Due to low attendee registration, and after several discussions with HPE personnel, customers, and other vendors, the MATUG Board has regretfully decided to postpone the MATUG Meeting that was previously scheduled for Tuesday, October 18 at the HPE facilities in Herndon, Virginia. We hope to hold this event in late Spring, 2017, possibly in May or June. We are sorry if this postponement has caused anyone hardship in regards to changing travel plans. We look forward to meeting in the Spring!

XYPRO - Breaches are from Mars, Security is from Venus

 Be sure to test your security knowledge by taking the short quiz at the end of the article!

 There is quite a large disconnect in the way security breaches are evolving versus how security solutions and resources are keeping up to address them, much like the book from John Gray covering relationships and the different motivations, of men and women. Unlike the book though, we’re not trying to come to a happy medium – we’re trying to keep the war like Mars at bay. As a security strategist, I’m constantly evaluating what is possible to help identify gaps and opportunities. The one thing I have learned over the course of my career is:

The only thing constant in cyber security is that attackers’ methods will continue to evolve.  They get smarter, more resourceful and are impressively ever patient.

The HPE Integrity NonStop server is not only a foundation of the HPE Server business, it is also central to countless mission-critical environments globally.  For the longest time, security of these powerful systems and the “Mission Critical” applications they run remained mostly static and under the radar while high profile attacks on other platforms have taken the spotlight.  That hasn’t lessened the risk and exposure of the NonStop server.  It’s actually created a gap. With globalization and introduction of new technologies for the NonStop server, this security gap will only increase if not addressed.

Interestingly enough, the NonStop server isn’t the only mission critical enterprise solution in this situation. There are some colorful parallels that can be drawn between applications running on the NonStop server and those running in SAP environments. Both are in highly mission-critical environments and vital to the revenue generation of an organization, and they frequently run payments applications like ACI’s BASE24 and other homegrown applications. This creates some interesting security challenges. In a recent The Connection Magazine Article, Jason Kazarian, Senior Architect at HPE described legacy systems as “complex information systems initially developed well in the past that remain critical to the business in spite of being more difficult or expensive to maintain than modern systems”. His article went on to point out the security challenges of legacy applications.  In summary some of these types of applications can tend to be unsupported, security patches aren’t readily available and if they are, they aren’t applied in a timely fashion because of fear of disruption, and they don’t have a lot of the security features modern applications would have. This makes detecting and addressing security risk and anomalies a greater challenge than it already is.

MIND THE GAP

How can this problem be addressed? Protect what you can.  As a first step, be it system, application or data – push the risk down the stack to an area that is more controllable by typical security. For example, tokenizing data used by a legacy application will send an attacker to go search for that data through another method, preferably one better suited for detection.

Have a risk based, layered approach.  This will swing the odds in your favor. OK, maybe not completely in your favor, but this approach will provide you with the arsenal you previously did not have:  It will create those choke points, provide the visibility needed and help reduce mean time to detection and response.

With the way threats are evolving, those of us responsible for security need to constantly evaluate and assess our capabilities. Let’s take a dive into each layer to explore the benefits they provide in an overall security strategy.

Protect

Protection/prevention is the first and most critical layer of any security framework. Without a proper protection layer in place, none of the other layers can be relied upon. Think of the protection layer as the traditional defensive strategy – “the wall built around assets“. This includes defining and implementing a security policy as well as hardening of the network, the system and applications. The protection layer is also where users, roles, access control and audits are set up. Key fundamental concepts to consider as part of the protection layer.

• Authentication – Allows a system to verify that someone is who they claim to be. In a HPE NonStop server environment, this can be done using Safeguard, XYGATE User Authentication, or through application authentication.
• Authorization – Determines what a user can and cannot do on a system. Authorization defines roles and access to resources.
• Access Control – Enforces the required security for a resource or object.
• Logging and Auditing – Ensures that all security events are captured for analysis, reporting and forensics
• Encryption and Tokenization – Secures communication and data both in flight and at rest. Examples of products which protect data include VLE, TLS, SSH, Tokenization and more.
• Vulnerability and Patch Management – Ensure timely installation of all RVUs, SPRs and application updates. Prioritize and take recommended action on HPE Hotstuff notices.

