Interop 2014: F5 Interop NOC Stats

We visit with Ken Bocchino and Joe Wojcik of F5 Professional Services again to get some insight on the Interop.net network stats for the week. We talk DNS (15 million DNS lookups, half via BIG-IP recursion), SPDY and IPv6 along with a little insight on some of the overall traffic and the attack mitigation that occurred for the World’s Largest Temporary Network.

ps
Related

• Interop 2014: Find F5 Pop Up Edition
• Interop 2014: F5 in the NOC (feat Bocchino & Wojcik)
• Interop 2014: F5 Synthesis Whiteboard (feat Wagner)
• F5 executive Sangeeta Anand on Cisco ACI
• F5 at Interop
• F5 YouTube Channel

Technorati Tags: f5,Interop,vegas,synthesis,security,silva,video,noc,dns,spdy,ipv6,big-ip

Connect with Peter:	Connect with F5:

HELLO, My Name is Cloud_009...

 ...scrolls across the small 16:9 LCD protruding from my chest cavity. 

In case you missed it, I'm from the future, where we all have become our own personal cloud.  Some clouds you can actually see, like auras, but look somewhat like the classic Peanuts character Pigpen.  We've all become walking antennas, routers, hotspots and hubs for all the other personal clouds.  If auto-discovery is enabled, once you are in range of a 'friend' that you 'like,' a few beeps go off and they appear as an icon right in our own retina.  You remember those smart phones that allowed users to tap the phones to send a picture or file?  Now, all we have to do is crank up some digital audio and do a move called 'The Bump.'  It's based on some ancient 1970's fad dance where participants would lightly 'bump' hips to the beat of the music.  Today we use it to exchange data.  A bump or two and you've shared your music library.  A hip-check, your movie collection.  Passing gas is kinda like your old computer's recycle bin that you need to empty every so often.

All this works in conjunction with the IPv6 chip inserted into the freshly cut umbilical cord of every newborn, so it heals right into the system.  As you grow, the bellybutton also becomes a power source - you can interchange belly-ring connections and power almost any device with the solar plexus.  But we really do not carry 'mobile' devices anymore since their functionality is now mostly built in to our carcasses.  Our ear and earlobe have evolved to have the capability of answering calls or listening to audio just by pushing in the outer ear plug or as you used to call it, the tragus.  The earlobe itself is a highly sensitive bio-metric scanner that'll check your thumbprint and if authenticated, will unlock your car, home or any other item that you program. 

We each have a cloud identifier to distinguish our identity.  I'm Cloud_009.  I used to be Cloud_337528 but since I'm usually happy, have a strong security posture and graduated from ISO University, I was recently upgraded.  You're probably wondering if I know Cloud_007.  We've met a couple times but I try to stay away from the espionage cloud since you really don't know what you may catch in there.  Lots of infecting, crashing and drive-by Bumps. 

I'm also able to segment parts of my cloud for work and play.  Some clouds do top half/bottom half but I like to go right down the middle.  When enabled, my right side handles my work/corporate data and the left does my personal stuff.  Because I'm flexible, the percentages can adjust on the spot when the demand goes up.  From 9-5, I might use up to 80% of my cloud-body for work related computations with the other 20% reserved for bathroom breaks, eating, breathing, recharging and any other personal activities.  The data stays separate, secure and encrypted. 

Well, I got a hologram coming in that I need to watch but it was nice talking with you.  We don't do much of that anymore since most messages are sent telepathically these days.

ps

Related:

• Hey You, Get Off-ah My Cloud!
• Cloud vs Cloud
• The Venerable Vulnerable Cloud
• The Inter-Cloud: Will MAE become a MAC?
• 4 out of 5 Folks Not Quite Sure What the Cloud Is
• Drama in the Cloud: Coming to a Security Theatre Near You

Connect with Peter:	Connect with F5:

Technorati Tags: cloud,cloud computing,mobile,silva,smart phone,security

Evolving (or not) with Our Devices

When I talk on the phone, I’ve always used my left ear to listen.  Listening in the right ear just doesn’t sound right.  This might be due to being right handed, doing the shoulder hold to take notes when needed.  As corded turned to cordless and mobile along with the hands-free ear-plugs, that plug went into the left ear whenever I was on the phone.  Recently, I’ve been listening to some music while walking the dog and have run into an issue.  The stereo ear plugs do not fit, sit or stay in my right ear.  I have no problem with the nub in my left ear but need to keep re-inserting, adjusting and holding the plug in my right ear.  I’m sure I was born with the same size opening for both ears years ago and my only explanation is that my left ear has evolved over the years to accommodate an ear plug.  Even measuring each indicates that the left is opened more ever so slightly.  I seem to be fine, or at least better, with the isolation earphone style but it’s the ear-bud type that won’t fit in my right ear.  I realize there are tons of earplug types for various needs and I could just get one that works for me but it got me thinking.  If my ears or specifically my left ear has morphed due to technology, what other human physical characteristics might evolve over time.

