The Great American Betrayal: How H1-B and F1 Visas Enabled $600 Billion Wealth Transfer While Handing Critical Infrastructure to Foreign Adversaries

The $100,000 annual fee President Trump imposed on H1-B visas represents the most aggressive attempt yet to address a program that has systematically transferred hundreds of billions of dollars in American wages to foreign workers while displacing millions of US employees. The policy, which took effect September 21, 2025, finally puts a real cost on what has become one of the largest wealth transfer schemes in American history — but the fees are insufficient and miss the broader F1-H1-B pipeline that has created America’s greatest national security vulnerability.

Note: The $100,000 fee applies to the initial 3-year H1-B visa application, not an annual payment.

PART I: THE CASE — THE SCALE OF THE BETRAYAL

Executive Summary: America’s Greatest Strategic Vulnerability

On Friday evening, September 19, 2025, President Trump signed a proclamation that fundamentally altered the H1-B visa landscape¹. The new $100,000 fee — described by the White House as targeting companies that “spam the system and drive down wages” — comes after decades of documented abuse that has displaced American workers while funneling tens of billions annually to India and China through below-market wages and remittances.

The timing reflects growing evidence of the program’s transformation from addressing skill shortages to enabling systematic worker replacement. As Trump’s proclamation noted, unemployment in computer occupations jumped from 1.98% in 2019 to 3.02% in 2025, even as companies laid off 85,000 American workers while hiring 34,000 new H1-B workers in 2022 alone².

However, the H1-B program represents only half the problem. When combined with 1.6 million F1 student visa holders, America currently hosts 2.2 million foreign nationals in strategic educational and employment positions, creating the largest peacetime transfer of strategic capabilities in American history.

The National Security Catastrophe: Foreign Control of America’s Digital Defense

CRITICAL ALERT: 81% of cybersecurity functions are outsourced — the highest outsourcing rate of any technology sector. This represents the most dangerous transfer of national security capabilities in American history.

The scale of combined F1-H1-B dependency extends far beyond economic displacement to pose an existential national security threat. With approximately 600,000 H1-B workers and 1.6 million F1 students currently in the United States, the vast majority concentrated in critical technology sectors, America has essentially handed control of its digital infrastructure to foreign nationals who maintain primary loyalty to their home countries.

The Complete Foreign Workforce Analysis: 2.2 Million Strategic Positions

When combined with the 1.6 million F1 student visa holders, America currently hosts 2.2 million foreign nationals in strategic educational and employment positions, with the vast majority from India (73% of H1-B, 29.4% of F1) and China (12% of H1-B, 24.6% of F1).

The F1-to-H1-B Pipeline:

• 896,000 F1 students in STEM fields (56% of all international students)
• 95,384 students on STEM OPT gaining work experience
• ~65,000 new H1-B positions approved annually (mostly STEM)
• ~600,000 total H1-B workers currently employed

This creates a systematic 6–10 year pathway from foreign university training directly into America’s most critical technology positions.

H1-B Workers Control Critical Infrastructure

The cybersecurity workforce employs approximately 182,800 information security analysts according to the Bureau of Labor Statistics, but 81% of cybersecurity functions are outsourced — meaning foreign workers control America’s digital defense systems. With 3.5 million unfilled cybersecurity positions globally, this dependency has created a national security emergency where:

• Foreign nationals design America’s cybersecurity protocols
• Hostile nation citizens control access to critical infrastructure
• America’s digital defense strategies are visible to adversaries
• Cybersecurity incident response is managed by foreign entities

Complete H1-B Worker Distribution by Security Risk (Total: ~600,000 workers)

🔴 CRITICAL NATIONAL SECURITY POSITIONS (77,340 workers — 12.9%)

🟡 HIGH NATIONAL SECURITY RISK POSITIONS (186,420 workers — 31.1%)

CRITICAL FINDING: 263,760 H1-B workers (44.0%) occupy CRITICAL to HIGH national security risk positions, with direct access to America’s most sensitive technology infrastructure.

F1 Student Distribution by National Security Criticality (Total: ~1.6 million students)

CRITICAL FINDING: 661,150 F1 students (41.3% of all international students) are studying in fields with CRITICAL to HIGH national security implications, primarily from India and China.

The AI Infiltration Crisis: Foreign Control of America’s Most Strategic Technology

Beyond cybersecurity vulnerabilities lies an even more insidious threat: the systematic foreign penetration of America’s artificial intelligence infrastructure. With AI becoming the defining technology of the 21st century — projected to contribute $15.7 trillion to the global economy by 2035 — America’s dependence on foreign workers in this critical sector represents the transfer of our most strategic technological advantage.

Combined AI/ML Pipeline Analysis:

• 32,800 F1 students in AI/Machine Learning (2.1% of all international students)
• 189,750 F1 students in Computer Science (11.9% of all international students)
• 24,500 H1-B workers in AI/ML roles (4.1% of all H1-B workers)
• 27,875 H1-B Software Engineers (many in AI-adjacent roles)

Total AI-Related Foreign Nationals: ~275,000

This represents 37% of America’s estimated AI engineering workforce, with the vast majority from countries with documented histories of intellectual property theft and strategic competition with the United States.

Major Tech Companies’ AI Vulnerability:

The implications are catastrophic: foreign nationals from strategic competitor countries control significant portions of America’s AI development, from algorithm architecture to training data access to deployment strategies.

The $600 Billion Wealth Transfer: Economic Warfare Through Legal Channels

Annual Wealth Transfer Breakdown:

The scale of wealth transfer through combined F1-H1-B programs becomes clear when examining multiple economic flows:

Direct Remittances:

• $35 billion annually to India from H1-B workers (28% of India’s $125B total)
• $50 billion annually to China from all sources (significant H1-B portion)
• $85+ billion total in direct remittances from foreign workers

Wage Suppression:

• 83% of H1-B positions certified at below-median wages
• Level 1 workers earn 17% below market rates
• Level 2 workers earn 34% below market rates
• $15–25 billion annually in suppressed American wages

Educational Revenue:

• $43.8 billion annually from F1 students to American universities
• Creates institutional dependency on foreign students
• Subsidizes foreign access to cutting-edge research

Intellectual Property Theft:

• $225–600 billion annually in documented IP theft (mostly China)
• H1-B and F1 workers provide legal access to facilitate systematic theft
• Technology transfer through academic and corporate networks

Total Economic Impact: $600+ Billion Annually

The Foreign Education Subsidy Advantage

A critical dimension involves the unfair competitive advantage foreign nationals receive through government-subsidized education and additional taxpayer subsidies through FICA tax exemptions:

Educational Cost Comparison:

• Indian technical institutes (IITs): $1,000–3,000 annually
• Chinese universities: Near-free engineering education for citizens
• American universities: $50,000–80,000 annually for equivalent programs
• American student debt burden: $37,000 average, up to $100,000+ for advanced degrees

Hidden Taxpayer Subsidy Through FICA Tax Exemptions: F1 students provide companies with a 15.3% total cost advantage over hiring American workers through Social Security and Medicare tax exemptions:

• F1 visa holders are EXEMPT from FICA taxes (Social Security and Medicare) for their first 5 calendar years in the US
• Companies save 7.65% in employer FICA contributions (6.2% Social Security + 1.45% Medicare)
• Students save 7.65% in employee FICA contributions, making them willing to accept lower wages
• Total advantage: 15.3% cost reduction compared to hiring American workers
• Duration: Up to 5 years, covering most degree programs plus OPT periods

H1-B Workers Pay Full FICA Taxes:

• H1-B visa holders are REQUIRED to pay FICA taxes same as US citizens (15.3% total)
• No exemptions available based on H1-B visa status
• Immediate transition: When F1 students change to H1-B status, FICA taxes begin immediately

The F1-to-H1-B Tax Arbitrage: This creates a systematic 10-year cost advantage for foreign nationals:

1. Years 1–5: F1 status with 15.3% FICA tax exemption advantage
2. Years 6–10: H1-B status with 20–34% below-market wage advantage
3. American workers: Pay full FICA taxes from day one AND face wage suppression from foreign competition

Taxpayer Subsidization of Foreign Worker Preference: This system forces American taxpayers to subsidize companies’ preference for foreign workers:

• Social Security and Medicare programs receive less funding due to F1 exemptions
• American workers pay higher relative tax rates while competing against tax-exempt foreign workers
• Companies receive taxpayer-funded cost advantages for choosing foreign over American workers
• Educational institutions become dependent on international student revenue while displacing American students

This creates systematic competitive disadvantage where debt-free, tax-exempt foreign workers can underbid American workers who must service educational debt while paying full tax rates from the start of their careers.

Corporate Giants’ Billion-Dollar Bills — But Fees Are Still Too Low

The immediate impact on major H1-B employers reveals both the program’s scale and the inadequacy of Trump’s proposed fees:

Top H1-B Employers Analysis:

🔴 CRITICAL POLICY FAILURE: $100K FEES INSUFFICIENT TO CHANGE BEHAVIOR

The harsh reality is that Trump’s $100,000 H1-B fee, while generating headlines, is insufficient to eliminate the systematic displacement of American workers. For major technology companies generating tens of billions in annual profits, these fees represent operational expenses rather than behavioral deterrents.

Critical Clarification: The $100,000 fee applies to the initial 3-year H1-B visa, making the effective annual cost only $33,333 per worker.

Economic Analysis Reveals Continued Profitability of Displacement:

Even with the $100K one-time fee, companies save money compared to paying correct American wages:

• Average H1-B underpayment: $34,890 annually per worker (20% below market rates)
• 3-year total savings from wage suppression: $104,670 per worker
• $100K visa fee: Still $4,670 cheaper than paying correct wages over 3 years
• Annual effective cost: Only $33,333 per year vs. $34,890 in annual wage savings
• Net result: Companies still save $1,557 annually per worker while continuing systematic displacement

Required Fee Levels for Genuine Reform:

• Minimum H1-B fee needed: $157,000 per 3-year visa (50% above wage suppression savings)
• Effective annual cost: $52,333 per year (above the $34,890 annual wage savings)
• Current proposed fee: $100,000 (insufficient by $57,000)
• F1 fee should be: $40,000 annually (currently proposed $25,000 too low)

Documented Displacement at Industrial Scale

Trump’s proclamation references specific examples of displacement: one software company approved for 5,000 H1-B workers while announcing 15,000 layoffs; another IT firm approved for 1,700 H1-B workers while laying off 2,400 Americans in Oregon.

These patterns echo documented cases from the 2010s. At Disney World in 2014, 250 IT workers spent their final 90 days training H1-B replacements from Indian consulting firms, with one displaced worker testifying to Congress: “Never in my life did I imagine that I could be sitting at my desk and somebody would be flown in from another country, sit at my same desk and chair, and take over what I was doing.”

The F1-to-Displacement Pipeline:

1. 281,675 F1 students in Computer Science (42% from India, 28% from China)
2. 95,384 students on STEM OPT gaining work experience at American companies
3. Transition to H1-B status for permanent displacement of American workers
4. Knowledge transfer to offshore operations in home countries

The Cybersecurity Crisis: Escalating Breaches Under Foreign Control

With 81% of cybersecurity functions outsourced to foreign nationals, America has experienced a dramatic escalation in cyber incidents coinciding with increased foreign workforce penetration in critical security roles.

Annual Cybersecurity Incidents vs. IP Theft Prosecutions (2014–2024)

Key Correlations:

• 400% increase in cyber incidents (2014–2021) coinciding with peak H1-B displacement
• IP theft prosecutions increased 688% (2014–2024) as foreign workforce expanded
• Major breaches increasingly involve foreign contractors with legitimate access

Documented Intellectual Property Theft: The $225–600 Billion Annual Heist

The FBI’s counterintelligence data reveals the true scope of technology transfer to hostile nations. FBI Director Christopher Wray reports the FBI opens a new Chinese counterintelligence investigation every 12 hours, with over 1,000 cases involving Chinese nationals.

Recent Major Cases:

• Google AI Technology Theft: Chinese Google engineer Linwei Ding charged with stealing 1,000+ files of AI technology, including TPU and GPU trade secrets
• Operation CuckooBees: Chinese APT 41 stole trillions in IP from 30 companies, including fighter jet blueprints and pharmaceutical formulas
• Academic-to-Corporate Pipeline: Multiple cases show F1 students transitioning to H1-B status while maintaining systematic technology transfer

The F1-H1-B Intelligence Network: The combination creates unprecedented intelligence collection opportunities:

• Academic research access through F1 status at top universities
• Corporate insider access through H1-B employment
• Long-term relationship building over 6–10 year periods
• Legal framework protecting information gathering activities

Congressional Recognition and Systematic Failure

Bipartisan congressional investigations between 2015–2017 documented extensive displacement, but failed to address the educational pipeline component. Representative Judy Chu stated: “Replacing American workers with temporary foreign workers for the purpose of driving wages down most definitely must not be the program’s intent.”

Despite overwhelming evidence — record fraud settlements, congressional testimony, extensive documentation — enforcement remained minimal, highlighting regulatory capture that market-based mechanisms must now circumvent.

PART II: THE SOLUTIONS — COMPREHENSIVE REFORM BLUEPRINT

Trump’s Fee Structure: Right Direction, Insufficient Scale

President Trump’s $100,000 H1-B fee represents recognition of the systematic abuse, but analysis reveals the fees are insufficient to change corporate behavior. Comprehensive reform requires both higher fees and structural changes to address the F1-H1-B pipeline.

Corrected Fee Structure for Behavioral Change:

H1-B Visa Fees:

• Current proposed: $100,000 per 3-year visa ($33,333 annually — insufficient)
• Required minimum: $157,000 per 3-year visa ($52,333 annually — above wage suppression savings)
• Recommended: $175,000 per 3-year visa ($58,333 annually — to ensure American workers are clearly more attractive)

F1 Visa Fees:

• Current proposed: $25,000 annually (too low)
• Required minimum: $40,000 annually
• For critical fields: $50,000 annually (AI, cybersecurity, quantum computing)

Combined Revenue Potential:

• H1-B fees: $14.9 billion every 3 years ($4.97 billion annually at corrected rates)
• F1 fees: $19.8 billion annually
• Total: $24.8 billion annually for American workforce development

Immediate National Security Measures

Emergency Security Reviews

All foreign nationals currently in CRITICAL positions must undergo immediate comprehensive background checks:

• Temporary suspension from critical systems during 30-day review
• FBI background investigation with polygraph examination
• Financial audit including international transfers and family contacts
• Communication monitoring of international contacts and social media
• Automatic termination if any security concerns identified
• No exceptions for length of service or past clearances

Mandatory Annual Security Review Requirements

🔴 CRITICAL POSITIONS (Annual FBI Background Check + Polygraph):

• All cybersecurity roles (analysts, engineers, architects)
• AI/ML development and research positions
• Critical infrastructure roles (power, water, transportation, finance)
• Defense contractor positions with security clearance
• Positions with access to classified or proprietary algorithms

🟡 HIGH-RISK POSITIONS (Annual FBI Background Check):

• Software engineering at major technology companies
• Database administrators with sensitive data access
• Cloud architects and DevOps engineers
• Network administrators and system engineers
• University research with defense funding

Background Check Requirements:

1. Foreign Contact Verification: All family, associates, professional contacts
2. Financial Audit: Bank accounts, investments, debt, money transfers
3. Communication Monitoring: Social media, messaging, international communications
4. Travel Pattern Analysis: All international travel and contacts made
5. Technology Access Logging: Systems accessed, data downloaded, information shared
6. Professional Network Mapping: Colleagues, mentors, associations in home countries

Structural Program Reforms

H1-B Program Overhaul

Automatic Visa Termination: H1-B visas automatically terminate after 36 months maximum, eliminating current six-year extensions that enable indefinite worker replacement.

Mandatory Job Market Testing: Companies must demonstrate genuine inability to fill positions by posting all H1-B jobs on USAJobs.gov for minimum 180 days before filing petitions.

Skills Training Requirements: Companies must demonstrate active, funded programs to train American workers for identical roles, with specific timelines, budgets, and measurable outcomes for transferring skills.

Prevailing Wage Reform: Mandate wages at 90th percentile of regional rates to eliminate underpayment advantages that make displacement profitable.

American Worker Priority: Companies must offer identical relocation packages and student loan repayment benefits to American workers in comparable positions.

F1 Program Restrictions

Duration Limits: F1 visas limited to three years maximum, eliminating indefinite education extensions that serve as backdoor immigration pathways.

Critical Field Restrictions: F1 students from strategic competitor nations face enrollment restrictions in:

• Artificial Intelligence and Machine Learning
• Cybersecurity and Information Security
• Quantum Computing and Advanced Physics
• Advanced Engineering with dual-use applications
• Computer Science with defense applications

Elimination of FICA Tax Arbitrage: Employers must pay the full 7.65% employer portion of FICA taxes for all F1 students regardless of student exemption status. This critical reform would:

• Eliminate the 7.65% employer cost advantage companies currently receive for hiring F1 students over Americans
• Remove economic incentive for systematic preference of foreign students in hiring decisions
• Generate additional Social Security/Medicare revenue to offset the impact of student exemptions
• Level the playing field between American workers and F1 students from an employer cost perspective
• Maintain student exemption for the employee portion while eliminating employer subsidy

Implementation: Companies employing F1 students must remit the full employer FICA contribution (7.65%) to the Treasury, with funds specifically allocated to Social Security and Medicare trust funds. This eliminates taxpayer subsidization of corporate hiring preferences while maintaining the student benefit.

