DEV Community: Chen Shem Tov

Software Security Vulnerability: Zero-Day Exploit

Chen Shem Tov — Thu, 08 Aug 2019 18:16:28 +0000

In cyber circles, the term zero-day could inspire excitement or fear, depending on which side of the attack you’re on. Yes, there are sides—the digital world is a binary one, in which people and machines engage in a fierce cyber warfare.

For a threat actor, zero-day is a means to an end. For everyone else, zero days is the time in which a vulnerability is disclosed, and you have a short span of time to patch it. If you can patch it on time, you’ll have won the battle. Otherwise, a threat actor might make off with your data, take over your site, or sabotage you network.

Threat, Exploits and Vulnerabilities—Defining Core Concepts

In order to understand what zero-day means, you’ll need to gain a better understanding of the core principles of cyber attacks—vulnerabilities, exploits and threats—as explained in this section.

What Is a Vulnerability?
In cyber security, the term vulnerability applies to any flaw that can be used to initiate an attack against a network, system or device. Threat actors use vulnerabilities to compromise security perimeters.

Vulnerabilities can be generally classified according to the location of the flaw, as follows:

Software vulnerabilities—pieces of code that can be used to initiate attacks, such as a bug created by human error, or a code distortion created by a forced injection of malware.

Network vulnerabilities—intentional or accidental flaws in the design of the network architecture, and insecure open-source connections and APIs.

Hardware vulnerabilities—hardware flaws due to a decay in the physical conditions of the components or the intentional sabotage by external or insider threats.

What Is an Exploit?
In cyber security, an exploit is the method threat actors use to take advantage of (exploit) a security flaw (vulnerability).

An exploit can be a piece of code (injections), a program (usually malware or ransomware), an automated bot (exploit kits) or a human being. The latter is called an insider threat, which is a term that refers to people with authorized access to the company network, who are blackmailed or tricked into initiating an attack from the inside.

Threat actors often use an exploit kit, which is a collection of exploits, to search for vulnerabilities and/or exploit a security vulnerability through an injection of code or malware. Some exploit kits are fully automated, while others have a manual component. Exploits play a major role in long-term and strategic attacks, such as an Advanced Persistent Threat (APT) attack.

What Is a Threat?
In cyber security, the term “threat” refers to a potential danger to the security perimeter. Unpatched or unknown vulnerabilities, which exist in the network, system or device, and endanger the network, are a threat. Once the vulnerability is exploited, it becomes a risk that needs to be remediated as soon as possible.

Since there are thousands of known vulnerabilities, and potentially thousands of unknown vulnerabilities, prioritizing the remediation of vulnerabilities has become a common practice in cyber security. Some security teams approach vulnerability management manually, and others make use of automated tools.

Zero-Day Vulnerability: What It Is and How It Works

Now that you have gained a better understanding of the terms “vulnerability”, “exploit” and “threat”, and how they operate within the sphere of cyber security, you’ll be better prepared for reading about the term “zero-day”, including its connection to the core concepts we learned.

What Is the Meaning of the Term Zero-Day?
In cyber security, the term zero-day is used to describe the initial discovery of a vulnerability. Once the vulnerability is discovered—by the technology vendor, the network administrator, the security team or a vulnerability library, such as the National Vulnerability Database (NVD)—there’s a race between threat actors and security teams.

This time-sensitive battle has been given the name zero-day, which originates from the time of digital bulletin boards, when threat actors attempted to steal software before it was released. Nowadays, it’s a matter of whether the security teams manage to patch the vulnerability before the threat actors manage to exploit the vulnerability. Whoever wins the battle wins the data.

What Is a Zero-Day Vulnerability?
When a vulnerability is disclosed to the public, and it is deemed a critical threat that requires immediate remediation, it is called a zero-day vulnerability.

What Is a Zero-Day Exploit?
A zero-day exploit can tip the scales in favor of a threat actor, because they provide them with the means to exploit a zero-day vulnerability before security teams get the chance to patch.

The Zero-Day Black Market
System administrators and users are usually left in the dark until a vulnerability is disclosed to the public. Once the vulnerability is disclosed, it takes time for the community to find a solution and then apply the fixes.

