5 ms·

TL;DR - "If you really want to protect your network you have to know your network, including all the devices and technology in it" There, saved you a click.

unethical_ban 11y ago
It's much deeper than that. I think he also made a subtle joke at how even if you think you know what's on your network, they know the entire technology stack running it. It also had a lot of common best practices like asset management, strong network segmentation and inspection, anomaly detection, and application whitelisting. The sort of stuff you hear about on the Critical Security Controls Top 20. https://www.sans.org/critical-security-controls/ https://www.sans.org/critical-security-controls/
nickpsecurity 11y ago
I've always found it better to emulate high-security engineers at defense contractors and IAD instead of listening to their hackers. The hackers are good for spotting problem areas. As in my other comment, the defense side in academia and high-assurance market has been effectively countering them for decades. People just don't apply what was learned. On my end, being limited back then, I combined whatever proven method I could with obfuscation across the board. That by itself, per monitoring, stopped very sophisticated attacks that common approaches failed to. They'd have to hack it to even figure out how it worked and was configured. Then they could hack it normally. See how that doesn't work out for them? ;) The attacks would transition to physical infiltration (never happened I think...) or social engineering (mitigated many). Examples for your amusement: (a) using obscure processors + OS's + network-layer guards while advertising they're x86 Linux boxes; (b) sandwiching a custom, randomly-generated, messaging protocol or middleware w/ security features between others; (c) my polymorphic ciphers w/ several AES candidates, random iteration, and random counter values; (d) real port-knocking like SILENTKNOCK variant that doesn't advertise itself; (e) hiding authentication or taint (for tracing) data in checksums at various layers; (f) straight ripping privileged code out of a system while using minimal, unusual libraries for stdlib etc; (g) tools like Softbound + CETS to automatically make stuff safe or languages that do by default. Lots of tricks that require almost no work, don't negate the security of proven components, require almost no maintenance (outside OS stripping) once you deploy them, and stop or detect all kinds of attacks. Proven against nation-state attackers time and time again. Just wait till I integrate stuff from SecureCore, Air Force's HAVEN, SAFE, or CHERI processors plus my randomization/obfuscation shit at HW level. Need funding & specialists for that but I'm still doing high-level designs & research in case I ever get it. NSA already failed to breach weaker versions of that. TAO gonna scream when next-gen versions get rolled out into production. ;)
- Joof 11y ago
  You have a lot of fun :) Thanks for the read.
  - nickpsecurity 11y ago
    Sure thing. I hope you copy one or more of them to have fun yourself at attackers' expense. I like to imagine my work results in hackers doing stuff like this: https://images.duckduckgo.com/iu/?u=http%3A%2F%2Fcdn.patch.com%2Fusers%2F22830411%2F2014%2F12%2FT800x600%2F201412547de3f8799a8.jpg&f=1 https://images.duckduckgo.com/iu/?u=http%3A%2F%2Fcdn.patch.c...
- arca_vorago 11y ago
  I'm convinced that its wrong to say there is no security in obscurity. It's just one more layer in what should be many, and it has many benefits(simple example: ssh port changing at least reduces alert fatigue so I know when I get a lvl 10 from OSSEC I know I need to dig into it asap!) Port knocking is great as well. Sounds like you are doing great work!
  - nickpsecurity 11y ago
    "and it has many benefits(simple example: ssh port changing at least reduces alert fatigue so I know when I get a lvl 10 from OSSEC I know I need to dig into it asap!)" Interesting point. False alarms were small enough that I never thought to measure the impact of alert fatigue in these changes. Might consider it in the future. "I'm convinced that its wrong to say there is no security in obscurity." It might help to just call what we're doing obfuscation. That's the proper term. Security by obscurity is either defined as or is connected to the concept that only hiding the details would keep you safe. In our examples, we're using a strong, security technique plus hiding a critical aspect of how we use it. Take away the hidden part, it's still at least as strong as a good, security technique. Hence, we're obfuscating otherwise good security rather than doing security by obscurity. "Sounds like you are doing great work!" Appreciate it! Email me if you want to see other solutions or essays I did. I let people copy them without fee so long as they give credit. No blog so it's currently a lot of text files and links to master copies on Schneier's blog.