University Accountability Requirements:

• Limit F1 enrollment from competitor nations to 10% per critical program
• Report all research collaborations with foreign entities
• Demonstrate American student priority in competitive programs
• Maintain technology transfer restrictions for international students

Enhanced Corporate Transparency

Mandatory SEC Reporting Requirements for All Publicly Listed Companies:

All publicly traded companies must provide quarterly SEC filings with the following detailed employment disclosures:

Core Employment Metrics (Via IRS W-2 Reporting):

• Total W-2 employees by unique SSN (no distinction between part-time/full-time)
• W-2 employees by citizenship status (US citizens vs. work authorization holders)
• H1-B visa holders by job category and average compensation
• Monthly workforce changes: Workers displaced, laid off, terminated, or hired

Economic Class Distribution Reporting: All public companies must disclose employee compensation distribution by economic class:

Government Assistance Recipients:

• Number of employees receiving Medicaid or other government-sponsored health insurance
• Number of employees receiving SNAP (Supplemental Nutrition Assistance Program/Food Stamps)
• Number of employees receiving Section 8 housing assistance or other housing subsidies
• Number of employees receiving WIC (Women, Infants, and Children nutrition program)
• Number of employees receiving TANF (Temporary Assistance for Needy Families)
• Number of employees receiving EITC (Earned Income Tax Credit)
• Number of employees receiving Childcare assistance or subsidies
• Number of employees receiving utility assistance programs
• Total employees receiving any form of government assistance (unduplicated count)
• Percentage of workforce requiring government assistance to meet basic needs
• Estimated annual taxpayer cost to subsidize underpaid workforce

Minimum Wage Workers:

• Number of employees at federal minimum wage ($7.25/hour or $15,080 annually)
• Number of employees at state/local minimum wage by jurisdiction
• Percentage of total workforce earning minimum wage rates

Living Wage Workers:

• Number of employees earning living wage (defined as sufficient to cover basic needs without government assistance)
• Living wage calculations by geographic region where employees work or reside
• Gap analysis showing employees below living wage thresholds

Middle Class Workers:

• Number of employees earning middle class wages (annual salary equal to 1/2 of median house price)
• Geographic calculation basis: National median house price OR zip code median where employee works/resides (for remote workers)
• Current thresholds:
• National: ~$220,000 annually (1/2 of ~$440,000 national median home price)
• By zip code: Varies by local housing markets (e.g., San Francisco ~$600K, Cleveland ~$85K)
• Middle class percentage of total workforce by location

High Earners:

• Number of employees earning $300,000-$500,000 annually including:
• Base salary in this range
• Total compensation (salary + bonuses) in this range
• Valued stock options/equity bringing total compensation into this range
• Number of employees earning $500,000-$750,000 annually (all compensation sources)
• Number of employees earning $750,000-$1,000,000 annually (all compensation sources)
• Number of employees earning $1,000,000-$2,000,000 annually (all compensation sources)
• Number of employees earning $2,000,000-$5,000,000 annually (all compensation sources)
• Number of employees earning over $5,000,000 annually (all compensation sources)
• Executive vs. non-executive breakdown for each compensation band
• Total high earners over $300,000 (unduplicated count across all bands)

America First Executive Compensation Requirements: For all publicly traded companies, CEO and C-Suite bonus compensation must be tied to America First performance metrics, not just financial profits:

Mandatory Bonus Criteria (Minimum 60% of total bonus calculation):

• American Job Creation: 25% of bonus tied to net increase in W-2 American citizen employees
• Living Wage Achievement: 20% of bonus tied to percentage of workforce earning living wage or higher
• Middle Class Job Creation: 15% of bonus tied to employees achieving middle-class compensation (½ of local median home price)

Bonus Penalties for Anti-American Practices:

• 10% bonus reduction for every 1% of workforce on government assistance programs
• 25% bonus reduction for any mass layoffs followed by H1-B hiring within 24 months
• 50% bonus reduction for offshoring jobs to foreign countries
• 100% bonus forfeiture for documented worker displacement schemes or systematic preference for foreign workers

Traditional Financial Metrics (Maximum 40% of bonus calculation):

• Profit margins, stock performance, revenue growth may comprise no more than 40% of total bonus structure

Public Disclosure Requirements:

• Quarterly reporting of all bonus calculation components and actual payments
• Detailed explanation of how America First metrics were achieved or missed
• Comparison with peer companies on worker compensation and citizenship ratios

The Boeing Lesson — Why Profit-Only Incentives Fail: Boeing’s executives received massive bonuses while:

• Cutting American engineering jobs and outsourcing to foreign contractors
• Prioritizing short-term profits over long-term safety and quality
• 346 people died in two 737 MAX crashes due to cost-cutting measures
• American aerospace leadership was compromised by foreign dependency

America First compensation would have prevented this by:

• Penalizing job cuts and foreign outsourcing in bonus calculations
• Rewarding investment in American engineering talent and manufacturing capability
• Aligning executive incentives with national competitiveness rather than just quarterly profits
• Creating accountability for long-term American industrial strength

Contractor and Outsourcing Transparency:

• Number of 1099 contractors with access to data systems or customer information
• Outsourced contractors by location (domestic vs. offshore)
• Foreign contractors with system access by country of origin and access level
• Percentage of critical functions performed by contractors vs. W-2 employees
• Contractor compensation ranges by function and location

Technology Access and Security:

• Foreign nationals with access to proprietary systems, customer data, or intellectual property
• Contractors with administrative privileges on corporate networks
• Third-party access to sensitive data including cloud services and integrated platforms
• Security clearance status of all personnel with classified or sensitive access

Displacement and Workforce Planning:

• American workers displaced in connection with H1-B hiring or offshore outsourcing
• Jobs eliminated vs. jobs created by geographic region
• Skills training programs and measurable outcomes for American worker development
• Severance costs and displacement-related expenses

Economic Impact Analysis:

• Wage distribution changes year-over-year by economic class
• Geographic wage analysis comparing local vs. remote worker compensation
• Housing affordability metrics for workforce by location
• Income inequality ratios within the company (CEO pay vs. median worker pay)

Investment and Policy Disclosure:

• Total visa fees paid annually for H1-B and other work authorization programs
• Offshore outsourcing contracts by value and function type
• Corporate policies regarding American worker priority and training requirements
• International workforce strategy and foreign talent dependency ratios

Standardized Reporting Format: All companies must use standardized SEC forms enabling investor comparison of:

• Economic class distribution across different companies and industries
• True employment composition (W-2 vs. contractor ratios)
• Foreign workforce dependency across different business functions
• American worker displacement patterns and replacement strategies
• Real job creation vs. contractor relationships that extract value
• Wage progression opportunities within company structure

Geographic Calculation Methodology:

• Remote workers: Use zip code of employee’s primary residence
• Office workers: Use zip code of primary work location
• Hybrid workers: Use zip code providing most accurate housing cost comparison
• Multi-location workers: Use location where employee spends >50% of work time
• Housing price data: Updated quarterly using official real estate indices

Investor Protection Through Transparency: This reporting enables investors to:

• Assess taxpayer subsidization of corporate profits through underpaid workers
• Evaluate true cost of employment including government assistance burden
• Identify corporate welfare recipients that privatize profits while socializing worker support costs
• Assess wage sustainability and employee retention risks
• Evaluate genuine middle-class job creation vs. exploitation of low-wage workers
• Understand economic impact on local communities where companies operate
• Compare workforce equity across competing companies
• Assess operational risks from foreign workforce dependency
• Identify companies creating genuine economic opportunity vs. value extraction

Enforcement and Penalties:

• False reporting penalties: Automatic SEC violations for misrepresenting employment data
• Whistleblower protections: Enhanced protections for employees reporting workforce misrepresentation
• Audit requirements: Mandatory annual third-party audits of employment reporting for companies with >10,000 employees
• Public database: SEC maintains searchable public database of all workforce reporting data
• Geographic verification: Cross-reference with IRS data to verify employee location reporting

This transparency requirement would expose companies that claim job creation while paying poverty wages, reveal true middle-class job creation impact, show the stark compensation gaps between executives earning millions and workers struggling to afford housing in the same communities where they work, and force disclosure of how many “profitable” companies are actually subsidized by taxpayers through government assistance programs for their underpaid workers.

Mandatory Displacement Severance: Companies eliminating American positions within 24 months of hiring H1-B workers must provide:

• 24 months base severance for all displaced workers
• Additional 2 months per year of service beyond 5 years
• Full health insurance continuation during severance period
• Career transition services and job placement assistance
• Accelerated vesting of retirement benefits and stock options

American Workforce Development Initiative

H1-B Fee Revenue Investment Strategy

$49 billion in annual revenue should fund comprehensive American worker competitiveness:

Debt-Free STEM Education:

• $98,000 per graduate: Fund 500,000 debt-free American STEM graduates annually
• Student loan elimination: Target existing debt for Americans in high-demand technical fields
• Skills-focused curriculum: Emphasize current industry practices over theoretical coursework

Corporate Training Mandates:

• Companies using H1-B workers must establish corresponding American training programs
• Specific targets for transitioning work from foreign to American workers
• University partnerships offering internships, co-ops, direct employment pathways

Regional Skills Centers:

• Establish training centers in areas with high H1-B concentration
• Focus on AI, cybersecurity, advanced manufacturing, biotechnology
• Provide pathways from training directly to employment at competitive wages

Competitive Advantage Restoration

Educational Cost Reduction:

• Federal grants for American students in critical STEM fields
• Partnerships between government agencies and universities
• Direct funding for practical skills development programs

American Innovation Incentives:

• Tax credits for companies hiring American workers over foreign alternatives
• R&D tax benefits tied to American worker employment ratios
• Government contract preferences for companies with majority American technical workforces

International Coordination and Enforcement

Allied Nation Coordination

Democratic Partner Standards: Coordinate with countries sharing democratic values to ensure responsible actors maintain technological leadership while authoritarian regimes face systematic disadvantages.

Technology Transfer Restrictions: Implement export controls treating AI algorithms and training methodologies as controlled dual-use technologies, with enhanced monitoring of foreign nationals’ access.

Academic Research Restrictions: Universities receiving federal funding prohibited from employing foreign nationals from strategic competitor nations in research with potential military or surveillance applications.

Enforcement Mechanisms

Department of Justice Investigations: Launch immediate investigations into companies with documented patterns of worker displacement identified in congressional hearings and whistleblower complaints.

Real-Time Monitoring Systems:

• Track all H1-B and F1 holder movements between companies
• Monitor technology access patterns and data downloads
• Flag suspicious patterns for immediate investigation
• Coordinate with intelligence agencies on threat assessment

Visa Revocation Authority: Immediate termination capability for any visa holder showing security concerns, with no appeal process during active investigation.

Technology Sovereignty Restoration

American AI Dominance Initiative

National AI Workforce Program:

• Train 1 million Americans in AI development over 5 years
• Focus on military, cybersecurity, and critical infrastructure applications
• Guarantee employment pathways in government and defense contractors

Secure AI Development: All AI research with potential military applications restricted to American citizens with appropriate security clearances.

AI Export Controls: Treat advanced AI capabilities as strategic weapons, with strict controls on foreign access to development tools, training data, and deployment methodologies.

Critical Infrastructure Protection

American-Only Requirements: Phase in requirements for American citizenship in:

• All cybersecurity positions protecting critical infrastructure
• All AI development roles with potential military applications
• All positions with access to classified or proprietary government systems
• All senior technical roles at defense contractors

Infrastructure Independence: Reduce dependency on foreign technical workers through:

• Accelerated training programs for American cybersecurity professionals
• Premium compensation packages to attract American talent
• Career pathway programs from military service to civilian cybersecurity roles

Conclusion: Restoring American Technological Sovereignty

The Great American Betrayal through H1-B and F1 visas has created the largest peacetime transfer of strategic capabilities in history. The $600 billion wealth transfer and foreign control of critical infrastructure represent existential threats that demand comprehensive, immediate action.

Trump’s $100,000 H1-B fee represents recognition of the problem but fails to provide sufficient deterrent to change corporate behavior. The proposed solutions outlined above offer a comprehensive pathway to:

1. Eliminate the economic incentive for systematic worker displacement
2. Restore American control of critical technology infrastructure
3. End the systematic wealth transfer to strategic competitor nations
4. Create the world’s most competitive debt-free American technical workforce
5. Ensure American technological dominance in the AI age

The choice facing America is stark: Implement comprehensive reform now to restore technological sovereignty, or accept permanent technological dependence on nations that view America’s decline as their opportunity.

The correlation between foreign workforce expansion and escalating cyber threats, combined with massive IP theft, demands immediate action. America cannot afford to wait while foreign nationals continue controlling critical infrastructure and advanced technology development.

This is America’s last chance to reverse the Great American Betrayal before foreign control of our most strategic capabilities becomes irreversible. The solutions exist — the question is whether America has the will to implement them.

References and Data Sources

1. White House. “Restriction on Entry of Certain Nonimmigrant Workers.” Presidential Proclamation, September 19, 2025.
2. Economic Policy Institute. “Tech and outsourcing companies continue to exploit the H-1B visa program at a time of mass layoffs.” 2023.
3. Business Standard. “NRIs in US may soon have to pay ₹5,000 tax on every ₹1 lakh sent to India.” May 16, 2025.
4. Fortune. “Over 70% of H-1B visa holders are Indian citizens.” September 22, 2025.

Key Data Sources:

• U.S. Citizenship and Immigration Services (USCIS) H1-B Employer Data Hub
• U.S. Department of Labor Labor Condition Application Database
• Institute of International Education (IIE) Open Doors Report 2024
• Department of Homeland Security SEVIS Records
• Economic Policy Institute Immigration Research
• FBI Counterintelligence Division Reports
• U.S. Trade Representative IP Theft Assessments

The Problem: Microsoft’s “One Size Fits None” Approach

Microsoft did it again. 🎭

You know that feeling when you’re trying to install Azure CLI on your pristine macOS 15 system, and Microsoft’s official installation script assumes you’re living in a Homebrew-only world? Yeah, that feeling. It’s 2025, and apparently, Microsoft still thinks there’s only one package manager on macOS.

Spoiler alert: There isn’t.

Why Homebrew Makes Me Reach for the Antacid

Before we dive into the solution, let’s talk about why some of us avoid Homebrew like it’s a Windows Vista installation disk:

Homebrew: The “Friendly” Dictator

• Opinionated Installation Paths: Everything goes to /opt/homebrew (Apple Silicon) or /usr/local (Intel). No flexibility.
• Automatic Updates: Surprise! Your Python just got updated and broke your entire development environment.
• Single Version Philosophy: Want Python 3.9 and 3.10 simultaneously? Good luck with that.
• Binary Packages: Less control over compilation flags and optimization.

MacPorts: The Swiss Army Knife

Enter MacPorts — the package manager that actually respects your choices:

• Prefix Flexibility: Everything lives cleanly in /opt/local by default, but you can change it
• Source-Based: Compiles packages with your specific system optimizations
• Multiple Versions: Want Python 3.8, 3.9, AND 3.10? No problem!
• Variants: Customize packages with specific features enabled/disabled
• Clean Dependency Management: No mysterious symlink forests

Microsoft’s Script: A Comedy of Errors

So there I was, trying to install Azure CLI 2.75 on my MacPorts-powered macOS 15 system. Microsoft’s official script? Let me count the ways it failed:

Error #1: The Great Virtualenv Disaster

bash

ERROR: The executable /usr/local/lib/azure-cli/bin/python3.10 is not functioning
ERROR: It thinks sys.prefix is '/private/tmp/tmp0dza4yyf/virtualenv-16.7.11' (should be '/usr/local/lib/azure-cli')
ERROR: virtualenv is not compatible with this system or executable

Microsoft’s brilliant solution? Use a crusty old virtualenv package (version 16.7.11) from 2019 that’s about as compatible with modern Python as Internet Explorer is with modern web standards.

Error #2: Package Manager Blindness

The script cheerfully assumes you’re using Homebrew and completely ignores:

• MacPorts at /opt/local
• Custom Python installations
• Any package manager that isn’t Homebrew

Error #3: Python Version Russian Roulette

Want to choose which Python version to use? Microsoft says: “Take what we give you and like it!” The script grabbed whatever Python it found first, regardless of whether it was suitable.

Error #4: Living in the Python Past

Here’s where Microsoft really shows their commitment to staying current: their Azure CLI installer only supports Python 3.8, 3.9, and 3.10.

Wait, what?

Yes, you read that correctly. In 2025, Microsoft’s installer completely ignores:

• Python 3.11 (released October 2021 — over 3 years old!)
• Python 3.12 (released October 2023 — the current stable version)
• Python 3.13 (released October 2024 — the latest and greatest)

Because apparently, Microsoft operates on “Internet Explorer time” where adopting new standards takes half a decade. Meanwhile, the Python community has moved on, enjoying performance improvements, better error messages, and new language features that Microsoft’s Azure CLI will never see.

