When and what AMI to start
Once started how to do you configure it from base to functional. Especially in a way that doesn’t become a vendor lock.
How do you manage the massive sprawl of instances, inventory them and track your assets
Monitoring and general life cycle management
When and how do you shut them, and what cleanup is needed. Being billed by the hour means this has to be a consideration
These are significant problems and just a tip of the ice berg. All of the traditional aspects of infrastructure management – like Asset Management, Monitoring, Procurement – are totally useless in the face of the cloud.

A lot of work is being done in this space by tools like Pool Party, Fog, Opscode and many other players like the countless companies launching control panels, clouds overlaying other clouds and so forth. As a keen believer in Open Source many of these options are not appealing.

I want to focus on the 2nd step above here today and show how I pulled together a number of my Open Source projects to automate that. I built a generic provisioner that hopefully is expandable and usable in your own environments. The provisioner deals with all the interactions between Puppet on nodes, the Puppet Master, the Puppet CA and the administrators.

Sadly the activity in the Puppet space is a bit lacking in the area of making it really easy to get going on a cloud. There are suggestions on the level of monitoring syslog files from a cronjob and signing certificates based on that. Really. It’s a pretty sad state of affairs when that’s the state of the art.

Read More

The study of about 100 IT managers also found changes in security staff size over the past year, with it increasing for 15% of responding organizations, decreasing for 24%, and remaining static for 54%. Going forward, 20% of organizations planned to hire more security personnel, 15% planned to downsize, and 51% expected to stay the same.

remaining static or decreasing, and budgets not being allocated to put security processes in place, organizations are going to face greater challenges than ever to their security posture.”
The also study found that just over half of respondents stated that their organization was more secure today, versus 12 months ago. Yet 65% don’t think their organization has “complete visibility” into its security posture at any given time.

Based on the survey results, “security professionals are being asked to do more with less, while at the same time, the organization is being put at a higher risk,” said Tracy Hulver, executive VP of products and marketing at netForensics, in a statement.

Her recommendation is that organizations should look at using tools and technologies that can scale up their response, without adding staff or budget. Examples of such tools include “outsourcing to cloud security, deploying technologies that maximize existing security infrastructure without having to invest in new, big-budget items, [and] acquiring technology via SaaS pricing models.”

Interestingly, even with the majority of organizations seeing increasing numbers of threats, but little or no increase in their security budget, 70% of respondents said they wouldn’t outsource their organization’s security. Then again, such a move might risk making respondents redundant.

Source

The U.S. Computer Emergency Readiness Team must share information about threats and trends more quickly and in greater detail with other federal departments so they can better protect themselves, the audit said.

Issued Wednesday by the Homeland Security Department’s inspector general, the report lays out criticism that long has been aired by U.S. officials and outside experts who say the government’s computer systems are vulnerable to attacks, are persistently probed, and lack the needed management and security standards.

And it highlights many of the problems Congress is trying to address in a number of bills aimed at creating a more effective government structure to improve and enforce security standards.

Cyber security has become a top priority for the government, bolstered by President Barack Obama’s declaration last year that it is “one of the most serious economic and national security challenges we face.” Officials say U.S. networks are scanned and probed millions of times a day, and in some cases breached by hackers, cyber criminals and other nations.

The 35-page report said the Computer Emergency Readiness Team, which is a part of DHS, has made progress helping federal agencies protect against computer-based threats, including the creation of a cyber center. But it said the team does not have the enforcement authority it needs to get other federal agencies to take the steps required to secure their systems.

In a detailed response to the report, DHS Undersecretary Rand Beers noted that the inspector general did not make a recommendation on how the agency could gain more enforcement authority. But he said the agency agrees that giving DHS more formal authority would be helpful.

Members of Congress currently are tussling over legislation that would give Homeland Security greater power to draft and enforce standards, and require federal agencies to more quickly address gaps in their computer systems. Other lawmakers say that authority should reside in the White House and with the National Institute of Standards and Technology.

Sen. Susan Collins, R-Maine, who along with Sen. Joe Lieberman, I-Conn., has legislation to increase the DHS’ power, said the agency needs “precise authorities with real teeth.” That effort got a boost Wednesday as key House members said they would introduce a similar bill.

