31 ms·

Defenders think in lists, attackers think in graphs (2015)

405 points by akyuu 2y ago

CharlieDigital 2y ago
Whoa. I briefly worked for a "cyber security" company and couldn't quite put my dinner on why I ultimately hated the product and felt that the approach that they took -- and a large part of the industry -- was ultimately a sham. I couldn't quite put it into words, but now I get it: we were building the tools to support the most useless of cybersecurity practices -- org-level checklists.
- xyzzy123 2y ago
  If you can't do checklists though, you can't do anything else. All activities have lists and recurring calendar entries at their heart. You have to regularly show up and do the things. I agree that deeper / better approaches are required during the "do the things" steps.
  - deleted 2y ago
    [deleted]
  - yodelshady 2y ago
    Right, I think the industry is too self-critical at times. I onboarded a new client recently, and within five minutes of guessing a Wi-Fi password I had sensitive financial data using stock tools. Anyone with physical access to the office could do the same. Contrast an existing client, after a month of trying and writing custom shellcode loaders, spear phishing campaigns, my entire team had... some graduate CVs. Really, you're saying that because the NSA could probably do a better job with the latter than us by intercepting and hardware-hacking networking gear, that no value has been provided?
- cedws 2y ago
  That’s basically the entire cybersecurity industry. Companies buy these tools as a kind of blast door for when things go wrong, to point a finger at. “We followed all the checklists and our security software didn’t catch it, it’s not our fault.” If companies cared about security they would hire red teams instead of paying for useless scanners with a <1% signal to noise ratio.
  - Frost1x 2y ago
    That’s not just cyber security, that’s part of the reason many service/support contracts tend to exist, the whole CYA finger pointing by externalizing the responsibility. Ultimately you end up having to clean up the mess after either way but at least there’s a paper trail of responsibility passing to CYA.
- paulmooreparks 2y ago
  Perhaps it depends upon why the checklists exist, how accurately they model what needs to be done, and how closely they are followed. Consider aviation: pilots live by checklists. In the world of aviation, following checklists doesn't guarantee that things won't go wrong during a flight, but not following them or treating them cavalierly is an invitation for disaster. Those checklists are built upon years and years of hard-earned experience. Granted, however, having a checklist for no good reason other than to say that you have a checklist, or not regularly reviewing and updating the checklist based upon real-world conditions, is meaningless.
- blencdr 2y ago
  I'll be more nuanced.Doing operational security can enhance your security posture, but the real trick in cybersecurity isn’t just putting measures in place, it’s keeping them up over time. That’s where checklists come in. A lot of companies get it wrong. They think the checklist is the security. But really, the checklist is just there to remind you that you did something right before and you need to keep it up. Treating the checklist like it’s the goal is where things go off track.
- deleted 2y ago
  [deleted]
bsder 2y ago
Defenders need to win every single time. Attackers only need win once. So attackers win.
- CoastalCoder 2y ago
  I wonder if this could change if our governments' policy was to hunt would-be hackers to the ends of the earth. (Note: I genuinely have no idea if that would be done outside of an authoritarian / autocratic regime. So I'm not remotely advocating it at this point.)
  - yashap 2y ago
    Hackers are global, though, and no matter what country you’re in, almost certainly the vast majority of hackers attempting to attack you are doing so from outside your country. Enforcing laws on a global scale is extremely difficult and almost impossible to do effectively.
    - desert_rue 2y ago
      You both have a point, so I would word it in a different way: if we devoted enough resources to track hackers down no matter where, could we lessen their impact? It would take a crazy amount of resources, like sending in infiltration teams into hostile countries. It is technically possible, but where is the balancing point?
      - bluGill 2y ago
        What will you do when you find them? if you find one in say France, the French will deal with it and attacks stop. However most attacks are tracedto North Korea or Russia where they don't care and so you can't do anything.
  - deleted 2y ago
    [deleted]
  - bsder 2y ago
zmgsabst 2y ago
What? Those visualizations of network graphs enhanced by segmentation/clustering data are at least a decade old. As is studying how attackers traverse. Here’s something I find my true: Defends think in cheap cliches, attackers think like professionals — so attackers win.
- Retr0id 2y ago
  The post is almost a decade old too, but I don't think it's any less relevant now.
mhh__ 2y ago
> Philosophy has an affinity with despotism, due to its predilection for Platonic-fascist top-down solutions that always screw up viciously. Schizoanalysis works differently. It avoids Ideas, and sticks to diagrams: networking software for accessing bodies without organs. BWOs, machinic singularities, or tractor fields emerge through the combination of parts with (rather than into) their whole; arranging composite individuations in a virtual/ actual circuit. They are additive rather than substitutive, and immanent rather than transcendent: executed by functional complexes of currents, switches, and loops, caught in scaling reverberations, and fleeing through intercommunications, from the level of the integrated planetary system to that of atomic assemblages. Multiplicities captured by singularities interconnect as desiring-machines; dissipating entropy by dissociating flows, and recycling their machinism as self-assembling chronogenic circuitry.
- notjoemama 2y ago
  Amongst the linguistic hand waving is information theory. But who am I to judge someone else's word-a-day calendar?
dang 2y ago
Discussed (a bit) at the time: Defenders think in lists. Attackers think in graphs - https://news.ycombinator.com/item?id=9442565 https://news.ycombinator.com/item?id=9442565 - April 2015 (7 comments)
tpmoney 2y ago
I feel like this goes too deep. Or maybe it hits on the right reason, but the wrong cause. The defender’s job isn’t defense. Cyber security isn’t a sportsball game where there are clear even goals and objectives with alternating positions. It’s a side show, and a distraction from the main business of whatever else the defenders are trying to do. By contrast, an attacker’s entire job is to attack the system. There is no other purpose they are serving, no secondary masters or considerations that need to be used to weaken their attacks. Attackers win for the same reason that Microsoft is better at publishing operating systems than Cisco, because ciscos operating systems are a means to an end. Microsoft’s are the end
