Skip to content

OpenTelemetry: A modern observability standard

Blog thumbnail 2022 11 24 2

OpenTelemetry

Please check out our first article on observability to gain a fuller context for the topic we’re about to discuss. OpenTelemetry is currently the most actively developed standard in the field of observability. It is being adopted as the Cloud Native Computing Foundation incubating project. Born primarily as a merging of former OpenTracing and OpenCensus standards, OpenTelemetry continues to gain popularity, with its supporters including representatives of Google, Microsoft, and Uber.

The goal of the OpenTelemetry project is to introduce a standardized open solution for any development team to enable a proper observability layer in its project. OpenTelemetry provides a standard protocol description for metrics, tracing, and logging collection. It also collects APIs under its nest instrumentation for different target languages and data infrastructure components.

Below is a visualization of the overall scope of OpenTelemetry (credits to CNCF):

The development of specifications and all related implementations is being run in an open way in Github, so anyone involved can propose changes.

Different instrumentation implementations for different languages are in development. The current state of readiness can always be found on a related page of official documentation (for example, PHP).

Logs

Logs are the oldest and best-known type of telemetry signals, and they have a significant legacy. Log collection and storage is a well-understood task, with many solutions being established and widely adopted to carry it out. For example, the infamous ELK (or EFK) stack, Splunk, and Grafana Labs recently introduced the Loki project, a lighter alternative to ElasticSearch.

The main problem is that logs are not integrated with other telemetry signals – no solutions offer an option to correlate a log record with a relative metric or trace. Having the opportunity to do this can form a very powerful introspection framework.

OpenTelemetry specifications try to solve this problem with a logging format standard proposal. It allows correlating logs via execution context metadata, timing, or a log emitter source.

However, right now the standard is at an experimental stage and under heavy development, so we won’t focus on it here. The current specifications can be found here.

Metrics

As discussed previously, metrics are numeric data aggregates representing the software system’s performance. Through aggregation, we can develop a combination of measurements into exact statistics during a time window.

The OpenTelemetry metrics system is flexible. It was designed to be like this to cover the existing metric systems without any loss of functionality. As a result, a move to OpenTelemetry is less painful than other alternatives.

The OpenTelemetry standard defines three metrics models:

  • Event model — metric creation by a developer on the application level.

  • Stream model — metric transportation.

  • Time Series model — metric storage.

The metrics standard defines three metric transformations that can happen in between the Event and Stream models:

  • Temporal reaggregation reduces the number of high frequency metrics being transmitted by changing the resolution of the data.

  • Spatial reaggregation reduces the number of high frequency metrics being transmitted by removing some unwanted attributes and data.

  • Delta-to-cumulative reduces the size of high frequency metrics being transmitted via a move from absolute numbers (cumulative) to changes between different values (delta).

We will talk about the Stream and Time Series models in the third part of our blog series, where we will discuss signal transportation and storage. For now, let’s focus on the Event model, which is related to instrumentation.

 

 

The process of creation for every metric in OpenTelemetry consists of three steps:

  • Creation of instruments that will generate measurements – particular data points that we evaluate.

  • Aggregation of measurements into a View – a representation of a metric to output from the instrumented software system.

  • Metric output – the transportation metrics to storage using a push or pull model.

The OpenTelemetry measurements model defines six types:

  1. Counter – non-negative, continually increasing monotonic measurement that receives increments. For example, it may be a good fit for counting the overall number of requests the system has processed.

  2. UpDownCounter – the same as the Counter, but non-monotonic, allowing negative values. It may be a good fit for reporting the amount of requests being currently processed by the system.

  3. Histogram – multiple statistically relevant values distributed among a list of predefined buckets. For example, we may be interested not in particular response time but in the percentile of response time distribution, it falls into (a Histogram would be useful here).

  4. Asynchronous Counter – the same as the Counter, but values are emitted via a registered callback function, not a synchronous function call.

