Да прочетеш непрочетимото – как разчетоха човешкия геном

Post Syndicated from original https://www.toest.bg/da-prochetesh-neprochetimoto-kak-razchetoha-choveshkiya-genom/

Двойната спирала

Да прочетеш непрочетимото – как разчетоха човешкия геном

Всички са чували за ДНК, или двойната спирала. Но какво всъщност се крие в тази структура, наподобяваща спираловидното стълбище към кабинета на професор Дъмбълдор в магическото училище „Хогуортс“? ДНК съдържа пълните инструкции за развитието на една клетка, тъкан, орган. Звучи почти като фантастика, но дезоксирибонуклеиновата киселина има 521 години полуживот, което означава, че половината ДНК от една проба деградира за тези 521 години.

ДНК в една клетка в „разплетено“ състояние (подобно на развито кълбо прежда) е дълга два метра. За да се събере цялата тази информация, тя е в компактно състояние, наречено хромозома. Хромозомата е „кълбо от прежда“, което се развива само при нужда, тоест тя променя компактното си състояние само ако даден ген е активен и е на път да се превърне в РНК и оттам в белтък.

В центъра на всички човешки клетки (ядрото) има 46 броя хромозоми (две двойки по 23 – диплоиден набор). Понятието „геном“ включва всъщност точно тези 23 хромозоми (хаплоиден набор). Единствените клетки с 23 хромозоми са половите (яйцеклетки и сперматозоиди), тъй като след сливането им се осигурява диплоидният набор и генетичното разнообразие.

Проектът за човешкия геном

Преди 70 години учените са установили структурата на ДНК. Тя е изградена от нуклеотиди, които са съставени от азотни бази, захар, наречена дезоксирибоза, и фосфатна група. Макар през 1963 г. Джеймс Уотсън, Франсис Крик и Морис Уилкинс да печелят Нобелова награда за откритието си, няма как да не се отбележи, че редица други учени са участвали в процеса и имат не по-малки заслуги: органичният химик Александър Тод, биохимикът Ървин Чаргаф, биофизикът Розалинд Франклин и физикохимикът Лайнъс Полинг.

Проектът за човешкия геном (1990–2003) е смятан за най-важното биомедицинско проучване на ХХ век. Освен самите научни постижения, той е от изключителна значимост, защото дава начало на идеята за публично споделяне на научните данни и разглежда въпроса за етиката при биомедицинските изследвания. Друга отличителна черта на проекта е, че учените изследват неизвестното в биологичния свят, а не както по принцип се провежда една научна разработка – с изказване на научна хипотеза/теория и последващото ѝ приемане или отхвърляне.

Проектът е интернационален и целта му е била да се секвенира (разчете) целият човешки геном, както и геномът на няколко други организъма (бактерията Escherichia coli, дрождите, винената мушица и мишките). Целите на проекта и начертаният план са се променяли в хода им и е интересно да се отбележи, че той е приключил цели две години по-рано от планираното, надминавайки очакванията и представите на учените, които са обмисляли идеята още през 1988 г.

Какво представлява разчитането на един геном?

Геномът е изграден от определени последователности (секвенции), подобно на книга, състояща се от изречения, изградени от думи, а думите – от букви. Секвенирането на ДНК представлява определянето на подредбата на азотните бази, които я изграждат. Това са аденин (А), цитозин (Ц), гуанин (Г) и тимин (Т). Голяма част от усилията на участниците в Проекта за човешкия геном са насочени именно към развитието на технологиите, разчитащи генома (т.нар. секвенатори).

Разчетеният човешки геном не е само на един човек. В проекта са участвали анонимни доброволци, подписали информирано съгласие за използване на техния генетичен материал (кръвна проба) за научни изследвания.

Проектът е публично финансиран, като първоначалните средства за обезпечаването му са възлизали на 3 млрд. долара за планирания 15-годишен период. Изразходваната сума трудно може да се изчисли с точност, тъй като участниците са от 20 университета от САЩ, Великобритания, Франция, Германия, Япония и Китай, но се смята, че е близка до първоначално заложената. Въпреки огромната сума, постигнатите резултати със сигурност си заслужават отделените средства, време и труд. Икономическите ползи от развитието на геномиката, като например напредъкът във фармацевтичната и биотехнологичната индустрия, са за поколения напред.

Един от най-интересните аспекти на проекта са т.нар. Бермудски принципи. След две срещи на учените от проекта в Бермуда е взето решение всеки разчетен участък от генома да бъде почти веднага публично достъпен. Това решение за прозрачност и информираност при споделянето на данни от биомедицински изследвания е безценно.

Въпреки многогодишната работа и неоспоримите ползи от Проекта за човешкия геном, всъщност нашият геном не е разчетен напълно при приключването на първоначалната работа през 2003 г. Геномът ни носи информация за производството на РНК и белтъци в участъци, известни като екзони, но той е изграден и от интрони. Доскоро се смяташе, че интроните не кодират никаква информация и са излишни и непотребни (т.нар. junk DNA). ДНК съдържа и по-комплексни и често повтарящи се участъци, които затрудняват разчитането ѝ.

През 2000 г. Консорциумът за секвениране на човешкия геном съобщава, че геномът ни е 90% разчетен, но с цели 150 000 неизвестни области от ДНК, познати като „празнини“. През 2003 г. Консорциумът съобщава за подобрения в разчитането на генома и почти пълното му завършване – 92%, с 400 останали празнини.

През 2013 и 2019 г. Консорциумът за референтен геном добавя поправки и подобрения към публично наличната информация за разчетения геном.

Разшифроване на последните 8 процента от човешкия геном

На 31 март 2022 г. консорциумът „От теломер до теломер“ съобщава, че е запълнил останалите празнини и напълно завършеният човешки геном вече е факт. Полученият пълен геном (означаван като T2T-CHM13) вдига 20-годишната бариера, която ни е делила от оставащите 8%. Те включват всички центромерни райони на хромозомите (структура, която играе основна роля при разделянето на ДНК по време на деленето на клетката) и целите къси рамена на 5 хромозоми (13-та, 14-та, 15-та, 21-ва и 22-ра).

Късите рамена на тези хромозоми се състоят от хиляди повторения и гените носят информация за производството на т.нар. рибозоми. Рибозомите са структури от изключително важно значение, тъй като те изграждат всички белтъци, необходими за функционирането на една клетка. Високото ниво на генетични вариации в центромерите е златна мина, която тепърва ще се копае, за да се установи функционалното им значение.

Учените съобщават, че са добавили около 200 млн. ДНК бази. Всичко това не би било възможно без разработването и внедряването на най-новите секвенатори на Oxford Nanopore и Pacific Biosciences. Секвенаторите са машини, които четат азотните бази от ДНК (А, Г, Ц и Т), и след това софтуер ги подрежда. ДНК се изолира от генетичния материал (например кръв), след това се подготвя т.нар. ДНК библиотека. Секвенаторът не може да чете цялата ДНК, защото е прекалено дълга. Затова тя се накъсва (фрагментира), маркират се краищата на всеки фрагмент и след като секвенаторът ги прочете, софтуерът ги подрежда. Новата технология за секвениране позволява разчитането на по-дълги участъци с точност над 99%.

Следващата стъпка

Наличното пълно разчитане на човешкия геном е предпоставка за установяването на още гени, предразполагащи към определени заболявания. Общият поглед над целия геном без празнини или „скрита“ ДНК ще даде възможност на учените да изяснят множество въпросителни относно човешкото здраве и еволюция.

Въпреки че CHM13 представлява пълният геном, той не обхваща целия спектър от генетичните вариации при човека. Поради тази причина консорциумът „От теломер до теломер“ вече е обединил силите си с Консорциума на човешкия референтен пангеном с цел събирането на висококачествени референтни геноми от разнообразни проби.

Персонализираната медицина днес и в близкото бъдеще

Анализът на огромната информация от индивидуалните различия на гените позволява създаването на персонализираната (прецизна) медицина. Морето от информация, известно като Big Data, се анализира с алгоритми, основаващи се на машинно обучение. Приложението им в персонализираната медицина ще помогне за разработването на нови лекарства за терапия на генетични заболявания.

Напредъкът в машинното обучение, като изкуствения интелект и дълбокото обучение, са част от кутията с инструменти, подготвяна за предстоящите изследвания на геномната информация. Прогресът в тези области е неотменна част от иновациите, които тепърва предстоят в областта на персонализираната медицина.

Заглавно изображение: Кариограма на човек (хромозомите, подредени по размер, вид и брой). Източник: Wikimedia Commons

Болоня 2023

Post Syndicated from Зорница Христова original https://www.toest.bg/bolonya-2023/

Болоня 2023

Преди осем години, в първата си статия за Международния панаир на детската книга в Болоня, съм написала това:

Разбира се, освен павилиони на отделни издателства има и национални павилиони – нещо, което би звучало логично и в нашия случай. Те са обикновено много промислени, дизайнът им е интересен (ефект на черна дъска при хърватите, стърчащи моливчета като опора за книгите при литовците), подборът – внимателен. Някой някъде е вярвал на специалистите си повече, отколкото на лобитата, та резултатът не е сбириток от пазара, а стои цялостно и има физиономия. Литовците, примерно, са издали няколко различни каталога – един дебел, специално за илюстрация, друг с кратки резюмета на книгите, трети по-подробен, но пък свил фокуса до 20 важни детски книги. Спомням си какво съм виждала и в Латвия, и изведнъж се сещам, че ние дори нямаме история на българската детска книга, камо ли пък съвременна история, камо ли пък годишен каталог. А би било лесно и хубаво.

Слава богу, за осем години развитие има. През това време въпросният годишен каталог се появи, издание на Националния център за книгата. Появи се и български павилион. Всъщност първоначално се появи павилион, който носеше името „България“, но беше събрал накуп няколко издателства, спонсорирани от Агенцията за подпомагане на малките и средни предприятия. Това беше чудесно, но не и представително – и не изключваше необходимостта България да има свое национално присъствие.

Тази година павилионът е факт, като беше отчетена и друга важна критика при представянето ни във Франкфурт – а именно че книгите, изпратени от издателства членове на АБК, не могат да играят ролята на лице на България. В Болоня проблемът беше решен наполовина: имаше и изпратени от издателствата книги, и селекция, като обаче двете пространства бяха останали необозначени за посетителя. Общият вид на щанда беше приемлив, но минималистичен – организаторите бяха поръчали визуални материали на художничката Кристина Тужарова, авторка на детски книги за Владимир Димитров – Майстора и Иван Милев.

Като цяло, мисля, че е добро начало, но ще си позволя да отправя някои препоръки за следващи години.

1. Наемът на самата площ е висок.

Струва си да се инвестира повече не само във визия, а и в цялостен дизайн. Тоест нужен е не само художник, а и архитект, който да осмисли пространството от гледна точка на функцията му – да открои детската ни книжнина и да позиционира страната ни сред другите, но и да позволи пространството да се използва за срещи с литературни агенти и други издателства. Ние имаме чудесни автори на модули за преносими изложби, например пътуващата изложба за археологията на „Музейко“, и това съвсем не е непостижимо.

2. Частта със селектираните книги може да бъде много по-голяма.

В момента третата стена на павилиона е празна, което е пропусната възможност. Има смисъл да присъстват и книги, които не са от последните една-две години – не сме толкова познати на света, че по-старите издания да са втръснали на всички. Напоследък българската детска книга изживява подем и това, което съм казала през 2015-а, вече не е вярно. Имаме чудесна собствена продукция и можем да покажем немалко. Българската илюстрация в частност си струва да се промотира – в нашия павилион имаше корици, с които всеки друг би могъл да се гордее.

3. Много малко хора по света говорят български.