Want to use Python 3.12’s improved error tracebacks or 3.13’s new REPL? Too bad! Microsoft has decided you don’t need those fancy modern features. They’re probably still testing Python 3.11 for “enterprise readiness.” 🙄

The Solution: An Enhanced Installer That Actually Works

After banging my head against Microsoft’s script for the umpteenth time, I decided to fix it myself. Because apparently, that’s what we do now.

Key Improvements Made

1. Modern Virtual Environment Creation

python

# OLD (Microsoft's way - broken):
# Downloads ancient virtualenv package, fails spectacularly

# NEW (the way that actually works):
def create_virtualenv(tmp_dir, install_dir, python_path):
    """Create virtual environment using Python's built-in venv module."""
    cmd = [python_path, '-m', 'venv', install_dir]
    exec_command(cmd)

Translation: Use Python’s built-in venv module like a reasonable person instead of downloading packages from the Paleozoic Era.

2. Intelligent Package Manager Detection

python

def _get_macos_package_manager():
    """Detect which package manager is available on macOS."""
    # Check for MacPorts
    if os.path.isfile('/opt/local/bin/port'):
        return 'macports', ['sudo', 'port', 'install'], '/opt/local'
    
    # Check for Homebrew (Apple Silicon)
    if os.path.isfile('/opt/homebrew/bin/brew'):
        return 'homebrew-arm', ['brew', 'install'], '/opt/homebrew'
    
    # Check for Homebrew (Intel)
    if os.path.isfile('/usr/local/bin/brew'):
        return 'homebrew-intel', ['brew', 'install'], '/usr/local'

Translation: Actually check what package manager people are using instead of assuming everyone drinks the Homebrew Kool-Aid.

3. Smart Python Version Selection

python

# Prioritization: MacPorts > Homebrew > System Python
def sort_key(path):
    score = 0
    if PREFERRED_PYTHON_VERSION in version:
        score += 1000  # Python 3.10 preferred
    if '/opt/local/' in path:  # MacPorts
        score += 100
    elif '/opt/homebrew/' in path or '/usr/local/' in path:  # Homebrew
        score += 50
    return -score

4. Future-Ready Python Support

python

# Current (conservative approach):
SUPPORTED_PYTHON_VERSIONS = ['3.8', '3.9', '3.10']
PREFERRED_PYTHON_VERSION = '3.10'

# Future enhancement potential:
# SUPPORTED_PYTHON_VERSIONS = ['3.8', '3.9', '3.10', '3.11', '3.12', '3.13']
# PREFERRED_PYTHON_VERSION = '3.12'  # Latest stable

Translation: While Microsoft clings to Python 3.10 like it’s the last version ever released, the enhanced installer can easily be updated to support modern Python versions. Because some of us like to live in 2025, not 2021.

The Installation Experience: Before vs. After

Before (Microsoft’s Script):

bash

$ python3 install_azure_cli.py
Error: virtualenv incompatible
Error: sys.prefix confusion
Error: general sadness and frustration

After (Enhanced Script):

bash

$ python3 install_azure_cli.py
-- Enhanced Azure CLI Installer v1.0.0
-- Original by Microsoft Corporation
-- Enhanced by Colin Bitterfield <colin@bitterfield.com>
-- Azure CLI Version: 2.75.0
-- Detected MacPorts at /opt/local
-- Found Python executables in '/opt/local/bin':
--   Python 3.10: /opt/local/bin/python3.10
-- Multiple Python versions found:
--   1: 3.10 - /opt/local/bin/python3.10 (PREFERRED, MacPorts)
--   2: 3.9 - /opt/local/bin/python3.9 (MacPorts)
--   3: 3.9 - /usr/bin/python3 (System)
===> Select Python version (1-3): 1
-- Creating virtual environment using built-in venv module
-- Installation successful!

Chef’s kiss 👌

Why MacPorts + Enhanced Installer = Developer Happiness

MacPorts Advantages for Azure CLI:

1. Clean Installation: Everything in /opt/local, no system pollution
2. Multiple Python Versions: Keep 3.8, 3.9, 3.10, 3.11, 3.12, AND 3.13 simultaneously (unlike Microsoft’s limited support)
3. Latest Python Support: Use modern Python versions while Microsoft catches up to 2021
4. Optimized Builds: Compiled specifically for your Mac
5. Dependency Isolation: No conflicts with system packages
6. Easy Cleanup: sudo port uninstall actually removes everything

Enhanced Script Benefits:

1. Automatic MacPorts Detection: Finds and prioritizes your MacPorts Python
2. Modern Virtual Environments: Uses Python’s built-in venv module
3. Dependency Management: Installs MacPorts packages (openssl, libffi, pkgconfig) if needed
4. User Choice: Select exactly which Python version to use
5. Future-Proof: Won’t break when Microsoft updates their dependencies

Getting Started: The Right Way

1. Install MacPorts (If You Haven’t Already)

Visit macports.org and download the installer for macOS 15.

2. Install Python via MacPorts

bash

# Install Python 3.10 (Microsoft's "latest" supported version)
sudo port install python310

# Or go wild with actual modern Python versions
sudo port install python311 python312 python313

# Install multiple versions (because you can!)
sudo port install python39 python310 python311 python312

# Set Python 3.12 as default (if you want to live in the future)
sudo port select --set python3 python312

# Set Python 3.10 as default (if you want Azure CLI compatibility)
sudo port select --set python3 python310

Pro Tip: MacPorts supports Python versions that Microsoft has never heard of. While Microsoft is still “evaluating” Python 3.11 for “enterprise readiness,” MacPorts users are already enjoying Python 3.13’s performance improvements and new features.

3. Use the Enhanced Azure CLI Installer

bash

# Download the enhanced installer
git clone https://github.com/cbitterfield/azure-cli-installer-enhanced.git
cd azure-cli-installer-enhanced

# Test your system (optional)
./test_installer.py

# Install Azure CLI
python3 install_azure_cli.py

4. Test Your Installation

bash

# Login to Azure
az login

# Verify installation
az --version

# Show your account
az account show

The Technical Deep Dive

Virtual Environment Modernization

The original script downloaded a tar.gz file of virtualenv 16.7.11 (released in 2019!) and tried to extract and run it. This approach:

• Downloads unnecessary code
• Uses outdated virtualenv logic
• Fails with modern Python installations
• Has SHA256 verification that nobody updates

The enhanced script simply uses Python’s built-in venv module, which:

• Ships with Python 3.3+
• Is maintained by the Python core team
• Has no external dependencies
• Actually works

Package Manager Intelligence

Microsoft’s script had zero package manager detection. It just assumed Homebrew and failed silently on MacPorts systems.

The enhanced version:

1. Detects MacPorts at /opt/local
2. Detects Homebrew on Apple Silicon (/opt/homebrew)
3. Detects Homebrew on Intel (/usr/local)
4. Scans multiple Python installation paths
5. Gives users clear choices with recommendations

Dependency Handling

The enhanced installer automatically handles native dependencies:

MacPorts:

bash

sudo port install openssl libffi pkgconfig

Homebrew (if detected):

bash

brew install openssl libffi pkg-config

Manual guidance for edge cases.

The Results: A Success Story

After implementing these fixes:

• ✅ Azure CLI installs cleanly on macOS 15
• ✅ MacPorts Python versions are properly detected and prioritized
• ✅ Virtual environments work without sys.prefix errors
• ✅ Dependencies install automatically via the correct package manager
• ✅ Users can choose their preferred Python version
• ✅ No more fighting with Microsoft’s assumptions

Conclusion: Sometimes You Have to Fix It Yourself

Microsoft’s Azure CLI is a powerful tool, but their installation script feels like it was written by someone who’s never heard of package managers other than Homebrew, and who thinks Python 3.10 is “cutting edge technology.” Classic Microsoft move — build something useful, then make the installation experience unnecessarily painful for anyone not following the “blessed path,” while simultaneously ignoring three years of Python evolution.

Let’s be honest: Microsoft supporting only up to Python 3.10 in 2025 is like Internet Explorer supporting only CSS2 in 2010. The world has moved on, but Microsoft is still “evaluating enterprise readiness” of Python versions that have been stable for years.

Fortunately, with a little elbow grease and some respect for user choice, we can make it work properly. The enhanced installer proves that you can support multiple package managers, give users options, and use modern Python practices all in the same script.

Bottom Line: If you’re a MacPorts user who values control over your development environment, don’t let Microsoft’s Homebrew-centric worldview stop you from using Azure CLI. Use the enhanced installer, enjoy your clean MacPorts setup, and get back to building awesome things on Azure.

Because life’s too short to fight with broken installation scripts. 🚀

Resources

• Enhanced Azure CLI Installer: GitHub Repository
• MacPorts: Official Website
• MacPorts Installation: Installation Guide
• Microsoft’s Original (Flawed) Installer: Azure CLI macOS Documentation

Author: Colin Bitterfield — Information Security Engineer, Python Enthusiast, and Occasional Fixer of Microsoft’s Broken Scripts

I am working on adding “Starlink” to my RV and needed to make a bushing for the pole mount to connect it to a chainlink fence pole. $20 v $150 mast. I have a number of 3d printers including resin based ones.

So the problem starts with both a metric to sae conversion along with how to do practical geometry.

The “Starlink” version of a pipe adapter can be found on their website.

The chainlink rail can be found at Lowes or Home Depot

“designed to attach to any pole with a max diameter of 2.5" (64 mm)”

Notice that were are already playing with conversions. (Use 64mm) for the 1 3/8" convert and round down. Turns into 34.925 mm (I used 34.9). The issue is the inner dimension of the adapter is 74 mm not 64mm and you need to take the wall thickness into account.

Notice that we need to create a top (with larger areas) and a bottom with smaller areas and then connect them with a CADD loft. Also if you notice we will need to drill some holes for screws and that they will be on 120 degree centers.

I came up with this the first time but quickly realized an error.

It takes some very interesting math to make this work out.

The centerline for each of the three spokes is 0, 120, 240 degrees and 32mm (radius).

The problem is we need the centerline for construction but we need the degrees or radians for 1/2 the distance on each side.

The problem is we need to find the number of degrees to start and end the tab wedge using the construction line as reference. We need the total number of degrees for the tab (8.2mm) at 37.2 mm from the centerline.

Find the central angle given the arc length and radius

Given the following values

Arc Length (S) = Radius (r) * Theta (⍉)

8 mm = 37.2 mm * ⍉

8 / 37.2 mm = (37.2mm * ⍉) / 37.2 mm

0.21505376344086 (radians) = ⍉

radians to degrees:

A central angle calculator to check the work is located here.

Now let’s plug this back into our CADD program.

In the CADD program, all of the parameters are defined as variables so we can make adjustments to the variables and the sketch will update accordingly. This shows one of three of the tabs. (dash lines are for construction and are not part of the 3d part)

CADD replicates the tab area for 3 around the circle so you don’t need to draw the other lines.

The important part here is that you can use variables in CADD and adjust but you have to know the formulas. This program is smart enough that I could have put the formula in for all of it and had it calculate radians and us that in the sketch.

This is what the final part will look like (Test section 2mm)

When the design is done, I will complete the part and slice the bottom and top sections for a 4mm jig to test the print prior to final 3d print to avoid wasting materials.

This bushing is printed with ABS like resin that is hardened with UV light. For long term survivability outdoors it will need to be painted with UV resistant paint.

The top central angle:

The final product looks like this

In conclusion high school math is still useful 40 years later. It is also very relevant to 3D printing.

I created an equation so that I could just change arc length and the entire 3d object would update automatically. This helps with the final finish. Also I needed to reduce the size of the inner dimension by a 1/2 mm.

Over the last year, I have been asked about the security concerns with AI-Generated source code and “code assistants” like Tab9, CodePilot, and other LLM-based AI Generators. Overall my initial take on these services is they are emerging technology that is not ready to be implemented by enterprise commercial shops. I can see a fear that the use of AI Generators is a “game changer” in competition failure to adopt could put you out of business. On the flip side of that, early adoption could destroy your reputation and put you out of business. Just ask Samsung they now ban the use of all AI Generators.

Initially, any of these services should be vetted by ISO/SOC/NIST vendor due diligence requirements. This article is my findings based on looking at AI code generation through a security and compliance lens.

Many of us remember Elize from the 1980s. The source code has been missing since the 1960s. Perhaps it is being resurrected in a new form.

The value in these AI generators could potentially be very high and profitable for the company that gets it right and the customers that can leverage it. The image below was generated for this article from “text to images”. I tried a couple of different sites for this to create royalty-free art for this article. I can see this aspect really cutting into Adobe, Getty, and other stock art places. It gives people an alternative for self-publishing and license issues. The image below does not come without specific limitations. See the terms of service.

This brings up one of the primary issues: “copyright”. In terms of service, even though I generated the image it’s not mine based on copyright. After a lot of research, the reason why became apparent. If someone else uses the same site and more or less the same request, they have a very high likelihood of getting the same image. This is very important and I will touch on it later in the article.

AI Generators have the potential to do a lot of grunt work in programming. But the real danger is that people might ask the “AI” to do their work for them and not have the capacity to understand that work, validate it, or perhaps even understand it. This might create a critical risk with “AI” dependency or induce unknown security vulnerabilities.

I see these areas that have a high potential for use and misuse:

1. Software Development / DevOPS (Code Generation for applications and Infrastructure as Code IaC). This poses some new challenges but brings back a lot of challenges from outsourcing development to “unknown” programmers using a specification.
2. Marketing / Sales: Image generation, customer correspondence creation, and similar tasks.
3. Legal/HR: Policy and contract creation.
4. Finance: Analyzing complex financials.
5. Data Science: Analyzing big data.

The issue with these business functions using this technology is quite connected to the immaturity of the technology and the companies selling the technology.

Things that don’t exist or don’t exist well currently:

1. Corporate Policies on how, what, where, and when AI Generation should be used.
2. Rules of Attribution and Copyright
3. Legal cases and precedence in any or all industries. (licenses, copyrights, attribution, training, acceptable uses).
4. Liability Law for the AI Generator (some are limited to $100 in total limitations)
5. Rules of Compentcy inside of the AI. — Requirement for ISO/SOC/NIST shops.
6. Best practices by the industry
7. Non-Disclosure Agreements and other business contracts including sections for AI-generated or access content.
8. Ability to purge “accidentally disclosed information” from the AI/LLM model with proof of removal.
9. Ability to segment by the company their “AI”. — This is a very important concept.
10. The ability to control “AI Lying and Hallucinations” — Yes that is a thing.
11. The ability to attribute the AI’s knowledge source (and all kinds of privacy and non-disclosure issues)
12. Well-documented and attributable risks and vulnerabilities.
13. Lack of current government regulations on the subject. California and Virginia are leading the way on this.

A pause to remember the rules about robots (aka AIs) from Isaac Asimov

Isaac Asimov’s “Three Laws of Robotics”

1. A robot may not injure a human being or, through inaction, allow a human being to come to harm.
2. A robot must obey orders given it by human beings except where such orders would conflict with the First Law.
3. A robot must protect its own existence as long as such protection does not conflict with the First or Second Law.

This is an important takeaway. The AI (aka LLMs) being marketed don’t have anything like baseline ethics programming. The current round of AIs will make up the results.

“Google CEO Sundar Pichai says ‘hallucination problems’ still plague A.I. tech and he doesn’t know why” [link]

We have all watched Science Fiction or read it. The robot (AI) going insane and killing everyone is a major plot in most of these stories. Just like Sky Net creating “Terminators”. This should give everyone (even Eli Musk tweets about it) a pause for how this technology is implemented, deployed, used, and regulated.

The point of the article is why AI is not ready for prime time.

The current batch of AI Generators (SaaS vendors) have huge limitations and liabilities. They are used as “slaves” by employees to augment the employee’s work. The largest potential misuse other than unauthorized disclosure of confidential or proprietary information is when incompetent people use them “to be competent”.

One of the cornerstones to contract law is “respondeat superior”, which is Latin for “let the superior answer,” is a theory that holds employers responsible for the actions of their employees.

For instance, if a junior developer with little experience asks the AI Generator to write a program (or even a function) that they themselves can’t write, how could they supervise or validate that the code does not contain security vulnerabilities or other risks?

Apparently, one of the AIs (based on an article) passed the bar. That doesn’t make it a lawyer. Because the AI generates code, it doesn’t make it a programmer.

SOC2, ISO, and NIST all require that employees are competent to do their work and receive job-based training and security awareness training based on job roles. Furthermore, all types of workforce must conform to the same level of training regardless of status. (Employee, Contractor, or outsourced vendor). This is done in a variety of ways by vetting suppliers, checking IDs and credentials of the workforce, and so on.

If we extend this to AI Generators of any kind, we must also validate their competency to work. None of the generators, I looked at seem to have figured this out.

Consider general employee/contractor requirements just to work:

1. Credentials / Education including the verification of them.
2. Verifying they are who they say they are. (Is the AI Generator outsourced internally to another vendor?)
3. Training and Compentcy. How much programming time does the AI have? How was it trained?
4. Ethics requirements: Plagiarism, Lying, Stealing, violating employee handbook things.
5. Regulatory training. In many industries, people have to receive and know regulatory requirements like Sarbanes-Oxley or Export Controlled Requirements. It is unclear if these generators are trained on industry or general legal requirements.
6. In programming, for instance, developers are required to know and develop with security by design. For example not writing code vulnerable to SQL Injection or other OWASP requirements. Or perhaps to be aware of PI, PII, or PCI-type data and not use it inappropriately.
7. Non-Disclosure, Non-Compete contracts to keep employees from selling company secrets.

