Click here to close now.


Microservices Expo Authors: Pat Romanski, Elizabeth White, Yeshim Deniz, Jason Bloomberg, Liz McMillan

Related Topics: Cloud Security, Java IoT, Microservices Expo, Microsoft Cloud, Containers Expo Blog, @CloudExpo

Cloud Security: Article

Cybersecurity: A Human Problem

It seems that Cyberwar is no longer science fiction. It’s a reality, and we’re in the midst of one.

The latest Cyberattack to hit the news: a worm called Gauss, a relative of Stuxnet, targeted certain Lebanese banks. Kaspersky, a Russian security firm, discovered the attack. On their blog post, the Kaspersky researchers note that “after looking at Stuxnet…, we can say with a high degree of certainty that Gauss comes from the same ‘factory’ or ‘factories.’ All these attack toolkits represent the high end of nation-state sponsored cyber-espionage and cyberwar operations, pretty much defining the meaning of ‘sophisticated malware.’” They go on to say that “this is actually the first time we’ve observed a nation-state cyber-espionage campaign with a banking Trojan component.”

And this after a New York Times article exposed Stuxnet as being a joint US-Israeli covert operation targeting the Iranian nuclear industry, authorized by President G. W. Bush and further authorized by President Obama. The article further suggests that Iran is now mounting its own Cyberwar initiative, a result that the Obama administration understood and feared.

It seems that Cyberwar is no longer science fiction. It’s a reality, and we’re in the midst of one.

Whether you think the Stuxnet and Gauss worms were a good idea or not, this article is not the place to debate moral or ethical questions. Rather, we’re here to help you understand the reality of the situation in order to provide insight. And like it or not, we have a Cyberwar on our hands—and as with other wars, technology defines and constrains the rules of engagement. Yesterday we may have spoken about tanks or guns; today we speak of viruses and worms. But as with traditional machines of war, the human element is every bit as important as the technology, if not more so.

Problem between Keyboard and Chair
Here are some examples of what we’re talking about. When the press heard about the Gauss exploit, they asked the obvious question: who would benefit from attacking Lebanese banks? The obvious answer: anyone interested in the secret financial dealings of Hezbollah, the terrorist organization based in Lebanon. In other words, Israel and the US. The appearance of Gauss led many people across the world to come to a similar conclusion.

Assume for a moment, however, that someone wanted to make Israel and the US look bad, say the Iranians. Could the Iranians have come up with Gauss in order to gain political advantage against Israel and the US? Unlikely, perhaps, but possible. How would we know? After all, if the US and/or Israel were behind Gauss, they could have hidden their motivation simply by expanding the target to banks outside Lebanon. So maybe the fact that Gauss had such a narrow target should suggest that someone was trying to frame the US and Israel?

Here’s another twist: Kaspersky Lab was founded by Eugene Kaspersky, a Russian cryptography expert who learned his trade from the KGB’s cryptography school. Presumably he has substantial ties with Russia’s current secret police as well. Perhaps the Kaspersky report on Gauss was either fictitious or somehow skewed, a dastardly Russian plot of some sort? We have no reason to believe so, but again, how would we know for sure?

Sounds like a Robert Clancy spy novel, and for good reason—subterfuge has been a part of warfare (and in particular, espionage) since the Stone Age. But the problem is, the more we focus on the technology, the less we focus on the human aspects of the Cybersecurity problem. And that lack of focus both makes us more vulnerable, and prevents us from mounting efficacious attacks of our own.

Agile Architecture and Cyberwarfare
In a recent ZapFlash we recommended a “best defense is a good offense” approach: preventing future attacks with agile, self-innovating software. But even the most cutting-edge code is only a part of the story, because it still doesn’t address the human in the system. Targeting people is nothing new in the world of Cyberattacks, of course. Social engineering is becoming increasingly sophisticated as hackers plumb the weaknesses of our all-to-human personalities. Not a day goes by without a phishing attack arriving in our inboxes, not to mention how easy it is to talk people into giving up their passwords. But while social engineering works with individuals, Cyberwar is presumably between countries. How, then, might we go about what we might call political engineering: the analogue to social engineering, only taking place on the global stage? And how do we protect ourselves against such attacks?

The answer to both questions is to focus on how technology-centric actions will influence human beliefs and behavior. Creating a sophisticated computer virus and releasing it may achieve a technical end, the result of the software itself. But it will also likely achieve a variety of human ends, as well: it might arouse suspicion, cause people to shift their priorities or spend money, or it might make someone angry enough to retaliate, for example. Furthermore, these human ends may be more significant and desirable than the actual impact of the software itself.