Threat actors take advantage of this zero-day period of time, by creating, selling and buying zero-day exploit kits. There is also a thriving black market for zero-day vulnerabilities. Prices can range from a few thousand dollars to tens and even hundreds of thousands.

How Zero-Day Vulnerabilities Work
There is no one particular way to launch a zero-day attack. The only limitation is the imagination, skills and resources of the threat actor. These factors will determine the types and amount of zero-day vulnerabilities and exploits the threat actors can find or create.

The only qualifier for a zero-day initiative is to have as much of a head start on the security team as possible. For some threat actors, that means buying a zero-day vulnerability or exploit kit in the black market. For others, it means sending a bot to scan for vulnerabilities. And there are the threat actors who band together to raise an APT group for devising strategic zero-day attacks.

The Connection between APT and Zero-Day Initiatives
An advanced persistent threat (APT) is a long-term and strategic attack campaign, designed and deployed by threat actors, for the purpose of initiating a zero-day attack. The goal of an APT initiative is to infiltrate the network and remain undetected for long periods of time, during which the threat actors can achieve their goal.

Objectives of an APT can range from data extractions (as in the case of the Equifax breach), file inclusion (RFI), cross-site scripting (XSS) and SQL injection, or backdoor shells and Trojans that help the threat actors expand their reach within the network.

If the APT initiative is successful, the threat actors would have found an unknown or zero-day vulnerability, persisted in applying a zero-day exploit, and made off with the prize. Threat actors typically go after data, specifically intellectual property, and sensitive and financial information. An APT can also result in ransomware, site takeovers, and sabotage to the infrastructure.

It’s a Wrap!

Hopefully, by the time you reach this section, you’ll have gained a better understanding of the term zero-day and how it applies in cyber security.

Here’s a quick summary to keep the information fresh in your mind:
A vulnerability is a flaw in the security perimeter
An exploit is a method of using a vulnerability to breach the security perimeter
A threat is a potential danger to the security perimeter
The term zero-day refers to unknown or newly disclosed vulnerabilities or exploits
Threat actors often launch APT attacks to initiate zero-day attacks

Companies like Cynet provide security teams with the technology required to prevent and block zero-day attacks. Be sure to check out some of the available solutions, because you’ll need all the help to win the zero-day race.

Comparing the Best DAM Software of 2019

Chen Shem Tov — Thu, 20 Jun 2019 13:49:37 +0000

In today’s digital landscape, people are blasted with content. Brands vie for attention through any possible channel. Our emails are cluttered with promotional newsletters and once-in-a-lifetime offers. Our newsfeeds are splattered with sponsored ads, influencers’ reviews, the unsolicited opinions of well-intentioned friends and family and the occasional tech-savvy great aunt.

Visual media aids help brands distinguish themselves in a quick and efficient manner. Instead of long passages of texts, brands can distill their message into one image that says it all. Unfortunately, one image is never enough. The lifespan of a Facebook post or ad lasts only for the few seconds it takes to glimpse at it and scroll onwards—approximately six seconds. You need more than that to remain visible and reach prospective customers.

As brands accumulate more and more media, it becomes difficult to keep track of the distribution, management and usage licensing. Digital Asset Management (DAM) solutions enable brands to store, organize and distribute all their digital assets in one centralized platform.

What Is Digital Asset Management (DAM)?

Digital Asset Management (DAM) is comprised of a set of business practices and technological tools. DAM enables organizations to control the storage, usage and curation of their media assets.

What Is Digital Asset Management (DAM) Software?

DAM software was originally designed to help organizations manage rich media content, back when all you needed was two sliding images to create an interactive Web ad. These DAM tools relied solely on rudimentary metadata for organizing media libraries. You can add in the name, format, description, media type and date, and that’s about it.

With the traditional DAM, your searching capabilities are limited to the metadata you wrote for each asset. This is why Content Management Systems (CMS) like Wordpress fail to answer the needs of content-heavy websites—you have low visibility into your media library. Additionally, you have no ability to track licensing and usage rights, and there are no video editing features.

Today’s DAM solutions take into account the constant demand for new and different content, enabling organizations to manage all media formats in one location. You can upload images, vectors, videos, animations, GIFs, PDFs, presentations and more. You can integrate DAM solutions with your CMS, and streamline your content across all channels. If you have a sales team, you can give them access to marketing materials and bring the two disciplines together under one collaborative platform.