The current AI Generator vendors are simply too immature in the technology to be leveraged appropriately by Fortune 1000-level companies or companies in highly regulated industries.

For this technology to be readily usable there are a few things that need to happen:

1. The AI used by one company needs to have its knowledge base firewalled, or anonymized from other users and that base of knowledge needs to be proprietary to the company using the AI. AIs have a high probability of generating the same answer for multiple clients. It’s like sharing a key engineer between two competing companies.
2. The issue of AI Hallucination or lying needs to be resolved. The AI should say, I don’t know if it doesn’t. I wonder if this behavior is induced by the creator's own ethics or personality.
3. Copyright law / Patent law regarding the work product of the AI needs to be legally enforceable and defined.
4. AI Generators need a way to remove knowledge if accidentally disclosed.
5. AIs need to have some certification process for industry standards to allow companies to perform due diligence on them. For instance, this “AI” is trained not to write code that would violate security by design standards. All of the code used to train this AI was legally obtained and not scanned from odd internet sources. This might even include some testing on programming code. “Ask the AI to generate a series of code blocks and then test them for accuracy”
6. AI’s need to be able to attribute their sources in work products and maintain proper license control. If the AI utilizes a GNU 3 licensed library that requires attribution then it should put the proper attribution in the code.
7. Product liability for AIs needs to be worked out. If you are a consultant to a company you probably need the proper liability insurance.
8. Logging and attribution. AI vendors need to be able to report on which employees did what with the AI and what they generated with it.
9. A set of industry standards like CIS for using AI Generation.
10. AI Vendor safeguards (ability to forget and purge, notification if PII is uploaded, notification or protection if secret keys or credentials are uploaded, etc.)
11. Style and personality controls. Writing code or documents has a style to it. The AI should conform to corporate cultural norms. Especially if generating baseline policy documents.
12. AIs need to be more interactive and ask questions to clarify not just run with a request that is not fully understood. Same for any programmer or workforce person.
13. Industry protocols and norms need to be developed. This includes a review process.

In Summary:

My top ten list of why AI Generators should not currently be used in the Enterprise (other than for researching how they work). There is a general risk of employees using “AI” to improve their work product against company policy. This is a very high-risk aspect.

1. AI Generators are “shared” employees with no non-disclosure or non-compete agreement. They will likely provide the same (cut and paste) answer to anyone that asks. If you place your proprietary code in for optimization; your competitor might get it out when they ask.
2. AI Generators are frequently trained on data sets that don’t belong to the vendor training them.

Getty Images sues AI art generator Stable Diffusion in the US for copyright infringement

3. AI Generators can’t be validated as “Competent” or “Trained” this could cause an issue with certification under industry standards.

4. AI Generators can’t provide source attribution or license validation.

5. AI Generation by lesser competent people could slip through without proper review.

6. AI Generators a biased in some method by their creator and may be biased against the organization's culture or value set. (It’s not settable at this time)

6. AI Generators lack sufficient security controls, customer segregation, and reporting.

7. Total lack of best practices in the industry

8. AIs don’t understand and are not programmed to comply with ethics or industry regulation.

Next Steps:

My thoughts:

1. Ban this use of AI Generators in all aspects of corporate work products by policy and implement security controls like DNS firewalls to remove access.
2. Implement a well-written policy banning the “UnAuthorized” use of the technology.
3. Implement technical controls to block the use of the technology. (Google Workspace blocks on OAUTH, DNS Firewalls, MDM)
4. Create a working group internally to create policies, protocols, and procedures for vetting the AI Generators and use them. Including a review process.
5. Create security awareness training that clearly and simply informs the workforce of the risks.
6. Approve with proper due diligence the workgroup or interested employees' web-based access with conditions.
7. Have your privacy, legal, or compliance team monitor state and federal regulations regarding this technology.
8. Vet AI Vendors very carefully. I would not approve an AI Vendor unless they met at least the following conditions:

• Certification (ISO, SOC2, NIST)
• Could demonstrate data deletion (forgetting) of confidential data from the LLM and all datasets and backups.
• Could provide detailed logs (automatically to my S3 bucket or SEIM) about what users did what.
• Could provide proof of license attribution regarding source materials.
• Generated attribution in the code or document.
• Had clear copyright on generated materials.
• Could verify that my “answers” are going to wind up with my competitor somehow. (My own AI has my knowledge base)
• Had at least 1M in liability insurance
• Was trained on materials that were properly licensed for the purpose of training and can demonstrate this.
• And some control to prevent AI Hallucinations.
• Had a method of notification if a Zero-day exploit was propagated by the code generated.
• Had some internal methods for checking the code provided against OWASP 10/20, industry best practices, normal SDLC checking of code, and was certified not to induce OWASP-based vulnerabilities.
• Had clear terms of service that my data does not become their IP just because I uploaded it.
• Prevented my “asks” from being seen by other companies’ employees.

Clear Risks

1. Copyright and license infringement and liability.
2. Competition receiving proprietary code.
3. PII or other confidential data disclosed. (Imaging if restricted financial data was uploaded by the CFO and he asked the AI to analyze and report. Then the unreleased financials are available to anyone researching the company.)
4. Unauthorized disclosure or transfer of information in all forms.
5. Regulatory litigation. (Violation of Automated Decision Making, GDPR, Sarbanes-Oxley)
6. Litigation is based on inaccurate or biased information in code or documents.
7. Product Liability based on AI-generated work product.
8. Zero-day exploits based on AI hallucinations. I read an article where first the AI lied about the code repository and then researchers create that library in GitHub and then AI decided to download the repository to its body of knowledge but the code was tainted to see if malicious code could be injected.
9. Seeing “queries” for research could give a competitor proprietary information.
10. Over-dependence on the use of AI.

A thought that popped into my head on this is “What about required legal reporting?” What would happen if the AI gained a legal requirement to report criminal information? Back to a CFO uploading financial data to analyze, what if he lies to the SCC and the AI that can read the report has a required reporting on the difference between what it knows (the real numbers) and the published SCC information? Automated whistleblowing.

Research Examples

I performed some research for this article.

The https://codepal.ai/ site worked pretty well on generating some Python code and a Docker file. However, there were some key mistakes. As I changed how I wrote the requirement, the answers changed and were not always correct.

In the Python example, I asked it to write a function that executes some OS commands and presented the results. It did not properly create the function. It was close enough for me to finish but was by no means a final answer. The second code I had it write was a function to scan a directory avoiding hidden files recursively and present the results for directories that had a matching name. The code was pretty close to final on that one.

Directory Function:

def find_directories(directory_path, directory_name):
    """
    This function searches for all directories with a specific name in a given directory path.
    It does not include hidden directories.
    
    Parameters:
    directory_path (str): The path of the directory to search in
    directory_name (str): The name of the directory to search for
    
    Returns:
    list: A list of directory paths that match the specified directory name
    """
    try:
        # Check if the directory path exists
        if not os.path.exists(directory_path):
            raise ValueError("Directory path does not exist")
        
        # Initialize an empty list to store the matching directories
        matching_directories = []
        
        # Loop through all directories in the directory path
        for dirpath, dirnames, filenames in os.walk(directory_path):
            # Check if the directory is hidden
            if os.path.basename(dirpath).startswith('.'):
                continue
            
            # Check if the directory name matches the specified name
            if directory_name in dirnames:
                # Add the directory path to the list of matching directories
                matching_directories.append(os.path.join(dirpath, directory_name))
        
        # Return the list of matching directories
        return matching_directories
    except ValueError as e:
        # Log the error
        print(f"Error: {e}")
        return []

The docker file forgot to add key code without which the docker build hung indefinitely

ARG DATE_TIMEZONE=UTC
ARG DEBIAN_FRONTEND=noninteractive

It was also unable to create a proper start script for the service or run commands for the container.

Request:

runs ssd as a service. Copy a file named ubuntu.txt and install all of the packages in the file. Copy a file named graphics-kat.py, make it executable and put it in /usr/local/bin. Add /usr/local/bin to the PATH variable for the system.  Copy a filename requirements.txt and install all of the python libraries contained in the file. Mount three NFS shares named SOURCE, PROJECT, AND FINISHED and provide environment variables to pass the NFS Server mount points. Create a user named “graphics_kat”. Copy a file named authorized_keys to graphics_kat’s .ssh directory and set the correct permissions for login with an ssh key. Create the MAINTAINER TAG with my information. Supports CUDA and has cuda tools installed.  Create a start script that displays system logs and shows docker run instructions on startup. Install sudo and place the user graphics_kat in the sudo group. Create the start script dynamically in the docker file.

Results:

FROM ubuntu:latest

# MAINTAINER TAG
MAINTAINER <Your Name> <Your Email>

# Copy ubuntu.txt and install packages
COPY ubuntu.txt /tmp/
RUN apt-get update && apt-get install -y $(cat /tmp/ubuntu.txt)

# Copy graphics-kat.py, make it executable and put it in /usr/local/bin
COPY graphics-kat.py /usr/local/bin/
RUN chmod +x /usr/local/bin/graphics-kat.py

# Add /usr/local/bin to the PATH variable for the system
ENV PATH="/usr/local/bin:${PATH}"

# Copy requirements.txt and install python libraries
COPY requirements.txt /tmp/
RUN pip install -r /tmp/requirements.txt

# Mount three NFS shares
ENV SOURCE_MOUNT_POINT="<NFS Server mount point for SOURCE>"
ENV PROJECT_MOUNT_POINT="<NFS Server mount point for PROJECT>"
ENV FINISHED_MOUNT_POINT="<NFS Server mount point for FINISHED>"
RUN mount -t nfs $SOURCE_MOUNT_POINT /source
RUN mount -t nfs $PROJECT_MOUNT_POINT /project
RUN mount -t nfs $FINISHED_MOUNT_POINT /finished

# Create a user named “graphics_kat”
RUN useradd -m graphics_kat

# Copy a file named authorized_keys to graphics_kat’s .ssh directory and set the correct permissions for login with an ssh key
COPY authorized_keys /home/graphics_kat/.ssh/
RUN chown -R graphics_kat:graphics_kat /home/graphics_kat/.ssh/
RUN chmod 600 /home/graphics_kat/.ssh/authorized_keys

# Supports CUDA and has cuda tools installed
RUN apt-get install -y nvidia-cuda-toolkit

# Create a start script that displays system logs and shows docker run instructions on startup
RUN echo '#!/bin/bash \n\
echo "Displaying system logs..." \n\
echo "Docker run instructions..." \n\
exec "$@"' > /usr/local/bin/start.sh

# Install sudo and place the user graphics_kat in the sudo group
RUN apt-get install -y sudo
RUN usermod -aG sudo graphics_kat

# Set permissions for start.sh
RUN chmod +x /usr/local/bin/start.sh

# Set entrypoint
ENTRYPOINT ["/usr/local/bin/start.sh"]

# Set default command
CMD ["/bin/bash"]

I would have assumed it could have done a better job on the Ubuntu requirement which I run across all the time. It should have been able to create a better and more complete run script and give me an example of how to run the container. That part is normal and common.

On the good side, it got the SSH permissions right and has very readable code that is properly documented.

On the odd side, it knows who I am because I signed up and paid for access. When I asked to add my information to the docker file maintainer it was unable to do that.

I will test the CUDA integration later to see if that works.

Value Proposition

From my limited tests and use of various code generators, they can be very useful as a starting point to solve routine and standard problems that (we) programmers face every day.

For instance, I have created that directory function a number of times slightly tweaked each time for what I was working on. Not having to store a GIST and modify it as a starting point is useful and speeds up development. I have found over the last few years that I have to solve the same issue for each program I write and I maintained a small repository of useful functions for cut and paste.

I think there is a potential for a lot of value if the vendors can improve on security, privacy, and regulatory issues.

In the course of my daily work, I frequently need a starting point for code or documents. I usually use a Google Search for “free” based templates or examples as a starting point. That is usually very time-consuming. Getting an understandable and working template in a minute would save me hours of research.

I think in the area of code optimization and analysis for vulnerabilities this technology could be huge especially if Microsoft could incorporate good parts with GitHub actions (Synk does some of this now) to provide a recommendation during the pull request. (like, your code could be optimized if you did …) or your code could be compromised by abnormal input into this…

Dangers on the Horizon

The risk of lesser competent people using AI Generators to produce work products under their moniker is a strong risk. I think this will lead to a requirement for better vetting of people that write work products (developers, lawyers, sales, marketing). Most of the time persons in this category don’t know, abide or check for copyrights, licenses, and other related issues.

AI Generators pose a great starting point but they are not the final solution to any task and all products generated need to be reviewed by a competent person in that field.

Recently, I was asked how to securely delete the free space of a file on OSX. Back in the OSX El Captain days finder had an option “Secure Erase” for the trash can. That option has been removed on all of the modern OSX versions due to how SSDs work. Most of the articles I read still point back to older versions.

How to securely delete files on a Mac System from the command line or finder.

After some research, I found the binary (srm) secure remove for all OSX/Linux systems. There is a binary for Windows in the repository.

secure rm

Secure rm can be installed with MacPorts or possibly HomeBrew. It can also be installed via compiling with XCode tools in under a minute.

Step 1: Install XCode or XCode CLI.

XCode is apples native compiler (like GCC). If you are going to compile anything from source code at least the CLI tools need to be installed.

Either install the full application from the Apple App Store or use the following CLI commands.

xcode-select --install
sudo xcodebuild -license accept

Step 2: Download the SRM package

Download Source Package

Download with wget

wget -O srm-1.2.15.tar.gz https://sourceforge.net/projects/srm/files/1.2.15/srm-1.2.15.tar.gz/download

Step 3: Compile

tar -zxvf srm-1.2.15.tar.gz
cd srm-1.2.15
./configure
make all 
sudo make install 

The binary will install to /usr/local/bin by default. Change this with ./configure if desired.

Examples of Secure Deletion

Type of Deletion explained

--simple 
 Overwrite the file with a single pass of 0x00 bytes.  This is the default mode.

--openbsd
OpenBSD compatible rm.  Files are overwritten three times, first with the byte 0xFF, then 0x00, and then
              0xFF again, before they are deleted.

--dod
US Dod compliant 7-pass overwrite.

--doe
US DoE compliant 3-pass overwrite.  Twice with a random pattern, finally with the bytes "DoE".  See
              http://cio.energy.gov/CS-11_Clearing_and_Media_Sanitization_Guidance.pdf for details.

--gutmann
 Use the 35-pass Gutmann method.  See http://en.wikipedia.org/wiki/Gutmann_method for details.

--rcmp
Royal Canadian Mounted Police compliant 3-pass overwrite.  First pass writes 0x00 bytes.  Second pass
              writes 0xFF bytes.  Third pass writes "RCMP".  See https://www.cse-cst.gc.ca/en/node/270/html/10572 for
              details.

Example 1: Delete a single file

srm --dod srm-1.2.15.tar.gz 

Example 2: Delete a group of files

add “-vvv” for more information

 srm -vvv --dod test?