Корейският също не е лингва франка, затова някои южнокорейски издателства придружават

всяка книга с картонче с резюме на съдържанието,

пъхнато под корицата. Оскъдният текст (при картинните книги е лесно) е разпечатан на паус и залепен над оригиналния. Ако се интересуваш от издателството, веднага може да получиш визитка и координати.

Далеч съм от мисълта организаторите да правят всичко това вместо издателствата. Но биха могли да го поискат. В крайна сметка всяко издателство има интерес правата на книгата да бъдат откупени.

4. Панаирът е необятен

и подробното разглеждане на павилион по павилион и книга след книга е невъзможно. До нашия павилион се стига доста трудно и

едва ли можем да разчитаме само на случайно преминаващи любопитни издатели.

Други национални павилиони решават този проблем, като организират събитие – например канят някой илюстратор да рисува на живо, или още по-добре, организират коктейл, като не става дума за тежки трапези, а по-скоро за събитие, което да даде повод за социално общуване. На полския щанд например стандартната почерпка е ябълки; на щанда на едно шведско издателство има просто близалки… с мумини на опаковките. Та на въпросния  „коктейл“ се представя програмата на правителството за финансиране на преводи от съответния език. Да, ние също имаме такава програма. Поне миналата година обаче тя беше изключително тромава – документи се подаваха само на български език, нотариално заверени и пр. За сравнение, кандидатстването по подобни програми в Латвия, Нидерландия и Полша става почти мигновено – качваш на сайта договора за правата и договора с преводача, попълваш пет реда формуляр и приключваш. На английски, естествено, не търсиш кой в Нидерландия би превел и подал документите вместо теб.

С други думи, за да има смисъл от такава програма, тя трябва да бъде достъпна и лесна за използване. Иначе излиза, че целта ѝ е да откаже кандидатите. Тогава защо съществува?

Дотук за краденето на идеи от други щандове на панаира; нека сега погледнем пò на едро и да видим кои идеи на неговите организатори си струва да приложим у нас. Едва ли някой ще ни се разсърди.

Отскоро например между различните награди, присъждани на панаира, е и „Карла Поезио“ – наградата за дисертация в областта на детската книга. Защо това е важно? Ами защото детската книга е традиционно неглижирана в университетските среди, сякаш не е точно литература и не подлежи на академично вглеждане. Идеята да се даде рамо на изследователите в тази област може реално да промени пейзажа.

Второ, има награда специално за прохождащи илюстратори. Това е наградата „Арс ин фабула“ – за да я спечелиш, трябва да си под 35 години и да си селектиран за илюстраторската изложба (само по себе си трудна задача, кандидатите са над 4000). Обаче пък получаваш възможността да работиш една година с ментор от водещо издателство по конкретна книга. И е много вероятно тя да бъде издадена. Защо е важно? Заради приемствеността. Знанията, уменията, критериите трябва да могат да се предават. И университетите не са достатъчни за целта. У нас това е особено наболяло – много от издателствата са миниатюрни (както и моето собствено). Понякога дори става въпрос не за екип, а за един човек. Вярно, че занаят се краде… но май го пазим твърде добре.

Трето, има награда за превод на детска литература. Е, само за превеждащи на италиански. Но я дават италианци, нали? Нищо не ни пречи да направим своя. И без това преводът на детски книги е труден, с куп специфики (дори да не е римуван), почти без пари (понеже в повечето случаи става въпрос за съвсем малко текст) и незабележим за големите преводачески награди, за които трябва да си се хванал с роман, староарабски епос или научен труд.

Четвърто, различните теми на фокус. Тази година имаше конкурс за илюстрации по Итало Калвино – автор достатъчно престижен, популярен и „вкусен“ за илюстриране (особено трактовките по „Баронът по дърветата“ и „Разполовеният виконт“ бяха чудни). В предишни години на фокус са били книгите за художници. Или пък книгите за природата. И т.н.

И последно, пето, на мен ми харесва фактът, че

наградите дават рамо на книги, които са предназначени за някаква ограничена група читатели – например за незрящи деца, за деца мигранти и пр.

Книгоиздаването е пазар и една малка целева публика не може да осигури кой знае какви продажби, още повече ако е маргинализирана. Но това са деца и те също имат нужда от качествени книги. Тук акцентът е „качествени“ – аз вярвам, че социално важното изкуство също трябва да бъде изпипано, красиво, доставящо наслада. Иначе става пропаганден плакат. Е, тук може да се видят доста примери как не пречи нещо да е полезно и красиво едновременно. Има и примери за обратното, разбира се.

Изброявам тези неща, за да подчертая

как подобни награди могат да бъдат инструменти за промяна, а не просто раздаване на бонуси.

И как журито на една награда отстоява престижа ѝ с всеки свой избор, така че тя да значи нещо. За сравнение, години след статията на Нева Мичева за наградите „Христо Г. Данов“ много малко се е променило – може би някои категории, но не и елементарни неща, като уебсайт на наградите (двуезичен? или е твърде много?) и дори просто графичен символ на наградата, който да може да бъде отпечатан и сложен на самата наградена книга. Тогава може би и националните ни награди ще имат повече тежест на международния пазар.

Разбира се, нашият панаир на книгата, ако и да се казва „международен“, всъщност е съвсем друг тип събитие – не за продажба на права, а за продажба на книги – и чуждестранните павилиони са малко и встрани от същността му. Това обаче не значи, че не би могъл да бъде добър инструмент в някоя от гореописаните посоки. Най-малкото браншът го припознава като важно местно събитие, а освен това има добро начало с наградите „Златен лъв“. Нищо не пречи да се обмисли как най-добре да се използва този потенциал.

На второ четене: „Да бъдеш мъж и баща“

Post Syndicated from Стефан Иванов original https://www.toest.bg/na-vtoro-chetene-da-budesh-muj-i-bashta/

„Да бъдеш мъж и баща“ от Йеспер Юл

На второ четене: „Да бъдеш мъж и баща“

превод от немски Мария Енчева, изд. „Жанет 45“, 2019

Това е една болезнено важна и ценна книга на автор, който е вече добре познат на българската публика. Прочитът ѝ е особено належащ днес и тук, защото следствията от прекомерното втвърдяване на традиционни и консервативни ценности системно ескалират до катастрофа. До семейно насилие и убийства на жени.

Практическото прилагане на съветите на Йеспер Юл категорично би подействало не само полезно, но и лечебно на травмираното и ранено българско семейство и общество.

Датският семеен терапевт е натрупал изключително много опит, който щедро споделя с читателите. Още в предговора прави впечатление как авторът не изпада в излишни теоретични въведения или претенциозни изложения, а направо скача в дълбокото. Още на първата страница, както и на всяка следваща има нещо, което провокира размисъл, действие и най-вече подтиква към конкретно разрешение на проблем. Темите и примерите са представени практически и мъдро. Няма даже и намек за поучение или предизвикване на вина. Точно обратното.

На второ четене: „Да бъдеш мъж и баща“

Юл води читателя спокойно и овладяно по пътя към промяна на разбирания, които за мнозина изглеждат издялани върху камък. Мъжете могат и да отговарят не само за прехраната, както могат и да не оглавяват еднолично семейството. Здравословно за самите тях е да са активна част и от емоционалното, а не само от материалното или екзистенциалното всекидневие на децата и партньор(к)ите си.

Най-лесното, за съжаление, решение за мнозина мъже, когато се сблъскат с непознати задачи или когато им се наложи да напуснат зоната си на комфорт, по отношение на бащинството, е да се превърнат в „отсъстващи бащи“. Да отсъстват физически и емоционално за децата си. Това влече след себе си много болка и дефицити за децата. Но и за бащата.

Трудно е за бащата, особено за българския, да се адаптира към една нова роля. За нея няма пример, освен често пъти грешен. Като за начало

е добре бащата да знае, че окситоцинът е хормон, свързан с емоционалното обвързване и при мъжете, не само при жените,

и неговите нива се увеличават правопропорционално на отделеното време и грижи за децата от самото им раждане. Апетитът идва с яденето.

Мъжът също така не е само фигура, която работи, изкарва пари и поради това концентрира власт. Днешният свят и най-вече семейството е пространство, в което насилието, упражнявано от мъж, е табу. На върха на пирамидата от ценности е свободата. Тя е най-висшата и е нужно това непрекъснато да бъде напомняно. Свободата върви ръка за ръка с въпроси за личностното развитие и с отговорната роля човек да е архитект на живота си и да не строи въздушни кули, да не следва безполезни формули и клишета, а разума и чувствата си.

Децата отварят очите и сърцето единствено ако човек иска и е готов. Това, както и близките взаимоотношения с тях, не е еднократно действие, не е покупка и продажба, не е транзакция, а нещо постепенно и трудоемко, доживотен ангажимент. За да не бъде проиграна тази безценна възможност, е нужно човек да опознае колкото семейството си, толкова и себе си. И да преодолее трудността и риска да е непосредствено и спонтанно човешко същество.

Бащинството е дар и предизвикателство, твърди Юл, и е нормално да предизвиква смесени чувства, страх и нерешителност. Едно от първите клишета, които Юл „погва“, е, че

бащата не е полиция и съд, а събеседник,

чието най-голямо желание понякога е да не е като родителите си. Други атакувани постулати са тези за властта и йерархията, защото, за да отговаря на съвременните човешки права и разбирания, е нужно да има преподреждане в семейството, защото за него отдавна съществува нова дефиниция. Родителството, за да е здравословно, е полезно да почива на диалог, обмен и взаимодействие, на автентичност и правдоподобност. На топло, отговорно и съзнателно отношение.

Да станеш равностоен партньор и отговорен родител е процес на лично израстване през целия живот. То не се заключва в това да наказваш за непослушание момчето, токсично да третираш момичето като принцеса или да прехвърляш собствената си отговорност на детето, за да усеща то непосилно бреме и вина. Нужно е да си свидетел на живота им в добри и лоши моменти, да присъстваш тялом и духом. Да чуваш как те споделят страховете и надеждите си, но да не оставаш мълчалив, а да споделяш и своите. Не е редно бащата да се обижда и да ревнува детето от самата му поява, а да разсъждава как да преработи тези чувства и мисли.

Юл се опитва да обхване множество теми. От секса и промените в любовния живот по време на бременността и след нея до въпроса дали бащата да присъства на раждането. За датския автор най-добре е това да е собствен избор и решението да е взето не поради натиск, а от лична необходимост. Каквото и да е то, не е повод за срам и вина. Този избор, както и множество други, не те прави лош баща, а е стъпка по криволичещата пътека към целта да си достатъчно добър родител. Често се среща и важното припомняне как въобще да не се започва състезание кой е по-добър в двойката, защото в него всички губят. Най-много децата.

С течение на времето е неизбежно –

бащата започва да разбира по-добре собствения си баща.

Незаменимо е да се проведе разговор с него в такъв период, най-вече за времето, в което той самият е станал баща. Този диалог може да доведе както до облекчение в настоящето, така и до прошка за миналото.

Забележително е признанието на самия Юл, че е бил лош баща в началото. Това се променя след думи и действия на детето му. Те го карат да осъзнае къде и защо греши, и да промени настройката си. Най-лесното и същевременно най-трудното е да се чуе и види детето такова, каквото е в своята уникалност – без проекции. Детето живее собствения си живот.

Най-полезните съвети и изводи на Юл са и най-сложните. Да се грижиш за себе си, за да се грижиш и за семейството си. Да знаеш, че родителството е умение и за него са нужни упражнения и практика. Никой не се е родил научен. Това не е нещо вродено и е въпрос не на чувства, а на воля. Може и да е очевидно, но Юл специално подчертава няколко неща. Едно от тях е, че

любовта е щедрост, не е алчност, скъперничество или манипулация. В любовта също има граници и възможност за отказ.