As computers became commonplace and more people started using keyboards, we started to see a huge increase of carpal tunnel syndrome.  Sure, other repetitive tasks of the hand and wrist can cause carpal tunnel but typing on a computer keyboard is probably the most common cause.  Posture related injuries like back, neck, shoulder and arm pain along with headaches are common computer related injuries.  Focusing your eyes at the same distance over extended periods of time can cause fatigue and eye strain.  It might not do permanent damage to your eyesight but you could experience blurred vision, headaches and a temporary inability to focus on faraway objects.  Things like proper design of your workstation and taking breaks that encourage blood flow can help reduce computer related injuries.  Of course, every profession has their specific repetitive tasks which can lead to some sort of injury and, depending on your work, the body adjusts and has it’s own physical memory to accomplish the task.  Riding a bike.  Often smokers who are trying to quit can tolerate the nicotine deduction but it’s the repetitive physical act of bringing the dart up that causes grief.  That’s why many turn to straws or toothpicks or some other item to break the habit. 

We’ve gotten use to seeing people walking around with little blue-tooth ear apparatus attached to their heads and think nothing of it.  They’ll leave it in all day even if they are not talking on the phone.  Many probably feel ‘naked’ if they forgot it one day, almost like a watch or ring that we wear daily.  I mentioned a couple years ago in IPv6 and the End of the World that with IPv6, each one of us, worldwide, would be able to have our own personal IP address that would follow us anywhere.  Hold on, I’m getting a call through my earring but first must authenticate with the chip in my earlobe. That same chip, after checking my print and pulse, would open the garage, unlock the doors, disable the home alarm, turn on the heat and start the microwave for a nice hot meal as soon as I enter.  Who would have thought that Carol Burnett's ear tug would come back.

Now that many of us have mobile devices with touch-screens, we’re tapping away with index fingers and thumbs.  I know my thumb joints can get sore when tapping too much.  Will our thumbs grow larger or stronger over time to accommodate the new repetitive movement or go smaller and pointy to make sure we’re able to click the the correct virtual keypad on the device.  We got video eyewear so it’s only a matter of time that our email and mobile screens could simply appear while wearing shades or as heads up on the car windshield.  With special gloves or an implant under our hand, we can control the device through movement or tapping the steering wheel.

Ahhh, anyway, I’m sure things will change again in the next decade and we’ll have some other things happening within our evolutionary process but it’ll be interesting to see if we can maintain control over technology or will technology change us.  In the meantime, I’ll be ordering some new earphones.

ps

Technorati Tags: F5, humans, people, Pete Silva, security, behavior, education, technology, mobile, earphone, ipv6, computer injury, iPhone, web,

Connect with Peter:	Connect with F5:

Dynamic Application Control and Attack Protection

If you’ve perused any media outlet of late, the barrage of cyber threats are unrelenting and protecting your networks and applications continues to be a never ending task.  Organizations are making significant investments in IT security to improve their attack protection but still need to control costs and keep the systems running efficiently.  Since these attacks are targeting multiple layers of the infrastructure, both the network and applications, it is increasingly difficult to properly reduce the risk of exposure.  Siloes of protection and network firewalls alone cannot do the trick. Add to that, the dynamic nature of today’s infrastructures especially with cloud environments, makes the job even tougher.  Federal mandates and standards for government agencies, contractors and the public sector adds to an organization’s growing list of concerns.  DNS can be vulnerable to attacks; interactive Web 2.0 applications can be vulnerable; and IT needs analytics and detailed reporting to understand what’s happening within their dynamic data center.  On top of that, IPv6 is now a reality and v6 to v4 translation services are in demand.

F5’s most recent release, BIG-IP v11, delivers a unified platform that helps protect Web 2.0 applications and data, secure DNS infrastructures, and establish centralized application access and policy control.  In BIG-IP v10, F5 offered the Application Ready Solution Templates to reduce the time, effort, and application-specific knowledge required of administrators to optimally deploy applications.  With BIG-IP v11, F5 introduces iApp, a template-driven system that automates application deployment. iApp helps reduce human error by enabling an organization’s IT department to apply preconfigured, approved security policies and repeat and reuse them with each application deployment.  Also iApp analytics provides real-time visibility into application performance, which helps IT staff identify the root cause of security and performance issues quickly and efficiently.