ZapThink considers the focus on human issues as well as technology to be an aspect of Agile Architecture. We’ve spoken for years about the role governance plays in Agile Architectures like SOA, because governance is a best practice-driven approach for bringing human behavior in line with the goals of the organization. The big win for SOA governance, for example, was leveraging SOA for better organizational governance, rather than simple governance of the SOA initiative. The essential question, therefore, is what architectural practices apply to the human side of the Cybersecurity equation.

Our Cybersecurity example is analogous to SOA governance, although it turns governance inside out: we’re no longer trying to influence human behavior inside our organization, but rather within the world as a whole or some large parts of it. But the lesson is the same: the technology influences human behavior, and furthermore, the human behavior may be more important than the technology behavior. Protecting ourselves from such attacks also places us in the greater context of the political sphere as well.

Playing Defense

Education is the key to protecting yourself and your organization from human-targeted Cyberattacks. Take for example a phishing attack. You receive an email that looks like it’s from your bank. It tells you that, say, a large withdrawal was just made from your account. If you don’t realize it’s a phishing email, you might click on the login link in the email to check your account to see what the problem is. The link takes you to a page that looks just like your bank’s login page. But if you attempt to log in, you’re only giving your credentials to the hackers.

There are automated anti-phishing technologies out there, of course, but the hackers are always looking for ways around them, so you can’t rely upon them. Instead, you must proactively influence the behavior of your employees by educating them on how to recognize phishing attacks, and how to avoid them even when you don’t recognize them. Still not foolproof, but it may be the best you can do.

Protecting against political Cyberattacks would follow the same pattern, but would be far more difficult to implement, as educating a populace is far more difficult than educating your employees. Instead, the most effective course of action may once again be a good offense: you can use the same techniques as your opponent to influence beliefs and behavior.

Let’s use the hacker group Anonymous as an example. Any member of this loose association of hackers can propose an action—from taking down the MasterCard Web site to finding the location of a fast food worker who stepped on the lettuce, to name two real examples—and any member can vote to take that action. There’s no central control or consistent strategy. Now, let’s say you worked for a government Cyberwar department, and you were responsible for creating a Gauss-like worm with a narrow target, only you didn’t want anyone suspecting it was your country who created it. Could you make it look like Anonymous created it? Even the members of Anonymous might not realize their group wasn’t actually responsible.

The ZapThink Take

Your sphere of concern might not involve international espionage, but there are important lessons here for every architect. All too often, techies get techie tunnel vision, thinking that technology problems have technology solutions, and furthermore, the only interesting (or important) problems are technology problems. Architects, however, must also consider the human in the equation, whether you’re fooling the Iranians, making sure interface specifications are properly followed, and everything in between.

This principle is no truer than when you’re protecting against Cyberattacks. No password scheme will prevent people from writing their passwords on Post-It notes and sticking them to their computers. No firewall will prevent all phishing attacks or stop people from visiting all malware-infected sites. Education is one technique, but there’s more to governance than education. And whatever you do, always cast a skeptical eye toward any conclusions people draw from news about Cyberattacks. The technology is never the whole story.

If your job, however, is mounting Cyberattacks, understanding the human in the equation is a critically important tool—and often far less expensive and time-consuming than a purely technical attack. As any good poker player will tell you, the secret to winning isn’t having good hands, it’s knowing how to bluff, and even more importantly, knowing how to tell when the other guy is bluffing.

More Stories By Jason Bloomberg

Jason Bloomberg is the leading expert on architecting agility for the enterprise. As president of Intellyx, Mr. Bloomberg brings his years of thought leadership in the areas of Cloud Computing, Enterprise Architecture, and Service-Oriented Architecture to a global clientele of business executives, architects, software vendors, and Cloud service providers looking to achieve technology-enabled business agility across their organizations and for their customers. His latest book, The Agile Architecture Revolution (John Wiley & Sons, 2013), sets the stage for Mr. Bloomberg’s groundbreaking Agile Architecture vision.

Mr. Bloomberg is perhaps best known for his twelve years at ZapThink, where he created and delivered the Licensed ZapThink Architect (LZA) SOA course and associated credential, certifying over 1,700 professionals worldwide. He is one of the original Managing Partners of ZapThink LLC, the leading SOA advisory and analysis firm, which was acquired by Dovel Technologies in 2011. He now runs the successor to the LZA program, the Bloomberg Agile Architecture Course, around the world.

