just made from your account. If you don’t realize it’s a phishing email, you might click on the login link in the email to check your account to see what the problem is. The link takes you to a page that looks just like your bank’s login page. But if you attempt to log in, you’re only giving your credentials to the hackers.

There are automated anti-phishing technologies out there, of course, but the hackers are always looking for ways around them, so you can’t rely upon them. Instead, you must proactively influence the behavior of your employees by educating them on how to recognize phishing attacks, and how to avoid them even when you don’t recognize them. Still not foolproof, but it may be the best you can do.

Protecting against political Cyberattacks would follow the same pattern, but would be far more difficult to implement, as educating a populace is far more difficult than educating your employees. Instead, the most effective course of action may once again be a good offense: you can use the same techniques as your opponent to influence beliefs and behavior.

Let’s use the hacker group Anonymous as an example. Any member of this loose association of hackers can propose an action—from taking down the MasterCard Web site to finding the location of a fast food worker who stepped on the lettuce, to name two real examples—and any member can vote to take that action. There’s no central control or consistent strategy. Now, let’s say you worked for a government Cyberwar department, and you were responsible for creating a Gauss-like worm with a narrow target, only you didn’t want anyone suspecting it was your country who created it. Could you make it look like Anonymous created it? Even the members of Anonymous might not realize their group wasn’t actually responsible.

The ZapThink Take

Your sphere of concern might not involve international espionage, but there are important lessons here for every architect. All too often, techies get techie tunnel vision, thinking that technology problems have technology solutions, and furthermore, the only interesting (or important) problems are technology problems. Architects, however, must also consider the human in the equation, whether you’re fooling the Iranians, making sure interface specifications are properly followed, and everything in between.

This principle is no truer than when you’re protecting against Cyberattacks. No password scheme will prevent people from writing their passwords on Post-It notes and sticking them to their computers. No firewall will prevent all phishing attacks or stop people from visiting all malware-infected sites. Education is one technique, but there’s more to governance than education. And whatever you do, always cast a skeptical eye toward any conclusions people draw from news about Cyberattacks. The technology is never the whole story.

If your job, however, is mounting Cyberattacks, understanding the human in the equation is a critically important tool—and often far less expensive and time-consuming than a purely technical attack. As any good poker player will tell you, the secret to winning isn’t having good hands, it’s knowing how to bluff, and even more importantly, knowing how to tell when the other guy is bluffing.

More Stories By Jason Bloomberg

Jason Bloomberg is the leading expert on architecting agility for the enterprise. As president of Intellyx, Mr. Bloomberg brings his years of thought leadership in the areas of Cloud Computing, Enterprise Architecture, and Service-Oriented Architecture to a global clientele of business executives, architects, software vendors, and Cloud service providers looking to achieve technology-enabled business agility across their organizations and for their customers. His latest book, The Agile Architecture Revolution (John Wiley & Sons, 2013), sets the stage for Mr. Bloomberg’s groundbreaking Agile Architecture vision.

Mr. Bloomberg is perhaps best known for his twelve years at ZapThink, where he created and delivered the Licensed ZapThink Architect (LZA) SOA course and associated credential, certifying over 1,700 professionals worldwide. He is one of the original Managing Partners of ZapThink LLC, the leading SOA advisory and analysis firm, which was acquired by Dovel Technologies in 2011. He now runs the successor to the LZA program, the Bloomberg Agile Architecture Course, around the world.

Mr. Bloomberg is a frequent conference speaker and prolific writer. He has published over 500 articles, spoken at over 300 conferences, Webinars, and other events, and has been quoted in the press over 1,400 times as the leading expert on agile approaches to architecture in the enterprise.

Mr. Bloomberg’s previous book, Service Orient or Be Doomed! How Service Orientation Will Change Your Business (John Wiley & Sons, 2006, coauthored with Ron Schmelzer), is recognized as the leading business book on Service Orientation. He also co-authored the books XML and Web Services Unleashed (SAMS Publishing, 2002), and Web Page Scripting Techniques (Hayden Books, 1996).

Prior to ZapThink, Mr. Bloomberg built a diverse background in eBusiness technology management and industry analysis, including serving as a senior analyst in IDC’s eBusiness Advisory group, as well as holding eBusiness management positions at USWeb/CKS (later marchFIRST) and WaveBend Solutions (now Hitachi Consulting).

