The caveats to cloud security

Is cloud risk management a done job once a business has migrated into the cloud?

Aside from cost and the ability to upscale, one of the most compelling cases for a business to move to the cloud is security. Cloud service providers (CSPs) have the scale and resources necessary for the implementation of robust cyber-security systems, quick threat detection and effective incident response, so the argument goes.

A recent security breach of Microsoft Exchange Servers demonstrates rather convincingly the enormous threats potentially lurking behind on-premises software. The perpetrators, most likely hacker group Hafnium, supposedly financed by the Chinese state, first gained access to the servers either via stolen passwords or – taking advantage of vulnerabilities – disguising themselves as someone who has access.

The hackers then created a so-called web shell, a small piece of malicious code implanted on web servers to provide themselves with remote access and control to the server from a web browser. As this breach is unfolding practically in front of cyber-security experts’ eyes, the full extent of the damage is still hard to assess. What is certain is that the perpetrators have exfiltrated strategic data from infectious disease researchers, defence contractors and institutions of higher education, among others.

For many businesses, the attack by Hafnium serves as a wake-up call to finally move their servers from on-premises into the cloud – a decision that may not have made business sense up until a few years ago, but which – in the light of increasing risks of getting hacked – does now.

But rather than a remedy, the move to the cloud was a cause for trouble in the case of American bank Capital One. News of the company having moved all its operations into the AWS public cloud came in November 2020. The migration process took eight years to complete and suffered a major setback in 2019. In this case, no hacker groups were involved. A former AWS employee, allegedly without any insider knowledge, single-handedly found a vulnerability on Capital One’s firewall protecting access passwords and got hold of a treasure trove of personal data belonging to the bank’s 106 million

Misconfiguration and IAM flaws

The incident is a textbook case of what may go wrong with cloud deployments when a CSP’s customers don’t have continuous visibility and control of their operation in the cloud.

As uptake grows, the cloud is becoming an increasingly complex environment, where configuration ensures that all the assets a business has deployed operate securely and at an optimum level.

Misconfigurations, such as default passwords, out-of-use and forgotten about apps and excessive access permissions, are all conduits to hacks and breaches. It was the open-source misconfigured Capital One application firewall that the hacker exploited to steal critical passwords. The next point of failure was that the web application firewall (WAF) had excess privileges that it was never meant to, thus enabling the hacker to access data and exfiltrate information.

Capital One conceded that it was responsible for the breach, while AWS insisted that its underlying cloud technology played no part in the incident. But as Raef Meeuwisse, cyber-security expert and writer points out, “root cause analysis of widely-known cyber-security losses has repeatedly shown that mega-breaches can only occur when three or more critical or major security controls that should be in place are either missing or inadequate.”

Server-side request forgery (SSRF)

Although it hasn’t made it yet to the Top 10 OWASP Web Application Security Risks, SSRF flashes up ever more frequently on cyber-security experts’ radar, and has played a role in both the Capital One and the Microsoft incident. Relying on SSRF, the hacker could abuse the functionality of Capital One’s application server, getting it to access and clone information (security credentials) in the server’s realm, which they directly wouldn’t have been able to. In other words, the hacker’s external request for sensitive personal data was manipulated so it resembled an authorised internal request coming from the local machine itself.

SSRF had already been a well-known vulnerability before the Capital One incident. Andy Wyatt, security expert and writer, has labelled it an AWS feature, not a bug, in the wake of the breach. Although Microsoft and Google had already integrated protections against SSRF into their products in 2018, Amazon only followed suit in November 2019, when it released IMDSv2, protecting every request with session authentication.

Data breaches and other cyber-security incidents have been putting pressure on CSPs to build extra layers of security and thus increase the depth of defence even in areas which contractually come under the cloud service user’s responsibility. How security responsibilities are shared varies with the different cloud service models, but as a rule of thumb, the CSP is responsible for the security of the cloud (whether a physical data centre, physical and perimeter network or virtualisation platform), while the user is always accountable for what is in the cloud, such as data, accounts, and identities, as well as for its devices. The responsibility for what lies between the two, such as applications and network controls, seem to result in the most finger-pointing in IaaS and PaaS arrangements.