В любовта хората са партньори, а не обслужващ персонал. Друго важно нещо, минаващо като червена нишка по страниците – да се осмелиш да си себе си и да стоиш на своя страна, да не си жертва. Така се дава пример и детето да е на своя страна и да не си вреди. Бащата може да бъде спаринг партньор на детето си и да вярва в неговите сили, което значи да оказва съпротива, без да наранява и да вреди. Да изгражда доверие.

Едно от най-ценните неща в книгата са разказите на тринайсет бащи за значението на бащинството и свързаните с него промени, трудности и страхове. Това са думите на Баща 6:

За мен бащинството значи: да си много по-щастлив, отколкото без деца, да даряваш близост и топлина, да си спътник, да слушаш, да взимаш някого на сериозно, да даваш пример, да излъчваш плам, да позволиш на някого да е част от живота ти, от това, което те удивлява и възхищава, да се доверяваш, да стимулираш, да окуражаваш, да споделяш ентусиазма на друг човек, да споделяш ценностите си, да получаваш доверие и внимание, да можеш да виждаш как децата се смеят, да можеш да ги утешаваш, да взимаш връзката си на сериозно, да бъдеш по-отговорен, да трябва да вършиш хиляди неща, които придобиват нов смисъл.

Говоря от собствен опит, като казвам, че тази книга има потенциала да променя хора. Препоръчвам я открито както на приятели мъже, така и на близки жени, за да могат да разберат и отсрещната страна.


Активните дарители на „Тоест“ получават постоянна отстъпка в размер на 20% от коричната цена на всички заглавия от каталога на „Жанет 45“, както и на няколко други български издателства в рамките на партньорската програма Читателски клуб „Тоест“. За повече информация прочетете на toest.bg/club.

Никой от нас не чете единствено най-новите книги. Тогава защо само за тях се пише? „На второ четене“ е рубрика, в която отваряме списъците с книги, публикувани преди поне година, четем ги и препоръчваме любимите си от тях. Рубриката е част от партньорската програма Читателски клуб „Тоест“. Изборът на заглавия обаче е единствено на авторите – Стефан Иванов и Севда Семер, които биха ви препоръчали тези книги и ако имаше как веднъж на две седмици да се разходите с тях в книжарницата.

Гибралтар – плати ми за да ми платиш

Post Syndicated from VassilKendov original http://kendov.com/%D0%B3%D0%B8%D0%B1%D1%80%D0%B0%D0%BB%D1%82%D0%B0%D1%80-%D0%BF%D0%BB%D0%B0%D1%82%D0%B8-%D0%BC%D0%B8-%D0%B7%D0%B0-%D0%B4%D0%B0-%D0%BC%D0%B8-%D0%BF%D0%BB%D0%B0%D1%82%D0%B8%D1%88/

Гибралтар – плати ми за да ми платиш

Ако не сте били в Гибралтар, да знаете, че нямате никаква работа там. Ама никаква. Няма значение какво ви обясняват туристическите агенции и рекламните брошури. За да се насладите на гледка, ще ви се скъсат нервите и ще се учудите колко ще ви струва.
Веднага обяснявам защо.

Грешка Първа – отидохме с кола

Понеже не сме привърженици на груповия туризъм в който всичко е фиксирано и „уредено”, включително какво да чувствате и мислите, ние организираме екскурзиите си сами. Някак си не ни харесва да го играем овце с овчар, който ни побутва в определена посока. Обичаме свободата. Отиваме когато решим, тръгваме си когато решим и гледаме каквото решим. Естествено си плащме си за това удоволствие стига да можем. Защото в Гибралтар не можем.

Оказа се, че за да пресечем границата с Гибралтар е нужно да платим допълнителни 30 EUR за кола под наем. ОК, нямам проблем, както казахме плащаме си. Това обаче се оказа грешка. Трябваше да я оставим на паркинг преди да пресечем границата. Самия Гибралтар представлява една скала (нещо като пловдивско тепе) с прилежащо пристанище. Естествено уличките се оказаха толкова тесни и криви, че GPS-а повече пречеше отколкото помагаше. Просто не можеше да засече на коя точно улица сме, толкова бяха малки и тесни.
в помощ на шофьорите имаше и табели. Табели за всичко. Когато нямаше табели имаше надписи. Нали знаете че в UK табелите са с текст? Например на знака „Път с предимство” е изписано „Give way”. Аз през живота си толкова табели и знаци не бях виждал. Само не разбрах как се очаква да ги видиш, прочетеш и осмислиш докато караш. А там трафик дал господ. На тези 7 квадратни километра барабар с тепето живеят 30 000 човека. Първоначално се чудих какво дирят там, но после попрочетох. Гибралтар е офшорка и приходите им идват от онлайн казина, „финансови услуги” (разбирайте пране на пари и избягване на данъчно облагане) както и туризъм. Туризъм от заблудени турсити, отишли да видят “the rock” и живеещите там 3 двойки макаци. Може би най-известните макаци в света. Известни с това, че ги рекламира не кой да е английската корона. Все пак са английски макаци, а не някакви си шибеци в Азия  Африка или зоологическата градина.

Летището на Гибралтар. На снимката се вижда КПП-то. При влизане в Гибралтар с кола, пресичаш пистата. Явно единственото решение за тази малка територия.

Добре е да знаете, че ако влезете в автомобилния поток, няма къде да отбиете и спрете, просто защото уличките са тесни. Остава да разчитате на паркинг.

Следкато GPS-а ни заведе почти до върха, там видяхме какво? – Табелаааа. Табела на която пише, че не може да влизаме с колата, защото това е национален парк. Ама не може и пеша да минем, защото парка (разбирайте скалата) се ремонтирал и достъпа бил забранен. Трябвало да се върнем и влезем през друг път. Питайте ме как се обръща на тази уличка.

На връщане от забранената зона забелязваме въжета и кабинков лифт. Казваме си – „това е мястото и начина”.

Паркингът
Отдолу паркинг като слънце и ние естествено спираме. Идва случаен паркиращ човек и но казва на чист английски, че не можем да паркираме там, имало табелка.
Чета аз табелката и разбирам, че паркинга към лифтовете е с оранжеви, бели и сини места. Оранжевите са за местните (90%), белите са безплатни за всички но винаги заети (около 5%) и сините са платени. Говорим за малък паркинг. Платените са около 15 броя общо. Чакаме да се освободи някое и спираме. Огледжаме се и веднага забелязваме следващата табела, указваща машината за плащане. Представлява ръчичка пускаща монета. До тук добре, но машината не работи. Има указания, с които да си свалим приложение с което се плаща, и инструкция как да сложим билета за платената такса на видимо място на таблото на колата, иначе ще бъдем заключени. Имало човек, който минава и оглежда колите.
Отново изпадам в шок. Как по дяволите да разпечатам бележка, като машината не работи, а на телефона нямам принтер?!? Решавам, че е като в Словения на езерото Блед. Нямаш възможност да плащаш в брой, а само с приложение, което преди това трябва да инсталираш.
Започвам да се притеснявам, защото GPS-а вече ми е изсмукал батерията на телефона, а интернета там все едно го носят с кофи от Испания – толкова е бърз. Опитвам се да инсталирам приложението като “guest”без много регистрации, ноооо не става. Има го като опция, но не работи. Тръгвам на пълна регистрация, но батерията на телефона каза „КРАЙ” и единствената опция остана телефона на адв. Кендова. Предлагам да видим все пак на касата на лифта за някакво решение с плащането на таксата за паркинга пък и да преценим за колко време да си купим престой.
Да де ама на касата две паралелки с 12-14 годишни ученици. Не можеш да стигнеш до касата. Виждаш само цената на билетите – 18 паунда на човек. Паунди нямаме, но кредитни карти имаме. Ще плащаме с тях. Оставям благоверната да чака инсталацията на приложението и решавам да отида до тоалетната. Там обаче вече искат паунди. 1.5 паунда иначе вратата на тоалетната не се отваря.
Върнах се на опашката за лифта, прегърнах жена си и нежно и прошепнах в ухото „Любов, видях едно много хубаво ресторантче на плажа в испанската част, преди границата. Имам чувството, че правят страхотна паеля.”

30 минути по-късно бяхме в ресторанта и гледахме морето.
„- За какво мислиш?” – пита ме адв. Кендова.
„- Яд ме е.”
„ – Че не се качихме на скалата и не видяхме макаците ли?”
‘ – Не, Любов. Яд ме е, че нямах спрей да напиша на паркинга „КУР” преди да си тръгнем.”

Паелята беше фантастична и преживяването също. Много отрезвяващо за бъдещите ни пътувания. Не стига че сме наели кола и пътуваме от Малага, не стига че плащаме за пресичане на граница и искаме да си оставим парите по забележителностите, ами ще ни правят и на макаци! Ами виждал съм и макаци и скали, и оръдия, и гледки. И пак ще виждам, ама не в Гибралтар.
Между другото да знаете, че в двореца Алхамбра в Гранада паркинга се таксува на минута, а билетите за достъп са 5 вида с 5 цени за всяка забележителност в комплекса. Ако се разелиш с 50 EUR на човек, ще имаш и екскурзовод. Но това е друга история. Явно преди да отидеш някъде ще трябва предварително да се чете доста, което малко или много обесмисля ходенето там, но това е масовия туризъм в днешни дни. Еволюирал е до разходка на хора с манталитет на овце по места, които кураторите са решили, че ще видиш, по начина по който са решили, че ще ги видиш!
„Ми мирси!”, както се казва. Аз пък вече ще чета и ще избирам по-правилно къде да отида и за какво да си дам парите.

Запомнете – в Гибралтар работа нямате, а паелята в ресторантчето на плажа до пристанището е супер.

Малко факти за Гибралтар
Гибралтар (на английски: Gibraltar [Джибро̀лтър]) е задморска територия и град на Великобритания в най-южната част на Пиренейския полуостров.
До 2020 г. Гибралтар е член на Европейския съюз чрез членството на Великобритания.

The post Гибралтар – плати ми за да ми платиш appeared first on Kendov.com.

AWS Chatbot Now Integrates With Microsoft Teams

Post Syndicated from Sébastien Stormacq original https://aws.amazon.com/blogs/aws/aws-chatbot-now-integrates-with-microsoft-teams/

I am pleased to announce that, starting today, you can use AWS Chatbot to troubleshoot and operate your AWS resources from Microsoft Teams.

Communicating and collaborating on IT operation tasks through chat channels is known as ChatOps. It allows you to centralize the management of infrastructure and applications, as well as to automate and streamline your workflows. It helps to provide a more interactive and collaborative experience, as you can communicate and work with your colleagues in real time through a familiar chat interface to get the job done.

We launched AWS Chatbot in 2020 with Amazon Chime and Slack integrations. Since then, the landscape of chat platforms has evolved rapidly, and many of you are now using Microsoft Teams.

AWS Chatbot Benefits
When using AWS Chatbot for Microsoft Teams or other chat platforms, you receive notifications from AWS services directly in your chat channels, and you can take action on your infrastructure by typing commands without having to switch to another tool.

Typically you want to receive alerts about your system health, your budget, any new security threat or risk, or the status of your CI/CD pipelines. Sending a message to the chat channel is as simple as sending a message on an Amazon Simple Notification Service (Amazon SNS) topic. Thanks to the native integration between Amazon CloudWatch alarms and SNS, alarms are automatically delivered to your chat channels with no additional configuration step required. Similarly, thanks to the integration between Amazon EventBridge and SNS, any system or service that emits events to EventBridge can send information to your chat channels.

But ChatOps is more than the ability to spot problems as they arise. AWS Chatbot allows you to receive predefined CloudWatch dashboards interactively and retrieve Logs Insights logs to troubleshoot issues directly from the chat thread. You can also directly type in the chat channel most AWS Command Line Interface (AWS CLI) commands to retrieve additional telemetry data or resource information or to run runbooks to remediate the issues.