These types of preventative controls are necessary and intended to prevent unauthorized access to resources and data, but they cannot solely be relied on as a long term sustainable security strategy. Attackers’ motivations and sophistication are changing, therefore when prevention fails, detection should kick in while there is still time to respond and prevent damage.

Detect

In testimony given before the Senate Subcommittee on Science, Technology and Space, famed cryptographer and cyber security specialist Bruce Schneier said:

“Prevention systems are never perfect. No bank ever says: “Our safe is so good, we don’t need an alarm system.” No museum ever says: “Our door and window locks are so good, we don’t need night watchmen.  Detection and response are how we get security in the real world… “

Schneier gave this testimony back in July of 2001, yet in 2016 where organizations are getting hit by incidents they can’t detect, this premise is still valid and critical. In the previous section we discussed hardening systems and building a wall around assets as the first layer of security strategy. I’m surprised by the number of conversations I have with IT and Security folks who still carry the mindset that this degree of protection and compliance is good enough. No matter what level of protection a system has, given enough time, an attacker will find a way through. The faster you can detect, the faster you can respond, preventing or limiting the amount of damage a security breach can cause.

Detection is not a simple task. The traditional method of detection is through setting up distinct rules or thresholds. For example, if a user fails 3 logons in a span of 5 minutes, detect it and send an alert. In most cases that rule is explicit. If the failed logon events spanned 20 minutes, or worse yet, 10 days, it would not be detected. The limitation with relying on rules for detection is they will not alert on what they don’t know about. Those low and slow incidents and unknown unknowns – activity not normal on a given system -will fly under the radar and no one would be the wiser until you get a call from the FBI.

The other challenge is correlating events from multiple data sources. Let’s look at the incident pattern below.

In this incident pattern, we have events from EMS, Safeguard and XYGATE. The NonStop server could send each individual data source to an enterprise SIEM, but the SIEM would not have any context to detect the incident pattern as suspicious behavior. A security analyst could create rules to detect the incident pattern, but that’s just one use case. The traditional method is to scour through event audit records, try to put the pieces together and then create a rule to detect that pattern in the future. The weakness in that thinking is the incident has already occurred. You’re putting a rule together on the off chance it will happen again. However, it’s not reasonable or possible to anticipate and define every possible incident pattern before it happens.

A third area of concern is profiling a system and its behavior to understand what is normal behavior for users, applications and the system to be able to recognize when activity is not normal. This can be accomplished through evaluating the system and its configuration, profiling the system over a period of time, profiling user behavior, highlighting risk management and a variety of other intelligence methods. This is where machine learning has a significant advantage. No human could possibly evaluate the volume of data needed to make these types of determinations at the speed required by today’s standards. Machine learning is a type of artificial intelligence that enables the system to teach itself. Explicit rules are no longer the lone method of detection. Machine learning can profile a system or network over a given amount of time to determine what is normal to isolate what is not normal. Inserting machine learning as part of a solution process significantly increases abilities to stay on top of what is going on with a given system, user, network or enterprise.

Alert

The third layer relies on alerting. The challenge most environments have as they grow and their infrastructure becomes more chaotic with more tools, more users, more data and more events is that they alert too much or too little. How does one know what to act on and what is just noise? There are solutions that position themselves as being able to do data and analytics, but that ends up generating more data from existing data. Now someone needs to determine if the newly formed alert is actionable or just noise.

Going back to our previous failed logon example, if we were to receive 15 different alerts for the same rule, how can one know which alert to pay attention to and which to safely ignore? If you’ve ever been responsible for responding to security alerts, you know this creates alert fatigue. Back in my early days, mass deleting emails of similar types of alerts was one of my favorite things to do.

Contextualization allows the system itself to determine what is actionable and what is just noise. A solution likeXYGATE SecurityOne can evaluate each potential alert and, based on activity that happened previously for that that user, IP, system etc…, determine whether the reported activity is business as usual or a serious issue that needs to be paid attention to. Creating new data and new alerts from existing data doesn’t solve the problem. Applying context to the new incidents generated helps focus efforts on those incidents that truly need attention. Once an account changes hands, it will behave slightly differently.

