Can Security Be A Single Point Of Failure

RSS

The cloud is supposed to offer users a number of features including accessibility from almost anywhere. It, in theory, offers more storage and compute power than might normally be available if you have the electronic cash to pay for it. It is typically touted as being secure and there are any number of methodologies employed to make that true. Unfortunately there can be problems.

Microsoft’s issues with its Azure cloud services is just one example and this particular outage is different than what happened earlier with a portion of Amazon’s cloud services. In the latter case, it was a hardware issue. In Azure’s case, it was an expired SSL security certificate.

For those that don’t know, most web security is based on sets of keys and certificates that are used to encrypt and authenticate data. This prevents unwanted access and control of devices. The public key digital certificate system employs a hierarchical approach with root certificate authorities guaranteeing certificates they sign. If you trust the root then you should, in theory, trust certificates signed by the root or possibly anywhere down the chain. I won’t get into those details but essentially you can wind up with a certificate that lets your users know that communication with you will be secure.

The certificates also have an expiration date. There is also supposed to be a revocation list from a root that includes certificates that should expire prior to this date. Unfortunately, access to this list is not always possible and its update is typically something the root needs to handle. The expiration dates allow the system to work most of the time because someone must renew a certificate (actually they must a acquire a new certificate) before it expires.

What happened with Azure was its certificate expired before a new one was put in place with a later expiration date. Administrators could not access their applications. It was an administrative issue but it highlights a single point of failure within the system because the rest of Azure was based on it.

I’ve taken a few liberties on the explanation of the technology but in general it is an issue that everyone must be concerned with because these same techniques are employed with embedded and consumer applications. The same problem that Azure had can arise in other environments. This can have implications on features such as updates and even regular operation of a device Something that works today may not work tomorrow and determining why might be a challenge especially if the method of secure communication is the problem area.

Please or Register to post comments.

What's alt.embedded?

Blogs focusing on embedded, software and systems

Contributors

William Wong

Bill Wong covers Digital, Embedded, Systems and Software topics at Electronic Design. He writes a number of columns, including Lab Bench and alt.embedded, plus Bill's Workbench hands-on column....
Commentaries and Blogs
Guest Blogs
Aug 11, 2015
Commentary

Proof-of-Concept Prototypes versus Manufacturing Design Preparations 3

I have designed many early-stage proof-of-concept (POC) circuits, and observed many others do the same thing. It seems that there is often a huge disconnect between clients and engineers, though, when it comes to the goals of a POC design. In simple terms, an engineer worth his salt will overdesign an early POC circuit. This is because Murphy’s law always applies, and POCs are about overcoming unknowns. By overdesigning the circuit, one is able to prove the client’s product POC can be made to work, and quickly....More
Aug 4, 2015
blog

Inconspicuous Pitfalls in Datasheet Analysis

Identifying the limitations of a datasheet saves lots of time, and cost, in terms of troubleshooting and redesigning circuits....More
Jun 30, 2015
Commentary

Four-Wire Sensing Can Make or Break Your Measurements 7

Erroneously implementing four-wire sensing into a measurement instrument can be disastrous, so it becomes critical to have a firm grasp of how sense lines function....More

Sponsored Introduction Continue on to (or wait seconds) ×