Typing and remembering long commands is difficult. With AWS Chatbot, you can define your own aliases to reference frequently used commands and their parameters. It reduces the number of steps to complete a task. Aliases are flexible and can contain one or more custom parameters injected at the time of the query.

And because chat channels are designed for conversation, you can also ask questions in natural language and have AWS Chatbot answer you with relevant extracts from the AWS documentation or support articles. Natural language understanding also allows you to make queries such as “show me my ec2 instances in eu-west-3.”

Let’s Configure the Integration Between AWS Chatbot and Microsoft Teams
Getting started is a two-step process. First, I configure my team in Microsoft Teams. As a Teams administrator, I add the AWS Chatbot application to the team, and I take note of the URL of the channel I want to use for receiving notifications and operating AWS resources from Microsoft Teams channels.

Second, I register Microsoft Teams channels in AWS Chatbot. I also assign IAM permissions on what channel members can do in this channel and associate SNS topics to receive notifications. I may configure AWS Chatbot with the AWS Management Console, an AWS CloudFormation template, or the AWS Cloud Development Kit (AWS CDK). For this demo, I choose to use the console.

I open the Management Console and navigate to the AWS Chatbot section. On the top right side of the screen, in the Configure a chat client box, I select Microsoft Teams and then Configure client.

I enter the Microsoft Teams channel URL I noted in the Teams app.

Add the team channel URL to ChatbotAt this stage, Chatbot redirects my browser to Microsoft Teams for authentication. If I am already authenticated, I will be redirected back to the AWS console immediately. Otherwise, I enter my Microsoft Teams credentials and one-time password and wait to be redirected.

At this stage, my Microsoft Teams team is registered with AWS Chatbot and ready to add Microsoft Teams channels. I select Configure new channel.

Chabot is now linked to your Microsoft Teams There are four sections to enter the details of the configuration. In the first section, I enter a Configuration name for my channel. Optionally, I also define the Logging details. In the second section, I paste—again—the Microsoft Teams Channel URL.

Configure chatbot section one and two

In the third section, I configure the Permissions. I can choose between the same set of permissions for all Microsoft Teams users in my team, or I can set User-level roles permission to enable user-specific permissions in the channel. In this demo, I select Channel role, and I assign an IAM role to the channel. The role defines the permissions shared by all users in the channel. For example, I can assign a role that allows users to access configuration data from Amazon EC2 but not from Amazon S3. Under Channel role, I select Use an existing IAM role. Under Existing role, I select a role I created for my 2019 re:Invent talk about ChatOps: chatbot-demo. This role gives read-only access to all AWS services, but I could also assign other roles that would allow Chatbot users to take actions on their AWS resources.

To mitigate the risk that another person in your team accidentally grants more than the necessary privileges to the channel or user-level roles, you might also include Channel guardrail policies. These are the maximum permissions your users might have when using the channel. At runtime, the actual permissions are the intersection of the channel or user-level policies and the guardrail policies. Guardrail policies act like a boundary that channel users will never escape. The concept is similar to permission boundaries for IAM entities or service control policies (SCP) for AWS Organizations. In this example, I attach the ReadOnlyAccess managed policy.

Configure chatbot section three

The fourth and last section allows you to specify the SNS topic that will be the source for notifications sent to your team’s channel. Your applications or AWS services, such as CloudWatch alarms, can send messages to this topic, and AWS Chatbot will relay all messages to the configured Microsoft Teams channel. Thanks to the integration between Amazon EventBridge and SNS, any application able to send a message to EventBridge is able to send a message to Microsoft Teams.

For this demo, I select an existing SNS topic: alarmme in the us-east-1 Region. You can configure multiple SNS topics to receive alarms from various Regions. I then select Configure.

Configure chatbot section fourLet’s Test the Integration
That’s it. Now I am ready to test my setup.

On the AWS Chatbot configuration page, I first select the Send test message. I also have an alarm defined when my estimated billing goes over $500. On the CloudWatch section of the Management Console, I configure the alarm to post a message on the SNS topic shared with Microsoft Teams.

Within seconds, I receive the test message and the alarm message on the Microsoft Teams channel.

AWS Chatbot with Microsoft Teams, first messages received on the channel

Then I type a command to understand where the billing alarm comes from. I want to understand how many EC2 instances are running.

On the chat client channel, I type @aws to select Chatbot as the destination, then the rest of the CLI command, as I would do in a terminal: ec2 describe-instances --region us-east-1 --filters "Name=architecture,Values=arm64_mac" --query "Reservations[].Instances[].InstanceId"

Chatbot answers within seconds.

AWS chatbot describe instances

I can create aliases for commands I frequently use. Aliases may have placeholder parameters that I can give at runtime, such as the Region name for example.

I create an alias to get the list of my macOS instance IDs with the command: aws alias create mac ec2 describe-instances --region $region --filters "Name=architecture,Values=arm64_mac" --query "Reservations[].Instances[].InstanceId"

Now, I can type @aws alias run mac us-east-1 as a shortcut to get the same result as above. I can also manage my aliases with the @aws alias list, @aws alias get, and @aws alias delete commands.

I don’t know about you, but for me it is hard to remember commands. When I use the terminal, I rely on auto-complete to remind me of various commands and their options. AWS Chatbot offers similar command completion and guides me to collect missing parameters.

AWS Chatbot command completion

When using AWS Chatbot, I can also ask questions using natural English language. It can help to find answers from the AWS docs and from support articles by typing questions such as @aws how can I tag my EC2 instances? or @aws how do I configure Lambda concurrency setting?

It can also find resources in my account when AWS Resource Explorer is activated. For example, I asked the bot: @aws what are the tags for my ec2 resources? and @aws what Regions do I have Lambda service?

And I received these responses.

AWS Chatbot NLP Response 1AWS Chatbot NLP Response 2Thanks to AWS Chatbot, I realized that I had a rogue Lambda function left in ca-central-1. I used the AWS console to delete it.

Available Now
You can start to use AWS Chatbot with Microsoft Teams today. AWS Chatbot for Microsoft Teams is available to download from Microsoft Teams app at no additional cost. AWS Chatbot is available in all public AWS Regions, at no additional charge. You pay for the underlying resources that you use. You might incur charges from your chat client.

Get started today and configure your first integration with Microsoft Teams.

— seb

How SafetyCulture scales unpredictable dbt Cloud workloads in a cost-effective manner with Amazon Redshift

Post Syndicated from Anish Moorjani original https://aws.amazon.com/blogs/big-data/how-safetyculture-scales-unpredictable-dbt-cloud-workloads-in-a-cost-effective-manner-with-amazon-redshift/

This post is co-written by Anish Moorjani, Data Engineer at SafetyCulture.

SafetyCulture is a global technology company that puts the power of continuous improvement into everyone’s hands. Its operations platform unlocks the power of observation at scale, giving leaders visibility and workers a voice in driving quality, efficiency, and safety improvements.

Amazon Redshift is a fully managed data warehouse service that tens of thousands of customers use to manage analytics at scale. Together with price-performance, Amazon Redshift enables you to use your data to acquire new insights for your business and customers while keeping costs low.

In this post, we share the solution SafetyCulture used to scale unpredictable dbt Cloud workloads in a cost-effective manner with Amazon Redshift.

Use case

SafetyCulture runs an Amazon Redshift provisioned cluster to support unpredictable and predictable workloads. A source of unpredictable workloads is dbt Cloud, which SafetyCulture uses to manage data transformations in the form of models. Whenever models are created or modified, a dbt Cloud CI job is triggered to test the models by materializing the models in Amazon Redshift. To balance the needs of unpredictable and predictable workloads, SafetyCulture used Amazon Redshift workload management (WLM) to flexibly manage workload priorities.

With plans for further growth in dbt Cloud workloads, SafetyCulture needed a solution that does the following:

  • Caters for unpredictable workloads in a cost-effective manner
  • Separates unpredictable workloads from predictable workloads to scale compute resources independently
  • Continues to allow models to be created and modified based on production data

Solution overview

The solution SafetyCulture used is comprised of Amazon Redshift Serverless and Amazon Redshift Data Sharing, along with the existing Amazon Redshift provisioned cluster.

Amazon Redshift Serverless caters to unpredictable workloads in a cost-effective manner because compute cost is not incurred when there is no workload. You pay only for what you use. In addition, moving unpredictable workloads into a separate Amazon Redshift data warehouse allows each Amazon Redshift data warehouse to scale resources independently.

Amazon Redshift Data Sharing enables data access across Amazon Redshift data warehouses without having to copy or move data. Therefore, when a workload is moved from one Amazon Redshift data warehouse to another, the workload can continue to access data in the initial Amazon Redshift data warehouse.

The following figure shows the solution and workflow steps:

  1. We create a serverless instance to cater for unpredictable workloads. Refer to Managing Amazon Redshift Serverless using the console for setup steps.
  2. We create a datashare called prod_datashare to allow the serverless instance access to data in the provisioned cluster. Refer to Getting started data sharing using the console for setup steps. Database names are identical to allow queries with full path notation database_name.schema_name.object_name to run seamlessly in both data warehouses.
  3. dbt Cloud connects to the serverless instance and models, created or modified, are tested by being materialized in the default database dev, in either each users’ personal schema or a pull request related schema. Instead of dev, you can use a different database designated for testing. Refer to Connect dbt Cloud to Redshift for setup steps.
  4. You can query materialized models in the serverless instance with materialized models in the provisioned cluster to validate changes. After you validate the changes, you can implement models in the serverless instance in the provisioned cluster.

Outcome

SafetyCulture carried out the steps to create the serverless instance and datashare, with integration to dbt Cloud, with ease. SafetyCulture also successfully ran its dbt project with all seeds, models, and snapshots materialized into the serverless instance via run commands from the dbt Cloud IDE and dbt Cloud CI jobs.

Regarding performance, SafetyCulture observed dbt Cloud workloads completing on average 60% faster in the serverless instance. Better performance could be attributed to two areas:

  • Amazon Redshift Serverless measures compute capacity using Redshift Processing Units (RPUs). Because it costs the same to run 64 RPUs in 10 minutes and 128 RPUs in 5 minutes, having a higher number of RPUs to complete a workload sooner was preferred.
  • With dbt Cloud workloads isolated on the serverless instance, dbt Cloud was configured with more threads to allow materialization of more models at once.

To determine cost, you can perform an estimation. 128 RPUs provides approximately the same amount of memory that an ra3.4xlarge 21-node provisioned cluster provides. In US East (N. Virginia), the cost of running a serverless instance with 128 RPUs is $48 hourly ($0.375 per RPU hour * 128 RPUs). In the same Region, the cost of running an ra3.4xlarge 21-node provisioned cluster on demand is $68.46 hourly ($3.26 per node hour * 21 nodes). Therefore, an accumulated hour of unpredictable workloads on a serverless instance is 29% more cost-effective than an on-demand provisioned cluster. Calculations in this example should be recalculated when performing future cost estimations because prices may change over time.

Learnings

SafetyCulture had two key learnings to better integrate dbt with Amazon Redshift, which can be helpful for similar implementations.

First, when integrating dbt with an Amazon Redshift datashare, configure INCLUDENEW=True to ease management of database objects in a schema:

ALTER DATASHARE datashare_name SET INCLUDENEW = TRUE FOR SCHEMA schema;

For example, assume the model customers.sql is materialized by dbt as the view customers. Next, customers is added to a datashare. When customers.sql is modified and rematerialized by dbt, dbt creates a new view with a temporary name, drops customers, and renames the new view to customers. Although the new view carries the same name, it’s a new database object that wasn’t added to the datashare. Therefore, customers is no longer found in the datashare.

Configuring INCLUDENEW=True allows new database objects to be automatically added to the datashare. An alternative to configuring INCLUDENEW=True and providing more granular control is the use of dbt post-hook.

Second, when integrating dbt with more than one Amazon Redshift data warehouse, define sources with database to aid dbt in evaluating the right database.