- yen223 2y ago
  Cybersecurity being a sideshow to the main event is a brilliant way to frame the problem. It also explains why companies rarely get punished by the markets for data breaches.
  - whiterknight 2y ago
    It’s firmly in the “cost” center.
    - hnaccount_rng 2y ago
      That’s a worse framing than above. It doesn’t matter if it’s a cost or a profit center. It’s part of a trade off. You could achieve a perfectly secure system, if and only if you make that system do exactly nothing. If you want to achieve any other outcome you will have to trade some measure of security for the ability to do anything. Or as Matt Levine so aptly put it: the optimal amount of fraud is non-zero
      - whiterknight 2y ago
        Indeed. But I’m pointing out if it’s not the goal, then it’s a cost to minimize to achieve the goal.
  - 2y ago
dzink 2y ago
Sounds like there need to be one or more honeypots in each network for catching intruders in the system. Fake crypto credentials, fake password storage etc.
alephnan 2y ago
This is just a fancy way of saying defenders have to defend every entrypoint vs attackers who only have to find a single point of weakness.
- hypeatei 2y ago
  Asymmetry of defense, if you will.
- jakeinspace 2y ago
  Well, as the aphorism goes, the best defense is a good offense. Of course Microsoft and Google have security projects which aim to disrupt organized hacking groups, but maybe they need to go further? Like using honey pots to back-feed zero-day exploits (maybe even ones that have been engineered into Google/Microsoft/et al.'s products) to attacker's machines? Go full black-hat (with some sort of plausible deniability) and ransomware the ransomwarers. As I type this, I realize it sounds a bit like some of the evil all-powerful corporations in sci-fi, although they usually also go to the lengths of assassinating their enemies.
  - devjab 2y ago
    Wouldn’t any form of digital offence mainly be a waste of resources? The reasoning behind this is that the attacker has nothing to lose. What would you ransomeware? Cheap hardware which likely isn’t even owned by the attacker?
    - immibis 2y ago
      "Hacking back" has gotten hackers into jail in the past.
  - dhosek 2y ago
    > assassinating their enemies Well, Google no longer has a mandate of “don’t be evil” and Microsoft never did…
batch12 2y ago
I've done both. I've been an incident responder and have experience with penetration testing and red teaming. I think that, while reductive, this is somewhat true, but not necessarily as negative as the the article reads. Defense is made up of many things. For instance, developing effective controls to reduce the risk and impact of a security event, identifying attacks and compromise, and responding to the events. Lists of standards and responses work well. Defense also includes architectural decisions which require thinking about the graph of the network to develop these controls. There are lots of disciplines in defense too: architecture/engineering, risk management, incident response, application security, education, threat intelligence, and so on. Also interesting that the author implies the problem is about thinking of defense in lists then provides a list of items to consider to improve defense.
lmeyerov 2y ago
A formal way to frame this insight is how a formal methods security researcher might: graph-based program verification. A lot of core confidentiality and integrity security problems come down to 'safety property' verification (a notion from model checking), which in turn comes down to reachability on a program flow graph (a notion from program analysis). This is also true of access control verification, but that's a topic for another day. Imagine a dataflow or points-to analysis on a program, and extend it all the way to include the code in your OS and the cloud and the database. These analyses create a graph, and the question is can an attacker get from an entrypoint and precondition of some node A (a line of code) and traverse to the assets on point B (another line of code.) Interestingly, the security field is increasingly getting there, with ideas like CNAPP, IAM/Cedar, AD/bloodhound, where we are getting these basic access graphs modulated by estate, identity, access policy, etc. Often we don't even really need the programs, because it's more about a distributed system where we can focus just on identities and policies across trust zones. (Eg, If a box gets hacked, that exposes other credentials on the same box.) At the same time, anyone working in these things also knows graph reachability is simplistic 80's & 90's stuff: there can be complex logical policies at each node, So we're seeing things like modeling those harder points, not just as pure reachability, But also things we can actually peek into and more richly verify, such as by modeling fancy ABAC policies using smt solvers. I don't think that's really where the author is coming from, but it's a reason the article resonated with me for so many years from a principled perspective, and I think it's incredibly practical and important today. (Disclaimer: we do crazy GPU graph AI power tools for folks in the space at Graphistry / Louie.AI, in my first verification papers here were almost 20 years ago, so I've been thinking about this a lot.)
notepad0x90 2y ago
Defenders also think in graphs. Matter of fact, good defenders think like attackers. Case in point, to contradict the author of this post directly: https://github.com/BloodHoundAD/BloodHound https://github.com/BloodHoundAD/BloodHound BloodHound is primarily a defender tool, that uses graph theory to help defenders find attack paths. But attackers also use it to help them find the shortest path to owning an AD domain. BloodHound is used in by a lot of threat actors as part of those news stories where the entire company is ransomwared. But what you don't see is, in a lot of companies that don't get totally ransomwared, there is a chance defenders are also using BloodHound to find and fix attack paths.
- batch12 2y ago
  This true. A good responder understands the attack and methods used to perform the attack. The best can visualize the event through the eyes of the attacker and use this insight to contain the event quickly.
treflop 2y ago
Defenders use lists because they have to manage hundreds and thousands of assets at the same time. What do you do when you have to manage a ton of things? You make a list. You go through that list. You apply a checklist. Now should defenders also make dependency graphs too? Sure, but they should be making lists first before dependency graphs and making sure things are up to date, that they assume limited trust, and that resources are isolated. Then they should make dependency graphs. “Defenders have to think in list and graphs and manage a billion things. Attackers just have to look at a few things.”