Contextualization is key.
Respond
For any of the first three layers to produce value, there needs to be a proper incident response plan.
Responding will allow you to deploy your countermeasures, cut off access, send the attacker to a mousetrap or other actions that will assist in minimizing the impacts and recovery of a breach.

Containing the breach and quickly recovering from it are the most important steps of this layer. Response and containment comprise of a number of simultaneous activities to assist in minimizing the impact of a breach. These may include but not limited to:

• Disabling accounts
• Blocking IPs and Ports
• Stopping applications or services
• Changing administrator credentials
• Additional firewalling or null routing
• Isolating systems.

This is necessary to slow down or stop an attack as well as the preservation of evidence. Evidence of the attack is generally gathered from audit logs, but coupled with detection and analytics tools can provide access to information in a much quicker and more granular fashion. Being able to preserve evidence is key is forensic investigations of the breach as well as important for prosecution.

Once all the pieces fall into place and there is an incident alert that requires response, how will your organization deal with the issue? Breach incidents are hardly ever the same. There needs to be a level of categorization and prioritization on how to deal with specific incidents. In some cases, you may want to slowly stalk your attacker, where in others, the sledgehammer approach may be the only thing that can preserve data. Does everyone understand their assigned roles and responsibilities? Is there someone in charge? Is there a documented plan? All of these are considerations that need to be accounted for as part of response. This can be summarized in two words – BE PREPARED.

Resources

On the HPE NonStop server – the protection layer can be addressed with properly configuring Safeguard, implementing protection of data in flight and data at rest and deploying third party security tools available for the system. For alerting and detection, XYGATE Merged Audit with HPE Arcsight can provide the tripwires and alarms necessary for proper detection. For further detail on how to properly protect a NonStop server, HPE has published the HPE NonStop Security Hardening Guide. XYPRO has also published a 10 part blog series on how to properly protect a NonStop server (http://bit.ly/21nmQiY).

For the next generation of detection and alerting, XYPRO’s  newest offering, XYGATE SecurityOne (XS1), bringing risk management and visibility into real time. XS1 correlates data from multiple HPE Integrity NonStop server sources, detects anomalies using intelligence and analytics algorithms to recognize event patterns that are deemed out of the ordinary and suspicious for users, the system and environment. Coupled with HPE ArcSight, the solution can provide a constant, real time and intelligent view of actionable data in a way that was never been seen before.

Strong technology and process is important, but people are paramount to any successful security strategy. Constant security training and development on industry best practices, security trends and attack evolution should be factored into any security program. Without ongoing training and reinforcement of people, the gap only has an opportunity to widen. An organizations most valuable resource are the people hired to provide security and close the gap. Use them wisely and ensure they have the tools and training to provide the layers of defense required.

En Finale

Cyber criminals don’t sit around waiting for solutions to catch up. Security complacency ends up being the Achilles Heel of most organizations. Because of its unique attributes, security on the NonStop server needs to be addressed in a layered approach and Risk Management is a big part of the process. Putting the layers in place to allow us to highlight risk as early as possible to address it is key in dealing with upcoming challenges. This will hopefully help bridge the gap between attacks and security.

We need to recognize the paradigm shift and the change in mindset in how we approach security, and attackers’ ability to stay one step ahead of most defenses is central to their strategy. As the NonStop platform evolves and becomes more interconnected, what was put in place previously to address security will not be sustainable going forward. No matter how vendors position their solutions, security is hard, doing the right thing is hard, but that doesn’t mean security professionals need to work harder.