Output
srm: removing test1
srm: file size: 2097152, buffer_size=4096
srm: buffer_size=1048576
srm: US DoD mode
pass 7 sync                        srm: removing test2
srm: file size: 2097152, buffer_size=4096
srm: buffer_size=1048576
srm: US DoD mode
pass 7 sync                        srm: removing test3
srm: file size: 2097152, buffer_size=4096
srm: buffer_size=1048576
srm: US DoD mode
pass 7 sync                        srm: removing test4
srm: file size: 2097152, buffer_size=4096
srm: buffer_size=1048576
srm: US DoD mode
pass 7 sync 

Example 3: Recursively delete a folder(directory)

srm -vvv -r --dod ./srm-1.2.15/

output (snip)
srm: removing ./srm-1.2.15/srm.sln
srm: file size: 1988, buffer_size=4096
srm: buffer_size=1048576
srm: US DoD mode
pass 7 sync                        srm: removing ./srm-1.2.15/srm.spec
srm: file size: 947, buffer_size=4096
srm: buffer_size=1048576
srm: US DoD mode
pass 7 sync                        srm: removing ./srm-1.2.15/install-sh
srm: file size: 13663, buffer_size=4096
srm: buffer_size=1048576
srm: US DoD mode
pass 7 sync                        srm: removing ./srm-1.2.15/configure.ac
srm: file size: 1763, buffer_size=4096
srm: buffer_size=1048576
srm: US DoD mode
pass 7 sync                        srm: removing ./srm-1.2.15/INSTALL
srm: file size: 371, buffer_size=4096
srm: buffer_size=1048576
srm: US DoD mode
pass 7 sync                        srm: removing ./srm-1.2.15/test/fill.o
srm: file size: 2240, buffer_size=4096
srm: buffer_size=1048576
srm: US DoD mode
pass 7 sync                        srm: removing ./srm-1.2.15/test/fill_test
srm: file size: 39638, buffer_size=4096
srm: buffer_size=1048576
srm: US DoD mode

Taking it one step further and adding to finder with “Automator”

This is a bit of a work in progress and will be tailored to individual needs

Step 1: Open Automator and select Quick Action

Step 2: Wire up the finder to Apple Script

Step 3: Add the following code (Apple Script)

on isDirectory(someItem) -- someItem is a string
 set filePosixPath to quoted form of (POSIX path of someItem)
 set fileType to (do shell script "file -b " & filePosixPath)
 if fileType ends with "directory" then return true
 return false
end isDirectory



on run {thePaths, parameters}
 set the_results to {}
 set srmLocation to "/opt/local/bin/srm"
 -- Update the initial progress information
 set thePathCount to length of thePaths
 
 --get delete method
 set DeleteMethods to {"simple", "openbsd", "dod", "doe", "gutmann", "rcmp"}
 set theDeleteMethod to choose from list DeleteMethods with prompt "Select your secure delete method:" default items {"dod"}
 theDeleteMethod
 
 
 set theDeleteMethodSetting to "--" & theDeleteMethod
 
 set beginning of the_results to "Delete Method " & theDeleteMethodSetting
 
 repeat with a from 1 to length of thePaths
  
  -- Update the progress detail
  set progressNotify to (theDeleteMethod as text) & " deletion of Path " & a & " of " & thePathCount
  
  set theCurrentListItem to item a of thePaths
  -- Process the image
  set theFilePath to POSIX path of theCurrentListItem
  --display notification theFilePath & "has been secure erased." with title "Secure Erase" subtitle "Processing is complete."
  set the_results to the_results & "\n processing \n" & theFilePath  & "\n" as text
  
  
  
  if isDirectory(theFilePath) then
   set the_results to the_results & "Directory \n"
   set theResult to do shell script srmLocation & " --verbose --verbose --recursive " & theDeleteMethodSetting & " " & quote & theFilePath & quote
   
  else
   set theResult to do shell script srmLocation & " --verbose --verbose --verbose " & theDeleteMethodSetting & " " & quote & theFilePath & quote
   
  end if
  set the_results to the_results & theResult & "\n" as text
  
  display notification theResult with title theFilePath subtitle progressNotify
  
  -- Increment the progress
  
  
  -- Pause for demonstration purposes, so progress can be seen
  delay 1
  
 end repeat
 
 set the_results to the_results & "Paths Processed " & thePathCount as text
 
 display dialog the_results
 return thePaths
end run

Save this action as “Secure Erase”

Run the action

The results should look like this:

When you change laptops, upgrade OSX, or set up a new employer laptop, there is a litany of installation and configurations just to get working. I find myself reviewing my previous notes and “remembering” all of my settings. I do a lot of python development, so I am including setting up PyCharm Community and AWS CLI in this configuration guide.

Disclaimer: Actual Mileage and Preferences will vary

Step 1: Install internet downloadable (free) applications.

Choose the applications required for your environment.

• MacPorts — Provides CLI Linux tools to OSX (Python 3.10, Jupyter Notebook, etc)
• OnyX — OnyX is a multifunction utility that you can use to verify the structure of the system files; run miscellaneous maintenance and cleaning tasks; configure parameters in the Finder, Dock, Safari, and some Apple applications; delete caches; remove certain problematic folders and files; rebuild various databases and indexes; and more.
• Chrome — browser
• GitHub Desktop
• Firefox — browser
• iTerm2 — Better Terminal
• Docker Desktop
• OneNote (if you use it)
• Virtual Box (VirtualBox is a type-2 hypervisor for x86 virtualization)
• PyCharm — Community Version (or JetBrain Products)
• Visual Studio (If you use it)
• NeoOffice (Replacement for MS Office or Libre Office). This is a $29 version of Microsoft Office and is useful if your company uses Google Workspace.
• Slack — Messanger
• Zoom — Video Conferencing (Might just need to have it)
• XCode — At least the CLI tools for compiling MacPorts and source code. You will also need to accept the license. The full application can be downloaded here from the APP Store
• 1Password — Password Manager (or Keeper, or LastPass). I have changed to 1Password for ISO/NIST Compliance. Most of the companies I work for have this as a corporate application (the personal version is free with the corporate version). This allows you to have access to your personal passwords at work. The other really nice feature is a CLI version. The CLI version is installed with MacPorts.
• SQLite Browser — If you use SQLite databases. JetBrains also has DataGrip but that’s a paid option. The PyCharm Professional can also link databases but is also a paid option
• Namechanger — I Like the program for changing large numbers of files. Easier than the command line and remembering regex.

Step 2: Install XCode or XCode CLI.

XCode is apples native compiler (like GCC). If you are going to compile anything from source code at least the CLI tools need to be installed.

Either install the full application from the Apple App Store or use the following CLI commands.

xcode-select --install
sudo xcodebuild -license accept

Step 3: Install Open Source Binaries from MacPorts.

I install a bunch of tools that I always use. What I like about MacPorts over HomeBrew is the ability to install binaries for the whole computer, not just a user. I use multiple logins for my personal MacBook when I am consulting or working on a specific project for a customer. This allows me to not have to re-install everything for each user on the computer.

I use Python, AWS CLI2, Boto3, NPM, SQLite3, QT4/QT5, FFMpeg, and ImageMagic. I have also stayed with the BASH shell even though Apple wants me to change to zsh. I have too much time with BASH to switch. It is best to use the MacPorts installation if it exists for Python Libraries and other extensions. These will update together with the platform if installed.

At this time I am using Python 3.10 and NPM9. (Change the version to your version). Comment out any packages you are not using from the script.

After all of the installations, you will need to update the global paths in OSX. There are some “gotchas” after an OSX Upgrade or possibly an update. MacPorts will add a line to your local shell startup file. This will change later.

Make sure that MacPorts (port command) is on the path. Open a terminal window and type the following:

sudo port selfupdate

This will yield the following results if everything is good.

LAPTOPNAME:~ colin$ sudo port selfupdate
--->  Updating MacPorts base sources using rsync
MacPorts base version 2.8.1 installed,
MacPorts base version 2.8.1 downloaded.
--->  Updating the ports tree
--->  MacPorts base is already the latest version

This is the script I use, tailor as needed. It is best to either do this one by one or create the script. The issue is if you cut and paste this, the “sudo” command will timeout along the way and hang up. If you create the script and run it with “sudo” the whole script will be in “sudo” and you can go get coffee.

#!/bin/bash
# Install Non-Pythonic builds
sudo -H port -N install qt5 
sudo -H port -N install ImageMagick
sudo -H port -N install sqlite3 sqlite3-tools 
#sudo -H port -N install mongo
sudo -H port -N install texlive-xetex
sudo -H port -N install pandoc
sudo -H port -N install AtomicParsley
sudo -H port -N install mediainfo
sudo -H port -N install texlive-xetex
sudo -H port -N install pandoc
sudo -H port -N install cmake
sudo -H port -N install py-numpy
sudo -H port -N install ffmpeg-devel +gpl2 +gpl3 +nonfree
sudo -H port -N install libdvdnav
sudo -H port -N install lsdvd
sudo -H port -N install x264transcode
sudo -H port -N install HandBrake
sudo -H port -N install HandBrake71
sudo -H port -N install HandBrakeCLI
sudo -H port -N install 1password-cli
sudo -H port -N install dlib
sudo -H port -N install opencv4
sudo -H port -N install py-pyqt5
sudo -H port -N install sqlite3-tcl
sudo -H port -N install pandoc

# INSTALL NODEJS AND NPM
sudo -H port install -N npm9
sudo -H port install -N nodejs19
sudo -H npm install --save-dev webpack webpack-cli

# Install Python and libraries

# Install Basic Python first
sudo -H port -N install python310
sudo -H port -N install py310-pip
# This installs basic python 310 at the same time
sudo -H port select --set pip pip310
sudo -H port select --set pip3 pip310
sudo -H port select --set python python310
sudo -H port select --set python3 python310

# Install Jypyter Lab 310
# There are some various issues where you might want to install Jupyter 
# Manually (with PIP) most of the time this is fine.
sudo -H port -N install py-jupyter py310-jupyterlab

# Install Additional Python Modules directly.
sudo -H port -N install py310-yaml
sudo -H port -N install py310-xmltodict
sudo -H port -N install py310-beautifulsoup4 py310-soupsieve
sudo -H port -N install py310-openssl
sudo -H port -N install py310-validators  
sudo -H port -N install py310-numpy py310-Pillow 
sudo -H port -N install py310-opencv4
sudo -H port -N install py310-awscli2

# Select Versions
sudo -H port select --set cython cython310
sudo -H port select --set ipython py310-ipython
sudo -H port select --set ipython3 py310-ipython
sudo -H port select --set pygments py310-pygments

# Load DBUS
sudo -H port load dbus


# Install Python Modules not in MacPorts
sudo -H pip3 install ffmpeg-python

Note:

If you don’t use “sudo”, then it will be installed for the local user only. There is also maintenance work you do with the port command. “port selfupdate” and “port upgrade outdated”

Step 4: Customize your operating system's global settings.

Create the file $HOME/.bash_profile

This creates colorization and reads in the .bash_rc (non-interactive profile)

# Bash Profile
# # Interactive Login 
if [ -f ~/.bashrc ]; then
 . ~/.bashrc
fi

# Colorize the shell
export CLICOLOR=1
export LSCOLORS=GxFxCxDxBxegedabagaced

Create the file $HOME/.bashrc

# Bash non-interactive settings
# Allow Biometric login for 1Password CLI
export OP_BIOMETRIC_UNLOCK_ENABLED=true

Modify the global paths.

You may need to do both steps depending on how OSX interacts with python versions that are not native. After any major upgrade to OSX, it’s best to check your path variables.

Method 1: (After)

Install the paths to /etc/paths.d. This will append these paths to the existing paths. (AFTER). If you get the wrong python version, use method 2 to put them (BEFORE). Note the manpath variable needs to be set regardless of version.

sudo sh -c "echo "/opt/local/bin" > /etc/paths.d/mac-ports"
sudo sh -c "echo "/opt/local/sbin" > /etc/paths.d/mac-ports"
sudo bash -c "echo 'MANPATH=/opt/local/share/man:\$MANPATH' > /etc/manpaths.d/mac-ports"

Method 2: (Before)

sudo sed -i ‘’ -e $’1i\\\n/opt/local/bin’ /etc/paths
sudo sed -i ‘’ -e $’2i\\\n/opt/local/sbin’ /etc/paths

Test to see if it works:

python3 --version

It should return the correct version. If it doesn’t verify the path with “which python3”

Step 5: Configure SSH.

mkdir $HOME/.ssh
chmod 700 $HOME/.ssh
touch $HOME/.ssh/config
touch $HOME/.ssh/authorized_keys
touch $HOME/.ssh/known_hosts

# Set permissions
chmod 600 .ssh/authorized_keys
chmod 600 .ssh/known_hosts
chmod 600 .ssh/config

Generate a key pair

ssh-keygen -t rsa -b 4096

Results:

LAPTOPNAME:.ssh colin$ ssh-keygen -t rsa -b 4096
Generating public/private rsa key pair.
Enter file in which to save the key (/Users/colin/.ssh/id_rsa): 
Enter passphrase (empty for no passphrase): 
Enter same passphrase again: 
Your identification has been saved in /Users/colin/.ssh/id_rsa
Your public key has been saved in /Users/colin/.ssh/id_rsa.pub
The key fingerprint is:
SHA256:ujBhWvMctWsE6HMMkW2LbMREznU/30zZL1DNAHeckao colin@LAPTOPNAME.local
The key's randomart image is:
+---[RSA 4096]----+
|   ++o. .   ..+*=|
|   o++o. .   o *+|
|   o=o... o . + .|
|   .+o.o . o *  .|
|   .B + S   o + .|
|   + B + . E   . |
|  . o + o        |
|     o o         |
|      .          |
+----[SHA256]-----+

I generally don’t use a passphrase. There are good reasons to use them if you are working with more sensitive information.

Now set the permissions on your keys. They should have been correct, but we want to make sure.

chmod 600 .ssh/id_rsa
chmod 600 .ssh/id_rsa.pub

Create an ssh “config” file.

This makes life a lot easier especially if you have to use a proxy (bastion host)

edit the file “$HOME/.ssh/config”

# SSH Config file
#
# Hosts you connect to go here
Host myserver
  hostname my.server.com
  port 22
  IdentityFile ~/.ssh/id_rsa
  User colin

Host myserver
  hostname 192.168.1.10
  port 22
  IdentityFile ~/.ssh/santaclause_rsa
  User santaclause

# General Settings
#########################################################################################
Host *
  # Compression yes
  # ControlMaster auto
  # ControlPath ~/.ssh/ssh-ctrl_%r@%h:%p
  ForwardAgent yes
  LogLevel quiet
  ServerAliveCountMax 4
  ServerAliveInterval 240
  StrictHostKeyChecking no
  UserKnownHostsFile=/dev/null
  AddKeysToAgent yes
  User colin
  IdentityAgent "~/Library/Group Containers/2BUA8C4S2C.com.1password/t/agent.sock"

##########################################################################################
# Proxy Configuration
##########################################################################################
Host *+*
  ProxyCommand ssh -T -A $(echo %h |cut -d+ -f1) nc $(echo %h |cut -d+ -f2) %p 2>/dev/null

Note:

You can add a default user to the general settings (“User”) and you can send all known hosts to /dev/null if the hosts change and you don’t want notifications.

Customize as needed. Examples are here

Configure GIT if used

Git no longer allows passwords for access. If you are using git you will need to have a token setup. Additionally, you can configure HTTP or SSH (use SSH config).

# Add your name and email address.
git config --global user.name "John Doe"
git config --global user.email johndoe@example.com
git config --global color.ui true

Create a personal access token. Instructions are here

The token becomes your password. Be sure to put it in your password manager for future reference.

Aliases

A note for people new to OSX or Linux CLIs. When you have a preference for commands you want to run, using an alias is useful. I use them to start/stop docker containers or just customize a command for my usual preferences.

For instance, if you want to run “ls -lah” instead of “ls” because that is the version you use most frequently. We could also create a custom command ll to be ls -lah.

alias ls="ls -lah"
alias ll="ls -la"

This will change the ls command to ls -lah. Add this line to your $HOME/.bashrc file we created earlier

# Add to .bashrc 
# alias alias_name="command_to_run"

# Long format list
alias ll="ls -la"

# Print my public IP
alias myip='curl ipinfo.io/ip'

Security By Design

One of the requirements for companies to be certified in SOC2, ISO 27001, NIST 800–171, NIST 800–53, HITRUST, and others is security by design. This involves having a “well” setup laptop. (Windows or Mac)

Security by design is an approach to software and hardware development that seeks to make systems as free of vulnerabilities and impervious to attack as possible through such measures as continuous testing, authentication safeguards, and adherence to best programming practices.

Basic things:

• Turn on automatic updates for the operating system, browsers, and key applications. Only turn this off if there is a possibility for disaster from updates. If it’s turned off, set a schedule on your calendar to check and update the applications at least monthly.
• Only use CIS level 1 hardened containers and VMs for development work. It’s easier to do this than it is to figure out how to harden something already working.
• Never put passwords, keys, or other secrets into Github or in code.
• Never “Hack” something “To make it work”. Understand the settings and where the vendor wants them set.
• When writing code use a linter to make sure your code is good and to standard.
• Make sure libraries that you include “pip install xxx” are licensed for the work you do. Just because it is open source doesn’t mean it can be used for government work or commercial work.
• Use Snyk freemium for checking or something similar.
• Import only the part of the library you need in python from xxx import yyyy.
• Don’t be in the password business if you can avoid it. (Auth0 for instance)
• If you write a web application, make sure it supports cut-and-paste from at least two different password managers.
• Don’t bind yourself to specific versions of languages (python 3.8 v 3.10 v generic 3.x). Upgrading to the new version should never be an issue.

References:

• How to enable colorized output for ls command in MacOS X Terminal - nixCraft
• The MacPorts Project
• About the 1Password app integration | 1Password Developer
• The MacPorts Project
• JetBrains: Essential tools for software developers and teams
• NameChanger - MRR Software
• OnyX
• iTerm2 - macOS Terminal Replacement
• Snyk Code is now available for free | Snyk

I routine create python modules for security work and personal fun projects. Getting a directory structure prepared and prepped takes way too long manually. Recently I found a tool called “toptive python” that runs in Yeomn. It creates a shell, docker file, documentation and a complete skeleton for a well formed python module. Credit to “Franco Riberi”

The web's scaffolding tool for modern webapps | Yeoman

I use MacPorts to install NPM and yo.

$ sudo port install npm

$ sudo npm install -g yo

Then I installed Toptive-Python

$ npm install -g generator-toptive-python

For a little background, I use IntellJ Idea as my IDE but this will work for any IDE.

Now on to creating a shell repository in git hub.

Example:

Repository Name: medium-shell

Open your favorite browser and negotiate to Github

Example:

Open your terminal program

$ cd ${project_directory}

Run Topotive-Python

yo toptive-python

Uploading the initial shell to GitHub and creating the repository initialization.

