mTLS - building machine to machine trust

What is mTLS? 

mTLS is also known as mutual TLS, after the ubiquitous security protocol. It is used in environments where machine-to-machine trust really matters.

Where in general is mTLS used? Where specifically is mTLS used? Did someone say "Kubernetes service mesh"? I think so! 

It's not generally used for public websites, but inside serious enterprise systems, it's a standard way to guarantee only authenticated services speak to each other.

Examples in modern infrastructure include: Kubernetes service meshes (Istio, Linkerd), API gateways, internal microservices, banking and trading and zero-trust networks.

Is mTLS a standard?

It's a section in TLS standard.

Root Certificates

In cryptography, a root certificate is a public key certificate that identifies a root certificate authority (CA).

Examples of certificate authorities (CAs) include SwissSign.

Root certificates are self-signed and forms the basis of an X.509-based public key infrastructure (PKI). Recall the X.509 is the ITU standard for defining the format of a public key certificate.

Worth reading also is RFC5280 which covers X.509 certificates and CRLs (certificate revocation lists).

The PEM Format

PEM (Privacy Enhanced Mail) is a format used for transmitting cryptographic keys, certificates and other data.  

PEM structure consists of a text file in Base64 encoded data format (a binary-to-text encoding consisting of 64 printable characters - the idea is you can push binary data into a communication channel that only supports text). Base64 is famous for its use in attachments, since SMTP in its original form was designed to support 7-bit ASCII characters only.

An alternative to PEM in Java contexts is DER (Distinguished Encoding Rules) used for X.509 certificates and private keys.

Python Debugging: "SSL Certificate Verification Failed"

Ever seen this:

RuntimeError: Failed to fetch (insert_dataset_of_choice) data: SSL Certificate Verification Failed

This may happen in code that was previoulsy working. It can be caused by outdated or missing CA certificates. 

GitHub's Agentic Workflows in the Crosshairs of GitLost

Noma Security has publicised GitLost, a technique to get GitHub Agentic Workflows to spill private repository data.

The exploit is aimed at organizations with both public and private GitHub repositories, and relies on prompt injection.

Specifically, it uses indirect prompt injection  where malicious instructions are injected into seemingly regular requests.

GitHub's Agentic Workflows introduce LLMs into GitHub Actions, which is how the exploit is enabled.

What is DNSSEC?

DNSSEC uses a cryptographic signature of DNS records to protect domains against forged DNS answers.

DNSSEC stands for Domain Name System Security Extensions, and comprises a suite of protocols to protect against DNS Spoofing, cache poisoning and man-in-the-middle attacks.

A scenario in layman's terms would be an attack that sends a user to a fake copy of your site. E-commerce and SaaS platforms in particular must take care to ensure they use DNSSEC for added protection.

DNSSEC can be skipped for very early stage projects where DNS server settings may change frequently.

Multi-signer DNSSEC is an additional way to implement DNNSEC. An RFC covers this (note that it is not an Internet Standard however), with contributors from Salesforce and Verisign.

Basics of NAT

NAT refers to Network Address Translation.

NAT allows multiple devices in a private network to access the Internet using a single, public IP address. This results in a number of benefits, one being conservation of IP addresses (relevant for IPv4) and hides internal systems for added security.

Routers perform NAT to relay information between connected devices and the public Internet.

The Weird World of OCSP Revocation Checks (Certificate Status)

OCSP, or Online Certificate Status Protocol, enables real-time verification (for clients like web browsers) of digital certificate validity (rather than use downloaded lists of revoked certificates, a la CRLs, or certificate revocation lists). 

It reduces overhead in validation (could be useful in real-time use cases e.g. transaction processing).

Statuses can be "good", "revoked" or "unknown".

Certificate Authorities (CAs) are mandated to track certificates they revoke.

whois under the hood (just basic TCP)

The whois protocol is a very basic TCP-based query-response protocol that gives information on domain names. Unfortunately, it is not installed by default in cmd.exe but is available in WSL. 

It works by opening a TCP connection (SYN, SYN+ACK), query sent, response sent and a close (FIN, FIN)- very basic indeed. It has no mechanism for indicating character set used, and there has been no effort to support internationalisation in that respect. Historically the predominant encoding used has been US-ASCII.

It has no security provisions. Mechanisms for access control, integrity and confidentiality are excluded.

rdap is a modern alternative to whois. RDAP stands for Registration Data Access Protocol.

Why Pre Shared Keys are not Wifi Passwords

It is tempting to think of wifi passwords as equivalent to Pre Shared Keys (PSKs) used in authenticating wifi connections.  In fact, the wifi password is combined with the SSID (Service Set Identifier) of the wifi network to produce a 256-bit cryptographic key.

The Pre Shared Key model is not ideal for enterprise deployments, as anyone who knows the password can decrypt traffic, if they capture the handshake. IoT devices using Pre Shared Keys are also not secure where keys are leaked in plaintext logs. This is why there is a separate WPA2-Enterprise that abandons the PSK model.

WPA3-Personal replaced PSK with SAE (Simultaneous Authentication of Equals) to enhance security, adding a principle of forward security, by introducing unique keys for every session.