For example, assume a dbt project is used across two dbt Cloud environments to isolate production and test workloads. The dbt Cloud environment for production workloads is configured with the default database prod_db and connects to a provisioned cluster. The dbt Cloud environment for test workloads is configured with the default database dev and connects to a serverless instance. In addition, the provisioned cluster contains the table prod_db.raw_data.sales, which is made available to the serverless instance via a datashare as prod_db′.raw_data.sales.

When dbt compiles a model containing the source {{ source('raw_data', 'sales') }}, the source is evaluated as database.raw_data.sales. If database is not defined for sources, dbt sets the database to the configured environment’s default database. Therefore, the dbt Cloud environment connecting to the provisioned cluster evaluates the source as prod_db.raw_data.sales, while the dbt Cloud environment connecting to the serverless instance evaluates the source as dev.raw_data.sales, which is incorrect.

Defining database for sources allows dbt to consistently evaluate the right database across different dbt Cloud environments, because it removes ambiguity.

Conclusion

After testing Amazon Redshift Serverless and Data Sharing, SafetyCulture is satisfied with the result and has started productionalizing the solution.

“The PoC showed the vast potential of Redshift Serverless in our infrastructure,” says Thiago Baldim, Data Engineer Team Lead at SafetyCulture. “We could migrate our pipelines to support Redshift Serverless with simple changes to the standards we were using in our dbt. The outcome provided a clear picture of the potential implementations we could do, decoupling the workload entirely by teams and users and providing the right level of computation power that is fast and reliable.”

Although this post specifically targets unpredictable workloads from dbt Cloud, the solution is also relevant for other unpredictable workloads, including ad hoc queries from dashboards. Start exploring Amazon Redshift Serverless for your unpredictable workloads today.


About the authors

Anish Moorjani is a Data Engineer in the Data and Analytics team at SafetyCulture. He helps SafetyCulture’s analytics infrastructure scale with the exponential increase in the volume and variety of data.

Randy Chng is an Analytics Solutions Architect at Amazon Web Services. He works with customers to accelerate the solution of their key business problems.

MITRE ATT&CK® Mitigations: Thwarting Cloud Threats With Preventative Policies and Controls

Post Syndicated from James Alaniz original https://blog.rapid7.com/2023/03/16/mitre-attack-mitigations-thwarting-cloud-threats-with-preventative-policies-and-controls/

MITRE ATT&CK® Mitigations: Thwarting Cloud Threats With Preventative Policies and Controls

As IT infrastructure has become more and more sophisticated, so too have the techniques and tactics used by bad actors to gain access to your environment and sensitive information. That’s why it’s essential to implement robust security measures to protect your organization. One way to do this is to utilize the MITRE ATT&CK framework, which provides a comprehensive guide to understanding and defending against cyber threats.

Who is MITRE and what is the MITRE ATT&CK Framework?

MITRE is a non-profit organization supporting various U.S. government agencies across a variety of fields, but primarily focusing on defense and cybersecurity. The MITRE ATT&CK® Framework is a free knowledge base of adversarial tactics and techniques based on real-world observations.

It is a tremendous resource for any security practitioner, and can be used as a foundational resource for developing specific threat models and methodologies in both the public and private sectors. The framework is curated by the folks at MITRE, but anyone is able to contribute information or findings for review, as they look to crowdsource as much intelligence as humanly possible to better serve the broader community.

The ATT&CK Framework is intended to provide insights into the goals of hackers as well as the techniques and tactics they are likely to use. These insights provide organizations and the security teams that protect them with a detailed roadmap to plan, detect, and mitigate risk and detect threats. Once an organization has identified potential attack vectors, it can implement the appropriate mitigations.

Wait, but what are Mitigations?

Under each technique outlined within the ATT&CK Framework is a section on relevant mitigations. Mitigations represent security concepts and classes of technologies that can be used to prevent a technique or sub-technique from being successfully executed. It is a large and comprehensive list, so MITRE has broken these mitigations into two primary groups: “Enterprise,” focusing on mitigations that prevent hackers from breaching a corporate network, and “Mobile,” which—as you might have guessed—is dedicated to protecting against attacks targeting mobile devices.

While these mitigations can not guarantee that you won’t be breached, they serve as a great baseline for teams looking to do whatever they can to avoid an attacker gaining access to their sensitive data.

Example mitigations and what they entail

As noted above, MITRE provides a wide range of mitigations. For the purpose of this post, let’s look at a few example mitigations to give a sense of what they entail.

Before we dive in, a quick note: It’s very important to select and implement mitigations based on your organization’s specific threat landscape and unique aspects of your environment. You’ll want to prioritize the mitigations that address the most significant risks to business operations and data first to effectively mitigate risk and the likelihood of a breach.

Mitigation: Data Backup (ID: M1053)

Backing up data from end-user systems and servers is critical to ensure you’re not at risk of attack types that center around deletion or defacement of sensitive organizational and customer data, such as Data Destruction (T1485) and Disk Wipe (T1561). The only recourse to these types of attacks is to have a solid disaster recovery plan. Security teams should regularly back up data and store backups in a secure location that is separate from the rest of the corporate network to avoid them being compromised. This way, you’ll have the ability to quickly recover lost data and restore your systems to a steady state should a bad actor delete your data or hold it as ransom.

Mitigation: Account Use Policies (ID: M1036)

This mitigation is geared toward preventing unwanted or malicious access to your network via attack types such as brute force (T1110) and multi-factor authentication request generation (T1621). By establishing policies such as limiting the number of attempts a user has to properly enter their credentials and passwords before being locked out of their account, you can thwart bad actors that are simply repeatedly guessing your passwords until they gain access. This control needs to be configured in such a way that effectively prevents these types of attacks, but without being so strict that legitimate users within your organization are denied access to systems or data they need to perform their jobs.

Mitigation: Encrypt Sensitive Information (ID: M1041)

As you can probably guess from the name, this mitigation focuses on implementing strong data encryption hygiene. Given that the end goal of many breaches is to gain access to sensitive information, it will come as no surprise that this mitigation plays a critical role in protecting against a wide range of attack techniques, including adversary-in-the-middle (T1557), improper access of data within misconfigured cloud storage buckets (T1530), and network sniffing (T1040), just to name a few. Properly encrypting data—both at rest and in transit—is a critical step in fortifying against these types of attacks.

There are several MITRE tactics and techniques, such as those highlighted above, where the only mitigation for an attack is to ensure your organization’s security policies and controls are configured properly. While it can be a daunting task to ensure you maintain compliance with all policies and controls across your entire environment, InsightCloudSec offers out-of-the-box insights that are mapped directly to each mitigation.

Leveraging InsightCloudSec to implement and track performance against MITRE ATT&CK Mitigations

With this new pack, InsightCloudSec you can easily audit and assess your entire environment against the recommended mitigations provided by MITRE, and ensure you are taking every step possible to stop bad actors from gaining unauthorized access to your network and accessing sensitive information.

MITRE ATT&CK® Mitigations: Thwarting Cloud Threats With Preventative Policies and Controls

InsightCloudSec continuously assesses your entire cloud environment — whether single cloud or hosted across multiple platforms — for compliance with organizational standards. It detects noncompliant resources and unapproved changes within minutes. The platform continuously monitors your environment to ensure you’ve properly implemented the necessary controls as recommended by MITRE for thwarting attackers, regardless of which technique or sub-technique they utilize.

InsightCloudSec can instantly detect whenever an account or resource drifts from compliance. The platform comes out of the box with 30+ compliance packs, including a dedicated pack for MITRE Mitigations. A compliance pack within InsightCloudSec is a set of checks that can be used to continuously assess your cloud environments for compliance with a given regulatory framework, or industry or provider best practices.

If you’re interested in learning more about how InsightCloudSec helps continuously and automatically enforce cloud security standards, be sure to check out the demo!

On-demand InsightCloudSec Demo

Protect your cloud and container environments from misconfigurations, policy violations, threats, and IAM challenges.

LEARN MORE

Amazon Linux 2023 released

Post Syndicated from original https://lwn.net/Articles/926332/

Amazon has released
a new version
of its vaguely Fedora-based, cloud-optimized
distribution.

Last—and this policy is by far my favorite—Amazon Linux provides
you with deterministic updates through versioned repositories, a
flexible and consistent update mechanism. The distribution locks to
a specific version of the Amazon Linux package repository, giving
you control over how and when you absorb updates. By default, and
in contrast with Amazon Linux 2, a dnf update command
will not update your installed packages.

SFC: John Deere’s ongoing GPL violations: What’s next

Post Syndicated from original https://lwn.net/Articles/926330/

The Software Freedom Conservancy calls
out John Deere
for failure to comply with the GPL and preventing
farmers from repairing their own equipment.

This is a serious issue that goes far beyond one person wanting to
fix their printer software, or install an alternative firmware on
a luxury device. It has far-reaching implications for all farmers’
livelihoods, for food security throughout the world, and for how
we as a society choose to reward those who make our lives better,
or stand in the way of empowering everyone to improve the world.

CDN Bandwidth Fees: What You Need to Know

Post Syndicated from Molly Clancy original https://www.backblaze.com/blog/cdn-bandwidth-fees-what-you-need-to-know/

A decorative image showing a cloud with three dollar signs and the word "Egress", three CDN nodes, and a series of 0s and 1s representing data.

You know that sinking feeling you get in your stomach when you receive a hefty bill you weren’t expecting, especially when you then have to justify it to your finance team or face making cuts elsewhere to cover budget overrun? That is what some content delivery network (CDN) customers experience when they get slammed with bandwidth fees without warning. To avoid those painful conversations, it’s important to understand how bandwidth fees work. Knowing precisely what you are paying for and how you use the cloud service can help prevent eye-popping bills you weren’t prepared for.

A CDN can be an excellent way to speed up your website, improve performance, and boost SEO, but not all vendors are created equal—some charge significantly more for data transfer than others. As a leading provider of specialized cloud storage, Backblaze offers free egress to leading CDN providers like Fastly, bunny.net, and Cloudflare. Backblaze also offers tools for developers that help manage storage efficiently while integrating smoothly with CDN services.

So, let’s talk about bandwidth fees and how they work to help you decide which CDN provider is right for you.

What are CDN bandwidth fees?

Most CDN cloud services work like this: You can configure the CDN to pull data from one or more origins (such as a Backblaze B2 Cloud Storage Bucket) for free or for a flat fee, and then you’re charged fees for usage, namely when data is transferred when a user requests it. 

These fees are known as bandwidth, download, or data transfer fees. (We’ll use these terms somewhat interchangeably.) Typically, storage providers also charge fees when data is retrieved by a CDN.

The fees aren’t a problem in and of themselves, but if you don’t have a good understanding of them, it could lead to unexpected costs. 

For example, if you’re a game-sharing platform, and one of your games goes viral, bandwidth and egress fees can add up quickly. CDN providers usually charge in arrears, meaning they wait to see how much of the data was accessed each month, and then they apply their fees.

Some of the cost factors to consider include traffic spikes, regional distribution of your users (as some regions have higher transfer rates), and frequency of transferring large media files. Monitoring and managing data transfer fees can be challenging, especially during high-traffic events, as fees can quickly escalate without warning.

Although some CDN services offer calculation tools, these are estimates and may not always account for sudden increases in data transfer. It’s important to know exactly how these fees work so you can plan your workflows better and position your content strategically to reduce fees and increase cost efficiency.

How do CDN bandwidth fees work?

Data transfer occurs when data leaves the network. An example might be when your application server delivers an HTML page to the browser or your cloud object store serves an image via the CDN. Another example is when your data is moved to a different regional server within the CDN to make access faster for users in nearby locations.

A decorative photo of a sign that says "$5 fee per usage for non-members."