- carlmr 2y ago
  Put in other words. Creating a graph of your assets should be a part of your checklist.
- beardedwizard 2y ago
  in this scenario you seem to be arguing lists as the basis of graphs - this is still the authors point, and a subtle but critical difference in how the problem is approached by defenders. You have to have the insight to pivot your list into a graph, otherwise you just have a list of Crown Jewels and play whack-a-mole on the 10000s of ways they can be reached that you didn't consider.
- soulofmischief 2y ago
  It's just breadth vs depth.
anothernewdude 2y ago
Graphs are lists. https://en.wikipedia.org/wiki/Adjacency_list https://en.wikipedia.org/wiki/Adjacency_list
hckevrythng 2y ago
I know practically nothing of the industry this post is referring to except my passion for continuing my education until I can legitimately become a part of it. Computers and the cybersecurity industry are passions of mine. Im apalled at how badly threat actors are ruining things and I just feel like it takes a hacker to catch a hacker. I've dabbled but never become serious enough to get the required education. Frankly to my way of thinking that involves, ( aside from all the playing around with what one can break), learning a programming language. So I'm slogging through C. But honestly I believe it is the constraints of societal perceptions that most hinders the security industry from doing better. They tie their own hands by playing "good guy" within the framework of certain rules themselves formulated out of overcaution, while the "bad guys" run rampant, operating effectively without constraints. Most likely despite all the effort and knowledge I will have eventually accumulated as the criteria for being qualified no person or company will ever hire me. I spent a number of years in several states incarcerated in the penal system for crimes entirely unrelated to this industry nevertheless rendering me unfit as far as any firm is concerned to work in the cyber security industry. Even though an education coupled with a map of the criminal mind because of my experiences would be an unbeatable combination (nearly..lol) the fear that abides in the heart of the defenders will be the reason they will always stay one or more steps behind. The idea that reform is not only possible but that SOME of us so abhor the way we once were that we are now staunch bulldogs on the side of morality is an idea entirely unknown in this country currently. And that's a shame. Because last I checked it was understood the best way to catch a thief...
akira2501 2y ago
> Bob admins the DC from a workstation. If that workstation is not protected as much as the domain controller, the DC can be compromised. They both run Windows. The protection class between the two is identical. You can draw as many graphs and lists as you want, but the security of this arrangement is mostly down to timely and accurate Windows Updates. > Learn to Spot List Thinking I think in terms of "diffs." I want to know what is _changing_ on my network. I don't ever need an enumeration of things in any particular arrangement and as a human being, whether graph or list, I'm not equipped to use it in any meaningful way. A difference list is typically very short, reveals intrusion patterns quickly, and is something you can automate easily.
- StressedDev 2y ago
  You can do a lot more than just keep Windows up to date. Here are some other things you should do: 1) Use separate accounts and machines for administration tasks. Basically, IT people should never use their e-mail, web browsing, and development machine for system management tasks. They should use a separate machine with a different account for these tasks. The main reason is the system management machine has a much smaller attack surface. Ideally, it should only run a communications program (IRC, Slack, MS Teams, etc.), and the tools the person needs to do their job. Examples of tools people need include SSH, Remote Desktop, kubectl (Kubernetes tool to manage a cluster), etc. The machine should have a web browser BUT the web browser should be restricted to the bare minimum number of sites needed to administer the systems. Examples of acceptable sites include the Azure Portal, the AWS web site, web sites to configure equipment, etc. Examples of things which are not allowed include web mail, documentation, etc. The goal is to have the smallest possible attack surface. 2) People need to be mindful of what they install on their machines. I have seen a lot of people who will install anything which looks useful on their machine. This is a great way to get hacked. Here are the questions people need to ask before installing software. - Why do I trust the people who wrote the software? - Why was the software created? What was the motivation of the author? - How does the author support himself or herself? What would happen if one of the authors was in financial distress? - How will I know when the software needs to be updated? - What are the capabilities of the software's authors? Do the authors understand how to write secure software? How do the authors handle security bug reports? Basically, you ask these questions because you want to avoid malware, and you want to use software which fixes its security problems. 3) Consider putting system management machines on a different network or VPN. Basically, it's harder to hack a machine if you can't easily communicate with it. 4) System management machines should not be listening on any ports (or should have a firewall which blocks all connection attempts). It's harder to break into a machine when an attacker cannot connect to it. 5) Put the system management machines behind a firewall. 6) Consider what happens when an account is eventually hacked. Many people assume that only dumb or incompetent people get hacked. Unfortunately, this is not true. Systems should be designed to assume accounts will get hacked. The best designs limit the blast radius (damage) of account attacks. 7) All users should have limited privileges. Basically, they should get the privileges they need to do their jobs. Very few people should be allowed to have the equivalent of root/Administrator for the entire system (obviously, people may have these permissions for some machines but almost no account should be able to do anything on any system the organization runs).
krn1p4n1c 2y ago
Attackers aren't hampered by organizational imperatives. They are free to find targets of opportunity and move between them as it suits them. Defenders usually have to justify their work to management and balance "real" defense work with things that reduce liability. This ends up being a prioritized list. I blame JIRA for giving the attackers an advantage.
waihtis 2y ago
Attackers win so easily because corporate security teams play predominantly 1) regulatory games 2) compliance games 3) CV optimization games 4) political games and finally 5) actual security work games within their organization
