The Commit Log

At a time when data security and compliance with European standards have become key concerns, this question is becoming increasingly crucial.

Clever Cloud recently joined Hexatrust, in line with its commitment to security in the cloud, and the importance of creating and supporting French and European digital ecosystems.

While we have maintained TLS 1.0 and TLS 1.1 for compatibility reasons, this will no longer be the case as of June 30.

Few days ago, Marak Squires, the developer behind the open-source npm libraries colors and faker, decided to corrupt the libraries, to denounce issues in open-source projects' funding system. Learn how to protect your app.

What is Log4Shell?

You probably heard about Log4Shell (or CVE-2021-44228), the vulnerability which impacted log4j,…

Yesterday two issues affecting CPUs have been released to the public.

TL;DR: the attacks are…

As you know, security is a big deal for us. You might have heard that…

Wake up. Check the news. There is a new OpenSSL vulnerability, the world is on…

To protect your web app or API, there is almost only one way at this…

nom is a parser combinators library witten in Rust that I started about a…

Geoffroy Couprie is a consultant in software security and an independent developer. He teaches development teams how to write safe software. This is the most seducing approach in IT security. This is also the worst. For more than 20 years now, people have believed that their network was a fortress, protected from the outside world by firewalls, NAT and DMZ. This idea is obsolete, we must change now. 20 years ago, it was still possible to see internal networks totally open, with every machine directly addressable from Internet. There were enough IPv4 addresses for everybody, the networks were small, life was good. But the security was atrocious: TCP stacks were remotely exploitable, worms were reproducing on corporate networks, internal file servers were publicly available, so people found the easiest way to secure everything on the cheap: isolate the network from the outside world. There's nothing wrong with that approach: it made sense at the time. As usual when someone finds a small, temporary hack instead of fixing everything, people kept improving it, approaching the local optimum. This led to firewalls on every machine, every network. People discovered that NAT could hide IP addresses, instead of simply allowing IP reuse, and thought it was a security feature. All of the nonsense about DMZ and airgapped networks appeared. Companies were actually selling hardware which would get packets from one network, disconnect (physically) from it, connect to another network, then send the packets. Airgap, yup. It worked for a time, since a lot of exploits in the 90s focused on remote exploits in operating systems and servers. If you cannot exploit the public face of the network, everything is alright. The attacker is only one wrong click on a lovingly crafted PDF file away from your network. Sysadmin taunting hackers Unfortunately, we cannot think that way anymore. Web applications give too much entry points to your servers. Pivoting from a DMZ server to the internal network is easy, since internal users will also access those web applications. The attacker is only one wrong click on a lovingly crafted PDF file away from your network. Why would you concentrate on firewall rules when phishing is so effective? Once the attacker is in your network, it is over. Listen to traffic, elevate your privilege, pivot to another machine, impersonate users, traverse the whole network... Traditional IT infrastructure The fortress metaphor, where everything behind your firewall is safe and trusted, is dead. Your walls are useful, but not that much when the attacker can get insiders to help him, willingly or unknowingly. The goal is not to keep the attacker out of your system. It is to detect the threat, isolate it, find the attacker's path and heal the system. The attacker may have been in your network for months. How would you be sure he is not there anymore? There is a much better metaphor than the fortress, now. Think of your system as a city. The city can have walls, but to function properly, it should let people enter and get out. You cannot know precisely if everything in your city is legit. Chances are, someone uses his personal USB key. Someone else connected a WiFi router in his office. People are talking on Facebook, watching porn, using forbidden applications, like modern browsers. You will not be able to catch them, unless repression is your main tool, and this will not help them work. You want to reduce criminality in your city, but you will not eradicate it. You cannot prevent fires, but you can prevent them from spreading too far and too fast. If you imagine the attacker as already present on your network, you go from plugging holes in one wall, to verifying dependencies and access control between systems. The trusted network approach is flawed, you have to think in terms of authorization from one user/app/machine to the other. The attacker will explore your network from one node to the next connected one, from one access level to the upper one, and try to combine them. Defenders think in lists, attackers think in graphs. You must assume that the internal network is as dangerous as the Internet. Assuming that servers will be safer if they are on your own network leads to a false sense of security. This is also why the nonsense around private cloud has to die. Assuming that servers will be safer on your own network leads to a false sense of security. A system built from scratch to handle the worst of internet has a better chance to survive. What matters is access control granularity around data, users and applications. The network is not a security boundary anymore.

TL;DR:
We are disabling the support of SSLv3 in front of our platform the Friday, 24th…

Did you like [Heartbleed?]({{ site.basepath }}/features/2014/04/08/openssl-101g-update.html) Meet Shellshock — aka CVE-2014-6271 — a new bug…

Yesterday, a security patch of OpenSSL 1.0.1g was issued, fixing a pretty critical vulnerability (refered…

Lire la version française

Since the beginning of…

French version below

We have updated PostgrSQL following…

Le cloud computing repose sur une infrastructure qui souvent n'est pas la propriété de l'hébergeur.…

Clever Cloud is designed to let you code and create wonderful applications able to enable…