Each instance where your data may be accessed or moved incurs a cost, and these fees can quickly add up. Typically, CDN vendors charge a fee per GB or TB up to a specific limit. Once you hit these thresholds, you may advance up another pricing tier or incur expensive overage charges. A busy month could cost you a mint, and traffic spikes for different reasons in different industries—like a Black Friday rush for an e-commerce site or around events like the Super Bowl for a sports betting site, for example.

Price comparison of bandwidth fees across CDN services

To get a better sense of how each CDN service charges for bandwidth, let’s explore the top providers and what they offer and charge. Each CDN varies in bandwidth fees, additional costs, and value-added features such as enhanced security and caching options.

As part of the Bandwidth Alliance and the CDN Alliance, some of these vendors have agreed to discount customer data transfer fees when transferring one or both ways between member companies. What’s more, Backblaze offers free egress with CDN partners Fastly, bunny.net, and Cloudflare, among other vendors, helping reduce costs for businesses with high data transfer fees. 

When comparing CDNs, consider not only their per-GB costs but also factors like regional pricing variations, tiered pricing thresholds, and any add-ons for specific services like DDoS protection, web application firewalls (WAF), or dedicated support. These factors can significantly impact total costs, especially for businesses with varying traffic levels.

Note: Prices are as published by vendors as of 11/21/2024.

1. Fastly

Fastly offers edge caches to deliver content instantly around the globe. The company also offers SSL services for $20/per domain per month. They have various additional add-ons for things like web application firewalls (WAFs), managed rules, DDoS protection, and their Gold support.

Their CDN pricing offers flexibility through three main options:

  1. Free Tier: This option provides up to $50 in monthly usage for any product (including CDN), with no request throttling and no cap on redirects or page rules. 
  2. Usage Tier: This option at $50 per month plus usage fees. It includes up to $100 in monthly CDN and Compute usage, with no cap on usage, five included TLS domains, mutual TLS, and SSO authentication.
  3. Packages: Start at $1,500 per month and include various features, with tiers designed to support growing and large businesses needing predictable, scalable CDN services.

Fastly proudly partners with Backblaze, so mutual customers enjoy zero egress fees. Fastly also offers custom enterprise pricing and trials for hands-on experience. For more info you can check out how Fastly’s CDN beats AWS CloudFront.

2. bunny.net

bunny.net labels itself as the world’s lightning-fast CDN service, with affordable region-based pricing. This makes them another strong alternative to AWS Cloudfront for companies with a limited budget. For the Standard Network (123 PoPs), rates start at $0.01/GB per month for North America and Europe, $0.045/GB for South America, $0.03/GB for Asia and Oceania, and $0.06/GB for the Middle East and Africa.

For businesses with higher bandwidth needs, the Volume Network offers a global rate of $0.005/GB up to 500TB, with tiered discounts available up to 2PB and beyond.

bunny.net partners with Backblaze to offer free egress. Check out how bunny.net compares to AWS CloudFront.

3. Cloudflare

Cloudflare offers a limited free plan for hobbyists and individuals. They also have tiered pricing plans for businesses called Pro, Business, and Enterprise. Instead of charging bandwidth fees, Cloudflare opts for the monthly subscription model, which includes everything.

The Pro plan costs $20/month (for 100MB of upload). The Business plan is $200/month (for 200MB of upload). You must call to get pricing for the Enterprise plan (for 500MB of upload).

Cloudflare partners with Backblaze, and joint customers enjoy free egress between the two services. It also offers dozens of add-ons for load balancing, smart routing, security, serverless functions, etc. Each one costs extra per month.

4. AWS Cloudfront

AWS Cloudfront is Amazon’s CDN and is tightly integrated with its AWS services. The company offers tiered pricing based on bandwidth usage. The specifics are as follows for North America:

  • First 1TB of data transfer per month is free.
  • $0.085/GB for the next 9TB per month.
  • $0.080/GB for the next 40TB per month.
  • $0.060/GB for the next 100TB per month.
  • $0.040/GB for the next 350TB per month.
  • $0.030/GB for the next 524TB per month.

Their pricing extends up to 5PB per month, and there are different pricing breakdowns for different regions.

Amazon offers special discounts for high-data users and those customers who use AWS for their application storage. You can also purchase add-on products that work with the CDN for media streaming and security.

A decorative image showing a portion of the earth viewed from space with lights clustered around city centers.
Sure it’s pretty. Until you know all those lights represent possible fees.

5. Google Cloud CDN

Google Cloud CDN offers fast and reliable content delivery services. However, Google charges bandwidth, cache egress fees, and for cache misses. Their pricing structure is as follows:

  • Cache Egress: $0.02–$0.20 per GB.
  • Cache Fill: $0.01–$0.04 per GB.
  • Cache Lookup Requests: $0.0075 per 10,000 requests.

Cache egress fees are priced per region, and in the U.S., they start at $0.08 for the first 10TB. Between 10–150TB costs $0.055, and beyond 500TB, you have to call for pricing.

Google charges $0.01 per GB for cache fill services.

6. Microsoft Azure

The Azure content delivery network is Microsoft’s offering that promises speed, reliability, and a high level of security.

Azure offers a limited free account for individuals to play around with. Depending on the zone, the price will vary for data transfer. For Zone One, which includes North America, Europe, Middle East, and Africa, pricing is as follows:

  • First 10TB: $0.158/GB per month.
  • Next 40TB: $0.14/GB per month.
  • Next 100TB: $0.121/GB per month.
  • Next 350TB: $0.102/GB per month.
  • Next 500TB: $0.093/GB per month.
  • Next 4,000TB: $0.084/GB per month.

Azure charges $.60 per 1,000,000,000 requests per month and $1 for rules per month. You can also purchase WAF services and other products for an additional monthly fee.

Comparing the CDNs

How to save on bandwidth fees

A CDN can significantly enhance the performance of your website or web application and is well worth the investment. However, finding ways to save on bandwidth fees pays dividends. Here are some strategies:

  • Look for Bandwidth Alliance partners. Many CDN providers, including those in the Bandwidth Alliance, offer discounted rates for bandwidth and egress fees when transferring data between member companies.
  • Choose affordable origin storage. Select origin storage that integrates seamlessly with your chosen CDN provider, reducing your data transfer costs. Backblaze B2, for example, offers completely free egress to partners like Fastly, bunny.net, and Cloudflare, and free egress up to 3x the amount you store for transfer to other services.
  • Optimize caching and edge settings. Fine-tuning caching rules to keep frequently accessed data at edge locations can reduce the amount of data transferred, helping to avoid unnecessary bandwidth fees.
  • Implement data compression. Compressing files, especially large media, reduces the data size served by the CDN, which in turn reduces bandwidth usage.
  • Minimize redirects and request loops. Reducing redirects and optimizing request loops helps keep data transfer low and avoids additional bandwidth fees.
  • Use tiered or reserved data transfer plans. Some CDNs offer reserved or tiered data transfer options that provide discounts on larger volumes; consider these if your data transfer needs are predictable and high.

Here at Backblaze, we think the world needs lower egress fees, and we offer free egress from Backblaze B2 to many CDN partners like Fastly, bunny.net, and Cloudflare.

FAQ

1. What is CDN bandwidth?

CDN bandwidth refers to the amount of data that is transferred between a content delivery network (CDN) and its end-users. When a user accesses a website or service that uses a CDN, the data they request is delivered from servers closest to them, which speeds up delivery and reduces latency. The total amount of this data transfer over time is considered the CDN bandwidth, and it can significantly affect performance and costs depending on traffic levels.

2. What is a bandwidth fee?

A bandwidth fee is a charge imposed by a CDN provider based on the volume of data transferred from the CDN’s servers to end-users. CDNs use a pay-per-use model for bandwidth, meaning websites or services pay for each unit of data transferred, typically measured in gigabytes (GB) or terabytes (TB). High traffic volumes or large files (like videos) can quickly increase these fees, making it important to monitor and manage bandwidth usage.

3. How can I reduce CDN usage?

Reducing CDN fees involves optimizing data transfer and content delivery practices. A few effective strategies are to look for bandwidth alliance partners, choose affordable origin storage, optimize caching and edge settings, implement data compression, minimize redirects and request loops, and use tiered or reserved data transfer plans.

4. How do I monitor CDN bandwidth usage effectively?

Most CDN providers offer analytics and reporting tools to track bandwidth usage in real time. By regularly reviewing these reports, you can identify high-demand assets, monitor peak traffic times, and adjust your delivery strategy to minimize bandwidth fees.

The post CDN Bandwidth Fees: What You Need to Know appeared first on Backblaze Blog | Cloud Storage & Cloud Backup

OpenSSH 9.3 released

Post Syndicated from original https://lwn.net/Articles/926321/

OpenSSH 9.3 has been released. It includes a couple of security fixes, as
well as adding an option for hash-algorithm selection to
ssh-keygen and an option that allows configuration checking
without actually loading any private keys.

Internally And Externally Facing Honeypots

Post Syndicated from Bozho original https://techblog.bozho.net/internally-and-externally-facing-honeypots/

Honeypots are great security tools – you install a “decoy”, which attracts malicious traffic. They have certain ports open and they work with certain protocols, mimicking regular interactions, e.g. SSH, RDP, Telnet, HTTP. Usually, at least in introductory materials, honeypots are assumed to be externally-facing (e.g. installed in the DMZ). This means attackers can see it in the open internet and you can collect valuable information.

However, there can be a different mode for honeypots – internally-facing. In normal circumstances, they’d be completely silent. Only in case of a real intruder (doing lateral movement) or during security audits and pentests they will collect data (otherwise nobody has any business poking in that IP address).

It makes sense to have both types of honeypots. Here are the positive sides of an externally facing honeypot:

  • Constantly collects threat information (IPs, attempted passwords, attempted protocols) and apply this knowledge in other tools (e.g. insert IPs in SIEM/Firewall)
  • Distinguish automated probes from human intrusion attempts
  • Visualize trends in malicious activity

And the benefits of internally-facing honeypot:

  • Get alerted in case of lateral movement. Almost every hit on the internal honeypot needs to be investigated immediately
  • No risk for allowing intruders in through 0days in the honeypot software stack
  • Not consuming much resources (the external honeypot has to services potentially many requests; the internal one is serving 0 if everything is fine)

The post Internally And Externally Facing Honeypots appeared first on Bozho's tech blog.

[$] Zero-copy I/O for ublk, three different ways

Post Syndicated from original https://lwn.net/Articles/926118/

The ublk subsystem enables the creation of
user-space block drivers that communicate with the kernel using io_uring. Drivers implemented this way show
some promise with regard to performance, but there is a bottleneck in the
way: copying data between the kernel and the user-space driver’s address
space. It is thus not surprising that there is interest in implementing
zero-copy I/O for ublk. The mailing lists have recently seen three
different proposals for how this could be done.

How Cloudflare and IBM partner to help build a better Internet

Post Syndicated from David McClure original https://blog.cloudflare.com/ibm-keyless-bots/

How Cloudflare and IBM partner to help build a better Internet

How Cloudflare and IBM partner to help build a better Internet

In this blog post, we wanted to highlight some ways that Cloudflare and IBM Cloud work together to help drive product innovation and deliver services that address the needs of our mutual customers. On our blog, we often discuss exciting new product developments and how we are solving real-world problems in our effort to make the internet better and many of our customers and partners play an important role.

IBM Cloud and Cloudflare have been working together since 2018 to integrate Cloudflare application security and performance products natively into IBM Cloud. IBM Cloud Internet Services (CIS) has customers across a wide range of industry verticals and geographic regions but they also have several specialist groups building unique service offerings.

The IBM Cloud team specializes in serving clients in highly regulated industries, aiming to ensure their resiliency, performance, security and compliance needs are met. One group that we’ve been working with recently is IBM Cloud for Financial Services. This group extends the capabilities of IBM Cloud to help serve the complex security and compliance needs of banks, financial institutions and fintech companies.