jvda 2y ago
This is exactly why (good) defenders work by threat modeling using different perspectives and representations: one of them being attack graphs. But yes, a lot of the mandated compliance and governance stuff is just checking lists, which is why it does not work.
- beardedwizard 2y ago
  compliance requirements are the table stakes you should do you in your sleep so that you spend most of your time decomposing risks (attack graphs or not). It's a mistake to dismiss compliance (or CIS in another posters comment) as useless, they are basic - and the fact that so many cant deliver the basics is a huge issue.
Joel_Mckay 2y ago
I prefer systems inspired by ecology: 1. Network connectivity: Crickets 2. Cluster resources: Bees 3. Queues/pipelines: Ants Consider the population of ants on earth is 20*10^15 : One could spend the rest of their life stepping on individuals, but the futile behavior remains meaningless to self-repairing ecosystems. https://www.youtube.com/watch?v=ksZTYRqr444 https://www.youtube.com/watch?v=ksZTYRqr444 (Jimi Hendrix, "Castles Made of Sand" )
Faelian2 2y ago
As a pentester, I would argue that attackers don't think in graphs either. Apart from Bloodhound, I can't think of any tools where we have graphs. For web security, I can't think of something where "graph thinking" applies. But we have a pretty huge list of attacks to test https://portswigger.net/web-security/all-topics https://portswigger.net/web-security/all-topics. And ultimately, what is inside your pentest report ? Not a graph, a list of things to do: - SMB signing. - Don't use the domain admin to manage every machine. - ... The main reason this phrase is so popular, is that it panders to the hacker community: "We are the smart guys, all the defenders do is excel sheets." IMHO, the nugget of truth in this is that defenders can spend considerable amounts of time on things that don't matter. Like doing CIS benchmark by hand on all servers. While missing the low-hanging fruits that would give them a strong security posture. In a lot of companies, the defenders are just sysadmins that don't have any idea of what they should focus on.
- syntheticcorp 2y ago
  I get your point but I think pentesters are perfectly capable of thinking in graphs, including web security. Bug chains are the immediate example, where a couple of CVSS 4-7 vulns can be turned into a full rce/whatever 9.8 equivalent. This bug chaining fundamentally occurs via elements of compromise i.e a graph traversal. Bloodhound is great, and a nice visual tool for people to conceptualise attack graphs but it’s just a part of the process of understanding the target domain from an attackers perspective. No nice tool like bloodhound exists for web pentesting because a chain of compromise can’t simply be reduced into tool form there because a chain is often specific to the app and not an underlying framework, unlike AD where the security boundaries are well(ish) understood and codified. Pentest reports include stuff like SMB signing and “don’t admin everything with your DA account ” because they are glowing hot nodes very early in a chain of compromise, meaning that is often how stuff gets popped IRL. It’s (hopefully) not that the pentester doesn’t understand graph thinking, it’s just the the first node in the graph represents effectively complete compromise, so why traverse?
hoherd 2y ago
Isn't a defense strategy based on a graph an O(n!) problem, and thus unrealistic? Perhaps it's not quite that bad, but it has to be somewhere in computationally infeasible solutions territory.
talkingtab 2y ago
I feel like this does not go deep enough. :-) "lists" is just short hand for components. "Graphs", shorthand for interoperation. The component view is analysis, the interaction view - well we don't have a really good word for that, and yet as the article points out, that is often the attack surface. Complex adaptive systems (see John Holland's "Hidden Order") have components and a messaging bus which crucially provides a way for the constituent components to interoperate. You can swat ants individually, but if you want to stop them, you destroy the ability to leave pheromone trails. Maybe there should be a word like "analysis" for understanding how things interoperate. Gestaltysis?
nunez 2y ago
"Attackers" usually have a single mission in mind (exfiltrate juicy data, destabilize the target, hold juicy data for ransom, etc.) and have the privilege of exploring as deeply as needed until the mission is accomplished. "Defenders" (like the SOC) have to think in lists because they're tracking many signals and threat vectors at a time and need to prioritize which ones warrant their attention/require action because a regulator told them so (think high-scoring CVEs against code that's been deprecated forever ago). Without having "defenders" post in random places along the graph looking for interesting activity, I don't know how they'll be able to "think in graphs". To wit, the suggestions that the author made would be, you guessed it, signals in a list that a "defender" would check against!
- beardedwizard 2y ago
  I disagree with this. In my experience we saw the red team use graph techniques to plot paths to high value assets over and over, where defenders were not even thinking about this approach. As soon as they did, they identified potential attacks before the red team launched them. Smart teams will immediately adopt the red team technology that, for example, crawls AWS as a graph looking for paths to from low to high value accounts. Its not a zero sum or sea change thing, but defenders absolutely can think more like attackers and leverage attacker tools more often in the act of defense.
  - uberman 2y ago
    How do you define and track high values assets? Perhaps in a list?
    - Jerrrrrrry 2y ago
      High values can exist on different dimensions. The CEO is worth more in some ways than the HR lady. The HR lady is worth much, much more than the CEO in other ways. This added dimension turns the 1D list into a 2D map, or a graph.
    - deleted 2y ago
      [deleted]
uberman 2y ago
Attackers win because they only need to succeed once after proving for weak points. Defends have to guard everything at once.
er4hn 2y ago
Judging by the comments this article seems true in the abstract: "You are only as strong as your weakest link" can be formalized better as "You are only strong if there is no path over your assets for an attacker to carry out their objective." The big problem with "checklist based security" is that it is agnostic to underlying infra and ignores whatever issues a graph based approach might reveal. I'll add another item that defenders use for graphs: SBOMs. You can map out component relationships with them and understand if, for example, there's an issue with openssl, note which end applications are affected.
frays 2y ago
Fantastic analogies useful for cybsercurity here.