How to Choose a DAM Solution

Make sure that you choose the right DAM solution for you. You can create a DAM guideline to help keep you focused on the capabilities that matter most to your organization. Figure out how much media you want to store, and define a storage limit. Define roles and the number of users who need access to the platform, and keep everyone informed about licensing compliance standards and security best practices.

Here are the most fundamental features you should look for in a DAM solution:

Integration—the content you manage in your DAM solution is always needed elsewhere. Ensure that your DAM solution can distribute your content seamlessly to all of your media channels.
Curation—the whole point of moving all of your content to a new location is to enforce simple organization standards. Look for solutions that enable cataloging features. AI-powered tagging and automated metadata, can especially make your work easier.
Search—a DAM solution should make it easier for you to find the media you need. To that end, some solutions provide Artificial Intelligence (AI) capabilities such as search suggestions, AI image recognition and auto-tagging.

Depending on the needs of your organization, you might also want your DAM solution equipped with the following capabilities:

Sharing
Collaboration
Version control
Access and authorization management
Cloud hosting
Intuitive user experience
Support

Once you sort and organize your content, you’ll be able to manually identify content patterns and adjust your DAM guidelines accordingly. DAM solutions with intelligent analytics capabilities can also provide you with automated insights about the performance and usage of your assets.

Top DAM Software Providers

WebDAM

WebDAM is a cloud-based digital asset management platform, powered by Bynder. WebDAM’s interface is simple and intuitive, integrating seamlessly into your daily routine.

Capabilities: WebDAM is packed with features that can be configured according to your needs. You can set up your account for 10 users or for 30 user, and for any storage requirement. WebDAM offers assistance and support during and after the adoption of their software. The core features of the software include faceted search—which enables sorting and filtering capabilities within the library—automated keywords suggestions, and intuitive workflows for collaborating and sharing.

Pricing: you can request a personalized quote via their website.

Asset Bank

Asset Bank is an end-to-end digital asset management solution, powered by Bright. Asset Bank offers a variety of hosting methods, including shared hosting, and on-premise installation.

Capabilities: Asset Bank comes with robust features for creating a searchable catalog for your digital assets, and you have full control over how you configure the library. The platform’s advanced search capabilities include a search builder, saved searches and Geotagging. You can manage access and authentication, collaborate and share assets, and maintain compliance by increasing visibility into usage rights of each asset.

Pricing: Asset Bank offers three monthly subscriptions—Essential for £390, Professional for £615, and Enterprise for £1430 per month.

Cloudinary

Cloudinary provides Software as a Service (SaaS) digital asset management solutions. Cloudinary’s cost-effective subscription models can help you grow at scale.

Capabilities: Free users get access to a user-friendly DAM media library, along with an upload widget and API. You can run queries, set up automatic backups and optimization, and create image and video manipulations. The Plus, Advanced, and Custom pricing models will grant you access to Artificial Intelligence (AI), user access control and workflow integration capabilities.

Pricing: Cloudinary offers three monthly subscriptions—free, Plus for $99, and Advanced for $249. You can also get in touch with a sales rep for a personalized quote.

Brandfolder

Brandfolder provides customized digital asset management solutions, configured according to industries, roles, the size of the organization, and the needs of the users.

Capabilities: Premium users gain access to features such as curated collections, cloud storage, interface branding, and user permission controls. Enterprise clientele enjoys premium features plus identity management, software support, video storage and formatting, insights and analytics reports, and more. If you handle a lot of assets on a consistent basis, Brandfolder’s bulk capabilities can help you reduce the time it takes to tag, move, merge, and edit your assets.

Pricing: you can request a personalized quote via their website.

Never Lose Track of Your Media Content

Working with media content doesn’t have to be a long, tedious and painful process. Instead of manually uploading, organizing, editing and publishing media, you can use a DAM solution. Even the most basic of DAM modules can set you up with an efficient workflow. A user-friendly solution can help you delegate tasks to the machine and clear up your time for what matters most to you.

Animated GIF and Video Compared: Which Should You Prefer and Why?