Bot Management

As malicious bot attacks get more sophisticated and manual mitigations become more onerous, a dynamic and adaptive solution is required for enterprises running Internet facing workloads. With Cloudflare Bot Management on IBM Cloud Internet Services, we aim to help IBM clients protect their Internet properties from targeted application abuse such as account takeover attacks, inventory hoarding, carding abuse and more. Bot Management will be available in the second quarter of 2023.

Threat actors specifically target financial services entities with Account Takeover Attacks, and this is where Cloudflare can help. As much as 71% of login requests we see come from bots (Source: Cloudflare Data) Cloudflare’s Bot Management is powered by a global machine learning model that analyses an average of 45 million HTTP requests a second to track botnets across our network. Cloudflare’s Bot Management solution has the potential to benefit all IBM CIS customers.

Supporting banks, financial institutions, and fintechs

IBM Cloud has been a leader when it comes to providing solutions for the financial services industry and has developed several key management solutions that are designed so clients only need to store their private keys in custom built devices.

The IBM CIS team wants to incorporate the right mix of security and performance, which necessitates the use of cloud-based DDoS, WAF, and Bot Management. Specifically, they wanted to incorporate the powerful security tools that were offered through IBM’s Enterprise-level Cloud Internet Services offerings. When using a cloud solution, it is necessary to proxy traffic which can create a potential challenge when it comes to managing private keys. While Cloudflare adopts strict controls to protect these keys, organizations in highly regulated industries may have security policies and compliance requirements that prevent them from sharing these private keys.

Enter Cloudflare’s Keyless SSL solution.

Cloudflare built Keyless SSL to allow customers to have total control over exactly where private keys are stored. With Keyless SSL and IBM’s key storage solutions, we aim to help enterprises benefit from the robust application protections available through Cloudflare’s WAF, including Cloudflare Bot Management, while still retaining control of their private keys.

“We aim to ensure our clients meet their resiliency, performance, security and compliance needs. The introduction of Keyless SSL and Bot Management security capabilities can further our collaborative accomplishments with Cloudflare and help enterprises, including those in regulated industries, to leverage cloud-native security and adaptive threat mitigation tools.”
— Zane Adam, Vice President, IBM Cloud.

“Through our collaboration with IBM Cloud Internet Services, we get to draw on the knowledge and experience of IBM teams, such as the IBM Cloud for Financial Services team, and combine it with our incredible ability to innovate, resulting in exciting new product and service offerings.”
— David McClure, Global Alliance Manager, Strategic Partnerships

If you want to learn more about how IBM leverages Cloudflare to protect their customers, visit: https://www.ibm.com/cloud/cloudflare

IBM experts are here to help you if you have any additional questions.

Protect your key server with Keyless SSL and Cloudflare Tunnel integration

Post Syndicated from Dina Kozlov original https://blog.cloudflare.com/protect-your-key-server-with-keyless-ssl-and-cloudflare-tunnel-integration/

Protect your key server with Keyless SSL and Cloudflare Tunnel integration

Protect your key server with Keyless SSL and Cloudflare Tunnel integration

Today, we’re excited to announce a big security enhancement to our Keyless SSL offering. Keyless SSL allows customers to store their private keys on their own hardware, while continuing to use Cloudflare’s proxy services. In the past, the configuration required customers to expose the location of their key server through a DNS record – something that is publicly queryable. Now, customers will be able to use our Cloudflare Tunnels product to send traffic to the key server through a secure channel, without publicly exposing it to the rest of the Internet.

A primer on Keyless SSL

Security has always been a critical aspect of online communication, especially when it comes to protecting sensitive information. Today, Cloudflare manages private keys for millions of domains which allows the data communicated by a client to stay secure and encrypted. While Cloudflare adopts the strictest controls to secure these keys, certain industries such as financial or medical services may have compliance requirements that prohibit the sharing of private keys.In the past, Cloudflare required customers to upload their private key in order for us to provide our L7 services. That was, until we built out Keyless SSL in 2014, a feature that allows customers to keep their private keys stored on their own infrastructure while continuing to make use of Cloudflare’s services.

While Keyless SSL is compatible with any hardware that support PKCS#11 standard, Keyless SSL users frequently opt to secure their private keys within HSMs (Hardware Security Modules), which are specialized machines designed to be tamper proof and resistant to to unauthorized access or manipulation, secure against attacks, and optimized to efficiently execute cryptographic operations such as signing and decryption. To make it easy for customers to set this up, during Security Week in 2021, we launched integrations between Keyless SSL and HSM offerings from all major cloud providers.

Protect your key server with Keyless SSL and Cloudflare Tunnel integration

Strengthening the security of key servers even further

In order for Cloudflare to communicate with a customer’s key server, we have to know the IP address associated with it. To configure Keyless SSL, we ask customers to create a DNS record that indicates the IP address of their keyserver. As a security measure, we ask customers to keep this record under a long, random hostname such as “11aa40b4a5db06d4889e48e2f738950ddfa50b7349d09b5f.example.com”. While it adds a layer of obfuscation to the location of the key server, it does expose the IP address of the keyserver to the public Internet, allowing anyone to send requests to that server. We lock the connection between Cloudflare and the Keyless server down through Mutual TLS, so that the Keyless server should only accept the request if a Cloudflare client certificate associated with the Keyless client is served. While this allows the key server to drop any requests with an invalid or missing client certificate, the key server is still publicly exposed, making it susceptible to attacks.

Protect your key server with Keyless SSL and Cloudflare Tunnel integration

Instead, Cloudflare should be the only party that knows about this key server’s location, as it should be the only party making requests to it.

Enter: Cloudflare Tunnel

Instead of re-inventing the wheel, we decided to make use of an existing Cloudflare product that our customers use to protect the connections between Cloudflare and their origin servers — Cloudflare Tunnels!

Protect your key server with Keyless SSL and Cloudflare Tunnel integration

Cloudflare Tunnel gives customers the tools to connect incoming traffic to their private networks without exposing those networks to the Internet through a public hostname. It works by having customers install a Cloudflare daemon, called “cloudflared” which Cloudflare’s client will then connect to.

Now, customers will be able to use the same functionality but for connections made to their key server.

Getting started

Protect your key server with Keyless SSL and Cloudflare Tunnel integration

To set this up, customers will need to configure a virtual network on Cloudflare – this is where customers will tell us the IP address or hostname of their key server. Then, when uploading a Keyless certificate, instead of telling us the public hostname associated with the key server, customers will be able to tell us the virtual network that resolves to it. When making requests to the key server, Cloudflare’s gokeyless client will automatically connect to the “cloudflared” server and will continue to use Mutual TLS as an additional security layer on top of that connection. For more instructions on how to set this up , check out our Developer Docs.

If you’re an Enterprise customer and are interested in using Keyless SSL in conjunction with Cloudflare Tunnels, reach out to your account team today to get set up.

Super Bot Fight Mode is now configurable!

Post Syndicated from Adam Martinetti original https://blog.cloudflare.com/configurable-super-bot-fight-mode/

Super Bot Fight Mode is now configurable!

Super Bot Fight Mode is now configurable!

Millions of customers around the world use Cloudflare to keep their applications safe by blocking bot traffic to their website. We block an average of 336 million requests per day for self-service customers using a service called Super Bot Fight Mode. It is a crucial part of how customers keep their websites online.

While most customers use Cloudflare’s Verified Bot directory to securely allow good, automated traffic, some customers also like to write their own localized integration scripts to crawl and update their website, or perform other necessary maintenance functions. Because these bots are only used on a single website, they don’t fit our verified bot criteria the way a Google or Bing crawler does. This makes Super Bot Fight Mode difficult to manage for these types of customers.

Super Bot Fight Mode: now configurable!

Previously, Super Bot Fight Mode ran as an independent service on our global network and other Cloudflare security services were unable to affect its configuration. To solve this, we’ve rewritten Super Bot Fight Mode behind the scenes. It’s now a new managed ruleset in the new WAF, just like the OWASP Core Ruleset or the Cloudflare Managed Ruleset. This doesn’t change the interface, but brings Super Bot Fight Mode closer to where customers are managing their other security exceptions.

As we speak, the WAF team is carefully migrating all self-serve customers from our old Firewall Rules system to a new system. This new system, called Custom Rules, simplifies the exception process in the rules you write with no other changes or loss of functionality. In the old system we had two separate actions, “allow” and “bypass”. In the new Custom Rules, there’s only one action called “skip”. Rules that “skip” traffic can skip the rest of your custom rules (just like an “allow” rule would) and other Cloudflare services. As Cloudflare customers are given the “Skip” action, you will be able to see the option available to “skip” Super Bot Fight Mode. Here’s an example:

Super Bot Fight Mode is now configurable!

While we spoke to customers about their use cases for skipping Super Bot Fight Mode, one use-case kept popping up that didn’t quite fit the rest: WordPress Loopback requests. As many people know, as part of WordPress’ self-diagnostic capabilities, a WordPress site will make automated requests back to itself over the Internet to confirm its reachability and functionality. These loopback diagnostics can come from dozens of different community developed plugins, each implementing loopback requests slightly differently. To help accommodate an ever-growing diversity in diagnostic tools used in WordPress, we have added a simple configuration option to securely allow these loop-back requests.

Super Bot Fight Mode is now configurable!

In the future, we will be integrating this feature with the Cloudflare WordPress plugin to make it even easier to use WordPress with Cloudflare.

What’s next?

Self-serve customers with Custom Rules can create “Skip” rules to create exceptions for Super Bot Fight Mode today. We are currently rolling out Custom Rules to all of our customers. If you do not see this option available now, you should expect to see it in the next several weeks. If the lack of flexibility has prevented you from using Super Bot Fight Mode in the past, please log into the Cloudflare dashboard and try it with these new skip rules!

While we’ve added flexibility to customers’ Super Bot Fight Mode deployments, we know that Free plan customers want the same level of customization that self-serve customers do. Now that our migration of Super Bot Fight Mode to the new WAF is complete, we plan to do the same for the original Bot Fight Mode to allow more free customers than ever before to join us in the fight against bots.

No, AI did not break post-quantum cryptography

Post Syndicated from Lejla Batina (Guest author) original https://blog.cloudflare.com/kyber-isnt-broken/

No, AI did not break post-quantum cryptography

No, AI did not break post-quantum cryptography

News coverage of a recent paper caused a bit of a stir with this headline: “AI Helps Crack NIST-Recommended Post-Quantum Encryption Algorithm”. The news article claimed that Kyber, the encryption algorithm in question, which we have deployed world-wide, had been “broken.” Even more dramatically, the news article claimed that “the revolutionary aspect of the research was to apply deep learning analysis to side-channel differential analysis”, which seems aimed to scare the reader into wondering what will Artificial Intelligence (AI) break next?

Reporting on the paper has been wildly inaccurate: Kyber is not broken and AI has been used for more than a decade now to aid side-channel attacks. To be crystal clear: our concern is with the news reporting around the paper, not the quality of the paper itself. In this blog post, we will explain how AI is actually helpful in cryptanalysis and dive into the paper by Dubrova, Ngo, and Gärtner (DNG), that has been misrepresented by the news coverage. We’re honored to have Prof. Dr. Lejla Batina and Dr. Stjepan Picek, world-renowned experts in the field of applying AI to side-channel attacks, join us on this blog.

We start with some background, first on side-channel attacks and then on Kyber, before we dive into the paper.

Breaking cryptography

When one thinks of breaking cryptography, one imagines a room full of mathematicians puzzling over minute patterns in intercepted messages, aided by giant computers, until they figure out the key. Famously in World War II, the Nazis’ Enigma cipher machine code was completely broken in this way, allowing the Allied forces to read along with their communications.