From a security professional’s perspective, cyber criminals will always be viewed as Mars – warlike.  Relentlessly driving to break into systems, get to data, wreak havoc and cause disruption to fulfill their malicious objectives. Meanwhile, cyber security staff need to act more like Venus – clouded in mystery and deliberately avoid being seen while following the enemy.  If Mars knows our tactics, Mars can avoid them. Mars is at war. Mars is patient. Mars will continue to attack, low and slow. With the proper security layers in place, Mars will be thwarted by deliberate masking, redirection and detection that hides where the data really is and alerts when the enemy is near. We continue to get smarter by blocking, hiding and redirecting things away in response to attacks. But unlike men and women,  Venus in the security world has a  goal is to keep Mars at bay forever…or longer…

Payment Card Industry Data Security Standard (PCI DSS) v3.2

New Requirement 8.3.1 (effective February 1, 2018) addresses multi-factor authentication for all personnel with non-console administrative access to the CDE.

New Requirement 8.3.2 addresses multi-factor authentication for all personnel with remote access to the CDE (incorporates former Requirement 8.3).

The Authenticator agent can be configured to include all or some users and terminals. Additionally, selected NonStop users can be assigned to specific RSA ids.

CSP Authenticator can provide authentication services in two ways:

1)    Safeguard Authentication SEEP

In this mode, all login attempts by Guardian users that are normally processed against Safeguard are instead passed to the Authenticator agent, which in turn sends the login request to the RSA Authentication Manager for authentication.

2)    Pathway Server

In this mode, login attempts through a Pathway application are passed to the Authenticator agent, which in turn sends the login request to the RSA Authentication Manager for authentication.

CSP Authenticator is certified with the latest RSA release and works seamlessly with other security products in the NonStop environment.

 For more information please visit www.cspsecurity.com

Lusis TANGO Webinar Series  

Please join us for our next series of 1-on-1 presentations on transaction processing software for acquiring, routing, switching and authentication.

TANGO is a solution that authorizes payments across multiple channels including ATM, POS, eCommerce, Prepaid and Mobile.

Learn how TANGO:

·         Has become the most cost effective long term payments solution on the market

·         Has been chosen by companies worldwide due to its performance and hardware agnostic capability

·         Can offer flexible architecture while providing scalable performance

·         Has recently gone live at one of the Big Five Banks in Canada

·         Select a date and time that works best for you!

Register today: http://www.lusisblog.com/tango_webex.html

BRIAN MILLER

GENERAL MANAGER

Phone:     415-829-4577

Email:      Brian.Miller@lusispayments.com

Website:  www. lusispayments.com

Musings on NonStop!

September, ‘16

The opinions expressed here are solely
those of the now self-employed author

Are you finding this format for my Musings on NonStop useful? Do you find the links to my posts and commentaries worth following? It’s been a year since I changed the content of my monthly Musings but I am always monitoring the results – so if there are any suggestions you would like to make, feel free to email me at: richard@pyalla-technologies.com And if you plan on attending a couple of RUG meetings including DUST and CTUG, come and say Hi!

Continuing with these thoughts, who within the NonStop community these days doesn’t have a LinkedIn profile? On the other hand, even as LinkedIn constantly fine-tunes their product offerings, the amount of information crossing our desks / laps continues to climb. Have we reached saturation point where reading anything more has become information overload? Again, we are only a couple of months away from the NonStop Technical Boot Camp (TBC) and even as I look forward to catching up with many of you, I am open to changing style and formats to better suit the time you can spend staying current on all things NonStop.

Perhaps the overriding issue this month concerns just how many more changes can we expect to see occurring at HPE? There’s scarcely a week that passes where HPE isn’t making headlines – first with the now famous “spin-merge” of HP Enterprise Services (Services) to / with CSC and more recently, the additional spin-merge of HP Software (Software) with Micro Focus. Along the way there was the small news item concerning the purchase of SGI – a famed label within Silicon Valley but not a company that shared anything today with its former glorious past. However, HPE now has a top-end, scale up, option for the SuperDome X product line even as it generates further options for those running SAP-HANA in-memory. 

However, it is the new focus by HPE on infrastructure and platforms that has caught my attention as has the realization that today, NonStop is the best software “platform” on the planet. And how fortunate was if for NonStop to be considered within HPE as a platform! If you missed the December 15, 2016, post Picking the line … to the NonStop community blog, Real Time View, then you may want to revisit the observations I made and the direct quote from then HPE CTO, Martin Fink. Midway through the post you will read of my encouragement to truly reconsider the future of NonStop systems as HPE has clearly made a sizable investment in its future even as it turns up the heat on the value proposition of NonStop systems – there’s little confusion or ambiguity about the intentions of HPE concerning NonStop. “NonStop X? It’s the best software platform on the planet!”

