What is Heartbleed?
The problem affects a piece of software called OpenSSL, used for security on popular web servers. With OpenSSL, websites can provide encrypted information to visitors, so the data transferred (including usernames, passwords and cookies) cannot be seen by others while it goes from your computer to the website.
OpenSSL is an open-source project, meaning it was developed by really talented volunteers who wanted to help the internet community. It happens that version 1.0.1 of OpenSSL, released on April 19th 2012, has a little bug (a mistake introduced by a programmer) that allows for a person (including a malicious hacker) to retrieve information on the memory of the web server without leaving a trace.
What information are they stealing?
Heartbleed exploits a built-in feature of OpenSSL called heartbeat. When your computer accesses a website, the website will respond back to let your computer know that it is active and listening for your requests: This is the heartbeat. This call and response is done by exchanging data. Normally when your computer makes a request, the heartbeat will only send back the amount of data your computer sent. However, this is not the case for servers currently affected by the bug. The hacker is able to make a request to the server and request data from the server’s memory beyond the total data of the initial request, up to 65,536 bytes.
What should I do?
The important question is: Should you worry about this problem? The short answer is: “Yes, but don’t panic”. You should definitely change your passwords at least for the services confirmed as vulnerable and have now been fixed, such as Google and Yahoo. But you should be changing your passwords regularly no matter what. If you have trouble remembering your passwords, you can always use a password manager such as LastPass or 1Password (remember: Don’t ever write down your passwords on a Sticky note next to your monitor, a notepad or a document inside the computer).
You can also:
- Install/Update Internet Security Software – Most reputable Internet Security Suites have the options for browser add-ons that can detect sites that are affected and advise you before you establish a connection.
- Trend Micro Heartbleed Detector – Input a website URL and it will advise if the site is vulnerable or protected.
A simple explanation of Heartbleed:
back to top
Four reasons to refresh your ageing network
Innovation in business requires innovation in the IT network and this makes your network more relevant than ever before. The growing number of devices and traffic need to be managed in a cost-effective and secure way to help you focus less on keeping the lights on, and more on business innovation.
Many of the switches and Access Points (APs) used by businesses today were not designed for capabilities like Bring Your Own Device (BYOD), pervasive mobility, advanced security and Software Defined Networking (SDN). The IT network has to evolve to better handle these major technology transitions.
If your IT network is ageing then here are four reasons why you might consider upgrading your network infrastructure now:
1. Your Access Control is outdated
Traditional Access Control technology and practices have been made obsolete over last few years with the emergence of BYOD and the need to support a mobile workforce. Many businesses have separate, inconsistent security policies for wired, wireless and remote access and also lack context-based security.
Not long ago, employees were the only users on corporate networks. They used corporate-issued devices and these devices ran corporate applications and spent most of their life inside the office. Today employees, partners and customers share corporate networks and they connect their own mobile devices running non-approved, untested applications. And to further complicate matters these users now run both their corporate and personal devices across a mix of corporate, public, and home networks.
Companies, large or small, need to define, deploy and enforce context based security policies for differentiated access. The ‘context’ needs to be multi-dimensional: who (type of user), what (device and application), when (time-of-day), where (location), and how (network type). IT departments also need deeper application visibility and control to detect and protect against network abuse. Finally, IT teams also need to simplify security deployment, for example, transition from device based security to role-based security.
2. Your network is too complex
Every IT department is being asked to do more with less, complexity is multiplying with more devices, more applications and more traffic on the network. New technology is available to help simplify things and IT teams are now looking to network automation for simplicity, business agility and lower total operational cost (TCO).
New switches are available to help simplify the infrastructure with capabilities like:
- Programmability, to simplify the programming of the network
- Unified Access, to simplify policy enforcement
- Instant Access, to streamline deployment, on-boarding and wired-wireless convergence
3. Security is now more important than ever
Security is top of mind for companies due to BYOD, regulatory compliance, and increased network attacks. IT Directors often have dedicated budgets to address security and compliance challenges.
The transition from device-based security to context-based security requires upgrades to switches with advanced security features. Consider the newer switches that support advanced security features required for industry-specific compliance standards.
4. Your network can’t scale to meet growing demands
An average user now has three times more devices due to BYOD and mobility. A company of 1,000 users seems like a company of 3,000 users. Devices like sensors, CCTVs, and building automation are being connected to the network.
802.11ac mobile devices create three times more bandwidth demand than 802.11n on campus and branch infrastructure across access and backbone. Similarly, high-density 802.11n devices create more bandwidth demand than 802.11a/b/g. And, an average mobile device creates 500 Mb to 1Gb background traffic per month due to operating system and app updates and backups. Growth in video traffic is also driving bandwidth growth.
Current networks cannot sustainably handle the exponential growth of devices and applications without upgrading to newer higher performing switches.
Please contact us to discuss how to refresh your ageing network infrastructure.