Posts from the ‘Risk’ Category

May 5

Is your existing DNS service reliable? Unlikely!

(This is an occasional rant about how to make things on the Internet just simply work without problem or hinderance).

Many domains fail almost every one of the reliability tests. They have two nameservers (the minimum), but often on adjacent IP addresses, say x.y.z.1 and x.y.z.2. These are certainly on the same IP network, and therefore in the same AS. They’re probably in the same rack, one sitting on top of the other. There is a large number of common failure modes that can make them both temporarily unreachable.

You can use the whois command (or any WHOIS-lookup web site) to look up the NS records by the name of your domain. It should tell you both their names and their IP addresses.

Here’s a very bad example, but very typical:

$ whois example.com
(…)
Domain servers in listed order:

A.EXAMPLE.NET 192.0.34.43
B.EXAMPLE.NET 192.0.34.44

If there are only two of them, and their IP addresses are identical except in the last number (as in the bad example, above), you have a problem.

If they’re not as close together as the example, finding out for sure whether they share an IP network takes local knowledge of the routing topology, which you probably can’t determine on your own. Ask your DNS provider for details.

Finding the AS path for the IP addresses is easier, but the output takes some expertise to interpret. http://nitrous.digex.net/ has some Looking Glass web pages that will let you look up available routing information for any IP address. (Pick a site and choose a BGP Query.) If in doubt, ask your DNS provider to describe their redundancy in terms of IP networks, physical space, and AS diversity. If they don’t even know what you mean, escalate. If they refuse to “disclose” this to you, vote with your feet.

Dec 28

It’s Not Information Overload. It’s Filter Failure.

This piece from Clay Shirky isn’t new, but it’s sure still absolutely relevant.

http://www.youtube-nocookie.com/embed/LabqeJEOQyI?rel=0

May 22

Security utopia

The problem I’ve most often met in building secure systems is that this particular subject seems to bring out the utopian in people like no other.

This ‘should’ happen, that ‘should’ happen, its unfair or wrong or wicked that such and such is allowed to continue. Well, yes. But what are we actually going to do about it? So we need realistic problems solvers. That means a pragmatic approach, which can often offend a lot of purists. Peter Gutmann captures the essence beautifully - “I think a lot of purists would rather have PKI be useless to anyone in any practical terms than to have it made simple enough to use, but potentially “flawed”.”

May 8

Trust comes from knowing….

” Trust comes from knowing, not from blind faith. And to know one must understand, and to understand one must have an intimate awareness of what conditions are truly present, what people do and what they don’t, how people do what they do and don’t.” Michael Gerber, “The E-Myth Revisited“

May 2

Bruce Schneier: The security mirage

The feeling of security and the reality of security don’t always match, says computer-security expert Bruce Schneier. At TEDxPSU, he explains why we spend billions addressing news story risks, like the “security theater” now playing at your local airport, while neglecting more probable risks — and how we can break this pattern.

Apr 3