Mr. Bloomberg is a frequent conference speaker and prolific writer. He has published over 500 articles, spoken at over 300 conferences, Webinars, and other events, and has been quoted in the press over 1,400 times as the leading expert on agile approaches to architecture in the enterprise.

Mr. Bloomberg’s previous book, Service Orient or Be Doomed! How Service Orientation Will Change Your Business (John Wiley & Sons, 2006, coauthored with Ron Schmelzer), is recognized as the leading business book on Service Orientation. He also co-authored the books XML and Web Services Unleashed (SAMS Publishing, 2002), and Web Page Scripting Techniques (Hayden Books, 1996).

Prior to ZapThink, Mr. Bloomberg built a diverse background in eBusiness technology management and industry analysis, including serving as a senior analyst in IDC’s eBusiness Advisory group, as well as holding eBusiness management positions at USWeb/CKS (later marchFIRST) and WaveBend Solutions (now Hitachi Consulting).

Comments (0)

Share your thoughts on this story.

Add your comment
You must be signed in to add a comment. Sign-in | Register

In accordance with our Comment Policy, we encourage comments that are on topic, relevant and to-the-point. We will remove comments that include profanity, personal attacks, racial slurs, threats of violence, or other inappropriate material that violates our Terms and Conditions, and will block users who make repeated violations. We ask all readers to expect diversity of opinion and to treat one another with dignity and respect.