The report also said the Computer Emergency Readiness Team has been plagued with staff shortages and leadership turnover, hindering its ability to retain qualified staff. And due to the security clearance process, it can take nine months to 12 months for a new hire to begin work.

DHS is in the middle of a major boost in staffing. In early 2009, the readiness team had 16 employees, but the number jumped to 31 by October, and is now at 55, with another 25 workers in the hiring process.

The report notes that officials from other federal agencies have complained that the readiness team doesn’t quickly share data on cyber threats or incidents. DHS officials responded that much of the data is from intelligence agencies and is classified at various levels, making it difficult to coordinate and share.

Source

No one can set up a web server on an IP (Internet Protocol) address that hasn’t been allocated, but anyone can write code that points to the unused addresses. The unexpected activity found in these “dark spaces” may come from a variety of sources, including both Internet-borne attacks and benign code for testing an application or PC. Though the traffic doesn’t represent a security threat itself, an enterprise that acquired the affected addresses from an Internet service provider (ISP) typically would have to pay for the transmission of the irrelevant packets, said Manish Karir, a researcher at Merit Network. Merit is an educational network operator and Internet research center in Michigan.

IPv4 only allows for about 4.3 billion addresses, and that supply is expected to run out within the next two years. If some of those remaining addresses are polluted with unwanted traffic, that could make the problem even more urgent for enterprises that want new, usable IPv4 addresses.

IP addresses are allocated by regional Internet administrators, usually to ISPs, which then assign smaller blocks of them to their enterprise customers. Only a small number of blocks of IPv4 addresses are still waiting to be handed out. Karir and a group of other researchers tried to find out whether the addresses at the bottom of the virtual barrel are as good as those that have already been handed out.

“There’s growing concern that these blocks are less desirable,” Karir said. The concern is over types of traffic that have been blocked or moved from already-allocated blocks to ones that so far haven’t been assigned.

Karir’s team joined with APNIC, the Internet registry for the Asia-Pacific region, to test one new block, called 1.0.0.0/8, because it was known to have been used in examples and test cases over the years. Capturing packets over a period of about 10 days, they found a large amount of traffic.

In the entire 1.0.0.0/8 block, there was an average of 170M bps (bits per second) of sustained traffic, at an average of 150 packets per second, Karir said.

Some of the traffic occurred in a subnet called 1.1.1.0, which is commonly used to test computer and router configurations. But the researchers were puzzled by a very large amount of traffic in another subnet, which made up nearly 35 percent of all the traffic in the entire address block. So they used the Wireshark protocol analyzer to reconstruct it. The traffic consisted of fast busy signals and audio messages advising callers they had the wrong phone number. “If you’d like to make a call, please check the number and try again,” said one of the messages, which Karir played for the NANOG audience.

The researchers believe these signals were a side effect of problems with SIP (Session Initiation Protocol), a commonly used technology for voice over IP and other types of packet-based communication. The signals could have appeared in the dark space because of misconfigured SIP servers or because of “SIP invite” attacks, in which a system is flooded with malformed invitations to join a SIP session, Karir said. Because of a “hard-coded default,” the busy signals are configured to come to that particular subnet, he said.

Another source of packets to the address block, more than 17 percent of the total, was misdirected DNS (Domain Name System) queries embedded in Web pages that users clicked on.

Given the findings, APNIC decided to block the worst hotspot subnets within the 1.0.0.0/8 block. Cutting off the 10 worst hotspots significantly reduced the unwanted traffic, Karir said.

However, the researchers found evidence of similar types of pollution in several other unallocated address blocks, and it’s hard to predict where such traffic will turn up, he said.

“Each dark space is different … because hotspots exist in strange and unusual places,” Karir said.

He advised network administrators who are given polluted blocks to talk to the ISP about exchanging them. But this may become harder to do as the number of unused IPv4 addresses dwindles, he warned. There are only 16 remaining blocks of about 16.7 million addresses each, down from 22 such blocks just three months ago, Karir said.

Source

The security appliance company is profitable and growing — its earnings last quarter were 17% higher than for the same quarter last year — but with the security appliances industry consolidating, it needs to grow faster, says Patrick Sweeney, vice president of product management for SonicWall. The company has $200 million in cash as well, he says.