NonStop isn’t going anywhere even as Mission Critical Systems (MCS) at HPE, the home of NonStop, has become part of the Data Center Infrastructure Group (DCIG). This group is one of three that has been created in the new look HPE: it recently formed three core business groups within HPE's Enterprise Group division - one focusing on software-defined and cloud technologies, one focused on data center infrastructure, and one focused on edge technologies and the internet of things. But for more on this most recent development, look for next month’s Musings where I will have even more to say on the matter. In the meantime for all the coverage I have given to HPE and NonStop of late, check out the links below to the posts and commentaries for the month of August.

Real Time View:
And this month I wrote a fourth post as I celebrated the commencement of my tenth year of blogging!
http://itug-connection.blogspot.com/2016/08/time-to-reach-for-big-guns-fighting-for.html
http://itug-connection.blogspot.com/2016/08/where-do-we-turn-for-news-for-nonstop.html
http://itug-connection.blogspot.com/2016/08/you-want-to-read-more-posts-on-nonstop_20.html
http://itug-connection.blogspot.com/2016/08/inside-numbers-when-being-1-matters.html

LinkedIn blog / Pulse:
Becoming my go to place for short commentaries and where I have now published 50 posts!
https://www.linkedin.com/pulse/bizcations-how-we-all-working-future-richard-buckle?trk=mp-author-card
https://www.linkedin.com/pulse/supporting-my-clients-want-know-which-linkedin-groups-richard-buckle?trk=mp-author-card
https://www.linkedin.com/pulse/nonstop-vendors-continue-support-system-managers-usage-richard-buckle?trk=mp-author-card
https://www.linkedin.com/pulse/start-my-tenth-year-blogging-expect-see-many-more-posts-buckle?trk=mp-author-card
https://www.linkedin.com/pulse/boot-camp-coming-yes-once-again-omnipayments-hosting-reception?trk=mp-author-card

As well as a three part post on storage …
https://www.linkedin.com/pulse/bridging-data-gulch-part-1-richard-buckle?trk=mp-author-card
https://www.linkedin.com/pulse/bridging-data-gulch-part-2-richard-buckle?trk=mp-author-card
https://www.linkedin.com/pulse/bridging-data-gulch-part-3-richard-buckle?trk=mp-author-card

ATMmarketplace:
http://www.atmmarketplace.com/blogs/in-the-mood-to-steal-you-might-be-out-of-luck/

Banking Technology:
http://www.bankingtech.com/555822/lets-all-get-together-not-likely-mobile-payments-are-still-a-far-far-away-dream/

ComForte:
https://comforte.com/blog/blog-article/hpes-the-machine-what-it-means-for-nonstop/
https://comforte.com/blog/blog-article/with-yuma-nonstop-x-has-become-a-full-software-solution/

Tandemworld (Musings on NonStop):
Where you will find a collection of posts and articles in support of IR, DataExpress, TCM Solutions as well as my monthly Musings on NonStop:
http://www.tandemworld.net/newsletter_aug16.html

Buckle-Up-Travel:
http://buckle-up-travel.blogspot.com/2016/08/july-vacation-no-time-to-spare-so-how.html

Richard Buckle
Cofounder and CEO

Pyalla Technologies, LLC
Email:    richard@pyalla-technologies.com

With our eyes never far away from what our customers are doing and as we maintain regular contact with our colleagues at HPE, there is much that we are learning of late. It seems that there has been a sizable jolt that has passed through the NonStop community that has awakened many of our customers to just how good they are having it; running critical applications on NonStop is, once again, making sense to them. Historically, the banks we work with have been NonStop stalwarts for decades but many of our colleagues that we had dealt with over the years were considering career changes as they looked to develop skills on platforms apart from NonStop. It was only a year or so ago that we noticed a lot more chatter taking place about just how long NonStop could prevail.

Kind Regards

Tony Craig

Managing Director