  5. Asynchronous UpDownCounter – the same as the UpDownCounter, but values are emitted via a registered callback function, not a synchronous function call.

  6. Asynchronous Gauge – a specific type for values that should be reported as is, not summed. For example, it may be a good fit for reporting the usage of multiple CPU cores – in this case, you will likely want to have the maximum (or average) CPU usage, not summed usage.

Through Aggregations in OpenTelemetry, measurements are being aggregated into end metric values that afterward will be transported to storage. OpenTelemetry defines the following measurements as Aggregations:

  • Drop – full ignore of all measurements.

  • Sum – a sum of measurements.

  • Last Value – only the last measurement value.

  • Explicit Bucket Histogram – a collection of measurements into buckets with explicitly predefined bounds.

  • Exponential Histogram (optional) – the same as the Explicit Bucket Histogram but with an exponential formula defining bucket bounds.

A developer can define their own aggregations, but in most cases, the default ones predefined for each type of measurement will suit the developer’s needs.

After all aggregations have been done, additional filtering or customization can be carried out on the View level. To summarize, an example of a simple metric creation is the following (in GoLang):

import “go.opentelemetry.io/otel/metric/instrument”
counter := Meter.SyncInt64().Counter(
“test.counter”,
instrument.WithUnit(“1”),
instrument.WithDescription(“Test Counter”),
)

// Synchronously increment the counter.
counter.Add(ctx, 1, attribute.String(“attribute_name”, “attribute_value”))

Here we create a simple metric consisting of one counter-measurement. As you can see, many details we discussed are hidden but can be exposed if the developer needs them.

In the next part of our blog series, we will talk about metrics transportation, storage, and visualization.

Traces and spans

As we discussed previously, traces represent an execution path inside a software system. The execution path itself is a series of operations. A unit of operation is represented in the form of a span. A span has a start time, duration, an operation name, and additional context attached to it. Spans are interconnected via context propagation and can be nested (one operation can consist of multiple smaller operations inside itself). The resulting hierarchical tree structure of spans represents the trace – an entire execution path inside a software system.

The internal span structure can be visualized like this:

Here is an example of the simplest span creation (in GoLang):

import “go.opentelemetry.io/otel/trace”

var tracer = otel.Tracer(“test_app”)

// Create a span
ctx, span := tracer.Start(ctx, “test-operation-name”,
trace.WithSpanKind(trace.SpanKindServer))

testOperation()

// Add attributes
if span.IsRecording() {
span.SetAttributes(
attribute.Int64(“test.key1”, 1),
attribute.String(“test.key2″,”2”),
)
}

// End the span
span.End()

Now we have our first trace.

A trace can be distributed through different software microservices. In this case, so as not to lose the interconnection, OpenTelemetry SDK can automatically propagate context through the network according to the protocol being used. One example is the W3C Trace Context HTTP headers definition. However, not all language SDKs support automatic context propagation, so you may have to instrument it manually depending on the language you use.

Detailed documentation about traces with format explanations can be found here.

Signal interconnections

The ability to interconnect different types of signals makes an observability framework powerful. For example, it allows you to identify a service response that took too long via metrics and, in one click, jump to the correlating trace of this response execution to identify what part of the system caused the slow processing.

Signals in OpenTelemetry can be interconnected in a couple of ways. One is the use of Exemplars – specific values supplied with trace, logs, and metrics. These consist of a particular record ID, time of observation, and optional filtered attributes specifically dedicated to allowing a direct connection between traces and metrics. Detailed documentation about Exemplars can be found here.

Another approach to signal interconnection is the association of the same metadata with the use of Baggage and Context. Baggage is a specific value supplied with traces, logs, and metrics that allows you to annotate it and consists of user-defined pairs of keys and values. By annotating corresponding metrics and traces with the same values in Baggage, the user can correlate them. Detailed documentation about Baggage can be found here.

