Can Security Be A Single Point Of Failure

RSS

The cloud is supposed to offer users a number of features including accessibility from almost anywhere. It, in theory, offers more storage and compute power than might normally be available if you have the electronic cash to pay for it. It is typically touted as being secure and there are any number of methodologies employed to make that true. Unfortunately there can be problems.

Microsoft’s issues with its Azure cloud services is just one example and this particular outage is different than what happened earlier with a portion of Amazon’s cloud services. In the latter case, it was a hardware issue. In Azure’s case, it was an expired SSL security certificate.

For those that don’t know, most web security is based on sets of keys and certificates that are used to encrypt and authenticate data. This prevents unwanted access and control of devices. The public key digital certificate system employs a hierarchical approach with root certificate authorities guaranteeing certificates they sign. If you trust the root then you should, in theory, trust certificates signed by the root or possibly anywhere down the chain. I won’t get into those details but essentially you can wind up with a certificate that lets your users know that communication with you will be secure.

The certificates also have an expiration date. There is also supposed to be a revocation list from a root that includes certificates that should expire prior to this date. Unfortunately, access to this list is not always possible and its update is typically something the root needs to handle. The expiration dates allow the system to work most of the time because someone must renew a certificate (actually they must a acquire a new certificate) before it expires.

What happened with Azure was its certificate expired before a new one was put in place with a later expiration date. Administrators could not access their applications. It was an administrative issue but it highlights a single point of failure within the system because the rest of Azure was based on it.

I’ve taken a few liberties on the explanation of the technology but in general it is an issue that everyone must be concerned with because these same techniques are employed with embedded and consumer applications. The same problem that Azure had can arise in other environments. This can have implications on features such as updates and even regular operation of a device Something that works today may not work tomorrow and determining why might be a challenge especially if the method of secure communication is the problem area.

Please or Register to post comments.

What's alt.embedded?

Blogs focusing on embedded, software and systems

Contributors

William Wong

Bill Wong covers Digital, Embedded, Systems and Software topics at Electronic Design. He writes a number of columns, including Lab Bench and alt.embedded, plus Bill's Workbench hands-on column....
Commentaries and Blogs
Guest Blogs
Dec 15, 2014
blog

Who Are You? (I Really Want to Know!) 4

Borrowing a stanza from The Who’s hit song seemed like a good way to bring attention to a critical topic often ignored by engineers. When finding information on a company that has an interesting product, what do we do? Of course, we look at its Web page to learn more....More
Dec 15, 2014
blog

Bridging Technical Communication Barriers Between Cultures

Understanding technical concepts in different languages can sometimes prove to be difficult, particularly when you have to communicate it. In this article, I discuss the challenges and possible courses of action....More
Dec 1, 2014
blog

Programming Efficiency 7

When I started college, the Intel 4004 was being designed. The C programming language and UNIX operating system were being developed (unbeknownst to me). I did most of my programming in BASIC on an HP 2100 series mini-computer....More

Sponsored Introduction Continue on to (or wait seconds) ×