Comments (0)

Share your thoughts on this story.

Add your comment
You must be signed in to add a comment. Sign-in | Register

In accordance with our Comment Policy, we encourage comments that are on topic, relevant and to-the-point. We will remove comments that include profanity, personal attacks, racial slurs, threats of violence, or other inappropriate material that violates our Terms and Conditions, and will block users who make repeated violations. We ask all readers to expect diversity of opinion and to treat one another with dignity and respect.


@MicroservicesExpo Stories
DevOps is often described as a combination of technology and culture. Without both, DevOps isn't complete. However, applying the culture to outdated technology is a recipe for disaster; as response times grow and connections between teams are delayed by technology, the culture will die. A Nutanix Enterprise Cloud has many benefits that provide the needed base for a true DevOps paradigm. In his Day 3 Keynote at 20th Cloud Expo, Chris Brown, a Solutions Marketing Manager at Nutanix, will explore t...
Cloud promises the agility required by today’s digital businesses. As organizations adopt cloud based infrastructures and services, their IT resources become increasingly dynamic and hybrid in nature. Managing these require modern IT operations and tools. In his session at 20th Cloud Expo, Raj Sundaram, Senior Principal Product Manager at CA Technologies, will discuss how to modernize your IT operations in order to proactively manage your hybrid cloud and IT environments. He will be sharing bes...
SYS-CON Events announced today that Peak 10, Inc., a national IT infrastructure and cloud services provider, will exhibit at SYS-CON's 20th International Cloud Expo®, which will take place on June 6-8, 2017, at the Javits Center in New York City, NY. Peak 10 provides reliable, tailored data center and network services, cloud and managed services. Its solutions are designed to scale and adapt to customers’ changing business needs, enabling them to lower costs, improve performance and focus intern...
SYS-CON Events announced today that Linux Academy, the foremost online Linux and cloud training platform and community, will exhibit at SYS-CON's 20th International Cloud Expo®, which will take place on June 6-8, 2017, at the Javits Center in New York City, NY. Linux Academy was founded on the belief that providing high-quality, in-depth training should be available at an affordable price. Industry leaders in quality training, provided services, and student certification passes, its goal is to c...
SYS-CON Events announced today that CollabNet, a global leader in enterprise software development, release automation and DevOps solutions, will be a Bronze Sponsor of SYS-CON's 20th International Cloud Expo®, taking place from June 6-8, 2017, at the Javits Center in New York City, NY. CollabNet offers a broad range of solutions with the mission of helping modern organizations deliver quality software at speed. The company’s latest innovation, the DevOps Lifecycle Manager (DLM), supports Value S...
DevOps at Cloud Expo – being held October 31 - November 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA – announces that its Call for Papers is open. Born out of proven success in agile development, cloud computing, and process automation, DevOps is a macro trend you cannot afford to miss. From showcase success stories from early adopters and web-scale businesses, DevOps is expanding to organizations of all sizes, including the world's largest enterprises – and delivering real r...
SYS-CON Events announced today that Fusion, a leading provider of cloud services, will exhibit at SYS-CON's 20th International Cloud Expo®, which will take place on June 6-8, 2017, at the Javits Center in New York City, NY. Fusion, a leading provider of integrated cloud solutions to small, medium and large businesses, is the industry’s single source for the cloud. Fusion’s advanced, proprietary cloud service platform enables the integration of leading edge solutions in the cloud, including cloud...
There are two main reasons for infrastructure automation. First, system administrators, IT professionals and DevOps engineers need to automate as many routine tasks as possible. That’s why we build tools at Stackify to help developers automate processes like application performance management, error monitoring, and log management; automation means you have more time for mission-critical tasks. Second, automation makes the management of complex, diverse environments possible and allows rapid scal...
This talk centers around how to automate best practices in a multi-/hybrid-cloud world based on our work with customers like GE, Discovery Communications and Fannie Mae. Today’s enterprises are reaping the benefits of cloud computing, but also discovering many risks and challenges. In the age of DevOps and the decentralization of IT, it’s easy to over-provision resources, forget that instances are running, or unintentionally expose vulnerabilities.