Conclusion

We covered the pillars of OpenTelemetry and some details of application instrumentation. But we don’t just need to instrument our applications – we should also introduce tooling for the aggregation, storage, and visualization of the signals we supply. In the third part of this series, we will discuss tooling and the OpenTelemetry collector component in detail.

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About Nord Security
The web has become a chaotic space where safety and trust have been compromised by cybercrime and data protection issues. Therefore, our team has a global mission to shape a more trusted and peaceful online future for people everywhere.

How to Not Fall Victim to Browser Vulnerabilities

JumpCloud’s Universal Chrome Browser Patch Management

Browsers are the gateway to online productivity. 

Without them, we would not be able to get work done. To that end, they are also one of the biggest attack targets for bad actors. If we are not careful, and do not make a conscious effort to upkeep web browser security, hackers can easily exploit browser vulnerabilities. 

What makes browsers especially appealing to these individuals? Browsers access, collect, and hold lots of sensitive data — from personal credentials to company information — that cyber hackers can sell on the dark web and use to blackmail companies.

According to Atlas VPN, Google Chrome, the world’s most popular browser, has the highest number of reported (303) vulnerabilities year to date. Google Chrome also has a total of 3,159 cumulative vulnerabilities since its public release. 

In this article, we’ll dive into the topic of browser vulnerabilities, the importance of patch management, and how to streamline protection.

Atlas VPN top web browsers by vulnerability graph
Image courtesy of Atlas VPN

A Closer Look at Google Chrome’s Latest Vulnerabilities

On November 8, 2022, the Center for Internet Security (CIS) reported finding multiple vulnerabilities in Google Chrome. 

The most severe vulnerability within this group could potentially allow for arbitrary code execution in the context of the logged on user. What does that mean? 

Depending on a user’s privileges, an attacker could install programs and view, change, or delete data. The bad actor could even create new accounts with full user rights! 

Of course, users whose accounts have minimal user rights on the system would be less impacted than those with administrative user rights.

Multi-OS systems were affected, including:

  • Google Chrome versions prior to 107.0.5304.110 for Mac
  • Google Chrome versions prior to 107.0.5304.110 for Linux
  • Google Chrome versions prior to 107.0.5304.106/.107 for Windows

First and foremost, CIS recommends applying appropriate updates provided by Google to vulnerable systems immediately after appropriate testing. See here for all the other CIS recommended actions. 

The Need for Browser Patching 

Here are the key reasons you should regularly update or patch your browsers:

  • Enhance Security: Prevention of spyware, malware, and other viruses that could give someone access to your data or trick you into handing it over.
  • Improve Functionality: Outdated browsers might not work (well) or support new apps or software.
  • Boost User Experience: Older browsers usually do not support the latest and greatest code and will have trouble loading component files in the website. This might cause a website to freeze, crash or take forever to work.

For IT admins, security aspects are probably the most important reason to patch browsers. Keeping browsers updated with the latest version (i.e., downloading and installing all provided patches) goes a long way toward preventing cyber attacks and bad actors from exploiting known vulnerabilities. 

How to Create Default Chrome Browser Patch Policies

One of the easiest ways to stay on top of patches, and reduce browser vulnerability risk, is to use the JumpCloud Directory Platform. 

The latest capability addition to our Patch Management solution provides a universal policy to keep Google Chrome up to date for macOS, Windows, and Linux. 

A universal policy saves time by automatically scheduling and enforcing Chrome security patches on a large number of managed devices.

Screenshot of JumpCloud Policy Management Console 
JumpCloud Policy Management Console 

The platform’s four universal preconfigured default Chrome browser patch policies allow admins to deploy browser updates with different levels of urgency. Admins also have the option to configure a custom universal policy; this feature allows for easy modification of existing policy settings to tailor update experiences to organizational needs. 

The four JumpCloud default Chrome browser patch management policies control how and when a Chrome update is applied. The recommended deployment strategies include:

  • Day Zero: Deploy automated upgrades inside your IT Department the first day an update is available.
  • Early Adoption: Deploy automated upgrades to early adopters outside of IT.
  • General Adoption: Deploy automated upgrades to general users in your company.
  • Late Adoption: Deploy automated upgrades to remaining users in your company.