unethical_ban 11y ago

It's much deeper than that. I think he also made a subtle joke at how even if you think you know what's on your network, they know the entire technology stack running it. It also had a lot of common best practices like asset management, strong network segmentation and inspection, anomaly detection, and application whitelisting. The sort of stuff you hear about on the Critical Security Controls Top 20. https://www.sans.org/critical-security-controls/ https://www.sans.org/critical-security-controls/

nickpsecurity 11y ago

I've always found it better to emulate high-security engineers at defense contractors and IAD instead of listening to their hackers. The hackers are good for spotting problem areas. As in my other comment, the defense side in academia and high-assurance market has been effectively countering them for decades. People just don't apply what was learned. On my end, being limited back then, I combined whatever proven method I could with obfuscation across the board. That by itself, per monitoring, stopped very sophisticated attacks that common approaches failed to. They'd have to hack it to even figure out how it worked and was configured. Then they could hack it normally. See how that doesn't work out for them? ;) The attacks would transition to physical infiltration (never happened I think...) or social engineering (mitigated many). Examples for your amusement: (a) using obscure processors + OS's + network-layer guards while advertising they're x86 Linux boxes; (b) sandwiching a custom, randomly-generated, messaging protocol or middleware w/ security features between others; (c) my polymorphic ciphers w/ several AES candidates, random iteration, and random counter values; (d) real port-knocking like SILENTKNOCK variant that doesn't advertise itself; (e) hiding authentication or taint (for tracing) data in checksums at various layers; (f) straight ripping privileged code out of a system while using minimal, unusual libraries for stdlib etc; (g) tools like Softbound + CETS to automatically make stuff safe or languages that do by default. Lots of tricks that require almost no work, don't negate the security of proven components, require almost no maintenance (outside OS stripping) once you deploy them, and stop or detect all kinds of attacks. Proven against nation-state attackers time and time again. Just wait till I integrate stuff from SecureCore, Air Force's HAVEN, SAFE, or CHERI processors plus my randomization/obfuscation shit at HW level. Need funding & specialists for that but I'm still doing high-level designs & research in case I ever get it. NSA already failed to breach weaker versions of that. TAO gonna scream when next-gen versions get rolled out into production. ;)

Joof 11y ago
You have a lot of fun :) Thanks for the read.
- nickpsecurity 11y ago
  Sure thing. I hope you copy one or more of them to have fun yourself at attackers' expense. I like to imagine my work results in hackers doing stuff like this: https://images.duckduckgo.com/iu/?u=http%3A%2F%2Fcdn.patch.com%2Fusers%2F22830411%2F2014%2F12%2FT800x600%2F201412547de3f8799a8.jpg&f=1 https://images.duckduckgo.com/iu/?u=http%3A%2F%2Fcdn.patch.c...
arca_vorago 11y ago
I'm convinced that its wrong to say there is no security in obscurity. It's just one more layer in what should be many, and it has many benefits(simple example: ssh port changing at least reduces alert fatigue so I know when I get a lvl 10 from OSSEC I know I need to dig into it asap!) Port knocking is great as well. Sounds like you are doing great work!
- nickpsecurity 11y ago
  "and it has many benefits(simple example: ssh port changing at least reduces alert fatigue so I know when I get a lvl 10 from OSSEC I know I need to dig into it asap!)" Interesting point. False alarms were small enough that I never thought to measure the impact of alert fatigue in these changes. Might consider it in the future. "I'm convinced that its wrong to say there is no security in obscurity." It might help to just call what we're doing obfuscation. That's the proper term. Security by obscurity is either defined as or is connected to the concept that only hiding the details would keep you safe. In our examples, we're using a strong, security technique plus hiding a critical aspect of how we use it. Take away the hidden part, it's still at least as strong as a good, security technique. Hence, we're obfuscating otherwise good security rather than doing security by obscurity. "Sounds like you are doing great work!" Appreciate it! Email me if you want to see other solutions or essays I did. I let people copy them without fee so long as they give credit. No blog so it's currently a lot of text files and links to master copies on Schneier's blog.