The Firewall Is Dead, Long Live the Firewall

Half of all open source contributors are never encouraged to use digital signatures when making changes to the open source projects they’re involved with, according to the “2020 FOSS Contributor Survey.” In contrast, 17% are typically required to use a digital signature on all commits. Slightly more projects require cryptographic proof of somebody’s identity before the final package is released.

Especially in light of the recent SolarWinds attack, requiring digital certificates is a strong way to track open source code’s chain of custody throughout the software supply chain.

Since 2004, developer certificate of origins (DCOs) were used as a way to give a project legal permission to use a developer’s intellectual property, but their value as a way to increase trust among community participants has rarely been highlighted. In fact, when asked about the importance of DCOs, a third of contributors didn’t even know what they were, let alone if they were useful.

Requiring a digital signature can be a barrier for contributions because of the time and effort required to implement the system. If an open source project only has a few contributors, it may not seem worth the effort. Yet, 48% of projects also do not require the use of two-factor authentication (e.g., Google Authenticator or SMS messages) to accept a change request. Without this commonly used security approach, stolen or lost passwords can easily be used to hack a system.

These approaches demonstrate attempts to secure the code repository platform itself and the user actions within in, but there are countless other attack surfaces in the CI/CD pipeline. Many times the need to identify code authorship is related to debugging and not security concerns.

Choosing a license and governing model are essential elements to making a project ready for prime time. Creating a code of conduct and contributing guide are important too but so are policies that promote security. However, only 26% of the maintainers or core participants said the projects they are involved with have a security policy in place. On a slightly more positive note, 41% of the respondents said that the projects have someone with a security focus. Let’s hope that every project will have a security champion going forward.

The Firewall Is Dead, Long Live the Firewall

This week The New Stack saw a great deal of discussion around a concept we haven’t heard about in a while, Web Application Firewalls (WAFs). A WAF provides a shield between an internet-facing application and the internet. The cloud native computing community we cover is slowly coalescing around an idea that is almost diametrically opposite of firewalls, namely that of Zero Trust Computing. Zero Trust gets rid of the firewall boundary itself, assuming the internal network is already compromised, and moves the burden of authentication and access control to end-user devices and the applications (to their sidecars if they are service mesh-enabled). Zero Trust means you just don’t trust the network, even the private one.

A popular post on The New Stack this week, contributed by Check Point’s Head of Security TJ Gonen, pointed out that the WAF is totally unsuited for today’s DevOps environments: “It’s the worst-kept industry secret that WAFs aren’t all that they’re cracked up to be in the modern world of agile development. A WAF cannot keep up with application updates, which happen regularly, and maintaining a WAF has become labor-intensive and complex.”

Ouch! Others, however, are not so sure to body bag WAF. This week also saw the debut of Palo Alto Network (PANW)’s Web Application Firewall for its Prisma Cloud security platform. To be fair, PANW is no stranger to the fast DevOps environments that Gonen invokes: Prisma is literally made for dynamic cloud native environments. Also, Prisma’s WAF is not exactly your father’s WAF (assuming your father is a security professional).

“In PANW’s new-look web application firewall, several different functions are combined to protect your cloud services. Its WAF combines application programming interface (API) security, runtime protection, and a bot defense platform into a strong defense for cloud native applications,” writes TNS security reporter Steven J. Vaughan-Nichols, in a sponsored report on the new technology.

“The word ‘firewall’ is a bit dated, but as you will see, the concepts that we are presenting here are completely new and are for completely new-and-modern environments,” further explained Ory Segal, PANW senior distinguished research engineer in The New Stack Makers podcast hosted by TNS founder and Publisher Alex Williams.

The traditional firewall doesn’t work in cloud native environments, Segal agreed. But in addition to the usual firewall duties, such as API protection, access control, file upload control, detection of unprotected web applications, the Prisma WAF offers dynamic features such as a “penalty box” for attackers, one which can “ban” attackers’ access on an as-needed basis.

“Then it doesn’t matter if then they pull out the big gun or big trick or the sophisticated attack, since those will be automatically and categorically blocked, because they’re in the penalty box, which again, is a very good defense against such attacks,” Segal said.

vFunction Transforms Monolithic Java to Microservices

More than 21 billion Java virtual machines are out there today running predominantly monolithic applications. Many could take advantage of cloud native architectures, but rebuilding them for this new environment would be complex, time-consuming, and could require taking employees from other, more value-adding tasks. A new company publicly launched Tuesday, vFunction, has created a system to transform monolithic Java applications into microservices, using what it claims is a scalable, repeatable factory model.

2021 Will Be the Year of Enterprise Machine Learning

Could this be the year machine learning finally takes off in the enterprise? Diego Oppenheimer, founder and CEO of enterprise ML company Algorithmia, thinks so. He writes that “Every organization had to adapt to the realities of the pandemic. Business leaders adjusted their strategic roadmaps to refocus on their most pressing priorities and scale back or eliminate less critical plans. In the midst of considerable change, we at Algorithmia saw something fascinating unfold: Many enterprises not only moved full speed ahead with their AI/ML initiatives, but they actually doubled down on those efforts.” Read more here.

Thundra Cloud Debugging Platform Supports Java/Spring Hotfix Capabilities

Cloud monitoring provider Thundra has extended its platform by offering a plugin to debug and make fixes remotely for application code without disrupting application execution times. While Thundra previously allowed for monitoring and debugging applications and microservices, Thundra’s Sidekick plugin goes further by allowing for hotfixes to be implemented directly to live code.

ISSUE 252: The Firewall Is Dead, Long Live the Firewall

“Iceberg, an open table format for huge analytic datasets [is] based on an all-or-nothing approach: An operation should complete entirely and commit at one point in time or it should fail and make no changes to the table. Anything in between leaves a lot of clean-up work.”