Monthly Archives: February 2014

What We Should Learn From the Apple SSL Bug

Two years ago a paper appeared with the provocative title “The Most Dangerous Code in the World.” Its subject? SSL, the foundation for secure e-commerce. The world’s most dangerous software, it turns out, is a technology we all use on a more or less daily basis.

The problem the paper described wasn’t an issue with the SSL protocol, which is a solid and mature technology, but with the client libraries developers use to start a session. SSL is easy to use but you must be careful to set it up properly. The authors found that many developers aren’t so careful, leaving the protocol open to exploit. Most of these mistakes are elementary, such as not fully validating server certificates and trust chains.

Another dramatic example of the pitfalls of SSL emerged this last weekend as Apple issued a warning about an issue discovered in its own SSL libraries on iOS. The problem seems to come from a spurious goto fail statement that crept into the source code, likely the result of a bad copy/paste. Ironically, fail is exactly what this extra code did. Clients using the library failed to completely validate server certificates, leaving them vulnerable to exploit.

The problem should have been caught in QA; obviously, it wasn’t. The lesson to take away from here is not that Apple is bad—they responded quickly and efficiently the way they should—but that even the best of the best sometimes make mistakes. Security is just hard.

So if security is too hard, and people will always make mistakes, how should we protect ourselves? The answer is to simplify. Complexity is the enemy of good security because complexity masks problems. We need to build our security architectures on basic principles that promote peer-reviewed validation of configuration as well as continuous audit of operation.

Despite this very public failure, it is safe to rely on SSL as a security solution, but only if you configure it correctly. SSL is a mature technology, and it is unusual for problems to appear in libraries. But this weekend’s event does highlight the uncomfortable line of trust we necessarily draw with third party code. Obviously, we need to invest our trust carefully. But we also must recognize that bugs happen, and the real test is about how effectively we respond when exploits appear and patches become available. Simple architectures work to our favour when the zero-day clock starts ticking.

On Monday at the RSA Conference, CA Technologies announced the general availability of our new SDK for securing mobile transactions. We designed this SDK with one goal: to make API security simpler for mobile developers. We do this by automating the process of authentication, and setting up secure connections with API servers. If developers are freed up from tedious security programming, they are less likely to do something wrong—however simple the configuration may appear. In this way, developers can focus on building great apps, instead of worrying about security minutia.

In addition to offering secure authentication and communications, the SDK also provides secure single sign on (SSO) across mobile apps. Say the word SSO and most people instinctively picture one browser authenticating across many web servers. This common use case defined the term. But SSO can also be applied to the client apps on a mobile device. Apps are very independent in iOS and Android, and sharing information between them, such as an authentication context, is challenging. Our SDK does this automatically, and securely, providing a VPN-like experience for apps without the very negative user experience of mobile VPNs.

Let me assure you that this is not yet another opaque, proprietary security solution. Peel back the layers of this onion and you will find a standards-based OAuth+OpenID Connect implementation. We built this solution on top of the SecureSpan Gateway’s underlying PKI system and we leveraged this to provide increased levels of trust.

If you see me in the halls of the RSA Conference, don’t hesitate to stop me and ask for a demo. Or drop by the CA Technologies booth where we can show you this exciting new technology in action.

RSA Conference 2014 Preview And A Special CA Technologies/Layer 7 Event

Despite all our advances in communications—from social networking, to blogs, to actual functional video meetings—the trade conference is still a necessity. Maybe not as much for the content, which makes the rounds pretty fast regardless of whether you attend the show or not, but for the serendipitous meetings and social networking (in the pre-Facebook sense).

I find something comforting in the rhythm and structure a handful of annual conferences bring to my life. The best ones stay rooted in one location, occurring at the same time, year after year. They are as much defined by time and place as topic.

If it’s February, it must be San Francisco and the RSA conference. I’ve attended for years, and despite the draw from the simultaneous Mobile World Congress in Barcelona, RSA is a show I won’t skip. But I do wish MWC would bump itself a week in either direction so I could do both.

As everyone knows, this year the press made much ado of a few high profile boycotts of the conference and the two alt-cons, Security B-sides and TrustyCon, that sprung up in response. But I think it’s important to separate RSA the company from RSA the conference. The latter remains the most important security event of the year.

Every year, one theme rises above the rest. I’m not referring to the “official” theme, but the trends that appear spontaneously in the valley. The theme this year should be security analytics. The venture community put this idea on an aggressive regime of funding injections. We should expect an entertaining gallery of result good and bad. But either way, we will learn something, and it would be a poor move to bet against this sector’s future.

I’m also expecting 2014 to bring some real SDN traction. Traditional security infrastructure is low hanging fruit vendors too often miss. RSA is where SDNs for security will finally get a long awaited debut.

MWC may be the premier event for mobile, but most mobile security companies cover both, and CA is no exception. At RSA we’re showcasing our new Mobile Access Gateway (MAG). This features SDKs for iOS, Android, and JavaScript that make enterprise authentication simple for mobile developers.  As a bonus, this SDK offers cross app SSO. It means users sign on just once, from any authorized app. You should definitely come by the CA Technologies booth and have a look. And if you do see me at the show, be sure to ask me about the integrated PKI—surely one of the coolest, unsung features underneath the SDK hood.