If approved by shareholders, the deal will enable faster development of the company’s next big product push, called Super Massive, a jump to 10Gbit/s speeds for its unified threat management hardware with all the security features turned on, he says. “It’s important for us to grow as fast or faster than the market,” he says. “This will allow us to build a larger company a lot faster.”

Size is important because the industry is consolidating, he says, pointing to HP’s purchase of 3Com and its security devices division Tipping Point, making smaller companies more vulnerable.

As a listed company, SonicWall’s goals were constrained to ever increasing 90-day demands between fiscal reporting quarters, which limits longer term investments that can alter a company’s strategic course, he says.

SonicWall, which makes unified threat management, firewall, VPN and backup appliances as well as endpoint security, email security and antispam software, says the deal will buy out current shareholders for $11.50 per share in cash, which is 63 percent more than the stock is going for publicly. Stockholders still have to approve the deal, and that is expected by early in the fourth quarter of this year.

Source

We’ve added a new edge location in New York City. This location will provide even better performance to users requesting your content from New York and the northeastern United States.

We’ve reduced pricing for CloudFront HTTP requests by 25%. The prices now start at $0.0075 per 10,000 requests.

You can now deliver content over an HTTPS connection by replacing the “http:” with “https:” in the links to your CloudFront content.

You can configure any of your CloudFront distributions so that the content must be accessed by an HTTPS connection.

The first three items should be pretty much self-explanatory, so let’s take a look at the fourth…

You can now configure an Amazon CloudFront distribution such that access to the Amazon S3 objects represented by the distribution is limited to HTTPS connections. You can do this to protect your content as it travels from a CloudFront edge location to your client application, or to avoid the dreaded “mixed content” warning issued by many web browsers.

To configure your distribution in this matter you simply set the distribution’s RequiredProtocols attribute to the value “https”. If you do not set this attribute, the contents of the distribution will be accessible via both HTTP and HTTPS. You cannot currently make HTTPS requests via a CNAME.

The following third-party applications provide simple tools to set up your distributions for HTTPS access:

CloudBuddy Personal
CloudBerry S3 Explorer
Bucket Explorer
These third-party tools are provided by companies unaffiliated with AWS.

– Jeff;

Source

Much of the trick to the new “3-2-1″ network architecture involves the application of Juniper’s Virtual Chassis fabric technology to the access layer, thereby eliminating the need for aggregation. The firm claims the process can reduce by 99%, the number of switch interactions compared to legacy three layer networks.

Juniper said the new products enable legacy data center networks to be reduced almost immediately from three to two layers and to a single layer in the future. There’s more to the flood of new Jupiter software, services, systems and partnerships unveiled this week: ten new Gigabit Ethernet switches yielding up to five times lower latency are promised, too. Taken together capital expenditures of data center networking can be cut by 35%, the company said.

“Legacy data center networks are inherently complex, and they often force an unacceptable trade-off between user experience and economies,” said Jupiter’s David Yen in a statement. “Our breakthrough 3-2-1 architecture lays out a clear path to help customers flatten the network and eliminate layers of cost and complexity while simultaneously improving application and business performance.” Yen is executive vice president and general manager of Juniper’s Fabric and Switching Technologies Business Group.

The announcement hardens the battle lines between its data center approach and Cisco’s with IBM and Dell also lining up with Juniper.

Data center improvements have been rapidly accelerating with the pell-mell rush toward cloud computing and as old alliances are being dropped in favor of new partnerships. For instance, Juniper noted that IBM will ship Juniper’s SRX Series Services Gateways and that IBM will also provide Jupiter expertise and support with one call.

“The traditional approach of more boxes and more layers benefits legacy vendors, while burdening the customer with cost and complexity,” said Juniper CEO Kevin Johnson. “Our approach is different , and it’s fueled by a combination of Juniper and partner innovation at the systems, software and services levels – all designed to help IT eliminate those layers of cost and complexity while also enhancing applications and business performance.”

Source

Predictions name 9 September 2011 as the date on which the last of those tranches is released for net firms and others to use.

Everything connected to the net needs an “IP address” to ensure data reaches the right person or device.