Once you have created a Chrome browser patch policy, you can assign it to any devices, policy groups, or device groups. A policy group helps quickly and efficiently roll out existing policies to large numbers of similar devices. 

Capabilities of JumpCloud Browser Patch Management

JumpCloud’s new Browser Patch Management also introduces the following features:

  • Enforce Chrome updates and browser relaunch. 
  • Enforce or disable Chrome Browser Sign In Settings.
  • Restrict sign-in to a regex pattern to ensure users sign in via company email accounts.
  • Automate device enrollment into Google Chrome Browser Cloud Management, which unlocks limitless capabilities for browser and extension control within the Google Admin console. 

Dive deeper into the new Universal Chrome Browser Patch Management Release by exploring the release notes for this feature in the JumpCloud Community. 

Learn More About JumpCloud

The good news? Browser patching and patch management are included in JumpCloud’s affordable A La Carte pricing package. 

Try JumpCloud for free for up to 10 devices and 10 users. 

Complimentary support is available 24×7 within the first 10 days of account creation.

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About JumpCloud
At JumpCloud, our mission is to build a world-class cloud directory. Not just the evolution of Active Directory to the cloud, but a reinvention of how modern IT teams get work done. The JumpCloud Directory Platform is a directory for your users, their IT resources, your fleet of devices, and the secure connections between them with full control, security, and visibility.

Migrate your VFE licenses to Google Cloud Storage to save thousands at renewal time

It’s that time of the year again.

No, not the holiday season. It’s nearly the start of Google’s financial year, and, with that, time for a lot of you to renew your Google Workspace licenses. This year though, you might get hit by an unexpected surprise. Umer Hamid, one of our dedicated Google Sales Architects at CloudM, explains why.
“Around this time of year, I find customers getting in touch with me in a panic. In January, they will be renewing their Google Workspace license, but this time, it’s going to cost thousands more. Why? Because they have a few hundred Vault Former Employee (VFE) licenses gathering dust. As Google phases out free VFE and replaces them with paid Archived User (AU) licenses, many businesses find $$$ added to their bill.”

Ouch!

Well, what can you do to beat the bill (or at least make a considerable dent in it), whilst keeping compliant with data retention rules and regulations? Especially when you have a lot of data to move, are short on time, and you are restricted by Google’s limit of allowing only 20 VFE licenses to be migrated at any one time? Don’t worry! Here is the approach that Umer has suggested to our customers that are also facing this daunting situation.

Step 1

Quite simply, use CloudM Migrate to move all the required data in bulk and at speed from Google Vault into your own Google Cloud Storage, completely owned and managed by you as part of your Google Cloud Platform. Instead of paying for individual AU licenses for every offboarded employee, you will only have to pay the data storage cost. With the VFE data export limit of 20 concurrent users in place, some businesses might struggle to move all of their suspended users to storage before the renewal deadline, but CloudM Migrate is one of the fastest and most reliable ways to chip away at the number of AU licenses you might need, significantly reducing the figure you will need to pay out.  

Step 2

Phew! It was close but you’ve managed to migrate all that data (or at least a significant chunk) before your renewal date. Now though, how do you make sure that you never have a large amount of expensive Google licenses sitting idle, and costing you money at renewal time, ever again? CloudM Archive comes to your rescue! All you need to do is configure CloudM Archive so that it can offboard data to your Google Cloud Storage buckets, and add the Archive step to your CloudM Automate Offboarding Workflows. When an employee leaves, their email and drive data will automatically be sent to whichever bucket you specify on the Workflow. Using CloudM Archive, your data is secure, easily searchable and instantly restorable, and will automatically be deleted as part of data retention policies so you always stay compliant.  

Read our Counting the (recurring) costs of AU licenses blog for a more in-depth look at how CloudM Archive continues to save you money and time, year in, year out.