For DNS, BIG-IP GTM has offered a DNSSEC solution since v10 and with v11, we’ve added DNS Express, a high-speed authoritative DNS delivery solution. DNS query response performance can be improved as much as 10x. DNS Express offloads existing DNS servers and absorbs the flood of illegitimate DNS requests during an attack—all while supporting legitimate queries.  It’s critical to have the ability to protect and scale the DNS infrastructure when a DoS or DDoS attacks occur, since DNS is just as vulnerable as the web application or service that is being targeted.

For interactive web applications, BIG-IP ASM v11 can parse JSON (JavaScript Object Notation) payloads and protect AJAX (Asynchronous JavaScript and XML) applications that use JSON for data transfer between the client and server.  AJAX, which is a mix of technologies, is becoming more pervasive since it allows developers to deliver content without having to load the entire HTML page in which the AJAX objects are embedded. Unfortunately, poor AJAX code can allow an attacker to modify the application and prevent a user from seeing their customized content, or even initiate an XSS attack. Additionally, some developers are also using JSON payloads, a lightweight data-interchange format that is understandable by most modern programming languages and used to exchange information between browser and server. If JSON is insecure and carrying sensitive information, there is the potential for data leakage.  BIG-IP ASM can enforce the proper security policy and can even display an embedded blocking alert message. Very few WAF vendors are capable of enforcing JSON (other than the XML Gateways), and no other vendor can display an embedded blocking alert message. F5 is the only WAF vendor that fully supports AJAX, which is becoming more and more common even within enterprises. 

Also with v11, BIG-IP ASM is now available in a Virtual Edition (BIG-IP ASM VE), either as a stand-alone appliance or an add-on module for BIG-IP Local Traffic Manager Virtual Edition (LTM VE).  BIG-IP ASM VE delivers the same functionality as the physical edition and helps companies maintain compliance, including PCI DSS, when they deploy applications in the cloud. If an organization discovers an application vulnerability, BIG-IP ASM VE can quickly be deployed in a cloud environment, enabling organizations to immediately virtually patch vulnerabilities until the development team can permanently fix the application. Additionally, organizations are often unable to fix applications developed by third parties, and this lack of control prevents many of them from considering cloud deployments. But with BIG-IP ASM VE, organizations have full control over securing their cloud infrastructure.

After about 5 years of IPv4 depletion stories, it finally seems to be coming soon and IPv6 is starting to be deployed.  Problem is that most enterprise networks are not yet ready to handle IPv4 and IPv6 at the same time.  BIG-IP v11 provides advanced support for IPv6 with built-in DNS 6-to-4 translation services and the ability to direct traffic to any server in mixed (IPv4 and IPv6) environments. This gives organizations the flexibility to support IPv6 devices today while transitioning their backend servers to IPv6 over time.

Many more new features are available across all F5 solutions including BIG-IP APM which added support for site-to-site IPsec tunnels, AppTunnels, Kerberos ticketing, enhanced virtual desktops, Android and iOS clients, and multi-domain single sign-on.  These are just a few of the many new enhancements available in BIG-IP v11.

ps

Resources:

• The BIG-IP v11 System
• F5 Delivers on Dynamic Data Center Vision with New Application Control Plane Architecture
• F5’s Enhanced BIG-IP Security Solutions Thwart Multilayer Cyber Attacks
• ABLE Infrastructure: The Next Generation – Introducing v11
• The Evolution To IT as a Service Continues … in the Network
• iApp Wiki on DevCentral

Whitepapers:

• High-Performance DNS Services in BIG-IP Version 11
• Symmetric Optimization in the Cloud with BIG-IP WOM VE
• Secure, Optimized Global Access to Corporate Resources
• Maximizing the Strategic Point of Control in the Application Delivery Network
• Application Security in the Cloud with BIG-IP ASM
• F5 iApp: Moving Application Delivery Beyond the Network
• Simplifying Single Sign-On with F5 BIG-IP APM and Active Directory
• BIG-IP Virtual Edition Products,The Virtual ADCs Your Application Delivery Network Has Been Missing

Technorati Tags: F5,F5 News,v11,security,cloud computing,virtualization,access management,scalability,scaleN,BIG-IP,BIG-IP APM,BIG-IP LTM,BIG-IP GTM,JSON,Web 2.0,BIG-IP ASM,web application firewall,GSLB,DDoS,DoS,iApp

Connect with Peter:	Connect with F5:

Audio White Paper - Controlling Migration to IPv6: A Gateway to Tomorrow

While organizations worldwide are beginning to acknowledge their need to adopt IPv6, most are still struggling to define a workable strategy around it.  F5 solutions provide the flexibility organizations need to devise gradual migration plans that minimize disruption and downtime.  This White Paper describes how the BIG-IP LTM system help organizations migrate to IPv6, and can operate as an IPv4 to IPv6 gateway; operating identically in either environment, and within mixed environments. This capability is ideal for organizations that are either actively planning for or anticipating an IPv4 to IPv6 transition.  Running Time: 13:26  Read full white paper here.  And click here for more F5 Audio.