Chen Shem Tov — Fri, 14 Jun 2019 14:18:56 +0000

Both video and animated content are robust forms of visual media whose influence on the audience is growing day by day. According to a recent report, people spend 1.5 hours a day on average viewing video content. 81% of businesses utilize video as an influential marketing tool. Add to this the technological advancements in HTML5 videos and HTML video players, and video content is now easier to produce than ever before.

With the rise of visual content, animated GIFs have also grown in popularity. Animated GIFs essentially combine multiple images or ‘frames’ into a single file. These discreet images are displayed in quick succession, similar to a flip book, to convey motion. Each picture can be viewed by pulling apart the GIF file. Animated GIFs are highly visual and are a cheaper option when compared to video content.

Does File Size Matter?

A big concern when it comes to animated GIF is the size of the file. Because the GIF is a flipbook of separate images, compression can occur only at the image level. If you’re curious, try opening a GIF file from your browser. Here’s what you might see.

13.7MB is huge by modern web standards. This is 10 times the size of the content on most websites.

For video files, however, movie codecs allow not only for an x/y compression per frame but also compress across the 3rd dimension of time. The advantage here is that testing across time allows for much higher compression. This is because only changes across frames are recorded in the file.

Let’s look at this example of an animated file. The HD version of the GIF above is 6.6MB in size. If you have multiple GIFs on your website, it could considerably slow down your page and you risk losing your customers. On the other hand, an HD MP4 version of the GIF has a size of 311KB.

Research has concluded that animated GIFs are about 5-10 times larger than an optimally encoded MP4 video which is exactly what we saw in the image above. This difference in size implies that GIFs not only waste a substantial amount of bandwidth but also load slowly and lead to bad user experience.

Converting animated GIFs to video is a great optimization technique simply due to the reduction in file size that video files are capable of. Popular social media sites like Facebook, Twitter, and Imgur silently convert any animated GIFs that a user uploads into an MP4 video file and display that instead.

Impact on Page Performance

Though small file sizes are preferable, it isn’t the only thing that matters. We also need to understand how the media resource performs if it is downloaded. This is important since media files need to be decoded before playback.

Animated GIFs are not the best choice here because image decoding is needed for each frame in the image. This can contribute to jank.

This is how it looks like in the Performance panel in Chrome’s developer tools where the only content of a page is an element pointing to an animated GIF:

The Performance panel in Chrome's developer tools showing browser activity as an animated GIF plays.

The image decodings take place on the rasterizer threads as each new frame of the GIF is decoded. Now, here is a comparison table of total CPU time for GIF versus MPEG-4 and WebM videos:

GIF takes the highest CPU time when compared to both videos, especially MPEG-4. This shows that videos usually use less CPU time than animated GIF, which is a welcome performance improvement above and beyond reducing file size.

That said, some CPUs and GPUs offer hardware-accelerated encoding/decoding of video files (e.g., Quick Sync Video on Intel CPUs). Many processors can encode and decode for MPEG-4; however, WebM codecs like VP8 and VP9 have only just started to benefit from hardware-accelerated encoding/decoding on newer CPUs. You can read more about their performance over at Google Developer’s page.

Another crucial factor is the place where you’ve hosted your media elements and whether you’re optimizing them before they are rendered. For instance, there are many popular cloud strategies for hosting and optimizing video files on the fly. Optimizing GIFs is harder, though you can use image CDNs to host them. For video files, you can use cloud services like Cloudinary, Wistia etc. to host your videos and then link them back using Cloudinary. You can then use an HTML5 video player to render the video on your posts.
When to Use Animated GIFs
There are many advantages to using animated GIFs, especially when attempting to market your product or service. Here are some of the common scenarios where animated GIFs can come in handy.

Event or Product Promotion
Animated GIFs are ideal for marketing an organization’s products online to display the level of detail that can attract potential customers. Additionally, it gives audiences a closer look at your product as they do a great job of putting its features and benefits in the spotlight.

Increase Audience Retention
A recent study showed that visitors tend to read less than 30% of the text on a website and tend to skim through most of it. Additionally, visitors tend to remember only 20% of the text when not accompanied by visuals. Therefore, marketers tend to use more visual content like GIFs to put their brand message across.