Less splitting and more sharing of responsibility

There is a common perception that the way responsibilities are divided by CSPs and their customers is better described by splitting than sharing. On the other hand, even where providers go the extra mile and send alerts when detecting misconfigurations or gaps in firewalls, notifications often go unnoticed or ignored, while monitoring solutions fail to get enabled.

Automation and the use of AI may have the potential to square the circle. There are several start-ups, some of them already unicorns, whose business models are based on offering misconfiguration services, while others provide deeper visibility into cloud assets and their security posture. Paying for these services will naturally ramp up the costs of cloud deployments. But given the findings of Unit 42’s Cloud Threat Report, published in January 2021, that 65 per cent of all cloud security incidents are the result of customer misconfigurations, it’s money well spent.

As the problem doesn’t look like disappearing any time soon, CSPs, with vested interest in cloud security and uptake, may shortly try and integrate an automated multi-level misconfiguration detection service into their offerings. Until then, cloud service users need to keep reminding themselves that the public cloud is not safe by definition, and that cloud security is a dynamic and ongoing exercise.

---

Securing IoT in a 5G world: new approaches for innovation

5G promises to be a unified fabric that will connect virtually everything across our homes and businesses – but it presents both opportunities and challenges.

Cellular IoT’s ubiquitous connectivity is a key draw for engineering innovations across fast-growing markets such as infrastructure for more intelligent transport, smart consumer services, smart city devices and connected health. The adoption of 5G is going to significantly accelerate the deployment of these connected devices. But as with most disruptive new technology waves, 5G brings its own challenges that require designers to consider how they support new radio bands while balancing not making IoT device design too complex. Increasingly, the devices in question are low-power, long-lived in the field and low cost; afford low levels of physical access; and are deployed across further and remote locations.

Cellular IoT has long been the choice of secure, large-scale and resilient deployments due to the robust subscriber identity module (SIM) that authenticates a device. As our devices shrink, and as remote devices must endure a wider range of environmental conditions, securing the device’s identity requires new and broader solutions.

Every connected device will need to be updated at some point throughout its lifespan. One of the advantages of IoT devices is that they can receive software and firmware updates over the air. That said, the ability to only allow authorised updates is critical to ensuring the integrity of the device and the code running on it.

Scale is both the IoT’s most significant opportunity and hurdle. Manufacturers need to consider how they will manage and secure the device throughout an extended lifecycle – in the case of cars and even consumer devices, this includes an ‘after-sales’ business model to support the ability to repair, replace or decommission securely to be more sustainable.

Introducing the eSIM 

Embedded SIM (eSIM) technology is still a hardware-based SIM, but this elegant, robust and scalable technology is soldered permanently into the device and was designed to address some of the challenges impeding true scalability in cellular IoT. eSIM allows devices to be deployed anywhere with existing cellular coverage; operator profiles or network providers can be updated over the air, based on standards that offer a frictionless experience for device manufacturers and service operators.

iSIM builds upon eSIM 

But there’s more: an integrated SIM (iSIM) takes all the benefits of a standards-compliant eSIM and embeds them into the device’s permanent hardware array by combining the SIM with the system-on-a-chip architecture and cellular modem. Fusing the secure locations into the chipset itself offers a low footprint and introduces extra layers of security through a hardware-based secure enclave (a dedicated processor for security operations) that maintains the integrity of all cryptographic and key managed operations.

Security and scale go hand in hand

As the number of devices ramps up, the IoT attack vector will grow exponentially, and security cannot be an afterthought. IoT continues to move closer to core processes, and businesses should ensure that both devices (i.e. the endpoint itself) and data exchange (in technical terms, the chip-to-cloud security) have strong identity and trust foundations.

To achieve scale, businesses need simpler ways of manufacturing while being able to keep the robust security benefits derived from SIM capabilities. This has typically proven to be a challenge as new market needs for IoT are emerging. The fastest growth of eSIM and iSIM deployments is coming from markets that have not traditionally operated at the same cost points as the cellular or smartphone industry. Markets such as fleet management of e-bikes or e-scooters or connected health wearables did not exist in their current capabilities a few years ago.

