I like that madaidan is thinking deeply about these issues, and I think this is a great intro to the subject, along with some very interesting comments on the p

I like that madaidan is thinking deeply about these issues, and I think this is a great intro to the subject, along with some very interesting comments on the page. madaidan is also behind obscurix which is a hardened arch variant [1]. I tend to think the containerization of apps is the lowest hanging fruit approach, but I also think that there is a larger underlying issue touched upon which is the monolithic style of the current linux kernel, which is why I have also hoped HURD would rise some day, and continue to find minix 3 very interesting. All that said, I see one glaring omission: hids. One thing I like to emphasis with people is that especially in an age of APT, if someone sophisticated enough is targeting you, you will probably suffer a compromise. One of the most vital parts of a security model therefor is reducing the amount of time it takes to discover a compromise. This is highly undervalued in modern orgs imho. There are a few different ways to do this, and none are perfect but I tend to prefer a good HIDS like ossec, sometimes custom scripts checking file hashes, etc. There is one large weakness here though, which is how often I see a hids deployed but 1) not configured well, and 2) the logs never get monitored/ingested/alerted on! If you can combine a good hids and actually monitor the log outputs, you can discover most compromises fairly quickly with telltale system actions. Lastyly, this is also why versioned backup is so important. Because you need to be able to trust old data pre-compromise. The longer you go without knowing you are comped, the more likely you have data being restored that is comped also. [1] https://github.com/Obscurix/Obscurix https://github.com/Obscurix/Obscurix