@MicroservicesExpo Stories
JFrog has announced a powerful technology for managing software packages from development into production. JFrog Artifactory 4 represents disruptive innovation in its groundbreaking ability to help development and DevOps teams deliver increasingly complex solutions on ever-shorter deadlines across multiple platforms JFrog Artifactory 4 establishes a new category – the Universal Artifact Repository – that reflects JFrog's unique commitment to enable faster software releases through the first pla...
Overgrown applications have given way to modular applications, driven by the need to break larger problems into smaller problems. Similarly large monolithic development processes have been forced to be broken into smaller agile development cycles. Looking at trends in software development, microservices architectures meet the same demands. Additional benefits of microservices architectures are compartmentalization and a limited impact of service failure versus a complete software malfunction....
IT data is typically silo'd by the various tools in place. Unifying all the log, metric and event data in one analytics platform stops finger pointing and provides the end-to-end correlation. Logs, metrics and custom event data can be joined to tell the holistic story of your software and operations. For example, users can correlate code deploys to system performance to application error codes.
Somebody call the buzzword police: we have a serious case of microservices-washing in progress. The term “microservices-washing” is derived from “whitewashing,” meaning to hide some inconvenient truth with bluster and nonsense. We saw plenty of cloudwashing a few years ago, as vendors and enterprises alike pretended what they were doing was cloud, even though it wasn’t. Today, the hype around microservices has led to the same kind of obfuscation, as vendors and enterprise technologists alike ar...
With containerization using Docker, the orchestration of containers using Kubernetes, the self-service model for provisioning your projects and applications and the workflows we built in OpenShift is the best in class Platform as a Service that enables introducing DevOps into your organization with ease. In his session at DevOps Summit, Veer Muchandi, PaaS evangelist with RedHat, will provide a deep dive overview of OpenShift v3 and demonstrate how it helps with DevOps.
The web app is agile. The REST API is agile. The testing and planning are agile. But alas, data infrastructures certainly are not. Once an application matures, changing the shape or indexing scheme of data often forces at best a top down planning exercise and at worst includes schema changes that force downtime. The time has come for a new approach that fundamentally advances the agility of distributed data infrastructures. Come learn about a new solution to the problems faced by software organ...
Between the compelling mockups and specs produced by analysts, and resulting applications built by developers, there exists a gulf where projects fail, costs spiral, and applications disappoint. Methodologies like Agile attempt to address this with intensified communication, with partial success but many limitations. In his session at DevOps Summit, Charles Kendrick, CTO and Chief Architect at Isomorphic Software, will present a revolutionary model enabled by new technologies. Learn how busine...
SYS-CON Events announced today that Dyn, the worldwide leader in Internet Performance, will exhibit at SYS-CON's 17th International Cloud Expo®, which will take place on November 3-5, 2015, at the Santa Clara Convention Center in Santa Clara, CA. Dyn is a cloud-based Internet Performance company. Dyn helps companies monitor, control, and optimize online infrastructure for an exceptional end-user experience. Through a world-class network and unrivaled, objective intelligence into Internet condit...
The last decade was about virtual machines, but the next one is about containers. Containers enable a service to run on any host at any time. Traditional tools are starting to show cracks because they were not designed for this level of application portability. Now is the time to look at new ways to deploy and manage applications at scale. In his session at @DevOpsSummit, Brian “Redbeard” Harrington, a principal architect at CoreOS, will examine how CoreOS helps teams run in production. Attende...
The APN DevOps Competency highlights APN Partners who demonstrate deep capabilities delivering continuous integration, continuous delivery, and configuration management. They help customers transform their business to be more efficient and agile by leveraging the AWS platform and DevOps principles.
Containers are revolutionizing the way we deploy and maintain our infrastructures, but monitoring and troubleshooting in a containerized environment can still be painful and impractical. Understanding even basic resource usage is difficult - let alone tracking network connections or malicious activity. In his session at DevOps Summit, Gianluca Borello, Sr. Software Engineer at Sysdig, will cover the current state of the art for container monitoring and visibility, including pros / cons and li...
Containers are changing the security landscape for software development and deployment. As with any security solutions, security approaches that work for developers, operations personnel and security professionals is a requirement. In his session at @DevOpsSummit, Kevin Gilpin, CTO and Co-Founder of Conjur, will discuss various security considerations for container-based infrastructure and related DevOps workflows.
Manufacturing has widely adopted standardized and automated processes to create designs, build them, and maintain them through their life cycle. However, many modern manufacturing systems go beyond mechanized workflows to introduce empowered workers, flexible collaboration, and rapid iteration. Such behaviors also characterize open source software development and are at the heart of DevOps culture, processes, and tooling.
Any Ops team trying to support a company in today’s cloud-connected world knows that a new way of thinking is required – one just as dramatic than the shift from Ops to DevOps. The diversity of modern operations requires teams to focus their impact on breadth vs. depth. In his session at DevOps Summit, Adam Serediuk, Director of Operations at xMatters, Inc., will discuss the strategic requirements of evolving from Ops to DevOps, and why modern Operations has begun leveraging the “NoOps” approa...
Internet of Things (IoT) will be a hybrid ecosystem of diverse devices and sensors collaborating with operational and enterprise systems to create the next big application. In their session at @ThingsExpo, Bramh Gupta, founder and CEO of, and Fred Yatzeck, principal architect leading product development at, discussed how choosing the right middleware and integration strategy from the get-go will enable IoT solution developers to adapt and grow with the industry, while at th...
In their session at DevOps Summit, Asaf Yigal, co-founder and the VP of Product at, and Tomer Levy, co-founder and CEO of, will explore the entire process that they have undergone – through research, benchmarking, implementation, optimization, and customer success – in developing a processing engine that can handle petabytes of data. They will also discuss the requirements of such an engine in terms of scalability, resilience, security, and availability along with how the archi...
“All our customers are looking at the cloud ecosystem as an important part of their overall product strategy. Some see it evolve as a multi-cloud / hybrid cloud strategy, while others are embracing all forms of cloud offerings like PaaS, IaaS and SaaS in their solutions,” noted Suhas Joshi, Vice President – Technology, at Harbinger Group, in this exclusive Q&A with Cloud Expo Conference Chair Roger Strukhoff.
DevOps has often been described in terms of CAMS: Culture, Automation, Measuring, Sharing. While we’ve seen a lot of focus on the “A” and even on the “M”, there are very few examples of why the “C" is equally important in the DevOps equation. In her session at @DevOps Summit, Lori MacVittie, of F5 Networks, will explore HTTP/1 and HTTP/2 along with Microservices to illustrate why a collaborative culture between Dev, Ops, and the Network is critical to ensuring success.
Application availability is not just the measure of “being up”. Many apps can claim that status. Technically they are running and responding to requests, but at a rate which users would certainly interpret as being down. That’s because excessive load times can (and will be) interpreted as “not available.” That’s why it’s important to view ensuring application availability as requiring attention to all its composite parts: scalability, performance, and security.
Saviynt Inc. has announced the availability of the next release of Saviynt for AWS. The comprehensive security and compliance solution provides a Command-and-Control center to gain visibility into risks in AWS, enforce real-time protection of critical workloads as well as data and automate access life-cycle governance. The solution enables AWS customers to meet their compliance mandates such as ITAR, SOX, PCI, etc. by including an extensive risk and controls library to detect known threats and b...