405 points by akyuu 2y ago

Whoa. I briefly worked for a "cyber security" company and couldn't quite put my dinner on why I ultimately hated the product and felt that the approach that they took -- and a large part of the industry -- was ultimately a sham. I couldn't quite put it into words, but now I get it: we were building the tools to support the most useless of cybersecurity practices -- org-level checklists.

xyzzy123 2y ago
If you can't do checklists though, you can't do anything else. All activities have lists and recurring calendar entries at their heart. You have to regularly show up and do the things. I agree that deeper / better approaches are required during the "do the things" steps.
- deleted 2y ago
  [deleted]
- yodelshady 2y ago
  Right, I think the industry is too self-critical at times. I onboarded a new client recently, and within five minutes of guessing a Wi-Fi password I had sensitive financial data using stock tools. Anyone with physical access to the office could do the same. Contrast an existing client, after a month of trying and writing custom shellcode loaders, spear phishing campaigns, my entire team had... some graduate CVs. Really, you're saying that because the NSA could probably do a better job with the latter than us by intercepting and hardware-hacking networking gear, that no value has been provided?
cedws 2y ago
That’s basically the entire cybersecurity industry. Companies buy these tools as a kind of blast door for when things go wrong, to point a finger at. “We followed all the checklists and our security software didn’t catch it, it’s not our fault.” If companies cared about security they would hire red teams instead of paying for useless scanners with a <1% signal to noise ratio.
- Frost1x 2y ago
  That’s not just cyber security, that’s part of the reason many service/support contracts tend to exist, the whole CYA finger pointing by externalizing the responsibility. Ultimately you end up having to clean up the mess after either way but at least there’s a paper trail of responsibility passing to CYA.
paulmooreparks 2y ago
Perhaps it depends upon why the checklists exist, how accurately they model what needs to be done, and how closely they are followed. Consider aviation: pilots live by checklists. In the world of aviation, following checklists doesn't guarantee that things won't go wrong during a flight, but not following them or treating them cavalierly is an invitation for disaster. Those checklists are built upon years and years of hard-earned experience. Granted, however, having a checklist for no good reason other than to say that you have a checklist, or not regularly reviewing and updating the checklist based upon real-world conditions, is meaningless.
blencdr 2y ago
I'll be more nuanced.Doing operational security can enhance your security posture, but the real trick in cybersecurity isn’t just putting measures in place, it’s keeping them up over time. That’s where checklists come in. A lot of companies get it wrong. They think the checklist is the security. But really, the checklist is just there to remind you that you did something right before and you need to keep it up. Treating the checklist like it’s the goal is where things go off track.
deleted 2y ago
[deleted]

bsder 2y ago

Defenders need to win every single time. Attackers only need win once. So attackers win.