To Explain a Process
It has been proven to be easier to explain a process via an image rather than text. Step-by-step and how-to guides, as well as process flows, work better with GIFs rather than text.

To Create a Mini-Presentation
Creating a micro-presentation, a simple cartoon or sharing a mini-screen recording can help drive your point home. Especially on social media platforms like Twitter that have text limitations.

To Animate Data
GIFs can be used to provide your audience with context into a piece of data or statistic via an animated graphics or diagram. Some use cases can be to show, the advancement of deforestation, or flood waters, or changing climate conditions over a period, etc.
When to Use a Video Format
Here are some of the places where video format works better than animated GIFs.

Driving Customer Conversion
A recent study shows that 64% of consumers are more likely to purchase your product or service after they watch a video about it. If your product or service can appeal to the visitor’s emotions, a video does well to stir up those emotions and encourage them to proceed with the CTA.

For Explainer Videos
You can plan to explain your product or service in detail in your video and keep the rest of your web page shorter. As mentioned above, videos engage visitors much more than text. This works well with almost all products or services and can also be used to promote offers

Showcase the Human Connection
If you have a service or a product that can empathize with the human connection, a video can help win over your visitors almost instantly. In addition to being able to pull at the heartstrings, the movement, and sound in a video help in capturing and retaining a visitor’s attention when you need it.

For Email Marketing
It has been established that moving images in an email marketing campaign tend to generate a better response rate. In a study conducted by Playable in 2017, about 27% of emails that had embedded videos elicited a response from the receiver. Integrating high quality, relevant videos result in a better user experience, higher engagement and finally, more conversions
Does the Media Format Impact SEO?
When we think of content while formulating an SEO plan, we tend to default to text. However, other forms of content like video, images, and GIFs also play a crucial role in your site coming up against more queries, more often.

Including rich media like video and GIFs in posts on social platforms increases the likelihood of engagement. The same applies to the organic search channel as well. If you have more than one listing on a search engine results page, let’s say a web page and a video, the visibility of your brand increases.

Videos on your website and in platforms like YouTube improve the user experience and offer additional ways to interact with your business. In June 2014, Google published findings from a study showing how YouTube was an influential medium on the path to conversion for different consumer categories including vehicles, smartphones and beauty products.

If you’re not looking at rich media as part of your content strategy, you’re ignoring the chance of generating more traffic to your brand from organic search results. Images, GIFs, and videos represent more ways to connect with your target audience on their path to purchase, right from the research stage to conversion. If you want to know more about how media files influence SEO, you should consider reading this article published by Search Engine Journal.

Conclusion

Animated GIFs are a fun way to connect with different audiences through engaging and informative content. However, their large file size can be a hindrance, increasing the page load time and consuming data bandwidth.

Here are some aspects to keep in mind when trying to decide on using videos or an animated GIF on your landing page:

Well made and professional videos are great to have. Poorly made videos will probably do more harm than good for your conversion rate.
At times, animated GIFs can become a distraction from the main idea you want to put across.
If your video is a demo of a product, consider using an animated GIF.
Use videos to display emotions or if you need sound effects. Animated GIFs are not ideal for this scenario.

If you do want to include animated GIFs in your website or app, consider converting them to video files. This will save your customer’s data costs as well as not hinder your website or app’s speed.

What You Can Learn from these 5 Mistakes in Hybrid Cloud Implementations

Chen Shem Tov — Thu, 06 Jun 2019 16:56:15 +0000

Overview

Moving to a hybrid setup is a popular option for businesses looking to take advantage of the cloud. This article highlights five common mistakes in hybrid cloud implementations, helping to ensure a smooth hybrid cloud migration for your company.

However, it’s important to first define precisely what the hybrid cloud is and understand the motivations for choosing this form of cloud computing implementation.

The Hybrid Cloud Defined

The hybrid cloud is an integrated computing environment combining the use of internal (private) and external (public) cloud services. Private clouds are only accessible and controllable by a single client via a secure connection and they remain inside the corporate firewall, however, the actual physical infrastructure could be located in an on-premise data center or in a secondary location. Public clouds are computing services and resources offered by third-party providers over the Internet.

