Risky Business #720 -- How cloud identity provider federation features can get you mega-owned
Sep 5, 2023
auto_awesome
Mark Jow, Gigamon's EMEA Technical Director, joins the podcast to discuss the recent attacks on Okta customers, risks of cloud identity provider federation, Tor usage in Russian espionage, and surveillance firms exploiting SS7 access. The topics cover cyber threats, espionage tools targeting Uighur Muslims, Ukrainian military attacks, and collaboration on an attack emulation platform. The discussion also touches on ransomware attacks, NCSC's new CTO appointment, Gigamon's network data source role, SSL Terminator product for cloud environments, and network traffic gathering in cloud environments.
Recent attacks on Okta customers highlight the importance of cross-tenant impersonation prevention.
Third-party communication apps pose significant security risks, emphasizing the need for caution.
Russian espionage operations utilizing Tor for command and control show evolving cybersecurity threats.
Deep dives
Gigamon's Focus on Network Data and Collaboration with Security Companies
Gigamon has shifted its focus from NDR products to being a source of network data for security teams and vendors. By providing high-fidelity data and the right data attributes, Gigamon helps reduce the volume of traffic security teams need to handle and assists in integration with various security tools and vendors, enabling proactive security measures and enhanced threat detection.
Gigamon's New Cloud Product: SSL Terminator for Cloud Environments
Additionally, Gigamon is introducing a new cloud-focused product that acts as an SSL terminator for cloud environments, allowing for visibility behind the SSL encryption within clouds. This product is designed to provide network traffic data in a clear, immutable form, supporting cloud service providers and organizations in managing large volumes of data efficiently and securely.
Gigamon's Approach to Network Data Collection
In physical environments, Gigamon uses physical taps to gather network traffic data, sending it to the Gigamon visibility node for processing. In a virtual environment, the V-series solution offers a virtualized version of Gigamon's visibility node, using virtual taps to capture traffic within cloud environments. Gigamon adapts its data collection methods based on the cloud environment, leveraging network-specific features like NSX-T or VPC in AWS.
Gigamon's SSL Decryption and Traffic Handling Capabilities
Gigamon, known for its SSL interception solutions, is now offering an SSL terminator for cloud environments. This tool enables customers to access encrypted traffic in clear text within cloud environments securely. By terminating SSL connections and sending decrypted traffic through secure tunnels to designated tools, Gigamon ensures data integrity and security while allowing for enhanced visibility and analysis.
Upcoming Release: Gigamon's SSL Terminator for Cloud Environments
Gigamon's SSL terminator for cloud environments is slated for release on September 12th, providing organizations with a secure solution for decrypting and handling SSL traffic within cloud environments. This product will offer enhanced visibility and traffic analysis capabilities, catering to the evolving needs of cloud service providers and organizations managing encrypted traffic flows.