3 ms·

As you increase the number of systems in series you increase the likelihood of failure. In this case failure is "there's an exploit." When you have A->B->C it's

by R0b0t1 5y ago

As you increase the number of systems in series you increase the likelihood of failure. In this case failure is "there's an exploit." When you have A->B->C it's possible that exploiting B, the middle layer, is both possible by going through A but also allows you to pass traffic through C that lets you launch an attack or exfiltrate from the network. In practice it may be different, but it seems like security theater to just put a bunch of firewalls in series.

vlovich123 5y ago
The security failure rate here cannot drop below the weakest link in the chain. In other words in your example A -> B -> C is no different than just B. The likelihood of failure of independent systems in a series is defined as 1 - product(1 - p(failure of one component)) [1]. It only degraded to the probability of one of the links if the systems are correlated which they’re not here. I don’t think regular failure analysis applies here (more components = more failure) because the security failure rate gets better with more components and worst case is that of your weakest link. In the traditional failure analysis you’re arguing for, the best case is the failure of the weakest component and it gets worse from there. [1] https://www.sciencedirect.com/topics/engineering/failure-probability https://www.sciencedirect.com/topics/engineering/failure-pro...
- R0b0t1 5y ago
  > because the security failure rate gets better with more components [citation needed] This isn't obvious to me, and as I explained (in a way that agrees with your first paragraph) more components could just mean more opportunities to get hacked. You'd have to go out of your way to prove that the security does overlap, and you can't trivially go around one component if the other is hacked.
  - vlovich123 5y ago
    If hacking one component gives you full access, then yes, more components is worse. If hacking one component means you need to hack the next as well, then security gets better. This is the very definition of defense in depth.
    - dhx 5y ago
      It's security through obscurity more than defense in depth because the failure mode of the two firewalls in series is the same, as observed by other systems on the network. Defense in depth would better describe the situation that even if a firewall was compromised, standalone[1] web servers on the network would only allow communication to occur if they are first presented with a client TLS certificate that the firewall in all practical circumstances can never obtain[2]. There is a school of thought that by making the system ridiculously complex with dozens of ICT security products from multiple vendors, the hope is that an attacker would have nightmares about planning how to traverse the network without raising alarms. It is also a nightmare to manage an unnecessarily complex ICT system so the chance of getting caught traversing the complex network is possibly lower because no one truly understands if an alarm is significant or not and monitoring in general becomes much harder. Real alarms get lost amongst the noise and confusion of the situation. [1] (meaning: not accessible to or managed by the same central systems as the firewalls) [2] (example: clients cannot accept inbound connections from the firewall and certificate management is isolated from the network)

by R0b0t1 5y ago

vlovich123 5y ago

The security failure rate here cannot drop below the weakest link in the chain. In other words in your example A -> B -> C is no different than just B. The likelihood of failure of independent systems in a series is defined as 1 - product(1 - p(failure of one component)) [1]. It only degraded to the probability of one of the links if the systems are correlated which they’re not here. I don’t think regular failure analysis applies here (more components = more failure) because the security failure rate gets better with more components and worst case is that of your weakest link. In the traditional failure analysis you’re arguing for, the best case is the failure of the weakest component and it gets worse from there. [1] https://www.sciencedirect.com/topics/engineering/failure-probability https://www.sciencedirect.com/topics/engineering/failure-pro...

R0b0t1 5y ago
> because the security failure rate gets better with more components [citation needed] This isn't obvious to me, and as I explained (in a way that agrees with your first paragraph) more components could just mean more opportunities to get hacked. You'd have to go out of your way to prove that the security does overlap, and you can't trivially go around one component if the other is hacked.
- vlovich123 5y ago
  If hacking one component gives you full access, then yes, more components is worse. If hacking one component means you need to hack the next as well, then security gets better. This is the very definition of defense in depth.
  - dhx 5y ago
    It's security through obscurity more than defense in depth because the failure mode of the two firewalls in series is the same, as observed by other systems on the network. Defense in depth would better describe the situation that even if a firewall was compromised, standalone[1] web servers on the network would only allow communication to occur if they are first presented with a client TLS certificate that the firewall in all practical circumstances can never obtain[2]. There is a school of thought that by making the system ridiculously complex with dozens of ICT security products from multiple vendors, the hope is that an attacker would have nightmares about planning how to traverse the network without raising alarms. It is also a nightmare to manage an unnecessarily complex ICT system so the chance of getting caught traversing the complex network is possibly lower because no one truly understands if an alarm is significant or not and monitoring in general becomes much harder. Real alarms get lost amongst the noise and confusion of the situation. [1] (meaning: not accessible to or managed by the same central systems as the firewalls) [2] (example: clients cannot accept inbound connections from the firewall and certificate management is isolated from the network)