 Listen on Posterous
 

ps

Technorati Tags: F5, integration, data center, Pete Silva, security, business, education, technology, application delivery, infrastructure, ipv4, optimize, ipv6, web, internet, security, hardware, audio, whitepaper, big-ip

Connect with Peter:	Connect with F5:

Posted via email from psilva's prophecies

IPv6 and the End of the World

There’s always been a certain amount of conspiracy theories when security type events happen or instances where there is secrecy. There are those who don’t buy the ‘reported’ reason a security event (like a breach) occurred, those who claim to have inside information or just those who see a story and draw their own conclusions. The following is my take (Satire Alert) on Transmission Control Protocol/Internet Protocol v6 and the end of the world as we know it. That can affect our security, right?!?

Recently there have been more than the usual number of articles about IPv6 and the need to deploy it soon since the v4 blocks are almost gone. Yes we’ve been hearing this for years (RFC2460 was defined in December 1998) but now the hype may be over as indicated in this article. There are many security enhancements in v6 nicely covered here but that’s not where I’m going.

In my first blog post on DevCentral, aptly titled First Post, I introduced psilva’s prophecies. I’ve been in the Internet industry since ’94 and while not a ‘know it all’ I have seen my share of changes and have seen a bunch of ‘ideas’ over time come true. For instance, I had always thought that the Internet would eventually become our entertainment delivery method and some 14 years later, that’s the case. That’s not that wild as I’m sure many of you figured it was only a matter of time once we started to see streaming video and broadband to the home. In that First Post, I offered my prediction of how our nomenclature might change over the next 50-100 years. That now, we no longer give our full name/address for contacting/correspondence as we’ve done in the past – we just give email. The idea was that over time, our current first/last naming convention might dissolve to where we are known as users@domains or a single string of characters. Twitter is enforcing that with their @namingconventions.

IPv6, at 128-bits (v4 is 32-bit), gives us the ability to assign an IP address to just about anything – heck, all the portable mobile devices we carry each need one and consumer appliances like TVs, refrigerators, thermostat, DVRs, garage door openers, coffee machines and just about any electronic item could potentially have an IP address. Schedule your toaster via a Web GUI to perfectly brown your bagel when you get home. You can already control your lights and alarm systems over the internet. In addition, each one of us, worldwide, would be able to have our own personal IP address that would follow us anywhere.  Hold on, I’m getting a call through my earring but first must authenticate with the chip in my earlobe. That same chip, after checking my print and pulse, would open the garage, unlock the doors, disable the home alarm, turn on the heat and start the microwave for a nice hot meal as soon as I enter. I could chip my child (like the dog) to be able to GPS their behind if they are not at the movies as indicated. Not so farfetched. That doesn’t sound so sinister, psilva, how can that be the beginning of the end?

OK, now the fun begins.  While not a Nostradamus follower, although  History/Discovery Channels have covered him often, he does have something to say about numbers. You might remember he got a lot of press and was the subject of spam after 9/11 due to this quatrain which his followers say indicates that he predicted that disaster. Conspiracy? He was very much into numbers and also indicated that when we are all identified as numbers, that will be an sign of the impending doom. We do have a numbering system in the states called a Social Security Number, which is our Gov’t identity and very much linked to our own security. With IPv6, now the entire world can be identified by number and thus fulfills psilva’s prophecy #2.  The timing is right also.  2012 is getting a lot of play as the end of time.  Both the Mayans and Nostradamus feel that 2012 is the end of days and Hollywood has taken notice.  Now this does slightly negate my 1st prophecy since I’m giving our name change around 50 years but 2012 does sound about right for a full IPv6 transformation so it does fit nicely with doomsayers – if you’re into conspiracies.

ps

• #20 out of 26 Short Topics about Security
• previous stories: 19, 18, 17, 16, 15, 14, 13.5, 13, 12, 11, 10, 9, 8, 7, 6, 5, 4, 3, 2, 1