CoastalCoder 2y ago
I wonder if this could change if our governments' policy was to hunt would-be hackers to the ends of the earth. (Note: I genuinely have no idea if that would be done outside of an authoritarian / autocratic regime. So I'm not remotely advocating it at this point.)
- yashap 2y ago
  Hackers are global, though, and no matter what country you’re in, almost certainly the vast majority of hackers attempting to attack you are doing so from outside your country. Enforcing laws on a global scale is extremely difficult and almost impossible to do effectively.
  - desert_rue 2y ago
    You both have a point, so I would word it in a different way: if we devoted enough resources to track hackers down no matter where, could we lessen their impact? It would take a crazy amount of resources, like sending in infiltration teams into hostile countries. It is technically possible, but where is the balancing point?
    - bluGill 2y ago
      What will you do when you find them? if you find one in say France, the French will deal with it and attacks stop. However most attacks are tracedto North Korea or Russia where they don't care and so you can't do anything.
- deleted 2y ago
  [deleted]
- bsder 2y ago

zmgsabst 2y ago

What? Those visualizations of network graphs enhanced by segmentation/clustering data are at least a decade old. As is studying how attackers traverse. Here’s something I find my true: Defends think in cheap cliches, attackers think like professionals — so attackers win.

Retr0id 2y ago
The post is almost a decade old too, but I don't think it's any less relevant now.

mhh__ 2y ago

> Philosophy has an affinity with despotism, due to its predilection for Platonic-fascist top-down solutions that always screw up viciously. Schizoanalysis works differently. It avoids Ideas, and sticks to diagrams: networking software for accessing bodies without organs. BWOs, machinic singularities, or tractor fields emerge through the combination of parts with (rather than into) their whole; arranging composite individuations in a virtual/ actual circuit. They are additive rather than substitutive, and immanent rather than transcendent: executed by functional complexes of currents, switches, and loops, caught in scaling reverberations, and fleeing through intercommunications, from the level of the integrated planetary system to that of atomic assemblages. Multiplicities captured by singularities interconnect as desiring-machines; dissipating entropy by dissociating flows, and recycling their machinism as self-assembling chronogenic circuitry.

notjoemama 2y ago
Amongst the linguistic hand waving is information theory. But who am I to judge someone else's word-a-day calendar?

dang 2y ago

Discussed (a bit) at the time: Defenders think in lists. Attackers think in graphs - https://news.ycombinator.com/item?id=9442565 https://news.ycombinator.com/item?id=9442565 - April 2015 (7 comments)

tpmoney 2y ago

I feel like this goes too deep. Or maybe it hits on the right reason, but the wrong cause. The defender’s job isn’t defense. Cyber security isn’t a sportsball game where there are clear even goals and objectives with alternating positions. It’s a side show, and a distraction from the main business of whatever else the defenders are trying to do. By contrast, an attacker’s entire job is to attack the system. There is no other purpose they are serving, no secondary masters or considerations that need to be used to weaken their attacks. Attackers win for the same reason that Microsoft is better at publishing operating systems than Cisco, because ciscos operating systems are a means to an end. Microsoft’s are the end

yen223 2y ago
Cybersecurity being a sideshow to the main event is a brilliant way to frame the problem. It also explains why companies rarely get punished by the markets for data breaches.
- whiterknight 2y ago
  It’s firmly in the “cost” center.
  - hnaccount_rng 2y ago
    That’s a worse framing than above. It doesn’t matter if it’s a cost or a profit center. It’s part of a trade off. You could achieve a perfectly secure system, if and only if you make that system do exactly nothing. If you want to achieve any other outcome you will have to trade some measure of security for the ability to do anything. Or as Matt Levine so aptly put it: the optimal amount of fraud is non-zero
    - whiterknight 2y ago
      Indeed. But I’m pointing out if it’s not the goal, then it’s a cost to minimize to achieve the goal.
- 2y ago

dzink 2y ago

Sounds like there need to be one or more honeypots in each network for catching intruders in the system. Fake crypto credentials, fake password storage etc.

alephnan 2y ago

This is just a fancy way of saying defenders have to defend every entrypoint vs attackers who only have to find a single point of weakness.