• See GitHub Instruction from initial creation for more information.

razzamataz:IdeaProjects colin$ cd medium-shell/
razzamataz:medium-shell colin$ git init
Initialized empty Git repository in /Users/colin/IdeaProjects/medium-shell/.git/
razzamataz:medium-shell colin$ git add *
razzamataz:medium-shell colin$ git commit -m “first commit medium shell”
[master (root-commit) f2088a8] first commit medium shell
31 files changed, 968 insertions(+)
create mode 100644 AUTHORS.rst
create mode 100644 CHANGELOG.rst
create mode 100644 CONTRIBUTING.rst
create mode 100644 Dockerfile
create mode 100644 LICENSE.rst
create mode 100644 MANIFEST.in
create mode 100644 Makefile
create mode 100644 README.rst
create mode 100644 docs/Makefile
create mode 100644 docs/authors.rst
create mode 100755 docs/conf.py
create mode 100644 docs/contributing.rst
create mode 100644 docs/history.rst
create mode 100644 docs/index.rst
create mode 100644 docs/installation.rst
create mode 100644 docs/make.bat
create mode 100644 docs/readme.rst
create mode 100644 docs/usage.rst
create mode 100644 medium-shell/__init__.py
create mode 100644 medium-shell/medium-shell.py
create mode 100644 requirements/dev.txt
create mode 100644 requirements/prod.txt
create mode 100644 requirements/test.txt
create mode 100644 setup.cfg
create mode 100644 setup.py
create mode 100644 stests/__init__.py
create mode 100644 stests/common_resources.robot
create mode 100644 stests/default_suite.robot
create mode 100644 tox.ini
create mode 100644 utests/__init__.py
create mode 100644 utests/test_python_boilerplate.py
razzamataz:medium-shell colin$ git branch -M main
razzamataz:medium-shell colin$ git remote add origin git@github.com:cbitterfield/medium-shell.git
razzamataz:medium-shell colin$ git push -u origin main
Enumerating objects: 37, done.
Counting objects: 100% (37/37), done.
Delta compression using up to 16 threads
Compressing objects: 100% (32/32), done.
Writing objects: 100% (37/37), 13.05 KiB | 2.61 MiB/s, done.
Total 37 (delta 0), reused 0 (delta 0)
To github.com:cbitterfield/medium-shell.git
* [new branch] main -> main
Branch ‘main’ set up to track remote branch ‘main’ from ‘origin’.

Link to the actual repository I created.

The python tool “Bumpversion” is very useful here as well.

This shell is well formed and has everything you need in place to integrate with Travis and CICD pipelines.

Installing Bumpversion with MacPort Python

$ sudo port install py38-pip

— -> Some of the ports you installed have notes:
py38-pip has the following notes:
To make the Python 3.8 version of pip the one that is run when you execute the commands without a version suffix, e.g. ‘pip’,
run:
sudo port select — set pip pip38
sudo port select — set pip3 pip38
$ sudo port select — set pip pip38
Selecting ‘pip38’ for ‘pip’ succeeded. ‘pip38’ is now active.
$ sudo port select — set pip3 pip38
Selecting ‘pip38’ for ‘pip3’ succeeded. ‘pip38’ is now active.

$ pip install — upgrade bumpversion
Defaulting to user installation because normal site-packages is not writeable
Collecting bumpversion
Using cached bumpversion-0.6.0-py2.py3-none-any.whl (8.4 kB)
Collecting bump2version
Using cached bump2version-1.0.1-py2.py3-none-any.whl (22 kB)
Installing collected packages: bump2version, bumpversion
WARNING: The scripts bump2version and bumpversion are installed in ‘/Users/colin/Library/Python/3.8/bin’ which is not on PATH.
Consider adding this directory to PATH or, if you prefer to suppress this warning, use — no-warn-script-location.
Successfully installed bump2version-1.0.1 bumpversion-0.6.0

• Note for a Mac with MacPorts and your local bin file to your .profile, .zprofile, .bashrc or similar file. (Not recommended to add to global profile)

I use bash even though OSX 11.0 has recommended Zshell. Too many years of BASH programming to relearn.

$ echo “/Users/${USER}/Library/Python/3.8/bin” >> ~/.profile

Install Python virtualenv if not already installed.

Example:

$ sudo port install py38-virtualenv
Password:
 — -> Computing dependencies for py38-virtualenv
The following dependencies will be installed:
py38-appdirs
py38-distlib
py38-filelock
py38-six
virtualenv_select
Continue? [Y/n]: y

…

— -> Some of the ports you installed have notes:
py38-virtualenv has the following notes:
The executable is installed as ‘/opt/local/bin/virtualenv-3.8’. To symlink it to ‘/opt/local/bin/virtualenv’, run:

sudo port select — set virtualenv virtualenv38
$ sudo port select — set virtualenv virtualenv38
Selecting ‘virtualenv38’ for ‘virtualenv’ succeeded. ‘virtualenv38’ is now active.

Congratulations: You are now ready to code.

Setting up your MAC OSX 11 to use the AWS CLI and other python tools for accessing Amazon Web Services (AWS)

Every time that I change work laptops or upgrade my laptop to a new version of MAC OSX, I need to remove and reconfigure parts of MAC Ports and get things going. This is a short guide to getting things working for new OSX users working with the Amazon Command Line Interface (AWS CLI).

First step is to make sure that you have working credentials for a user account. For this we will need to create some IAM objects in your AWS Account. If you have root access or its equivalent, please login with those credentials. We will create the following objects:

Group named “ReadOnlyAdmin” <- Assigned RO Admin level credentials.
User named “roadmin” <- Added to Group
Keys for the User “roadmin”

Choose Create New Group

Enter Security Audit In the Policy and select it.

Create the Group

Now we create the User and add the user to the group.

Very important. Download the keys now. They will not be available later.

Very important. Download the keys now. They will not be available later.

At this point you should have the following handy:

1. Username
2. Access Key
3. Secret Key
4. Default Region (us-east-2)
   
   (Where are you working, us-east-1, us-east-2, us-west-1 and so on). I am working in us-east-2 (so that will be my default.

The MacPorts Project

Installation of MAC Ports for Python, Jupyter, and AWS CLI

1. Download the MAC Ports installer from: https://github.com/macports/macports-base/releases/

Setup the environment variables

Mac PORTS binaries and man pages are located under the /opt/local directory. There are two ways to accomplish setting the variables automatically. You can add them to the users profile or the global profiles. I prefer to add things globally so that other users can also use them. We need to set the following variables:

1. PATH
2. MANPATH

Run this command in the terminal window to create the appropriate path. You will need to close your terminal window and reopen to get the new changes after.

Adding the binaries after system binaries use this method:

sudo sh -c “echo “/opt/local/bin” > /etc/paths.d/mac-ports”

You can test if it worked by running this command

env | grep PATH

Results:

PATH=/usr/local/bin:/usr/bin:/bin:/usr/sbin:/sbin:/opt/local/Library/Frameworks/Python.framework/Versions/3.8/bin:/opt/local/bin

Adding the binaries before system binaries use this method.

• Note: After updates or upgrades you may need to run this

sudo sed -i ‘’ -e $’1i\\\n/opt/local/bin’ /etc/paths

sudo sed -i ‘’ -e $’2i\\\n/opt/local/sbin’ /etc/paths

Add the MANPATH Variable to the system

sudo bash -c "echo 'MANPATH=/opt/local/share/man:\$MANPATH' > /etc/manpaths.d/mac-ports"

You are all set to have easy access to MacPorts now.

Next we will add all of the tools we will need for developing AWS Python applications or access it with Jupyter Notebook.

1. Open the terminal window
2. run: sudo port install py38-awscli
    — -> Computing dependencies for py38-awscli
   The following dependencies will be installed:
   awscli_select
   bzip2
   expat
   gettext
   libedit
   libffi
   libiconv
   libyaml
   ncurses
   openssl
   py38-asn1
   py38-botocore
   py38-certifi
   py38-colorama
   py38-dateutil
   py38-docutils
   py38-ipaddress
   py38-jmespath
   py38-roman
   py38-rsa
   py38-s3transfer
   py38-setuptools
   py38-six
   py38-tz
   py38-urllib3
   py38-yaml
   python38
   python3_select
   python_select
   sqlite3
   xz
   zlib
   Continue? [Y/n]: Y
3. Set the Python as primary if you so desire:
   python38 has the following notes:
   To make this the default Python or Python 3 (i.e., the version run by the ‘python’ or ‘python3’ commands), run one or both of:
4. sudo port select --set python python38
   sudo port select --set python3 python38
5. Install Jupyter Lab (aka Notebook)
   sudo port install py38-jupyterlab

— -> Computing dependencies for py38-jupyterlab
The following dependencies will be installed:
ipython3_select
ipython_select
py38-appnope
py38-argon2-cffi
py38-async_generator
py38-attrs
py38-backcall
py38-bleach
py38-cffi
py38-chardet
py38-decorator
py38-defusedxml
py38-entrypoints
py38-idna
py38-ipykernel
py38-ipython
py38-ipython_genutils
py38-jedi
py38-jinja2
py38-json5
py38-jsonschema
py38-jupyter_client
py38-jupyter_core
py38-jupyterlab_pygments
py38-jupyterlab_server
py38-markupsafe
py38-mistune
py38-nbclient
py38-nbconvert
py38-nbformat
py38-nest_asyncio
py38-notebook
py38-packaging
py38-pandocfilters
py38-parsing
py38-parso
py38-pexpect
py38-pickleshare
py38-prometheus_client
py38-prompt_toolkit
py38-ptyprocess
py38-pycparser
py38-pygments
py38-pyrsistent
py38-requests
py38-send2trash
py38-terminado
py38-testpath
py38-tornado
py38-traitlets
py38-wcwidth
py38-webencodings
py38-zmq
pygments_select
zmq

— -> Some of the ports you installed have notes:
py38-ipython has the following notes:
To make this the default IPython or IPython3 (i.e., the version run by the ‘ipython’ or ‘ipython3’ commands), run one or both of:

sudo port select --set ipython py38-ipython
sudo port select --set ipython3 py38-ipython

py38-pygments has the following notes:
To make the Python 3.8 version of Pygments the one that is run when you execute the commands without a version suffix, e.g. ‘pygmentize’, run:

port select --set pygments py38-pygments

Configure AWS CLI for access to your AWS Account and test.

Configure:

From a terminal window run the following command. Remember to have your user keys handy.

$ aws configure --profile roadmins
AWS Access Key ID [None]: NZ7JN2HX3KC89PC79V09
AWS Secret Access Key [None]: !bAivY20SDQCFaB^A!G5VAy597va5ZufwVQGdab@
Default region name [None]: us-east-2
Default output format [None]: text

I am using a “profile” to avoid conflict with other user keys on my system. Each seperate user key pair can be a profile. If this is your first an only, you can omit the --profile part to configure the default profile.

Test:

Run this command to test
aws --profile roadmins ec2 describe-vpcs

Results should be similar:

VPCS 172.31.0.0/16 dopt-06a3366d default True 971650852359 available vpc-5f318134
CIDRBLOCKASSOCIATIONSET vpc-cidr-assoc-7410a21f 172.31.0.0/16
CIDRBLOCKSTATE associated
VPCS 10.1.0.0/16 dopt-06a3366d default False 971650852359 available vpc-028ffd91330d05253
CIDRBLOCKASSOCIATIONSET vpc-cidr-assoc-0c4bf677e28d16205 10.1.0.0/16
CIDRBLOCKSTATE associated
TAGS Name atc-vpc01

** I am assuming this is a new account without EC2s and other objects. So we will get a list of available VPCs because that exists in every new account.

Additional Reading and recommendations

1. Add your AWS ssh keys to .ssh/config and configure for easy access
2. Using Jupyter Notebook for accessing the AWS Cli
3. Additional tools that are useful in Jupyter notebook and MAC Ports: ImageMagick, Pillow, FFMEG, SQLite and any other linux tool you might want including tools like gnu versions of build-in tools (i.e. ggrep or gawk)

We called Sales and found out it will cost at lease $900.00/year per person. The other issue is that even with one salesperson, there is at least one or two other people that need access to the CRM data. The overall cost to start could be $2,700.00. My customer asked me if there were some alternatives. I checked out Godaddy (application) offering, among other openSource offerings. After some evaluation of openSource products currently being developed, we landed on SuiteCRM. I spoke to my friends over at Atlantic.NET for server costing, and they have a $10/month no-contract plan. So we opted for this option. Atlantic.NET also offers managed solutions and compliance managed solutions.

Customized Hosting Solutions For Your Business | Atlantic.Net

The $10/month server is a starter server. We chose Ubuntu (Bionic Beaver) 18.04 LTS for the most extended support. The Ubuntu 16.04.6 LTS (Xenial Xerus) is also an excellent choice. Both will be supported way into the future. Ubuntu created a long term support Linux option. It makes it a compelling argument for business.

SuiteCRM: “Our feature-rich enterprise-ready alternative to Salesforce provides all the benefits of CRM at substantially lower costs with the freedoms and flexibility of Open Source.”

SuiteCRM - Open Source CRM Software Application for Businesses

The compelling argument is that it can grow to a fully supported alternative to SalesForce.

SuiteCRM publishes the following requirements.

Recommended installation pre-requisites

• PHP
• JSON
• XML Parsing
• MB Strings Module
• Writable SugarCRM Configuration File (config.php)
• Writeable Custom Directory
• Writable Modules Sub-Directories and Files
• Writable Upload Directory
• Writable Data Sub-Directories
• Writable Cache Sub-Directories
• PHP Memory Limit (at least 128M)
• ZLIB Compression Module
• ZIP Handling Module
• PCRE Library
• IMAP Module
• cURL Module
• Upload File Size
• Sprite Support

The translation is there is not full documentation of the installation. This will eventually lead to a research project and discovering where it doesn’t work. This article is a shortcut to getting up in a few hours.

It is my opinion that a better way to put requirements is to have a list of commands for RHEL(yum) or DEB (apt). I have a personal preference for using Percona MySQL. I think it is a much faster implementation of MySQL, and the license is free. Be aware that not all free downloadable versions are free for commercial use (aka Oracle Version).

Notice: The 7.11 version says it supports Elastic Search. The smaller node I am using is too small for that. You need two cores and 8GB ram to run that.

Note:

Whenever you are installing a LEMP or LAMP configuration, you will need several user names and passwords.

• Linux Username (initially with password; SSH Key in production, set password to crazy long string)
• MySQL root password ( native mode, must web applications do not support the new password version yet)
• MySQL application username & password (Use current NIST Guidelines)
• Application admin user/password
• Application regular user/password — Sometimes

Linux Preparation

These instructions are not a full hardening guide. Please consult with CIS Benchmarks to harden your system before going into production and subsequently getting hacked. We are going to do a few security steps. Just to prevent problems.

1. Install pre-requisite software
2. Create a user
3. Create a banner message
4. Enable local firewall
5. Enable local antivirus
6. Enable 2FA (Google Auth) access
7. Remove all remote access by passwords.
8. Configure Apache to run

# Install pre-requisite software

# Percona SQL Server (MySQL)

sudo wget https://repo.percona.com/apt/percona-release_latest.$(lsb_release -sc)_all.deb
sudo dpkg -i percona-release_latest.$(lsb_release -sc)_all.deb

sudo apt-get update
# This will prompt you for a root password.
sudo apt-get install percona-server-server-5.7 -y

# Apache2
apt -y install apache2

# PHP7
apt -y install php php-cgi libapache2-mod-php php-common php-pear php-mbstring php-xml php-imap php-curl php-zip php-json php-mysql php-gd

# OS Packages
apt -y curl zip unzip sudo libpam-google-authenticator ufw sysvbanner certbot python-certbot-apache openjdk-8-jdk

# Update, Upgrade and remove old

apt update
apt upgrade -y
apt autoremove

At this point, take a moment to restart your server, in case the kernel has changed during the update process.

Create a user for this application:

# Update the Linux SKEL
mkdir /etc/skel/.ssh
touch /etc/skel/.ssh/authorized_keys
mkdir /etc/skel/html

# Create a location for this application
mkdir /data
useradd -c 'Suite CRM Application' -m -d /data/suitecrm --uid 3000 - -s /bin/bash suitecrm

# Set Crazy Password
SITE_PASS=${SITE_PASS:-$(< /dev/urandom tr -dc _A-Z-a-z-0-9 | head -c"${1:-32}";echo)}
printf  '%s\n%s\n' "${SITE_PASS?}" "${SITE_PASS?}" | passwd suitecrm
unset SITE_PASS

# Put your public key in authorized_keys
cat > ~suitecrm/.ssh/authorized_keys

# Set ssh permissions
chmod 700 ~suitecrm/.ssh
chmod 600 ~suitecrm/.ssh/authorized_keysb

# Create groups and group access
usermod -a -G suitecrm www-data
chown -R suitecrm:suitecrm /data

Create Basic Banner Message

banner SuiteCRM > /etc/update-motd.d/20-message

cat << EOF > /etc/issue.net
> 
> ==============================================================
> === Authorized Used only Contact (xxx) xxx-xxxx for help  ====
> ==============================================================
> EOF

My recommendation is always to set a banner message with a phone number. Implementing the machine banner is the first step towards CIS Level 1 hardening

Enable local firewall

UFW is standard on Ubuntu

sudo ufw allow proto tcp from any to any port 80,443

Port 22 is enabled by default. The best method is to enable a few ports and IPs in as practicable.