It has never been a better time to be a developer! Thanks to cloud computing, deploying our applications is much easier than it used to be. How we deploy our apps continues to evolve thanks to cloud hosting, Platform-as-a-Service (PaaS), and now Function-as-a-Service. FaaS is the concept of serverless computing via serverless architectures. Software developers can leverage this to deploy an individual "function", action, or piece of business logic. They are expected to start within milliseconds...
We all know that end users experience the internet primarily with mobile devices. From an app development perspective, we know that successfully responding to the needs of mobile customers depends on rapid DevOps – failing fast, in short, until the right solution evolves in your customers' relationship to your business. Whether you’re decomposing an SOA monolith, or developing a new application cloud natively, it’s not a question of using microservices - not doing so will be a path to eventual ...
One of the biggest challenges with adopting a DevOps mentality is: new applications are easily adapted to cloud-native, microservice-based, or containerized architectures - they can be built for them - but old applications need complex refactoring. On the other hand, these new technologies can require relearning or adapting new, oftentimes more complex, methodologies and tools to be ready for production. In his general session at @DevOpsSummit at 20th Cloud Expo, Chris Brown, Solutions Marketi...
SYS-CON Events announced today that HTBase will exhibit at SYS-CON's 20th International Cloud Expo®, which will take place on June 6-8, 2017, at the Javits Center in New York City, NY. HTBase (Gartner 2016 Cool Vendor) delivers a Composable IT infrastructure solution architected for agility and increased efficiency. It turns compute, storage, and fabric into fluid pools of resources that are easily composed and re-composed to meet each application’s needs. With HTBase, companies can quickly prov...
@DevOpsSummit at Cloud taking place June 6-8, 2017, at Javits Center, New York City, is co-located with the 20th International Cloud Expo and will feature technical sessions from a rock star conference faculty and the leading industry players in the world. The widespread success of cloud computing is driving the DevOps revolution in enterprise IT. Now as never before, development teams must communicate and collaborate in a dynamic, 24/7/365 environment. There is no time to wait for long developm...
With 10 simultaneous tracks, keynotes, general sessions and targeted breakout classes, Cloud Expo and @ThingsExpo are two of the most important technology events of the year. Since its launch over eight years ago, Cloud Expo and @ThingsExpo have presented a rock star faculty as well as showcased hundreds of sponsors and exhibitors! In this blog post, I provide 7 tips on how, as part of our world-class faculty, you can deliver one of the most popular sessions at our events. But before reading the...
The purpose of this article is draw attention to key SaaS services that are commonly overlooked during contact signing that are essential to ensuring they meet the expectations and requirements of the organization and provide guidance and recommendations for process and controls necessary for achieving quality SaaS contractual agreements.
SYS-CON Events announced today that OpsGenie will exhibit at SYS-CON's 20th International Cloud Expo®, which will take place on June 6-8, 2017, at the Javits Center in New York City, NY. Founded in 2012, OpsGenie is an alerting and on-call management solution for dev and ops teams. OpsGenie provides the tools needed to design actionable alerts, manage on-call schedules and escalations, and ensure that the right people are notified at the right time, using multiple notification methods.
The first step to solving a problem is recognizing that it actually exists. And whether you've realized it or not, cloud services are a problem for your IT department. Even if you feel like you have a solid grasp of cloud technology and the nuances of making a cloud purchase, business leaders don't share the same confidence. Nearly 80% feel that IT lacks the skills necessary to help with cloud purchases-and they're looking to cloud brokers for help instead. It's time to admit we have a cloud s...
According to a recent Gartner study, by 2020, it will be unlikelythat any enterprise will have a “no cloud” policy, and hybrid will be the most common use of the cloud. While the benefits of leveraging public cloud infrastructures are well understood, the desire to keep critical workloads and data on-premise in the private data center still remains. For enterprises, the hybrid cloud provides a best of both worlds solution. However, the leading factor that determines the preference to the hybrid ...
In this modern world of IT, you've probably got some new colleagues in your life-namely, the cloud and SaaS providers who now hold your infrastructure in their hands. These business relationships-yes, they're technology-based, but cloud and SaaS are business models-will become as important to your IT team and your company as the hardware and software you used to install. Once you've adopted SaaS, or inherited SaaS, it's on you to avoid price hikes, licensing issues and app or provider sprawl....