hypeatei 2y ago
Asymmetry of defense, if you will.
jakeinspace 2y ago
Well, as the aphorism goes, the best defense is a good offense. Of course Microsoft and Google have security projects which aim to disrupt organized hacking groups, but maybe they need to go further? Like using honey pots to back-feed zero-day exploits (maybe even ones that have been engineered into Google/Microsoft/et al.'s products) to attacker's machines? Go full black-hat (with some sort of plausible deniability) and ransomware the ransomwarers. As I type this, I realize it sounds a bit like some of the evil all-powerful corporations in sci-fi, although they usually also go to the lengths of assassinating their enemies.
- devjab 2y ago
  Wouldn’t any form of digital offence mainly be a waste of resources? The reasoning behind this is that the attacker has nothing to lose. What would you ransomeware? Cheap hardware which likely isn’t even owned by the attacker?
  - immibis 2y ago
    "Hacking back" has gotten hackers into jail in the past.
- dhosek 2y ago
  > assassinating their enemies Well, Google no longer has a mandate of “don’t be evil” and Microsoft never did…

batch12 2y ago

I've done both. I've been an incident responder and have experience with penetration testing and red teaming. I think that, while reductive, this is somewhat true, but not necessarily as negative as the the article reads. Defense is made up of many things. For instance, developing effective controls to reduce the risk and impact of a security event, identifying attacks and compromise, and responding to the events. Lists of standards and responses work well. Defense also includes architectural decisions which require thinking about the graph of the network to develop these controls. There are lots of disciplines in defense too: architecture/engineering, risk management, incident response, application security, education, threat intelligence, and so on. Also interesting that the author implies the problem is about thinking of defense in lists then provides a list of items to consider to improve defense.

lmeyerov 2y ago

A formal way to frame this insight is how a formal methods security researcher might: graph-based program verification. A lot of core confidentiality and integrity security problems come down to 'safety property' verification (a notion from model checking), which in turn comes down to reachability on a program flow graph (a notion from program analysis). This is also true of access control verification, but that's a topic for another day. Imagine a dataflow or points-to analysis on a program, and extend it all the way to include the code in your OS and the cloud and the database. These analyses create a graph, and the question is can an attacker get from an entrypoint and precondition of some node A (a line of code) and traverse to the assets on point B (another line of code.) Interestingly, the security field is increasingly getting there, with ideas like CNAPP, IAM/Cedar, AD/bloodhound, where we are getting these basic access graphs modulated by estate, identity, access policy, etc. Often we don't even really need the programs, because it's more about a distributed system where we can focus just on identities and policies across trust zones. (Eg, If a box gets hacked, that exposes other credentials on the same box.) At the same time, anyone working in these things also knows graph reachability is simplistic 80's & 90's stuff: there can be complex logical policies at each node, So we're seeing things like modeling those harder points, not just as pure reachability, But also things we can actually peek into and more richly verify, such as by modeling fancy ABAC policies using smt solvers. I don't think that's really where the author is coming from, but it's a reason the article resonated with me for so many years from a principled perspective, and I think it's incredibly practical and important today. (Disclaimer: we do crazy GPU graph AI power tools for folks in the space at Graphistry / Louie.AI, in my first verification papers here were almost 20 years ago, so I've been thinking about this a lot.)

notepad0x90 2y ago

Defenders also think in graphs. Matter of fact, good defenders think like attackers. Case in point, to contradict the author of this post directly: https://github.com/BloodHoundAD/BloodHound https://github.com/BloodHoundAD/BloodHound BloodHound is primarily a defender tool, that uses graph theory to help defenders find attack paths. But attackers also use it to help them find the shortest path to owning an AD domain. BloodHound is used in by a lot of threat actors as part of those news stories where the entire company is ransomwared. But what you don't see is, in a lot of companies that don't get totally ransomwared, there is a chance defenders are also using BloodHound to find and fix attack paths.

batch12 2y ago
This true. A good responder understands the attack and methods used to perform the attack. The best can visualize the event through the eyes of the attacker and use this insight to contain the event quickly.

treflop 2y ago

Defenders use lists because they have to manage hundreds and thousands of assets at the same time. What do you do when you have to manage a ton of things? You make a list. You go through that list. You apply a checklist. Now should defenders also make dependency graphs too? Sure, but they should be making lists first before dependency graphs and making sure things are up to date, that they assume limited trust, and that resources are isolated. Then they should make dependency graphs. “Defenders have to think in list and graphs and manage a billion things. Attackers just have to look at a few things.”

carlmr 2y ago
Put in other words. Creating a graph of your assets should be a part of your checklist.
beardedwizard 2y ago
in this scenario you seem to be arguing lists as the basis of graphs - this is still the authors point, and a subtle but critical difference in how the problem is approached by defenders. You have to have the insight to pivot your list into a graph, otherwise you just have a list of Crown Jewels and play whack-a-mole on the 10000s of ways they can be reached that you didn't consider.
soulofmischief 2y ago
It's just breadth vs depth.