Protecting RAM

Attacks on RAM are one of the arguments to better protect data in use.

There are various security attacks on RAM. One is malware that can scrape memory e.g. for plaintext credit card numbers (once read into RAM prior to encryption).  Modern systems aim to encrypt data as early as possible in the processing pipeline.

Privileged operators (e.g. cloud admins) can peek into RAM. This is why confidential VMs isolate memory to hide data-in-use from cloud providers. 

DMA devices such as Thunderbolt peripherals can read system memory (and hence potentially sensitive data, from RAM). Modern operating systems restrict "hot-plug" DMA access.

Note: this list of compromise attacks is non-exhaustive. This is a big field of operations.

Windows Baseline Security

Windows Baseline Security is something new for the Age of AI Agents.

The AI Agent Prevention Society

One of the obstacles to AI agents becoming all powerful is the technology infrastructure that actively seeks to obstruct agents.

This technology has various names, one being WAF, or web application firewall.  

The purpose of a WAF is to stop web applications from common attacks. 

Recall the OWASP Top Ten Risks? Some of the motivation behind these protections are good - for example, guarding against bot-driven DDoS attacks.

There are various vendors and products in this space; such as Imperva WAF, Cloudflare, Akamai Site Defender, AWS WAF, Azure Web Application Firewall and Google Cloud Armor.

These solutions are all effective at detecting and blocking agents, headless browsers, scrapers, credential stuffing bots (where leaked usernames and passwords are used across numerous websites to exploit potential duplication) and automated (even if legitimate) login attempts.

Action taken could range from limiting requests based on IP, presenting CAPTCHA challenges and blocking certain geographies.  However, these actions may prevent legitimate bots from using required services, or performing agentic actions on behalf of legitimate users.

Immutable Github Releases

Some software is distributed as immutable Github releases (this is for software supply chain security). One such example is Inno Setup.

Using ssh-keygen from WSL to generate an SSH key

SSH keys are useful to enable access to networked resources.  

The command ssh-keygen (the OpenSSH authentication key utilit) can be used to generate keys.

Example usage:  ssh-keygen -t ed25519 -C "myemail@mydomain.com".  

The -t option signifies type, and ed25519 refers to the algorithm based on Elliptic Curve Cryptography using an Edwards curve (the recommended default - it competes with RSA which is needed for compatibility with older systems). The -C flag provides a new comment. 

What gets generated is actually a pair of keys, a private key (stored locally) and a public key (stored on the server, but reference copy is typically stored locally too, in your .ssh directory).  It is an asymmetric authentication (not encryption) protocol.

info ssh-keygen will help you decode other command line options for generating keys.

The generated keys are stored in ~/.ssh.

Managed HSM as a secure key storage option in Azure

Managed HSM (Hardware Security Module) is when you need the highest level of key protection in Azure. 

FIPS 140-3 Level 3 hardware is utilised.  

These are stringent security requirements set by NIST. They include: physical security through hardened enclosure and tamper-evident seals and active tamper-detection. The tamper detection includes detection of physical intrusion, temperature and voltage anomalies.

Azure Key Vault

Azure Key Vault can store keys (e.g. API keys) securely which can then be retrieved by applications at runtime. Passwords and certificates can also be stored in the vault.

Objects in the vault are uniquely identified by a case-insensitive identifier called the object identifier. It has a prefix identifying the key vault, object type, user-provided object name, and object version. 

The key vault section starts with https://{vault-name}.vault.azure.net or https://{hsm-name}.managedhsm.azure.net, for Managed HSM Pools.

Object types are "keys", "secrets" or "certificates". 

Object name must be unique within the key vault. Only digits, letters and dashes are allowed in the object name. The object name must be between 1-127 characters. 

Deployment Toolkit (MDT) Support Removed - Try Windows Autopilot

Microsoft has removed support for its legacy enterprise deployment toolkit known as MDT (Microsoft Deployment Toolkit). 

This means no more updates (including for future versions of Windows) or security patches. 

Microsoft have recommended Windows Autopilot for cloud based deployment, or Configuration Manager operating system deployment (OSD) for on-prem infrastructure requirements, as alternatives.

Autopilot can be used to deploy Windows PCs as well as Hololens 2.

Fans lament that MDT was free and did not force Azure cloud adoption.

What is SASE?

SASE is Secure Access Service Edge, which delivers networking and security through a cloud service.

Risk Managing WSL

If you are manager of desktops and need to understand WSL risks, here is a summary.

WSL allows users root access inside their Linux instance with ability to install a host of useful software including compilers, packages etc. Linux binaries may be run which Windows Defender may not fully inspect.

However, users have no admin rights on Windows itself.

There are a number of risks which include unmonitored code execution and running unvetted network services as well as bringing unmanaged Linux tooling into the Windows estate.

It can be managed, but adds an additional complexity layer.

There is some degree of isolation between WSL and Windows but not completely. File systems are mutually accessible (from WSL, access Windows directories via /mnt/c, for example).

Note that Windows Defender scans WSL files.