Within these, businesses need simplification of both the bill of materials and that of the supply chain. iSIM fundamentally changes the way device makers can access cellular capabilities for devices that could not be served before. iSIM offers the highest protection for subscription credentials and isolates processing in a secure enclave. An additional authentication layer serves as a root of trust for secure communications while reducing the bill of materials.

One of the often-overlooked elements of security design is how trust is granted to a device and managed throughout its lifecycle. While trust is relatively easy to manage within a trust manufacturing environment, it is much more difficult once that device leaves the factory floor.

The GSMA standard IoT-SAFE iSIM supports the entire secure chip-to-cloud IoT infrastructure. It allows iSIMs to authenticate both connectivity and application credentials for any data being exchanged with any cloud over any cellular network by any device.

New opportunities

eSIM and iSIM are solutions to existing problems, but they also open up new opportunities for broader innovations. Artificial intelligence (AI) and machine learning (ML) have an increasingly important role to play in the IoT. The Economist Intelligence Unit reported in 2020 that 90 per cent of companies with extensive IoT deployments link their real-time data gathering with their AI planning. Companies with mature deployments can justify the traditionally high cost of incorporating AI and ML, as they had a demonstrable ROI from an existing deployment.

Luckily, that barrier to entry is being lowered today and we’re seeing the cost of leveraging these tools falling, broadening the types of diversity of devices that can be intelligent nodes across low-power, wide-area networks working together with mainstream 5G networks. Massive IoT will support the mainstay applications that we have come to envision with 5G, such as cellular-to-vehicle-to-everything (C-V2X).

The use cases are as broad as they are attractive. eSIM and iSIM are paving the way for centralisation of agricultural operations as smaller, less expensive tracking devices can be deployed in remote, extreme environments, and global logistics providers can track more assets in real-time with low-power secure modules that go for months between charges. The opportunities presented by cellular IoT underpinned by 5G are abundant. Herein is represented an unprecedented opportunity for collaboration across manufacturing, engineering, commerce and technology providers to ensure the 5G digital economy has security as its cornerstone.

---

by Vincent Korstanje, CEO, Kigen.

Visit kigen.com

Passing the test: precise exhaust systems quality control

Marko Grilc, Product Manager, InSpect Vision Systems, INEA

---

Concern about the environment is rapidly becoming the defining global trend of our lifetime. Because of that, every industrial sector is being challenged to keep its emissions to the minimum. And as EU authorities update the European emission standards for internal combustion vehicles to be stricter every few years, there is immense pressure on the automotive industry.

Producers of catalytic converters and diesel particulate filters (DPFs) are the most impacted in the supply chain. Their products are the ones that prevent harmful gases and particles from entering the atmosphere, so they need to continuously improve to keep up with the regulations. The production of these components is divided into the extrusion of ceramic monoliths, coating with a catalytic substrate, and “canning” into final exhaust system assemblies. The three links in the supply chain are aptly named extruders, coaters and canners.

Extruders, for instance, need to increase cell density; coaters have to adapt and evolve the washcoat; and canners are responsible for the flawlessness of the end product. The increase in R&D and continuous improvement investments are needed to keep up with the standards and avoid any unnecessary costs, not only those from product recalls and individual rejects, but also non-conforming batches being produced due to process issues. This is where efficient real-time quality control comes into play.

Today’s technology allows automated, continuous and precise inspection of every single catalytic converter/DPF multiple times throughout its manufacturing process. As each manufacturing stage is a complex high-precision process, the quality control also needs to be precise, but still robust enough to work without deviations in a rough industrial environment. It is almost like having laboratory equipment installed on the factory floor and running it at the speed of production cycle times.

INEA’s solution can inspect the surface of every individual cell with a surface area of less than 0.1mm². Since catalytic converters and DPFs work in fundamentally different ways, those cells need to either be clear in catalytic converters or sealed shut in DPFs. Possible plugged channels or optical leaks are checked for every cell, all while running the handling conveyors with speeds that can reach cycle times of under two seconds per product.