Some of the main vendors of cloud services include:

AWS (public)
Azure (public)
IBM (private)
VMWare (private)

There are also third-party solutions that link up with the services provided by these vendors, such as NetApp's Azure storage solution, which adds more data management capabilities to Azure cloud data storage, or Cloudhealth, which gives enterprises the ability to centralize governance of their AWS environments with automated policies.

The motives for choosing a hybrid setup include cost savings from only using public cloud resources when you need them, effortless scalability using policy-based automation between the two types of cloud, and the ability to supplement internal data storage with low-cost public cloud storage.

However, because this is a relatively new way of thinking about enterprise IT, it is easy to make mistakes when you decide on moving to the hybrid cloud.

Common Hybrid Cloud Mistakes

1. Neglecting Security and Compliance

With all the complex architectural concerns involved in ensuring seamless integration between public and private cloud environments, security and compliance can become afterthoughts. While the cloud service provider typically takes care of the overall security of the environment, you, the client, need to manage security within your hybrid setup.

Unencrypted data and lackadaisical security policies can wreak havoc in this type of setup, leading to the type of data breaches that can ruin a business. Furthermore, if you don’t prioritize compliance with regulations such as PCI DSS or GDPR, you can quite easily lose visibility over sensitive data in the hybrid cloud, potentially leading to fines due to non-compliance.

Make sure security is a top priority for you in the hybrid cloud. Consider hiring a cloud security specialist to make sure you get security right from the outset. Always perform due diligence on potential public cloud vendors to see that they comply with any regulations that protect sensitive data in your industry.

2. Doing It All At Once

Attempting to jump in at the deep end and move all desired workloads and data to the public cloud at the one time is a poor strategy for any hybrid cloud implementation. It’s prudent to migrate in phases by identifying data, applications, or processes that you can most easily “burst” to the public cloud. You can do these smaller pilot projects first, and they’ll give you the confidence and knowledge to move forward with a hybrid cloud migration on a broader scale.

There are established best practices for migration to each one of the major cloud providers. For example, here are good resources for learning about Azure migration and AWS migration.

3. Choosing The Wrong Type of Public Storage

There are several types of public cloud storage available to businesses and choosing the wrong one can wreak havoc for your hybrid cloud implementation. For example, you will need a high-performance storage type such as block storage for any apps you decide to extend to the public cloud during peak demand periods. Choosing a lower cost storage type that lacks the performance you need will lead to undesirable performance.

Similarly, choosing expensive storage types when a cheaper cold archiving object storage would suffice could end up costing you a lot of wasted money. To avoid this mistake, you must understand the available public cloud storage types and match the characteristics of your data to the correct type of storage.

4. Failing To Properly Monitor Cloud Usage

One of the main drivers of businesses migrating to the hybrid cloud is the cost savings involved in such an option. However, many organizations make the mistake of assuming these savings as a given and not adequately monitoring cloud usage. The end result of a lack of monitoring is often much higher than anticipated monthly bills.

Whether it’s choosing incorrect instance types for workloads, opting for incorrect storage types, or leaving instances running while they are not in use, these problems quickly add up and they are difficult to identify without monitoring your cloud usage.

To avoid this mistake, there is a real need for a centralized tool with a dashboard that monitors cloud usage between public and private clouds in addition to alerting you when you are on course to exceed your cloud budget.

5. Not Considering Network Bottlenecks

The convergence between two types of computing environments can have dramatic impacts on your network that businesses often fail to take into account. If you are moving from an on-premise implementation to the hybrid cloud, you are probably used to low-latency, high throughput on a local area network.

However, a network bottleneck can emerge when moving traffic over a wireless network between your private and public cloud services, particularly as you begin to leverage the public cloud more. It is imperative to prepare for this potential bottleneck by assessing your wireless network, your Internet service provider, and making sure the network is equipped to handle high volumes of traffic either by using more than one ISP or upgrading your existing contract.

Wrap Up

To prepare for the hybrid cloud, make sure you:

Make security and compliance priorities from the outset
Migrate in phases
Assess your existing network infrastructure
Fully research the available cloud providers and read their service level agreements
Implement a centralized tool that can monitor cloud usage

Avoid these common hybrid cloud mistakes and properly prepare for your migration. By doing so, your business maximizes the probability that everything will go smoothly and you can take full advantage of the benefits of the hybrid cloud.