If your Google Workspace license renewal is coming up quickly, and you want to avoid paying out for unnecessary AU licenses, the quicker you act, the more you will save. Umer and the team are on hand to help you so get in touch today.

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About CloudM
CloudM is an award-winning SaaS company whose humble beginnings in Manchester have grown into a global business in just a few short years.

Our team of tech-driven innovators have designed a SaaS data management platform for you to get the most from your digital workspace. Whether it’s Microsoft 365, Google Workspace or other SaaS applications, CloudM drives your business through a simple, easy-to-use interface, helping you to work smarter, not harder.

By automating time-consuming tasks like IT admin, onboarding & offboarding, archiving and migrations, the CloudM platform takes care of the day-to-day, allowing you to focus on the big picture.

With over 35,000 customers including the likes of Spotify, Netflix and Uber, our all-in-one platform is putting office life on auto-pilot, saving you time, stress and money.

Why Integrated Network Security Architecture is the Future

Integrated network security architecture is the design of a network to defend against cyber attacks. It is simply securing a network by integrating different security features. It is a systematic approach to designing and implementing a set of cybersecurity measures that are synergistic and mutually supportive to one another, to provide an increased level of protection.

With an integrated network security architecture, you can integrate multiple layers of protection into one cohesive system. This includes technologies, people, processes and policies. These layers work together to provide comprehensive protection for the company’s IT resources and data. It involves selecting hardware, software and services, their configuration and deployment, and how they are managed.

The security method is often referred to as the “defense-in-depth” approach. This means that it focuses on protecting data from a variety of different angles, as opposed to using just one single method. No wonder it has proven to be the most effective means of securing your network.

The three main layers of network security architecture are:

I. The Physical Layer

This includes everything from the cables and wireless antennas to the actual devices that make up your network. It is a form of perimeter protection that shields your network from wireless interference.

II. The Data Link Layer

This is where all data passes through on its way to being transmitted over the network. By default, this poses a vulnerable pathway requiring network and data protection.

III. The Network Layer

It is also referred to as endpoint protection because it is the last layer to ensure your network’s security.

Why is Integrated Network Security Architecture Important?

The integration of network security architecture is important as it helps to protect the network against cyber threats. It effectively provides a holistic view of the entire system, which is necessary for maintaining a secure and reliable network environment.

Network security is a vital part of any organization’s IT infrastructure. It is important to have an integrated network security architecture in place to protect the organization’s data and resources. This is especially crucial for organizations or even individuals that have data that they want to protect.

Four Proven Practices In Integrated Network Security Architecture

I. Perform a Threat Assessment of Your Organization’s Networks

A threat assessment is a process of identifying the potential threats to an organization and then determining how these threats might be realized. This would help to determine what measures to take to prevent it, thereby protecting your network and data.

Therefore, during any threat assessment, the first thing to do is to identify the assets in your organization. This aims to determine what would be at the risk in an attack. By putting yourself in the shoes of an attacker, you will be able to detect the assets that need to be protected.

The next step is to determine what type of threats might be present. It is important to know what kind of technology your company uses and how it might be vulnerable. Note that the major difference between threats and vulnerability is that threats are those who would want to cause harm, while vulnerabilities are weaknesses that the threats can exploit.

The last step is to develop a response plan for preventing, detecting, and responding to threats. This includes prioritizing the threats and vulnerabilities based on their level of severity and probability of occurrence.

When it comes to integrated network security architecture, threats can be categorized in two ways:

  • Technical Threats – A technical threat is when a system or network is compromised through a computer exploit or malware that disrupts its operations. This type involves exploiting security vulnerabilities in software or hardware to gain access to data and resources. Some common examples are; hacking, malware, denial of service attacks, etc.
  • Non-Technical Threats – This takes a more hands-on approach and can consist of things like insider fraud and theft of trade secrets.

II. Conduct a Business Impact Analysis

A business impact analysis is a process that can help an organization identify its risks and impacts related to network disruptions or attacks. It also helps businesses understand the vulnerabilities they might have.