CA and Layer 7 will host an afternoon event Monday Feb 24 at the nearby Marriott Marquis, and you are invited. You may recall we’ve held a few of these before, but this year, we have a very special guest. The event features Forrester Analyst Eve Maler, who will talk about Zero Trust and APIs. It is a great way to kick off the RSA 2014, and we’ll even give you a nice lunch. Who could refuse that?

To join us, sign up here.

New eBook: Five Simple Strategies For Securing Your APIs

Recently I wrote about the excitement I feel working within CA. This company is full of talented people, and when you draw on their capabilities, amazing stuff happens. Here in R&D we have some innovative solutions underway that are a tangible result of CA and Layer 7 working well together. I can’t reveal these yet, but you can see the same 1+1=3 equation at work in other groups throughout the organization.

Here is a good example. It’s an eBook we’ve assembled to help managers and developers build more secure APIs. The material started with a presentation I first delivered at a recent RSA show. We updated this with best practices developed by real customers facing real challenges. The content is solid, but what I love is the final product. It’s accessible, easy to digest, and the layout is fantastic. Half the battle is delivering the message so that it’s clear, approachable and actionable. This is just what we delivered. And best of all, it’s free.

The last year has been a difficult one in security. The Snowden affair made people talk about security; this, at least, is good and the dialog continues today. But if 2013 was a year of difficult revelation, 2014 is going to be about back-to-basics security.

APIs offer tremendous business value to enterprise computing. But they also represent a potential threat. You can manage this risk with a solid foundation and good basic practices, but you need to know where to start. This is the theme of our new eBook. It offers simple guidelines, not tied to a particular technology. You should apply these whenever you deploy APIs.

I hope you find this eBook useful. As always, I’d love to hear your feedback.

Download: Five Simple Strategies For Securing Your APIs.

Sex, Lies and Acquisitions

Has it really been almost a year since my last post? I suspected I was nearing that milestone, but it’s still surprising to discover it has been so long. Blogs have a natural ebb and flow, governed as much by the irregular rhythms of the day job as inspiration. But this was a pretty big ebb. Maybe catastrophic drought is a better metaphor.

Naturally, my absence was not lost on the spammers. That curious breed who prey on dormant blogs left me with a mountain of weirdly unctuous commentary that I needed to shovel out of the way just to get to the front door. But now that I’ve finally worked my way inside, it’s time to turn up the heat, blow out the cobwebs, and get back to work.

The story of the last year, of course, is the acquisition of Layer 7 by CA Technologies. This explains my extended absence from writing. I’m no less busy than in the past, and indeed often quite a bit more, but I’ve been completely consumed with making this deal a success. So the last year is a blur of integration, customer outreach, some terrific innovations—but not a lot of writing. That changes today.

The number one question people ask—and they ask this quite a bit—is how am I doing at a large company, and more specifically, how is CA? It is a logical question, but one always delivered with a slightly raised eyebrow that really implies just give me the dirt—and the juicer the better.

I respond with the truth. And the truth, to be honest, is quite a bit less salacious than everyone secretly hopes. Everyone knows acquisitions can go spectacularly bad. The cultural explosions can power a small city through a tough eastern winter. People love to hear these bad news stories; it’s somehow wired into our DNA to revel in nasty gossip.

Fireworks are fun, but more often acquisitions simply wither. Often the combination of start-up and Fortune 500 is an impossible calculus of mismatched expectations. In a way, this is a much worse outcome, because although the end is the same, the story is more depressing.

At CA and Layer 7, we are steering clear of these all-too-common disaster scenarios. Against all odds, we seem to be finding a very effective approach that just seems to work well for everyone.

We built a great company at Layer 7, and around this a powerful international brand. This feat is hard to achieve and once there, it is heartbreakingly easy to destroy the results. Nobody is more acutely aware of this than acquirers, and they usually respond with one of two strategies, each taken to extreme. Either they leave their new prize alone, fearful of killing the goose that laid the golden egg, or they embrace it with enthusiasm and their own unique style. The former creates silos that will never come down; but the later can squeeze the vigor out of a start-up until someone notices that the empty shell isn’t moving any longer.

We are all working very hard to find the virtuous middle ground. CA recognizes that the Layer 7 team in Vancouver is a great engine of innovation. So the band stays together, and moreover has the opportunity—really the mandate—to continue to push the envelope around APIs and mobility. We all recognize that we are part of a much larger narrative now. But honestly, this is what excites us most of all.

CA is big but it isn’t overwhelming. I’ve been struck with what a small-big company this actually is. In just seven months, I feel as though I have a good handle on who all of the key players are, and I can pretty much engage anyone I need to and be taken seriously. It’s a level of engagement I never dreamed of at IBM, a company much larger in size and exponentially more complex in organization.

That said, not everything is sunshine and roses. The expense department is convinced I’m really Frank Abagnale. I have big philosophical differences with the Internet policies. And the telephone conference codes are just too long. But I suppose I can adapt.

So the truth is boring, my anecdotes are not sexy, and that’s all a very good thing. Actually a great thing. The numbers are high, opportunity abounds, and there is a sense we can affect real change when change makes sense. My stories about the swashbuckling days of Layer 7 are far more entertaining.

But to hear these, you’ll need to buy me a beer.