Experts say that the net’s entire existing address space will be exhausted about a year after that date.

A newer scheme is being rolled out but many firms and countries are being slow to switch, experts warn.

Small pool
The net is built around version four of the Internet Protocol addressing scheme (IPv4) which has space for about four billion addresses. Its successor – IPv6 – has trillions available.

The continued growth of the net is tied to this pool of addresses.

While four billion was enough in the 1970s when the net was being set up, the growth of the world wide web is rapidly depleting this store.

The growth of the web has meant that only about 7% of these addresses, roughly 300 million, are left to allocate. This entire pool is expected to be depleted in April 2012.

In early May, the Internet Assigned Numbers Authority (IANA), which oversees the net address space, handed over two of the big chunks of remaining addresses.

The removal of these 17 million addresses from the global pool meant that the date on which there will be no more big chunks left jumped forward.

“This whole business of forecasting depletion involves a little bit of reading the tea leaves,” said Axel Pawlik, managing director of Ripe NCC, which hands out IP addresses in Europe.

“Ten years ago we said it would happen far in the future,” said Mr Pawlick. “Now we are all running around with iPhones, we’re in that future.”

While the cut off date is 18 months away, some fear it will shrink as the pace at which addresses get used speeds up. Throughout the whole of 2009, IANA handed out eight of the big blocks of IPv4 addresses. In the first 100 days of 2010, it has handed out six.

Early planning
Trefor Davies, chief technology officer at business ISP Timico, said rationing of the remaining IPv4 addresses was already under way.

“You cannot just ask for more IP addresses,” he said. “You have to prove you need them.”

“The registries will not let you have more until your reserves reach a certain threshold,” he said.

While IPv4 and IPv6 can live alongside each other, anecdotal evidence suggests it is not a trouble-free union, said Mr Davies.

The process of translating one address into the format of another introduces a significant delay.

Unless more ISPs and others start to adopt IPv6 those delays could start to hit general web browsing, fears Mr Davies.

“It adds quite a lot of latency onto people accessing your network because it has to go through network address translation,” he said.

Mr Pawlick from Ripe said it had seen significant growth in requests for IPv6 addresses over the last few months.

“What we are not seeing yet is those IPv6 addresses being used on the internet,” he said.

IPv6 tracking services suggest that less than 1% of the net’s top one million websites run IPv6. Another statistic suggests that only 6% of the networks that form the net use IPv6. China is one of the biggest users of the new addressing scheme.

Companies are being urged to get working with IPv6 now, to forestall any problems caused by the shortfall.

“The key thing to focus on is the opportunities IPv6 brings your business before IPv4 runs out,” said Simon McCalla, director of IT at Nominet, which oversees the .uk domain.

Source

Virtualization offers many benefits including scalability, flexibility, rapid deployment of new servers, cost savings, as well as energy efficiency. With all these immediate benefits, it is no surprise that virtualization is quickly transforming the IT landscape. However, in the rush to capitalize on these benefits, some organizations may have overlooked the ramifications a virtualized environment has on a company’s security posture. Most of us are used to securing individual machines that we can see and feel, but a virtualized environment is hidden in layers of code. As a result, it presents the security administrator with new challenges that are not obvious at first glance.

To better illustrate this point, let’s start with a basic definition — what exactly is virtualization? Virtualization is the technology that allows the creation of virtual networking and computing resources on a single physical piece of hardware. These virtual resources all share the resources of a single physical host. This is made possible by adding an additional hypervisor (also known as a VM monitor) layer to the host server. The hypervisor allows multiple operating systems to concurrently run on the host computer.

Prior to virtualization, servers typically had 1:1 software-to-hardware mapping, meaning one operating system or application would run on one hardware server. For larger deployments, this often meant hundreds to thousands of physical servers running in a data center environment. It takes substantial hardware, energy, deployment and management costs to run such an environment. In addition to that, these servers were on average running at only five to 10 percent capacity, resulting in a huge waste of resources. With virtualization, organizations were able to run 10 or more virtual servers on a single host. What once was a 1:1 ratio now becomes 10:1 or even 20:1. It is not difficult to see the immediate and long-term benefits that virtualization brings.