It serves as a methodology that can be used to assess the impacts of disruption that might occur in the event of a cyber attack.. The analysis should be conducted by the risk management team, with input from other stakeholders within the organization.

The main objective of this analysis is to identify and prioritize risks and impacts, as well as to understand how an event will affect different parts of the organization. Analysis should also help in understanding how much time is required for recovery after a disruption or attack.

This type of analysis helps the business make decisions to mitigate its risks and impacts for the future. If an organization fully understands what would happen if there were network disruptions or attacks on their systems, it will help them understand the precise impact it might have on their business operations. Moreover, it could also prepare them for a scenario where events could happen more frequently in the future.

III. Develop a Strategy for Handling Security Incidents

Security incidents are occurring these days at an unprecedented rate. This includes any event that can negatively impact the confidentiality, integrity, or availability of an organization’s data.

It is important to have a strategy in place for how to handle them, which includes clear priorities, responsibilities, and procedures. Below is a tested incident response plan template or incident response process that you need to emulate.

IV. Assess the Severity of the Situation

When faced with a security threat, the first step is to assess the severity of the security incident and determine whether it needs to be handled by higher-level personnel or not.

If it does, they should be notified and assigned responsibility for handling the incident. If not, then a lower-level employee should take on responsibility for handling it themselves or with assistance from someone else who is available and qualified to do so.

Your assessment should follow this pattern:

  • Think about the threats that you are likely to face.
  • Make sure that your plan is flexible enough to adapt to new threats as they emerge.
  • Consider the need for interoperability with other networks, such as your partners’ networks, suppliers’ networks and customers’ networks, when designing your network architecture.
  • Determine the level of protection needed, and how much funding is available before designing your security architecture and plan.

Consider your business needs and how much risk you are willing to take on, your when designing your security architecture and plan so that these factors can be aligned.

Contain the Damage

The second priority in handling a security incident is to contain the damage. This includes notifying those who need to know, containing the spread of any virus or malware, and preventing future incidents. Depending on the type of breach, this may include initiating a forensic investigation or contacting law enforcement.

Your containment strategy should:

  • Properly segment networks with firewalls
  • Perform vulnerability assessments
  • Implement intrusion detection systems
  • Install antivirus protection on all devices
  • Use two-factor authentication for access to data and accounts
  • Protect endpoints with endpoint security solutions
  • Ensure that servers are patched and updated regularly
  • Encrypt sensitive data that is stored on the network or devices

Prevent Similar Future Attacks

The third priority when it comes to integrated network security architecture is to identify what happened and how it happened. This includes identifying who and what data was affected by the breach, if any other systems were compromised, and how to prevent similar future attacks.

Make sure that your prevention plan encompasses the two implementations below:

  • Develop an operational plan
  • Implement controls to address identified risks in the system design, physical architecture, logical architecture designs, and operational plans.

IV. Assign IT Staff to Identified Roles & Tasks

By having a dedicated IT security team, you can effectively delegate security roles and responsibilities to ensure quick detection and mitigation of present and future security threats.

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About Portnox
Portnox provides simple-to-deploy, operate and maintain network access control, security and visibility solutions. Portnox software can be deployed on-premises, as a cloud-delivered service, or in hybrid mode. It is agentless and vendor-agnostic, allowing organizations to maximize their existing network and cybersecurity investments. Hundreds of enterprises around the world rely on Portnox for network visibility, cybersecurity policy enforcement and regulatory compliance. The company has been recognized for its innovations by Info Security Products Guide, Cyber Security Excellence Awards, IoT Innovator Awards, Computing Security Awards, Best of Interop ITX and Cyber Defense Magazine. Portnox has offices in the U.S., Europe and Asia. For information visit http://www.portnox.com, and follow us on Twitter and LinkedIn.。

From Nuclear Bombs to Zero Days

For those faithful few who follow my posts here regularly, you’re aware that much of my recent writing has explored cybersecurity in the context of national security. I’ve looked at how several countries are developing their national cyber defenses, and how some other countries are going on the offensive, using cyber attacks to achieve geopolitical ends. I think the evolution of international relations and realpolitik into the digital realm is a fascinating subject that will alter some of our fundamental expectations about how power operates across the globe. And we’re just seeing the start. I don’t mean to sound excited – there’s plenty to be terrified about – but I’m certainly riveted, and I hope others are too.

