4 ms·

> the security moves to the application The application access should be secured IN ADDITION to network access to it being secured! Security in layers is a th

> the security moves to the application The application access should be secured IN ADDITION to network access to it being secured! Security in layers is a thousands years old concept. Castles for example where built with multiple concentric walls that defenders could fall back to if the outer perimeter was compromised. Reasons for corporate IT network are multiple: the application could have an exploit at some point, the employee credentials could be compromised (even dual factor), the application if publicly exposed is vulnerable to denial of service even if it remains completely secured, vulnerabilities can be scanned if public, etc, etc. Please stop repeating bullshit from "zero security" vendor marketing materials.

pletnes 6y ago
When the network is so secure I can’t do my job anymore, I suggest to air-gap the power supplies. Ultimate security.
yodelshady 6y ago
I'm a bit sceptical - not rubbishing, but sceptical - of the castle walls analogy. If an attacker gets through your walls (network access), why do you think you'd stop them at the keep? I think castles have something of an answer to that question, because physical static defence is just more constrained than computational static defence - the ratio of effort of building a wall : effort to breach is poor compared to even complex passwords. Your REAL physical defence is(are?) your soldiers, and the wall mainly aids their co-ordination: small attacks aren't worth attention, big attacks are SLOW AND VISIBLE. Does infosec have a similar wall to that? Certainly, when attackers breached castle walls via backdoors, it was normally game over, keep or no.
- curryst 6y ago
  > If an attacker gets through your walls (network access), why do you think you'd stop them at the keep? This whole analogy is bad, but to work in the context of it, each of the castles defenses is impenetrable (Wolverine went back in time and taught them to make adamantium). The only way to get through is to discover and exploit flaws in the design of the defenses. If they breach the walls, they still have to find an exploit a flaw in the keep, _before_ you notice they made it through the first wall, rebuild the first wall without the defect and then send your wolverine-knight automatons to clean up the survivors. In this scenario, IDS/IPS systems are your scouts watching for invaders that breach the first wall. Importantly, the designs of these walls change all the time, so the attackers need a window during which both the keep and the walls have a design flaw. And unless the flaw is in something common to both the keep and walls, it is unlikely to be common to both (OpenSSL is an example of that). > small attacks aren't worth attention, big attacks are SLOW AND VISIBLE This is not true of castles nor infosec. A huge enemy force against a well-defended castle meant they likely mean to lay siege and starve them out of the castle. Not a significant concern so long as you have food and water; especially so if your resources would outlast their supply lines. Small forces on the other hand are exceptionally dangerous, because it's probably a sapper party that's going to try to tunnel under your wall and detonate explosives (or just collapse the tunnel if this is pre-explosives). Sappers are almost infinitely more dangerous. You can see the same pattern repeat in World War I. Trenches with machine guns are nearly impenetrable to attackers, thus No Man's Land. So we went back in time and re-created sappers to dig tunnels under their trenches. Having the other side come over their trenches at you is far less concerning than hearing sappers digging under you. Infosec is the same way. Port scans and attempted DDoS attacks are common, easily noticed, and unlikely to lead to anything threatening. Your real risk is being targeted. Someone interested in you specifically because of the data you have, or money, or whatever. People that will poke around your stuff in ways that are hard to notice, like analyzing your auth flow for vulnerabilities. Those are your digital sappers. Large DDoS attacks are bad, because they can knock you offline, but it's like a seige. All you have to do is outlast them, at the end of the day you lost some productivity but the castle is still intact. If the sappers get in, you go offline _and_ they'll steal your data.

pletnes 6y ago

When the network is so secure I can’t do my job anymore, I suggest to air-gap the power supplies. Ultimate security.

yodelshady 6y ago

I'm a bit sceptical - not rubbishing, but sceptical - of the castle walls analogy. If an attacker gets through your walls (network access), why do you think you'd stop them at the keep? I think castles have something of an answer to that question, because physical static defence is just more constrained than computational static defence - the ratio of effort of building a wall : effort to breach is poor compared to even complex passwords. Your REAL physical defence is(are?) your soldiers, and the wall mainly aids their co-ordination: small attacks aren't worth attention, big attacks are SLOW AND VISIBLE. Does infosec have a similar wall to that? Certainly, when attackers breached castle walls via backdoors, it was normally game over, keep or no.

curryst 6y ago
> If an attacker gets through your walls (network access), why do you think you'd stop them at the keep? This whole analogy is bad, but to work in the context of it, each of the castles defenses is impenetrable (Wolverine went back in time and taught them to make adamantium). The only way to get through is to discover and exploit flaws in the design of the defenses. If they breach the walls, they still have to find an exploit a flaw in the keep, _before_ you notice they made it through the first wall, rebuild the first wall without the defect and then send your wolverine-knight automatons to clean up the survivors. In this scenario, IDS/IPS systems are your scouts watching for invaders that breach the first wall. Importantly, the designs of these walls change all the time, so the attackers need a window during which both the keep and the walls have a design flaw. And unless the flaw is in something common to both the keep and walls, it is unlikely to be common to both (OpenSSL is an example of that). > small attacks aren't worth attention, big attacks are SLOW AND VISIBLE This is not true of castles nor infosec. A huge enemy force against a well-defended castle meant they likely mean to lay siege and starve them out of the castle. Not a significant concern so long as you have food and water; especially so if your resources would outlast their supply lines. Small forces on the other hand are exceptionally dangerous, because it's probably a sapper party that's going to try to tunnel under your wall and detonate explosives (or just collapse the tunnel if this is pre-explosives). Sappers are almost infinitely more dangerous. You can see the same pattern repeat in World War I. Trenches with machine guns are nearly impenetrable to attackers, thus No Man's Land. So we went back in time and re-created sappers to dig tunnels under their trenches. Having the other side come over their trenches at you is far less concerning than hearing sappers digging under you. Infosec is the same way. Port scans and attempted DDoS attacks are common, easily noticed, and unlikely to lead to anything threatening. Your real risk is being targeted. Someone interested in you specifically because of the data you have, or money, or whatever. People that will poke around your stuff in ways that are hard to notice, like analyzing your auth flow for vulnerabilities. Those are your digital sappers. Large DDoS attacks are bad, because they can knock you offline, but it's like a seige. All you have to do is outlast them, at the end of the day you lost some productivity but the castle is still intact. If the sappers get in, you go offline _and_ they'll steal your data.