Install AntiVirus

It is a lengthy process. Sophos and ClamAV are excellent choices for free AV.

See sophos instructions for installation

Download Sophos Linux On-Access Malware Scanning Tool

Enable 2FA (Google Auth) access

https://www.linkedin.com/post/edit/6606348453519900672/

You need to have an authenticator app on your phone or tablet: Google Authenticator, LastPass Authenticator, Okta Verify, OneLogin, or others.

Fast Method:

# As root (answer yes to all questions)
google-authenticator

# As suitecrm (or your user account) answer yes to all
su - suitecrm

Now configure Linux for use:

Add Group group to limit SSH access to:

groupadd -g 2000 ssh_login
usermod -a -G ssh_login root
usermod -a -G ssh_login suitecrm

-- Plus any other user that will need to login.

File: /etc/ssh/sshd_config
Patch file to apply: patch -v sshd_config < sshd_patch

--- sshd_config 2019-12-25 22:45:41.226235267 +0000
+++ _sshd_config 2019-12-25 22:43:47.317481104 +0000
@@ -53,12 +53,12 @@
 #IgnoreRhosts yes

# To disable tunneled clear text passwords, change to no here!
-#PasswordAuthentication yes
+PasswordAuthentication no
 #PermitEmptyPasswords no

# Change to yes to enable challenge-response passwords (beware issues with
 # some PAM modules and threads)
-ChallengeResponseAuthentication no
+ChallengeResponseAuthentication yes

# Kerberos options
 #KerberosAuthentication no
@@ -106,7 +106,11 @@
 #VersionAddendum none

# no default banner path
-#Banner none
+Banner /etc/issue.net
+AllowGroups ssh_login
+
+# Turn on 2FA Authentication
+AuthenticationMethods publickey,keyboard-interactive

# Allow client to pass locale environment variables
 AcceptEnv LANG LC_*

If you are unfamiliar with a patch, copy the above text into a file named sshd_patch and then run the command. Careful regarding smart cut and paste

File: /etc/pam.d/ssh

Patch file to apply: patch -v sshd < sshd_pam_patch

--- sshd 2019-12-25 22:55:08.989319574 +0000
+++ sshd_new 2019-12-25 22:55:03.193291733 +0000
@@ -1,7 +1,7 @@
 # PAM configuration for the Secure Shell service

# Standard Un*x authentication.
-@include common-auth
+#@include common-auth

# Disallow non-root logins when /etc/nologin exists.
 account    required     pam_nologin.so
@@ -53,3 +53,7 @@

# Standard Un*x password updating.
 @include common-password
+
+# Enable google authenticator
+auth required pam_google_authenticator.so nullok
+

Reference:

https://www.server-world.info/en/note?os=Ubuntu_18.04&p=httpd&f=1

Database Installation

Creating a database is relatively straightforward. The exception is when your installation sets the mysql.sock somewhere the server can’t see or when the password is the new and more secure method, and the application doesn’t support it.

mysql -u root -p  [ Use your root password when prompted ]
mysql> create database suitecrm_db;
mysql> CREATE USER 'suitecrm'@'localhost' IDENTIFIED BY 'user_password';
mysql> GRANT ALL PRIVILEGES ON suitecrm_db.* TO 'suitecrm'@'localhost';
mysql> flush privileges;

Apache Installation

Get an SSL Certificate (free) but legitimate

systemctl stop apache2
certbot certonly --standalone -d www.yourdomain.com

There are lots of how-to guides about setting this up to (auto-update)

IMPORTANT NOTES:
 - Congratulations! Your certificate and chain have been saved at:
   /etc/letsencrypt/live/www.yourdomain.com/fullchain.pem
   Your key file has been saved at:
   /etc/letsencrypt/live/www.yourdomain.com/privkey.pem
   Your cert will expire on 2020-03-24. To obtain a new or tweaked
   version of this certificate in the future, simply run certbot
   again. To non-interactively renew *all* of your certificates, run
   "certbot renew"

Create a virtual host file

FILE: /etc/apache2/sites-available/001-suitecrm.conf

We set up a port 80 with a redirect to 443

# HTTP Redirect
<VirtualHost www.yourdomain.com:80>
        ServerName www.yourdomain.com
        ServerAlias www.yourdomain.com
        ServerAdmin webmaster@www.yourdomain.com
        DocumentRoot /data/suitecrm/html

        #LogLevel info ssl:warn
        ErrorLog ${APACHE_LOG_DIR}/www.yourdomain.com/error.log
        CustomLog ${APACHE_LOG_DIR}/www.yourdomain.com/access.log combined
        RewriteEngine on
        RewriteCond %{SERVER_NAME} =www.yourdomain.com
        RewriteRule ^ https://%{SERVER_NAME}%{REQUEST_URI} [END,NE,R=permanent]
</VirtualHost>

#HTTPS Server
<VirtualHost www.yourdomain.com:443>
   ServerName www.yourdomain.com
   ServerAlias www.yourdomain.com
   ServerAdmin webmaster@localhost
   DocumentRoot /data/suitecrm/html

   #LogLevel info ssl:warn

   ErrorLog ${APACHE_LOG_DIR}/www.yourdomain.com/error.log
   CustomLog ${APACHE_LOG_DIR}/www.yourdomain.com/access.log combined

   ServerName www.yourdomain.com
   SSLCertificateFile /etc/letsencrypt/live/www.yourdomain.com/fullchain.pem
   SSLCertificateKeyFile /etc/letsencrypt/live/www.yourdomain.com/privkey.pem
   Include /etc/letsencrypt/options-ssl-apache.conf

        <Directory /data/www.yourdomain.com/html>
                Options All -Indexes -ExecCGI +Includes +MultiViews
                <IfModule mod_dav.c>
                        DAV Off
                </IfModule>
                AllowOverride All
                Require all granted

        </Directory>

</VirtualHost>

</IfModule>

Activate the site: Make sure to enable the SSL module.

cd /etc/apache2/sites-enabled
ln -s ../sites-available/001-suitecrm.conf

a2enmod rewrite
a2enmod ssl

apachectl -t [Make sure you don't have typos]

systemctl restart apache2

Put a quick test file into place to verify it all works

cd ~suitecrm/html
cat > index.html
it works
[CTRL][C]

# After you verify it works, delete the index.html file.

SuiteCRM installation

Download the ZIP file: SuiteCRM-7.11.10.zip and copy it to your user account.

scp SuiteCRM-7.11.10.zip www.yourdomain.com:~/

This file is a zip archive. You can unzip it on your local machine and use SFTP to push it up. Or use a two-step method to get rid of the enclosing directory

# Assuming your zip file is in ~suitecrm
# Remove the HTML directory first, be caureful
cd ~/suitecrm
rm -rf html
unzip SuiteCRM-7.11.10.zip
mv SuiteCRM-7.11.10 html
chmod -R 775 html

Go to your web server *www.yourdomain

Some final housekeeping issues.

Add the cron job

# m h  dom mon dow   command
* * * * *  cd /data/suitecrm/html; php -f cron.php > /dev/null 2>&1

Modify PHP.ini

vi /etc/php/7.2/apache2/php.ini

change:
; Maximum allowed size for uploaded files.
; http://php.net/upload-max-filesize
upload_max_filesize = 2M

to

; Maximum allowed size for uploaded files.
; http://php.net/upload-max-filesize
upload_max_filesize = 10M

Configure your email server:

https://www.yourdomain.com/index.php?module=EmailMan&action=config

At this point, the installation is complete. We spent some extra time to put a little security in place. If you would like to enable SSO for your small business. JumpCloud provides SAML/SSO for ten users for free.

Active Directory and LDAP Reimagined - JumpCloud

The SSO configuration with SAML2 did not work as expected. I have opened an issue with SuiteCRM. Once, I have additional information. I will update this article.

References:

• JumpCloud Support Community
• JumpCloud Support Community
• Configuring SAML Attribute Mapping for SugarIdentity

In the military, we used two concepts two describe problems of technology: 1. People, Process, and Technology 2. Prescriptive v Kinistec.

These concepts will help to shape the way I describe common mistakes. In a prescriptive manner, we follow written guides for every aspect; alternatively, in the Kinesthetic learning method, we feel our way through the issues and deal with them based on how they make us learn through experiences (or gut instinct). Less experienced professionals use the latter by building consensus or dealing with high priority reactive issues. More experienced professionals are likely to follow proven written methodologies. Both perspectives have different advantages and disadvantages. In the concept of people, process, and technology, we demonstrate an understanding that all problems cannot be solved by only adding more people, more technology, or more intricate procedures. On the process side, the issue is demonstrated by how easily we are all driven crazy by telemarketers with scripts or every sale and interaction, followed by an in-depth survey.

The problem with many of these mistakes is it creates an ever-increasing technical debt against which security is consistently de-prioritized for business growth. The Agile methodology compound and exasperates the issues. The result is a set of data breaches and hacks that are always effective using standard techniques. The fact that the OWASP 10 issues haven’t changed much in the last ten years is a testament to this.

2019 was a banner year for data breaches. If you take a look at this list, you can see a well-known set of problems.

Great year for hackers: Top 2019 data breaches so far

1. Unsecured Webpage / Database / Service
2. Changing URL information
3. Commonly used passwords
4. Github w/AWS Keys
5. OWASP top 10

Mistake 1. Governance

Startup companies are just so happy that they got funding or got an application to be saleable that they ignore basic business functions like having policies.

The 20 CIS Controls & Resources

At a minimum, all companies need to have the following written Guidance:

1. Acceptable Use Policy
2. Password creation and maintenance Policy
3. Policy on Background Checks for employees with elevated access. (this can include Customer Service Representatives)
4. Security Framework
5. Secure Coding Practices
6. Standards and Review Procedures
7. Change Control Procedures
8. Key and Cryptographic rotation procedures
9. “Don’t put your passwords and keys in GitHub.”

When a company is 1–10 people working in a small space, these issues are settled by group consensus and yelling across the room, “What do you think we should do?”

As the business grows, customers and vendors may ask questions related to security and processes. I pulled this language from a public RFP.

Data Security. Evaluate and assess current enterprise database security controls for mission critical applications located within the Finance, Fire, Human Resources, and Water Services Departments. Assessment should focus on controls for both regulatory and legal compliance (HIPAA, PCI, PII) as well as controls protecting Restricted City Information (RCI) following the NIST Cybersecurity Framework, per http://www.nist.gov/itl/csd/launchcybersecurity-framework-021214.cfm and http://www.nist.gov/cyberframework/upload/cybersecurity-framework021214.pdf

Eventually, the sales process requires a company to tell its “security” story. Making sure your companies story will sell is essential.

Mistake 2:

Choose standards before anything gets built.

In the United States, we have national standards. In other countries, they have regulations as well. The NIST Standards are about 80–90% of most others. So following it will make it easier to do business domestically and internationally.

Read the full Executive Order on America’s Cybersecurity Workforce at https://www.whitehouse.gov/presidential-actions/executive-order-americas-cybersecurity-workforce/.

My recommendations are as follows:

1. NIST 800–53r4 or r5 when it comes out.
2. NICE: NIST 800–181 (a cut down version of 800–53)
3. CIS Hardening standards for all technology that has them. (AWS, Azure, GCP, Linux, Windows, Docker, etc) https://www.cisecurity.org/cis-benchmarks/. These are guides, not checklists.
4. Vendor Best Business Practices (AWS has a long list of these)

The NICE Cybersecurity Workforce Framework (NICE Framework), NIST Special Publication 800–181, is a national-focused resource that categorizes and describes cybersecurity work. The NICE Framework establishes a taxonomy and common lexicon that describes cybersecurity work and workers irrespective of where or for whom the work is performed. The NICE Framework is intended to be applied in the public, private, and academic sectors.

Mistake 3:

IP address management or lack of it

A common misconception is that you don’t need network engineering in the cloud. Most companies want to multi-hat someone that is a programmer, cybersecurity (enterprise-level), network guy, terraform programmer, and AWS expert. These are vastly different disciplines, and knowing just a little can have some disastrous problems in technical debt.

Everybody decides that they will rule the world and use a Class “A” address 10.0.0.0/8 everywhere in AWS. What they fail to understand is that all of that space, approximately 16.7 million IPs, needs to be tracked and can’t be duplicated anywhere in their organization.

When you spin up an AWS environment and assign 10.0.0.0/0 to each account, you can create a security tooling nightmare. Most tools still focus on IP addresses, not AWS ARNs. Proper Management of IP space will simply “oodles” of problems.

Case in point:

Almost every home and guest wireless networks use space from RFP 1918. (Private Addresses).https://tools.ietf.org/html/rfc1918

Recommendation 1: Don’t use the following address space anywhere in a startup. Avoiding some IP ranges helps you track rouge systems.

Home Routers: 192.168.0.0/16

Default AWS Space: 172.16.0.0/12

Widely used Class A portion: 10.0.0.0/16

These addresses are widely used by well-known retailer’s like Starbucks and in almost every hotel

Recommendation 2:

Subnet your 10.0.0.0 network into/16 or more. Subnetting will give you approximately 254 class “B” networks of 65,000 hosts.

Allocation Guidelines:

Corporate Offices: 10.1.0.0/16.

Guest Networks and VPN connector space: 10.2.0.0/16

Unrouteable Docker and Kubernetes internal networks: 10.255.0.0/16. Sub allocate this as much as possible.

10.3.0.0/16: AWS Root Account

10.3–254.0.0/16: AWS Sub accounts.

Use a /21 or 21 for each VPC (that is 4–8k of address space)

Make sure that Development, Test, and QA don’t have overlapping allocation. Avoid all temptation to use hardcoded IPs in your architecture and create IP identical environments.

Mistake 4:

Initial lack of Single Sign or and Over-reliance on O365/gSuite directories. To maintain the level of security required under almost any framework, you need to have centralized control over access to all cloud services, workstations, and OS based VMs. These must also have Two Factor(2FA) authentication.

Recently, I found JumpCloud that provides a free single sign-on for up to 10 users. After that, I recommend Okta and OneLogin.

Case in point:

Without variation, every AWS deployment starts with regular user accounts and off the wall IAM policies. Later there is a massive re-engineering effort to use a singles sign-on provider.

Recommendation:

Make sure that all of your vendors support SAML or LDAP for SSO.

Mistake 5:

Bad Cloud Architecture and capacity planning

Design your architecture to scale with your project growth. Don’t just add more “stuff” as needed.

The SDLC model of Development, Staging/QA, and Production is valid in all models. CI/CD is no different.

Recommendation:

Create at least the following AWS account structures:

• Root Account
• Development Account
• Staging Account
• Production Account
• Security and AdHoc Account.

Use complete automation to spin out the accounts and not the console. Configuration Management is another critical factor in security frameworks. Terraform is free and is very easy to use.

Recommendation:

• Know before you grow. — Do a costing model
• Make sure you are using the correct services. (RDS v EC2 w/database).
• Engage the AWS transformation teams before you start. They will frequently review your plan for free.

Mistake 6:

Too much reliance on vendors and too many vendors.

When it comes to security, using the shared security model to avoid doing the security work and oversight does not protect your company from the front page of the Wall Street Journal.

Do due diligence in your cloud vendors. If they store your customer’s information, they must comply with the standards required for wherever your clients are. They also must have the same or higher standards for access to data with their employees as you do.

Outsourcing your SOC and Infrastructure still has to have oversight and due diligence. Auditors will not accept, “They handle all that security stuff.”

Mistake 7.

Patch and Vulnerability program/system/methods for all of your infrastructure and IT systems. Antivirus and endpoint systems like Crowstike are not a common operating picture for risk.

In all cases, systems must be secure against published vulnerabilities. There are only two ways this happens is by scheduled updates or instance replacements.

Recommendation:

Even when your company is small, have a policy of patching all systems, including desktops within 30 days for Critical and High Vulnerabilities. Sixty days for everything else.

If you can’t patch a system because it will break a production, there are legitimate wats to deal with that besides ignoring it. You can create a mitigating control or process. You can accept the risk and work on fixing the production issue. The critical factor for security is recognizing the requirement, creating mitigations, and documenting the situation. Documentation will help you pass any security compliance audits.

Recommendation:

The Tenable suite of products is useful in providing a real-time solution to may of these issues to include continuous monitoring and oversight.

Tenable® - The Cyber Exposure Company

Mistake 8:

Lack of endpoint security controls in the production environment.

Recommendation:

Pick a solution that can support your corporate systems and workstations in addition to your cloud-based OS VM/EC2.

Solutions Sophos, Crownstrike, and others are all good.

File Integrity Monitoring and Antivirus/Malware scanning are requirements for NIST Compliance and CIS Hardening. However, it does not have to be a traditional on-demand scanner. It can be a once a week scan. There are free products (ClamAV, AIDES) and others.

Mistake 9:

Not hardening production systems and corporate workstations.

Recommendation:

Workstations:

- Data at Rest FIPS-140–2 encryption

- Bios Passwords

- Centralized management and configuration

Production Systems:

- CIS Level 1 hardening and Central Management

- Scheduled updates, patches or replacement

It is 1000 times easier to develop on hardened platforms, then it is to harden production platforms in uses.