Because of the high cell density – 900 cells per square inch and more – the need arises to use a high-resolution line scan camera together with telecentric optics and special lighting. This provides a “through-and-through” image of the product and detection of any abnormalities, be it plugged cells or optical leaks. With size restrictions on the factory floor, the footprint of the machine is as small as it can be, but still large enough to accommodate various dimensions, from the smallest of products to the largest ones at 15-inch diameter and 70lb weight. The product handling system eliminates the vibrations that can occur during product transitions and the vision solution can then be used to its fullest extent.

Once the image of the product is acquired, it is processed by a series of software algorithms and the results are compared to the recipe set threshold values. The products are then flagged accordingly and either sent for further processing or quarantined. The detailed results, such as the number and location of plugged cells or leaks, are stored for further analysis so that the source of the issue can be quickly determined. This data can be used as a very effective warning system for process stages to be checked or adjusted.

As long as internal combustion vehicles dominate our highways, new methods will need to be adopted to reduce their negative impacts as much as possible. To help customers stay ahead, INEA is further developing existing approaches used in production-line vision applications. Their current emphasis is on 3D surface scanning, deep learning methods and X-ray technologies. Improvements in these areas will take the quality control one step forward and truly inspect the products inside and out.

---

For more information, click here.

Artificial intelligence must not be allowed to replace the imperfection of human empathy

At the heart of the development of AI appears to be a search for perfection. And it could be just as dangerous to humanity as the one that came from philosophical and pseudoscientific ideas of the 19th and early 20th centuries and led to the horrors of colonialism, world war and the Holocaust. Instead of a human ruling “master race”, we could end up with a machine one.

If this seems extreme, consider the anti-human perfectionism that is already central to the labour market. Here, AI technology is the next step in the premise of maximum productivity that replaced individual craftmanship with the factory production line. These massive changes in productivity and the way we work created opportunities and threats that are now set to be compounded by a “fourth industrial revolution” in which AI further replaces human workers.

Several recent research papers predict that, within a decade, automation will replace half of the current jobs. So, at least in this transition to a new digitised economy, many people will lose their livelihoods. Even if we assume that this new industrial revolution will engender a new workforce that is able to navigate and command this data-dominated world, we will still have to face major socioeconomic problems. The disruptions will be immense and need to be scrutinised.

The ultimate aim of AI, even narrow AI which handles very specific tasks, is to outdo and perfect every human cognitive function. Eventually, machine-learning systems may well be programmed to be better than humans at everything.

What they may never develop, however, is the human touch – empathy, love, hate or any of the other self-conscious emotions that make us human. That’s unless we ascribe these sentiments to them, which is what some of us are already doing with our “Alexas” and “Siris”.

Productivity vs. human touch

The obsession with perfection and “hyper-efficiency” has had a profound impact on human relations, even human reproduction, as people live their lives in cloistered, virtual realities of their own making. For instance, several US and China-based companies have produced robotic dolls that are selling out fast as substitute partners.

One man in China even married his cyber-doll, while a woman in France “married” a “robo-man”, advertising her love story as a form of “robo-sexuality” and campaigning to legalise her marriage. “I’m really and totally happy,” she said. “Our relationship will get better and better as technology evolves.” There seems to be high demand for robot wives and husbands all over the world.

In the perfectly productive world, humans would be accounted as worthless, certainly in terms of productivity but also in terms of our feeble humanity. Unless we jettison this perfectionist attitude towards life that positions productivity and “material growth” above sustainability and individual happiness, AI research could be another chain in the history of self-defeating human inventions.

Already we are witnessing discrimination in algorithmic calculations. Recently, a popular South Korean chatbot named Lee Luda was taken offline. “She” was modelled after the persona of a 20-year-old female university student and was removed from Facebook messenger after using hate speech towards LGBT people.

Meanwhile, automated weapons programmed to kill are carrying maxims such as “productivity” and “efficiency” into battle. As a result, war has become more sustainable. The proliferation of drone warfare is a very vivid example of these new forms of conflict. They create a virtual reality that is almost absent from our grasp.

But it would be comical to depict AI as an inevitable Orwellian nightmare of an army of super-intelligent “Terminators” whose mission is to erase the human race. Such dystopian predictions are too crude to capture the nitty gritty of artificial intelligence, and its impact on our everyday existence.