Given my recent writing, a report from several weeks back immediately caught my attention. In Microsoft’s 2022 Digital Defense Report, China is accused of essentially stockpiling cyber vulnerabilities for potential use in future cyber attacks. Countries used to hoard bombs and bullets. Now they’re doing the same things with accelerants for cyber attacks. It’s an alarming development that, to my genuine chagrin, aligns exactly with what I’ve been harping on of late. Let’s take a closer look.

Turning Weaknesses Into Weapons

Most developed nations, the US included, have formal channels in place to report cyber vulnerabilities. China took that one step further through a series of laws passed in 2021. Those laws made it mandatory for network operators and hardware/software makers to report any vulnerability discovered to local officials. That wouldn’t seem all that unusual in a centrally controlled, risk-averse country like China. But the laws made an unusual stipulation: report vulnerabilities to local officials but not anyone else. Officials would have to give permission before the vulnerability was disclosed to the developer or the public at large.

Officials explained this stipulation as a way to strengthen China’s cyber defenses – they could use the vulnerabilities to harden themselves against attacks before someone had a chance to exploit them. But it did not take a military mind to see an alternate and opposite scenario as just as likely: China was using turning these vulnerabilities into cyber attacks before anyone else knew they were exposed.

The more cynical interpretation is given credence by the fact that hackers based in or supported by the Chinese government have proven especially proficient at exploiting zero day (unknown) vulnerabilities, especially in just the last six months according to Microsoft. One can easily guess why: the Chinese government is feeding them intelligence.

I would encourage anyone interested in the technical specs to reference the report, which explains the particular vulnerabilities that have been exploited by China-affiliated hackers. Also interesting are some of the targets of these attacks, including energy, telecommunications, and government systems throughout Southeast Asia. If the reports are true, China clearly sees cyber attacks based on undisclosed vulnerabilities as both potent tools in their digital arsenal and a way to exert their influence throughout the region (and beyond.)

A Different Kind of Arms Race

I should probably stress here that I don’t think what China is alleged to be doing is all that surprising. Like so many aspects of cybercrime and digital disruption, what we see isn’t something totally new and novel but rather a futuristic spin on long-running forms of crime and conflict. For all of history, groups have been searching for their enemy’s weak points and keeping quiet when they find something. We used to look for cracks in the fortress walls, now we look for misconfigurations in the cloud. It makes sense that China would incorporate this technique into its cyber strategy.


Which leads me to believe they’re not the only ones doing it. Other countries may not have laws on the books requiring people to report vulnerabilities. That said, they almost certainly have ways to discover and leverage vulnerabilities early and quietly. It would be glaring a oversight not to.


Predictable as all of this may be, I think the long-term consequences are much harder to surmise. Just one example: what will happen with zero day attacks once countries are racing to both find vulnerabilities and keep them out of public knowledge? There’s been an admirable and to some extent effective push to see zero days as a collective problem that we must address through transparency and information sharing – but seeing vulnerabilities as valuable weapons of war would seem to undermine that effort. Then what?


We won’t have to wait long for the answer, I suspect. The cyber saber-rattling has been ramping up for years now. And with the conflict in Ukraine making this a record-setting year for cyber attacks sponsored by nation-states…the gloves are coming off.

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About VRX
VRX is a consolidated vulnerability management platform that protects assets in real time. Its rich, integrated features efficiently pinpoint and remediate the largest risks to your cyber infrastructure. Resolve the most pressing threats with efficient automation features and precise contextual analysis.