Little known fact:

It is tough to prosecute a hacker or person for unauthorized use of a system without a legally approved banner and Acceptable Use Policy.

Mistake 10:

Not understanding the connection between Cyber Security and Business Development and Business Risk.

A good cybersecurity program, even if your company is three people working in a garage, gives your company an advantage in RFPs. It can enhance your business grown and be a “Force Multiplier” for the business. Customers read about the hacks and lack of security all the time. Having a good program makes your product or application more desirable. It can also reduce your insurance costs and liability.

Case in Point: Twitter

Former Twitter employees charged with spying for Saudi Arabia by digging into the accounts of kingdom critics.

Does Twitter have liability in the murder or wrongful death of this reporter? The employees of Twitter potentials were accessories before the fact in this murder. Perhaps Twitter may or may not have vetted its employees or had internal controls on their access to the data.

On 2 October 2018, Jamal Khashoggi, a US-based journalist and critic of Saudi Arabia’s government, walked into the country’s consulate in Istanbul, where he was murdered.

Mistake 11:

Depending on “Free” stuff for your business.

Thirty years ago, n Unix operating system could cost $1000 or more. Now, we have Linux virtually free. In past days software came with support and a back end of people making sure it was stable and secure. Today, the “community” finds problems and hacks. Patches and fixes happen when “community” reaches consensus. You have no legal recourse on anything you get for free. Paying for AWS does not protect you for an opensource software package.

There are many useful opensource products to help a startup company. There are also paid-for choices that can reduce development time and increase security. Free is free for the code, not for the time to learn, understand, and implement. (and in some cases remediate and re-architect.

Something to consider:

Look for opensource products that have the capability to moving up to a supported version. For instance, Terraform and Terraform Enterprise. JumpCloud free for ten users, and without reconfiguration the ability to grow.

Also, don’t let a vendor talking you into a free trial that turns into a paid product unless you understand the long-term cost. For instance, AWS free trial is more or less a single server for a year and associated services. If you start there and develop a production system, you will be there for a long time. Make sure your business model can support the growth of cost in the same manner that the business grows. In AWS, there is a typical pattern of EC2 -> Docker -> Kubernetes -> GCP evaluation due to cost and lack of understanding of how things scale and their associated fees.

Consider the most basic “Free Stuff of All,” the Internet. We get it for free from StarBucks, McDonald’s, WeWork, Airports, Major Cities, and more.

WeWork’s Lax Wi-Fi Security

Security issues with WeWork’s Wi-Fi network were first introduced in August 2019 in a Fast Company report, which noted that the company “used the same weak passwords and outdated Wi-Fi system throughout all its branches”. WeWork’s lack of password security has gotten to the point that it has regularly been featured on the list of the worst passwords that anyone can possibly use. The report described that WeWork’s Wi-Fi weak security is “laughably weak” and “downright dangerous.”

The “laughably weak” Wi-Fi at WeWork now has resulted in exposing the sensitive documents and data of it’s New York’s Financial District members.

Weak Wi-Fi Security at WeWork Exposes Data | Perimeter 81

Mistake 12:

Microservices and Data Comingling as it affects customers, cost, and sales.

Typically, developers are not well informed with issues of regulation, security, or costs. After something is in production, the business folks will tell them to reduce costs. They always come up with some microservice strategy with docker/Kubernetes. However, this always leads to data co-mingling of customer data (including logs). Some regulations regarding the Government, HIPPA, Financial systems frown on customers’ data co-mingling with other customers.

All systems consist of data and data that is protected by regulatory law. Regulations like PCI, PII, HIPPA, and more, requires two things:

- Data in-transit encryption

- Data at-rest encryption.

If you co-mingle your customer’s data, you may not be able to serve other customers.

If you use microservices and SSL offloading, then the data may pass through some systems unencrypted. This situation may require a considerable number of risk acceptance steps if it is accepted at all.

Mistake 13:

Treasure Maps and Booty

Where is your data?

How many copies are there?

If you have an eCommerce application, you may or may not have PCI information, depending on how you process payments. However, you most certainly have PII and PI data that requires protection under another standard like COPA or FERPA.

Making a copy of production data for developers to work with is risky. Especially if the data has a name, address, phone, number, security questions, logs, and purchases, hackers can use this for identity theft. Or perhaps someone could use it for stalking a famous person.

Recommendation:

Take the time to create a development set of data that is approved. It can be an automated pull of production that changes out PI/PII data for anonymizing.

Know where every copy is stored, how it is protected, and if you have backups.

Have a standard and a policy even if there are two of you,

Mistake 14:

Reconstruction

Disaster Recovery and Continuity of Operations.

Most startups don’t consider this until they are so big that figuring it out requires hiring a person for this.

In simple terms, know how to duplicate your production environment from scratch. If you created your AWS architecture with the console as it evolved, then you don’t know what it will take to duplicate.

A startup should be able to use a set of offline or in another region backup to regenerate a production environment in 24 hours.

Case in Point: World Trader Center 9/11/2001

Most financial companies had their backup data centers in the opposite tower with a fiber connection. They had their hot and warm sites destroyed at the same time. They had to revert to their cold sites in New Jersey and rollback the data to the last good backup.

Recommendation:

1. Be able to create your root and production AWS Accounts with terraforming and no console. Including links to your SSO provider.
2. Maintain code and data backups online and under control, even if that is an SSD in your safe.
3. Practice spinning up a new account and recovering the data once a year.
4. Github is excellent, but where is the physical location of the data? What if it is the same AWS data center that has a problem?

Mistake 15:

The acquisition of shiny objects.

Shiny Object Syndrome - Focus Works

Engineers, marketing people, programmers and office techs love chasing the next shiny new thing. It seems like every week, we can learn about a new technology, software, or media platform that promises to be the much better and easier thing to use than what we have. I call the instant reaction to this the “Shiny Object Syndrome.”

The more technologies, vendors, and complexity you create, the number of risks you add to your company increases.

There is an adage. If you own a hammer, then every problem is a nail. When you are hiring developers, they will want to shift the design the language or technology they used last, want to learn more about, or think will help their career.

If shifts in technology are unmanaged and focused on personalities, it can damage a company’s capabilities and growth.

Recommendation:

Pick your technology changes carefully. Make sure that any new technology does what you want without introducing a new problem. There are a plethora of unintended consequences that can occur. New technology for performance can lead to instability or increased costs.

Mistake 16:

Let your fingers do the walking: Yellow Pages

Ignoring DNS related issues

Most developers have a consumer-level understanding of how the Internet works and how data exfiltration can occur. Developers are good at what they do.

A few attacks and hacks related to DNS:

1. BotNets
2. DDOS
3. MTM
4. DNS Data Exfiltration
5. RansomWare

DNS Data exfiltration — What is this and How to use?

Route53 is useful for what it does. It is not a DNS firewall.

One of the most common security issues is Phishing by all its names and variations. I have heard no end of junior security engineer lecture me on the education of end-users, tricking them, consequences, and so on. When I was in the military, we had to take a 3 hours online class every year about knowing when it’s a phishing email. I receive many hundred emails on multiple accounts. I correspond with people from around the world some that have English skills that good use a little polish. Generally speaking, no matter how much education or ability an end-user has or anyone who is acting like an end-user at the time of the email has, they will fail prey 7–20% of the time. (This includes security professionals). The result for the Enterprise is we have to train people on phishing for compliance, to lower our cybersecurity insurance, and to perform due diligence in our security framework. It also requires us to find another defense.

Phishing mostly works when someone clicks on a link. A click either downloads malware or runs malware as an attachment. Most of the email systems like O365 and others filter out the malware attachments. By using a DNS firewall, we can eliminate the clickable threat. Most DNS Firewall services have a real-time feed that updates to prevent this clicks.

Besides, botnets and some malware use DNS for a Command and Control C2 system. If they can’t reach their controller, they can’t get activated. A DNS firewall provides reporting for actions that attempt communication to a controller and prevents them at the same time.

Most home internet providers provide some level of DNS firewall. If we use (8.8.8.8) Google DNS on workstations then, we bypass all levels of filtering and firewalls. There are cases that require avoiding our standard DNS procedures for testing, but it should not be the rule.

Little Known Fact:

Companies like BitSight, track the click-through to bad sites and report on this (about you) to other companies. BitSight will accept IP markers for guest networks.

Your IP usage belongs to your company. If your guest network allows full access to the Internet, all actions are yours and tracked.

For guest wireless networks, always makes sure they are using a protected DNS firewall and use different external IP ranges than regular employees. If employees use it, have them use it with a username and a password; then, have it change external IPs based on authentications.

Mistake 17:

“to close the stable door after the horse has bolted.”

Lack of VPN usage and understanding regarding cloud security.

In the current “Startup View” of the world, everything is a cloud service. Infrastructure from AWS/Azure/GCP, HR/Payroll from UltiPro, Benefits from SWIFT, and this list goes on. The new paradigm of the inclusive Internet and Business centers in apartment buildings creates new challenges.

Where are hackers located? Sometimes it is from upper Moldovia, and sometimes it is from a compromised desktop in San Clara, CA, on the Xfinity network.

Use VPN access when not in your office if you own your network. If you use a place like WeWork, always use a VPN.

The Zero Trust Secure Network as a Service | Perimeter 81

There are many providers like Permiter 81 that provide Zero trust access solutions. In a very general sense, you can have almost any Cloud Provider white list your Office or VPN IPs so that the whole rest of the world can’t access your SaaS services. Public based VPNs provide an additional level of protection. Unlike using the AWS VPN internal services, it connects and provisions based on your SSO provider.

Recommendation:

When setting up a VPN:

1. Limit concurrent user sessions.
2. VPNs are not for service accounts; they are for people.
3. Site2Site VPN is for services.
4. Check usage to ensure people are not connecting for extraordinary periods or moving extraordinary amounts of data.
5. Retain user access and session logs according to your data retention policy, or at least 90 days.

By using a VPN provider, you can also limit the number of points of access to your corporate and cloud services, which reduces your attack surface.

Mistake 18:

Fight as you train, train as you fight

We use the manta, “Fight as you train, train as you fight.” We translate this to any industry, “don’t do anything in development or staging that you don’t want in production.”

This concept is general, but failing it very costly.

Case in point:

Don’t let developers work on non-hardened OS Images or Docker Images. If it is allowed, they will find some way to create code that does not work after security is applied. Security needs to evolve with the development needs, not created after. The best practice is development on standard and secured images.

Layer the application development like icing on a cake. Don’t try to slide a cake under the icing

Develop your business and technical process end to end with security in place. Don’t just stop when you “get it working.”

Jenkins systems that are unsecured are just as prevalent as AWS keys in Github.

Mistake 19:

Use your Gym Membership

Although this sounds funny, how many people have a gym membership that they pay for and never use. Even if they go, how many people know all of the services available to them under their membership plan.

This translates to, Use what you are paying for to the fullest and don’t get talked into “Best of Breed” solution sets.

You don’t buy a car in pieces, chassis from one vendor, engine from another transmission from a third, and computer systems from a fourth. Just because they all said, “Conforms to Open Standards.”

• Review your security tooling annually
• Fully utilize your tooling.
• Make sure it all works together.
• Reduce the number of “places” people have to look for information
• Create a common operating picture for your company

Do all of this while you are at the beginning. It only gets harder as things get more complicated.

Mistake 20:

Rogues, Thieves, and Dreamers

I can’t tell you the number of times a developer, financial person, security engineer, or some other team member tells me how their project can’t conform to the company guidelines. What they mean is they don’t know how to do it, or it’s too much work for them to do it, or perhaps some other variation.

There is a minimal set of security standards that must be applied to even be in this market place.

• Central User Management
• System Hardening / Layered Defenses
• Infrastructure Hardening / East-West Security
• Edge Hardening / North-South Security
• External Defenses
• Good Housekeeping Practices (user remove, data purges, etc.)
• DR/CooP capabilities

There is no credible case to step outside of this.

Every AWS account should be pre-hardened to a standard before you create a service.

Every OS/VM/EC2/Docker image needs hardening before its use, including how the base OS (or in ZERO os systems) Software is updated.

If the standard doesn’t work for the new project, use a process to update the rule. Don’t create a long list of edge cases with different standards.

Implementation of baseline controls is a must from AWS to VPNs, including Coffee Pots, Refrigerators, and animated dolls.

Mistake 21:

Isaac Asimov’s “Three Laws of Robotics”

• A robot may not injure a human being or, through inaction, allow a human being to come to harm.
• A robot must obey orders given it by human beings except where such orders would conflict with the First Law.
• A robot must protect its own existence as long as such protection does not conflict with the First or Second Law.

Translation: Don’t forget about IoT in the workplace.

In a modern workplace, tons of IT “stuff” exists. IoT equipment is easy to overlook. Sometimes it just walks in. Here are some crazy ones to look for and make sure they have at least a password on them. IoT is not limited to WiFi, BlueTooth, Zigbee, and other protocols are also used. If it can have an App, it’s connected.

• Security Systems, Cameras, Elevators
• Coffee Makers, Dishwashers, Refrigerators, Game Systems
• Copier, Fax, Printer Multifunction devices.
• Vendor provided equipment(postage machines)
• Loyalty Systems, Guest Checking Systems
• Conference Room Equipment and TVs.

Think about if someone got control of your TV and recorded every presentation. Perhaps used the Office printer as a scanner sniffing device and emailed copies of every document printed.

A lot of very inexpensive equipment as “very inexpensive” security.

Mistake 22:

The world is listening

There is no law against anyone sniffing wireless signals and gaining information from them.

WiFi is ubiquitous in the workplace. Cisco provides an excellent series of tools to secure wifi.

Basic Rules:

1. No access without credentials
2. Protect DNS
3. Don’t allow old devices or Rooted Devices to connect.
4. Log Connections and usage for at least 90 days.
5. Track for rogue equipment if practical.
6. SSID for the company should not be the company name.
7. Guest SSID should also not be the company name or the word “Guest.”
8. Don’t put encryption levels (WPA, for instance) in the SSID.
9. Every security domain and location should have a different external address.
10. All Wifi Equipment needs updating within 30 days or less. Don’t forget about it in a closet.

Wireless LANs (WLANs) bring incredible productivity and new efficiencies to organizations of all sizes. Advances in WLAN features and capabilities allow organizations to offer the benefits of wireless to their employees without sacrificing security. Properly deployed, WLANs can be as secure as wired networks. This paper discusses the five steps to creating a secure WLAN infrastructure. link

Mistake 23:

Liberté, égalité, fraternité

The IT department and corporate infrastructure is not subject to different rules, policies and leadership.

I see this one a lot in the DOT COM startup world. The product engineering side grows until they need to hire enough people to have a corporate team. Because the engineering team did not conform to standards, they set up a situation of us v them. When the company grows to an Enterprise level, the teams merge with varying levels of success.

When a company starts with baseline security from the beginning, it provides freedom to grow unrestricted by technical debt. All aspects of engineering and corporate are equally important. All security professionals belong to the same fraternity. If a burglar or nefarious individual make their way into the corporate side, they sidestep to the product engineering environment.

Without governance and baseline controls, applied from the beginning, the company acquires technical debt that is very expensive and hard to pay.

Mistake 24:

Yertle the Turtle and other stories.

The Shared Responsibility Model (AWS)

AWS responsibility “Security of the Cloud” — AWS is responsible for protecting the infrastructure that runs all of the services offered in the AWS Cloud. This infrastructure is composed of the hardware, software, networking, and facilities that run AWS Cloud services.

Many professionals think that the OS instances in EC2 are secured or that AWS performs some magic related to security. They are not responsible for making sure your account, neither is Azure or GCP, is secure meets a standard or protected in any way. They are also not responsible if your EC2s crash or reboot.

Before using “Infrastructure as a Service” read the SLAs for each service that you use.

Amazon’s business is to provide a service for money and get you to spend as much money as you want with them.

It is easier to build your service or application on a solid foundation; then it is to fix the Millennium Tower. As an example, the building cost $350 million to build and now will take $100 million to fix, if it is fixable at all. A better initial foundation cost is a fraction of the repair bill.

IT systems are very similar. Build it secure, and it will scale as large as you want. These structures were technology for security.

Mistake 25:

A submarine with a screen door

AWS Accounts are not ready to go. They need to be secured.

AWS provides great services. They have great people and innovative technology. A new account is very far from secure. Much like this screen door.

I ran an initial scan on a new AWS account courteous of CloudSplot. They provide a free account for startups to check out their security posture. Their service offers a series of features that help find and fix security issues.

CloudSploit | Cloud Security as a Service

I will place the CSV scan results on Github along with Terraform projects that go with these articles.

cbitterfield/odessa_media

In summary, the issues of infrastructure security only get harder to implement over time. Each of these issues is root in People, Process, and Technology and none of them can be solved by downloading a how-to guide 2 years after production work started. One of the key concepts in security work is due diligence. Even if you do everything right, your company still can experience a breach. But if you have done everything right along the way, you have a much better story to tell to your investors and customers.

My next article will feature wiring up a new AWS account with Terraform to resolve the security issues and create a method for deploying the same security to all sub-accounts.