Societies can benefit from AI if it is developed with sustainable economic development and human security in mind. The confluence of power and AI which is pursuing, for example, systems of control and surveillance, should not substitute for the promise of a humanised AI that puts machine learning technology in the service of humans and not the other way around.

To that end, the AI-human interfaces that are quickly opening up in prisons, healthcare, government, social security and border control, for example, must be regulated to favour ethics and human security over institutional efficiency. The social sciences and humanities have a lot to say about such issues.

One thing to be cheerful about is the likelihood that AI will never be a substitute for human philosophy and intellectuality. To be a philosopher, after all, requires empathy, an understanding of humanity, and our innate emotions and motives. If we can programme our machines to understand such ethical standards, then AI research has the capacity to improve our lives which should be the ultimate aim of any technological advance.

But if AI research yields a new ideology centred around the notion of perfectionism and maximum productivity, then it will be a destructive force that will lead to more wars, more famines and more social and economic distress, especially for the poor. At this juncture of global history, this choice is still ours.

---

Arshin Adib-Moghaddam, Professor in Global Thought and Comparative Philosophies, SOAS, University of London

---

This article is republished from The Conversation under a Creative Commons license. Read the original article.

How your supply chain operation can engineer greater resilience, sustainability and value

The coronavirus pandemic has deeply impacted people in communities across the globe, sadly with significant loss of life. As the number of those recovering from the virus continues to grow, we also recognise that our world has been changed forever.

Getting basic provisions such as foods and medicines has been a major challenge for many people during the crisis, with many retailers struggling to top up their shelves and customers seemingly panic buying and stockpiling products, from paracetamol to toilet rolls.

Supporting customers and retailers throughout have been multiple groups of wholesalers, distributors, manufacturers and suppliers collaborating as players within global supply chains.

Supply chains are fascinating, dynamic and exciting – highly sophisticated, multi-layered, interconnected and interrelated distribution systems which enable companies and countries to balance supply and demand and trade more efficiently. Globally, supply chains have led a relatively settled existence for the last 50 years or so. All that is about to change, not least as a result of the crisis.

The pandemic closed many factories across the globe, as companies acted swiftly to protect the health and wellbeing of their workers and respond to rapid reductions in their inventory and massive disruption to their supply lines and logistics networks across international borders.

Some were able to maintain, and in some cases increase, production – notably some food manufacturers. Others were able to switch some of their production lines to satisfy emergency needs, such as the manufacture of life-saving products and components for ventilating machines, and personal protection equipment (PPE) for health and social care workers.

One excellent example of this was the instant supply chain created by Ventilator Challenge UK, a consortium of 21 manufacturing engineering and seven Formula 1 racing firms, led by the UK government-backed High Value Manufacturing Catapult, delivering 10,000 ventilating machines to the NHS.

Recovery from the crisis will not be instantaneous for supply chains, as individual players and businesses within the chain emerge from what may well be a sustained period of inactivity. Retaining staff and skills will be vital.

Something which will be of great interest to the government once the crisis is over is the propensity of UK firms and overseas investors, to “right-shore” (also referred to as “onshoring” or “reshoring”) back to the UK manufacturing operations that were previously located abroad. Bringing supply chains geographically closer could be a significant step in the race to rebuild resilience, reduce carbon footprints and potentially increase revenues for the treasury.

Back on the shop floor, however, what every proprietor and manager will want to know is what we have learned from all of this. Whether you are an original equipment manufacturer (OEM), or tier 1 or lower supplier to that OEM, you may well be wondering how you engineer greater resilience, sustainability and value for your business in the future.

Industry 4.0 (altertnatively describe as digital manufacturing or Supply Chain 4.0) provides a large part of the solution enabled by an array of technologies such as the internet of things (IoT), robotics and automation, machine learning, 3D printing, artificial intelligence (AI) and augmented reality (AR).

At the Institution of Engineering and Technology (IET), we believe passionately in the creation and management of supply chain ecosystems for global growth “bounce-back” in a post-coronavirus world, backed by strong and secure digital infrastructure and driven by data.

We describe such an ecosystem as a dynamic environment composed of different elements interacting collaboratively to always ensure flexibility, resilience, responsiveness, transparency and traceability.