No, AI did not break post-quantum cryptography

It’s exceedingly rare for modern established cryptography to get broken head-on in this way. The last catastrophically broken cipher was RC4, designed in 1987, while AES, designed in 1998, stands proud with barely a scratch. The last big break of a cryptographic hash was on SHA-1, designed in 1995, while SHA-2, published in 2001, remains untouched in practice.

So what to do if you can’t break the cryptography head-on? Well, you get clever.

Side-channel attacks

Can you guess the pin code for this gate?

No, AI did not break post-quantum cryptography

You can clearly see that some of the keys are more worn than the others, suggesting heavy use. This observation gives us some insight into the correct pin, namely the digits. But the correct order is not immediately clear. It might be 1580, 8510, or even 115085, but it’s a lot easier than trying every possible pin code. This is an example of a side-channel attack. Using the security feature (entering the PIN) had some unintended consequences (abrading the paint), which leaks information.

There are many different types of side channels, and which one you should worry about depends on the context. For instance, the sounds your keyboard makes as you type leaks what you write, but you should not worry about that if no one is listening in.

Remote timing side channel

When writing cryptography in software, one of the best known side channels is the time it takes for an algorithm to run. For example, let’s take the classic example of creating an RSA signature. Grossly simplified, to sign a message m with private key d, we compute the signature s as md (mod n). Computing the exponent of a big number is hard, but luckily, because we’re doing modular arithmetic, there is the square-and-multiply trick. Here is a naive implementation in pseudocode:

No, AI did not break post-quantum cryptography

The algorithm loops over the bits of the secret key, and does a multiply step if the current bit is a 1. Clearly, the runtime depends on the secret key. Not great, but if the attacker can only time the full run, then they only learn the number of 1s in the secret key. The typical catastrophic timing attack against RSA instead is hidden behind the “mod n”. In a naive implementation this modular reduction is slower if the number being reduced is larger or equal n. This allows an attacker to send specially crafted messages to tease out the secret key bit-by-bit and similar attacks are surprisingly practical.

Because of this, the mantra is: cryptography should run in “constant time”. This means that the runtime does not depend on any secret information. In our example, to remove the first timing issue, one would replace the if-statement with something equivalent to:

	s = ((s * powerOfM) mod n) * bit(s, i) + s * (1 - bit(s, i))

This ensures that the multiplication is always done. Similar countermeasures prevent practically all remote timing attacks.

Power side-channel

The story is quite different for power side-channel attacks. Again, the classic example is RSA signatures. If we hook up an oscilloscope to a smartcard that uses the naive algorithm from before, and measure the power usage while it signs, we can read off the private key by eye:

No, AI did not break post-quantum cryptography

Even if we use a constant-time implementation, there are still minute changes in power usage that can be detected. The underlying issue is that hardware gates that switch use more power than those that don’t. For instance, computing 127 + 64 takes more energy than 64 + 64.

No, AI did not break post-quantum cryptography
127+64 and 64+64 in binary. There are more switched bits in the first.

Masking
A common countermeasure against power side-channel leakage is masking. This means that before using the secret information, it is split randomly into shares. Then, the brunt of the computation is done on the shares, which are finally recombined.

In the case of RSA, before creating a new signature, one can generate a random r and compute md+r (mod n) and mr (mod n) separately. From these, the final signature md (mod n) can be computed with some extra care.

Masking is not a perfect defense. The parts where shares are created or recombined into the final value are especially vulnerable. It does make it harder for the attacker: they will need to collect more power traces to cut through the noise. In our example we used two shares, but we could bump that up even higher. There is a trade-off between power side-channel resistance and implementation cost.

One of the challenging parts in the field is to estimate how much secret information is actually leaked through the traces, and how to extract it. Here machine learning enters the picture.

Machine learning: extracting the key from the traces

Machine learning, of which deep learning is a part, represents the capability of a system to acquire its knowledge by extracting patterns from data —  in this case, the secrets from the power traces. Machine learning algorithms can be divided into several categories based on their learning style. The most popular machine learning algorithms in side-channel attacks follow the supervised learning approach. In supervised learning, there are two phases: 1) training, where a machine learning model is trained based on known labeled examples (e.g., side-channel measurements where we know the key) and 2) testing, where, based on the trained model and additional side-channel measurements (now, with an unknown key), the attacker guesses the secret key. A common depiction of such attacks is given in the figure below.

No, AI did not break post-quantum cryptography

While the threat model may sound counterintuitive, it is actually not difficult to imagine that the attacker will have access (and control) of a device similar to the one being attacked.

In side-channel analysis, the attacks following those two phases (training and testing) are called profiling attacks.

Profiling attacks are not new. The first such attack, called the template attack, appeared in 2002. Diverse machine learning techniques have been used since around 2010, all reporting good results and the ability to break various targets. The big breakthrough came in 2016, when the side-channel community started using deep learning. It greatly increased the effectiveness of power side-channel attacks both against symmetric-key and public-key cryptography, even if the targets were protected with, for instance, masking or some other countermeasures. To be clear: it doesn’t magically figure out the key, but it gets much better at extracting the leaked bits from a smaller number of power traces.

While machine learning-based side-channel attacks are powerful, they have limitations. Carefully implemented countermeasures make the attacks more difficult to conduct. Finding a good machine learning model that can break a target can be far from trivial: this phase, commonly called tuning, can last weeks on powerful clusters.

What will the future bring for machine learning/AI in side-channel analysis? Counter intuitively, we would like to see more powerful and easy to use attacks. You’d think that would make us worse off, but to the contrary it will allow us to better estimate how much actual information is leaked by a device. We also hope that we will be able to better understand why certain attacks work (or not), so that more cost-effective countermeasures can be developed. As such, the future for AI in side-channel analysis is bright especially for security evaluators, but we are still far from being able to break most of the targets in real-world applications.

Kyber

Kyber is a post-quantum (PQ) key encapsulation method (KEM). After a six-year worldwide competition, the National Institute of Standards and Technology (NIST) selected Kyber as the post-quantum key agreement they will standardize. The goal of a key agreement is for two parties that haven’t talked to each other before to agree securely on a shared key they can use for symmetric encryption (such as Chacha20Poly1305). As a KEM, it works slightly different with different terminology than a traditional Diffie–Hellman key agreement (such as X25519):

No, AI did not break post-quantum cryptography

When connecting to a website the client first generates a new ephemeral keypair that consists of a private and public key. It sends the public key to the server. The server then encapsulates  a shared key with that public key, which gives it a random shared key, which it keeps, and a ciphertext (in which the shared key is hidden), which the server returns to the client. The client can then use its private key to decapsulate the shared key from the ciphertext. Now the server and client can communicate with each other using the shared key.

Key agreement is particularly important to make secure against attacks of quantum computers. The reason is that an attacker can store traffic today, and crack the key agreement in the future, revealing the shared key and all communication encrypted with it afterwards. That is why we have already deployed support for Kyber across our network.

The DNG paper

With all the background under our belt, we’re ready to take a look at the DNG paper. The authors perform a power side-channel attack on their own masked implementation of Kyber with six shares.

Point of attack

They attack the decapsulation step. In the decapsulation step, after the shared key is extracted, it’s encapsulated again, and compared against the original ciphertext to detect tampering. For this re-encryption step, the precursor of the shared key—let’s call it the secret—is encoded bit-by-bit into a polynomial. To be precise, the 256-bit secret needs to be converted to a polynomial with 256 coefficients modulo q=3329, where the ith coefficient is (q+1)/2 if the ith bth is 1 and zero otherwise.

This function sounds simple enough, but creating a masked version is tricky. The rub is that the natural way to create shares of the secret is to have shares that xor together to be the secret, and that the natural way to share polynomials is to have shares that add together to get to the intended polynomial.

This is the two-shares implementation of the conversion that the DNG paper attacks:

No, AI did not break post-quantum cryptography

The code loops over the bits of the two shares. For each bit, it creates a mask, that’s 0xffff if the bit was 1 and 0 otherwise. Then this mask is used to add (q+1)/2 to the polynomial share if appropriate. Processing a 1 will use a bit more power. It doesn’t take an AI to figure out that this will be a leaky function. In fact, this pattern was pointed out to be weak back in 2016, and explicitly mentioned to be a risk for masked Kyber in 2020. Apropos, one way to mitigate this, is to process multiple bits at once — for the state of the art, tune into April 2023’s NIST PQC seminar. For the moment, let’s allow the paper its weak target.

The authors do not claim any fundamentally new attack here. Instead, they improve the effectiveness of the attack in two ways: the way they train the neural network, and how to use multiple traces more effectively by changing the ciphertext sent. So, what did they achieve?

Effectiveness

No, AI did not break post-quantum cryptography

To test the attack, they use a Chipwhisperer-lite board, which has a Cortex M4 CPU, which they downclock to 24Mhz. Power usage is sampled at 24Mhz, with high 10-bit precision.

To train the neural networks, 150,000 power traces are collected for decapsulation of different ciphertexts (with known shared key) for the same KEM keypair. This is already a somewhat unusual situation for a real-world attack: for key agreement KEM keypairs are ephemeral; generated and used only once. Still, there are certainly legitimate use cases for long-term KEM keypairs, such as for authentication, HPKE, and in particular ECH.

The training is a key step: different devices even from the same manufacturer can have wildly different power traces running the same code. Even if two devices are of the same model, their power traces might still differ significantly.

The main contribution highlighted by the authors is that they train their neural networks to attack an implementation with 6 shares, by starting with a neural network trained to attack an implementation with 5 shares. That one can be trained from a model to attack 4 shares, and so on. Thus to apply their method, of these 150,000 power traces, one-fifth must be from an implementation with 6 shares, another one-fifth from one with 5 shares, et cetera. It seems unlikely that anyone will deploy a device where an attacker can switch between the number of shares used in the masking on demand.

Given these affordances, the attack proper can commence. The authors report that, from a single power trace of a two-share decapsulation, they could recover the shared key under these ideal circumstances with probability… 0.12%. They do not report the numbers for single trace attacks on more than two shares.

When we’re allowed multiple traces of the same decapsulation, side-channel attacks become much more effective. The second trick is a clever twist on this: instead of creating a trace of decapsulation of exactly the same message, the authors rotate the ciphertext to move bits of the shared key in more favorable positions. With 4 traces that are rotations of the same message, the success probability against the two-shares implementation goes up to 78%. The six-share implementation stands firm at 0.5%. When allowing 20 traces from the six-share implementation, the shared key can be recovered with an 87% chance.

In practice

The hardware used in the demonstration might be somewhat comparable to a smart card, but it is very different from high-end devices such as smartphones, desktop computers and servers. Simple power analysis side-channel attacks on even just embedded 1GHz processors are much more challenging, requiring tens of thousands of traces using a high-end oscilloscope connected close to the processor. There are much better avenues for attack with this kind of physical access to a server: just connect the oscilloscope to the memory bus.

Except for especially vulnerable applications, such as smart cards and HSMs, power-side channel attacks are widely considered infeasible. Although sometimes, when the planets align,  an especially potent power side-channel attack can be turned into a remote timing attack due to throttling, as demonstrated by Hertzbleed. To be clear: the present attack does not even come close.

And even for these vulnerable applications, such as smart cards, this attack is not particularly potent or surprising. In the field, it is not a question of whether a masked implementation leaks its secrets, because it always does. It’s a question of how hard it is to actually pull off. Papers such as the DNG paper contribute by helping manufacturers estimate how many countermeasures to put in place, to make attacks too costly. It is not the first paper studying power side-channel attacks on Kyber and it will not be the last.

Wrapping up

AI did not completely undermine a new wave of cryptography, but instead is a helpful tool to deal with noisy data and discover the vulnerabilities within it. There is a big difference between a direct break of cryptography and a power side-channel attack. Kyber is not broken, and the presented power side-channel attack is not cause for alarm.

The collective thoughts of the interwebz