6 ms·
The security exec at Pivotal, where I work, has been talking about "repaving" servers as a security tactic (along with rotating keys and repairing vulnerabiliti
by jacques_chester 10y ago
The security exec at Pivotal, where I work, has been talking about "repaving" servers as a security tactic (along with rotating keys and repairing vulnerabilities).[0]
The theory runs that attackers need time to accrue and compound their incomplete positions into a successful compromise.
But if you keep patching continuously, attackers have fewer vulnerabilities to work with. If you keep rotating keys frequently, the keys they do capture become useless in short order. And if you rebuild the servers frequently, any system they've taken control of simply vanishes and they have to start from scratch.
I'm not completely sold on the difference between repair and repave, myself. And I expect that sophisticated attackers will begin to rely more on identifying local holes and quickly encoding those in automated tools so that they can re-establish their positions after a repaving happens.
But it raises the cost for casual attackers, which is still worthy.
[0] https://medium.com/built-to-adapt/the-three-r-s-of-enterprise-security-rotate-repave-and-repair-f64f6d6ba29d#.k3dj6wlp1 https://medium.com/built-to-adapt/the-three-r-s-of-enterpris...
- tptacek 10y agoHaving everything patched as soon as patches are available (or within, say, 6 hours of availability, for "routine" patches, with better responsiveness for critical patches) is a win. The rest: not so much. Rebuilding continuously for security is not something I would recommend.
- jacques_chester 10y ago> Rebuilding continuously for security is not something I would recommend. So that I understand, could you elaborate? Particularly, do you mean "not recommend" as in "recommend against" or "not worth the bother"?
- tptacek 10y agoIt's not worth the bother. Apart from keeping patches up today --- which is a good idea --- it's probably not really buying you anything. It's not crazy to periodically rotate keys, but attackers don't acquire keys by, you know, stumbling over them on the street or picking them up when you've accidentally left them on the bar. They get them because you have a vulnerability --- usually in your own code or configuration. Rebuilding will regenerate those kinds of vulnerabilities. Attackers will reinfect in seconds.
- jacques_chester 10y agoThat was my hunch too. Thanks. I'll ask more about whether I missed something on the other side of the argument.
- tkiley 10y agoIt seems like it's good to be able to rebuild everything at a moment's notice after patching against a major exploit, though. You should have a fast way to rebuild secrets and servers after the next heartbleed-scale vulnerability.
- tptacek 10y agoBeing able to rebuild critical infrastructure from source, and know that you'll be able to reliably deploy it, is a _huge_ win for security. After a bunch of harrowing experiences with clients, I'm pretty close to believing "using packages for critical infrastructure is a bad idea".
- helloiamaperson 10y agoBeing able to rebuild critical infrastructure from source, and know that you'll be able to reliably deploy it, is a _huge_ win for security. In that case, you might be interested in bosh: http://bosh.io/docs/problems.html http://bosh.io/docs/problems.html (the tool that enables the workflow jacques_chester was describing). It embraces the idea of reliably building from source for the exact reasons you've mentioned.
- Noumenon72 10y agoWhat does "packages" mean here? Sorry.
- deleted 10y ago[deleted]