Each connected node within the supply chain contributes to the growth of the whole system, fostering a virtuous loop of benefits for the supply chain. This can make supply chains both sensitive to change but also more resilient to change, so long as that has been factored into their design.

A toolbox of these digital technologies and capabilities can help the redesign of processes and operations to build greater resilience, thus enabling the supply chain ecosystem to better adapt to shortages and surges in the future, and be equipped to pivot quickly and smoothly.

It can connect all players within the ecosystem, providing instant and open visibility for all. For manufacturers, distributors and suppliers such visibility will be crucial in enabling where and how much stock and value resides within the supply chain and what the gaps are.

Data gathered from across the ecosystem may be analysed against agreed key performance indicators and shared among the players. Respecting the privacy of those players who require it is becoming ever easier to put into practice, with the increasing maturity and adoption of blockchain technologies. These offer new ways of permanently recording transactions within a secure peer-to-peer network.

Supply chains have struggled to balance flow and demand during the crisis. As part of their collective response, manufacturers, distributors and those within supply chains will be giving some thought as to how things can be improved for next time. (Here’s hoping there isn’t a next time!)

Even before this is all over, think about how you can make a once-and-for-all change to benefit your business. Consider and review your digital toolbox. Design stronger dynamic resilience in your supply chain ecosystem and seek out collaborative help and expertise to build it and test it out. After all, resilience and collaboration are the two words that will dominate our business vocabulary and thinking from here on in!

---

For more on our vision for the creation of supply chain ecosystem visit our website and download our report, Developing An Eco-system for Supply Chain Success.

For more on the Industry 4.0 technologies referred to in this article have a look at our earlier Business Reporter article, “How to make more time and money from your manufacturing operation”.

---

by John Patsavellas, Institution of Engineering and Technology  

Covid-19 has fuelled automation — but human involvement is still essential

The Covid-19 pandemic has disrupted the way we work and interact with machines — and people — in the workplace. The surge in remote working brought on by the pandemic has magnified the need for unmanned work operations. More automation, however, does not always make the workplace more efficient.

Industries that have heavily relied on manual operations, like warehouses or meat packers, are now introducing more automated or tele-operated systems. Unlike traditional, manually operated machines, in tele-operation the human operator sits in a remote location away from the machine they control.

Despite some of the unquestionable benefits of automation, however, these trends are in part an attempt to address the high rates of Covid-19 among factory workers.

Despite some of the unquestionable benefits of automation, however, simply adopting a technology-driven approach aimed at replacing all manual operations with robots is not a viable fix.

Human-machine interaction

For decades, what’s known as human factors, a discipline at the intersection of cognitive science, engineering and kinesiology, has investigated the human-machine interaction in the workplace, with the goal of understanding the benefits and unintended consequences of automation. Among the phenomena being investigated is what’s known as the paradox of automation.

The paradox of automation — also known as the paradox of technology — occurs when introducing automated system will add to, not reduce, the workload and responsibilities of the human operator.

This is because automated systems often require more knowledge, human supervision and intervention from the human operator whenever something goes wrong.

Case in point is airport security screening. This industry has undergone an automation revolution for many decades now. Yet data shows that the failure rate in this industry is still as high as 95 per cent. Why?

 

The answer to this question is less about the technology, and more about the fact that system developers too often ignore or overlook the human factor.

In other words, a technology-centred approach is adopted over a human-centred one.

Ignoring or undervaluing human factors in automation does not only make systems impossible to use but, more importantly, hinders safety.

Recognize boundaries

A solution to this is developing systems that help automate manually intensive operations, as well as account for known boundaries in human cognition like the inability to multi-task effectively or sustain attention on a given task for long periods of times.

Like many other innovations borne out of challenging times in human history, the push for more automation and tele-operation triggered by the Covid-19 pandemic must come with the promise of more efficient and safer workplace operations.

But instead of fully and solely relying on what’s technologically possible, system developers must put human beings at the centre of designing automation instead of relegating them to its periphery.

---

Francesco Biondi, Assistant Professor, Human Kinetics, University of Windsor

---

This article is republished from The Conversation under a Creative Commons license. Read the original article.