3 ms·
Right so all the stars need to align for it to go unnoticed - compromised server, firewall and other alerting/monitoring tools. I would have thought one single
by Narkov 8y ago
Right so all the stars need to align for it to go unnoticed - compromised server, firewall and other alerting/monitoring tools.
I would have thought one single unexpected packet in these high security environments would raise significant alarm bells and any anomaly would be found very quickly.
- RL_Quine 8y agoI've worked on systems deployed in the financial sector in high risk environments. This sort of monitoring doesn't happen in the real world.
- Narkov 8y agoIntrusion Detection Systems are basic network security 101 type stuff. I'd be surprised if anything that was really "high risk" didn't use an IDS.
- detaro 8y agoThere's a big difference between "using an IDS" and "a few unintended/unexpected packets are noticed and properly followed up on".
- deleted 8y ago[deleted]
- Recurecur 8y agoIntrusion detection involves connections coming from the outside. These attacks originate inside the network, from the compromised equipment. Except on extremely controlled networks, this would be very hard to detect. It gets even worse when you consider that the Chinese had/have a distributed network of compromised machines. Imagine using a Google edge server as a dead drop...
- andrewflnr 8y agoAn IDS is perfectly capable of flagging outgoing or internal traffic.
- calgoo 8y agoWe had something similar where anything outside "normal" generated a ticket. It was disabled after 1 week because the support teams where getting more then 5000+ tickets each day. And this was after filtering etc.... Now this does not make it impossible, just very complex. In a more "controlled" environment such as a naval ship, i could see this actually working better, especially if the system is supposed to talk to very few external systems.
- contingencies 8y agoIt does. I've deployed systems that would not only notify staff when novel packets were observed but immediately isolate anomalous hardware through a combination of powerdown and network fabric reconfiguration.
- jki275 8y agoThe amount of false positives a system like that would generate would rapidly render such a system entirely unusable.
- contingencies 8y agoNot in a secure environment... where you are supposed to control the hardware, the software, and the network absolutely.
- jki275 8y agoThe only way to create such an environment is to totally disconnect it from the outside world -- I'm talking even power source, phones, internet, all of it has to be disconnected or else I can exfil data all day long and nobody would ever know.
- contingencies 8y agoYes, but eventually you have to get something done. Security engineering is about tolerable failure modes. - Dan Geer (2014)
- uuuups 8y agoHe was the "first employee and architect @ Kraken (2011-2015)". That might explain why Kraken spews out 502s all the time.
- contingencies 8y agoDear snarky anonymous coward, as stated I left in 2015. I think you will find referenced issues occurred subsequent to that date under very different technical leadership.
- Spooky23 8y agoOnly if you’re lucky. Priority is checking boxes and meeting audit requirements. If you’re running an IDS on a big 100 Gb datacenter network, you’re literally processing millions of events. Very few places would notice such a thing unless they were investigating something related, and the ones with the capability are going to be for static workloads as getting anything done will be slow and painful.