This much most of us know already. The issue is that these fantastic benefits have blinded some IT departments to virtualization’s potential risks. As with any new IT infrastructure technology, virtualization does bring new threats and security concerns. In fact, in October 2007, Gartner vice president Neil MacDonald predicted that through 2009, 60 percent of production VMs will be less secure than their physical counterparts. I’d be willing to bet this prediction has very much come true. There are simply too many new avenues that creative criminals are able to exploit.

The top security threats surrounding virtualization include:

VM sprawl – VMs are so easy to create that it sometimes leads to VM sprawl. VM sprawl is the phenomenon of VMs increasing in an environment over time to the point where the infrastructure becomes less than optimal due to forgotten VMs with no real function taking away from the pool of shared resources. VMs, like traditional systems, need to be properly patched and managed. Failure to do so can lead to huge security holes within the network.One can thus appreciate how VM sprawl leads to a less secure network – most Microsoft-based operating systems are patched regularly because Microsoft typically releases patches on “Patch Tuesdays” and most laptops and desktops are used daily. However, a forgotten VM that has been left dormant for weeks, if not months, will be seriously out-of-date with respect to patches, which increases the organization’s vulnerability footprint and reduces the organization’s security preparedness.

Virtualization specific attacks – Virtualization opens up a new vector for potential attackers to exploit. There have been real world examples of compromised VMs being used to attack other VMs on the same host, or even gain access to the host machine itself through the exploitation of memory space of devices shared by both the host and guest machines. Attacks on the hypervisor itself can potentially compromise all the VMs running above it.

Traditional threats – Legacy viruses, trojans, rookits, keyloggers and other malware can all do substantial damage to a VM and its host. Additionally, an infected VM can carry out attacks against other VMs as well as other physical servers on the network.

An effective security strategy for most virtualized environments is to “double-down” on conventional security wisdom, making sure to take a layered approach to security technologies. As the conventional wisdom states, there’s no such thing as a silver bullet that will bulletproof an organization’s security posture. This is doubly true for organizations rolling out a virtualized environment. By doubling down, I mean that most organizations have to take the following steps:

Anti-virus software must be deployed on each VM and especially on the host system.

Access rights need to be clearly defined for each virtual resource.

An AV and anti-malware security solutions should be deployed at the network gateway. This is particularly imperative for VMs, which may have been the result of sprawl and not had an operating system or AV software update for weeks or months.

Network intrusion prevention systems can thwart non-malware based attacks such as SQL injections.

Anti-spam and web filtering will prevent users from being exposed to malware carried through web and email.

Virtualization has transformed the computing world. It represents the ability to rapidly deploy new servers, maximum usage of hardware resources, and have a more streamlined computing environment. As more and more businesses rush to deploy virtual machines, they must also beware of the security issues specific to virtual environments. Keep your eyes wide open — and be safe!

Source

Customers with existing IT infrastructure in the EU can now deploy Amazon VPC in the same region in order to provide the best possible experience for their users. They can also deploy an Amazon VPC in the EU to ensure that their data remains in the EU.

A lot has happened in the VPC world since we first announced it last fall. Here’s a recap of the major developments:
We released the AWS SDK for .Net, with full support for the VPC APIs.

We opened up the VPC beta to all interested parties. At the same time we increased the maximum size of a VPC from a “/18″ (16K IP addresses) to a “/16″ 65K IP addresses).

We added support for launching from EBS-backed AMIs (enabling Windows 2008 and SQL Server 2008, larger root file systems, and faster boot times).

We enabled the use of the EC2 High Memory instance types (17.1, 34.2, or 68.4 GB of RAM) within a VPC.

I’ve focused on VPC in a number of my more recent presentations and the reception is always great. The audiences grasp the concept and the power immediately, and many of them want to create a VPC right away. In fact, after one of the talks on my recent east coast tour, an audience member came up to the podium so that we could speak in private. After hearing about the VPC he had sketched out a diagram of his existing network and his plans to use the VPC to extend it, complete with IP addresses. He asked me how he would go about getting it set up, and wondered if it would be difficult to do. I happened to have a printed copy of the VPC Getting Started Guide in my messenger bag and was happy to give it to him!”

Source