anothernewdude 2y ago

Graphs are lists. https://en.wikipedia.org/wiki/Adjacency_list https://en.wikipedia.org/wiki/Adjacency_list

hckevrythng 2y ago

I know practically nothing of the industry this post is referring to except my passion for continuing my education until I can legitimately become a part of it. Computers and the cybersecurity industry are passions of mine. Im apalled at how badly threat actors are ruining things and I just feel like it takes a hacker to catch a hacker. I've dabbled but never become serious enough to get the required education. Frankly to my way of thinking that involves, ( aside from all the playing around with what one can break), learning a programming language. So I'm slogging through C. But honestly I believe it is the constraints of societal perceptions that most hinders the security industry from doing better. They tie their own hands by playing "good guy" within the framework of certain rules themselves formulated out of overcaution, while the "bad guys" run rampant, operating effectively without constraints. Most likely despite all the effort and knowledge I will have eventually accumulated as the criteria for being qualified no person or company will ever hire me. I spent a number of years in several states incarcerated in the penal system for crimes entirely unrelated to this industry nevertheless rendering me unfit as far as any firm is concerned to work in the cyber security industry. Even though an education coupled with a map of the criminal mind because of my experiences would be an unbeatable combination (nearly..lol) the fear that abides in the heart of the defenders will be the reason they will always stay one or more steps behind. The idea that reform is not only possible but that SOME of us so abhor the way we once were that we are now staunch bulldogs on the side of morality is an idea entirely unknown in this country currently. And that's a shame. Because last I checked it was understood the best way to catch a thief...

akira2501 2y ago

> Bob admins the DC from a workstation. If that workstation is not protected as much as the domain controller, the DC can be compromised. They both run Windows. The protection class between the two is identical. You can draw as many graphs and lists as you want, but the security of this arrangement is mostly down to timely and accurate Windows Updates. > Learn to Spot List Thinking I think in terms of "diffs." I want to know what is _changing_ on my network. I don't ever need an enumeration of things in any particular arrangement and as a human being, whether graph or list, I'm not equipped to use it in any meaningful way. A difference list is typically very short, reveals intrusion patterns quickly, and is something you can automate easily.

StressedDev 2y ago
You can do a lot more than just keep Windows up to date. Here are some other things you should do: 1) Use separate accounts and machines for administration tasks. Basically, IT people should never use their e-mail, web browsing, and development machine for system management tasks. They should use a separate machine with a different account for these tasks. The main reason is the system management machine has a much smaller attack surface. Ideally, it should only run a communications program (IRC, Slack, MS Teams, etc.), and the tools the person needs to do their job. Examples of tools people need include SSH, Remote Desktop, kubectl (Kubernetes tool to manage a cluster), etc. The machine should have a web browser BUT the web browser should be restricted to the bare minimum number of sites needed to administer the systems. Examples of acceptable sites include the Azure Portal, the AWS web site, web sites to configure equipment, etc. Examples of things which are not allowed include web mail, documentation, etc. The goal is to have the smallest possible attack surface. 2) People need to be mindful of what they install on their machines. I have seen a lot of people who will install anything which looks useful on their machine. This is a great way to get hacked. Here are the questions people need to ask before installing software. - Why do I trust the people who wrote the software? - Why was the software created? What was the motivation of the author? - How does the author support himself or herself? What would happen if one of the authors was in financial distress? - How will I know when the software needs to be updated? - What are the capabilities of the software's authors? Do the authors understand how to write secure software? How do the authors handle security bug reports? Basically, you ask these questions because you want to avoid malware, and you want to use software which fixes its security problems. 3) Consider putting system management machines on a different network or VPN. Basically, it's harder to hack a machine if you can't easily communicate with it. 4) System management machines should not be listening on any ports (or should have a firewall which blocks all connection attempts). It's harder to break into a machine when an attacker cannot connect to it. 5) Put the system management machines behind a firewall. 6) Consider what happens when an account is eventually hacked. Many people assume that only dumb or incompetent people get hacked. Unfortunately, this is not true. Systems should be designed to assume accounts will get hacked. The best designs limit the blast radius (damage) of account attacks. 7) All users should have limited privileges. Basically, they should get the privileges they need to do their jobs. Very few people should be allowed to have the equivalent of root/Administrator for the entire system (obviously, people may have these permissions for some machines but almost no account should be able to do anything on any system the organization runs).

krn1p4n1c 2y ago

Attackers aren't hampered by organizational imperatives. They are free to find targets of opportunity and move between them as it suits them. Defenders usually have to justify their work to management and balance "real" defense work with things that reduce liability. This ends up being a prioritized list. I blame JIRA for giving the attackers an advantage.

waihtis 2y ago

Attackers win so easily because corporate security teams play predominantly 1) regulatory games 2) compliance games 3) CV optimization games 4) political games and finally 5) actual security work games within their organization

jvda 2y ago

This is exactly why (good) defenders work by threat modeling using different perspectives and representations: one of them being attack graphs. But yes, a lot of the mandated compliance and governance stuff is just checking lists, which is why it does not work.

beardedwizard 2y ago
compliance requirements are the table stakes you should do you in your sleep so that you spend most of your time decomposing risks (attack graphs or not). It's a mistake to dismiss compliance (or CIS in another posters comment) as useless, they are basic - and the fact that so many cant deliver the basics is a huge issue.

Joel_Mckay 2y ago

I prefer systems inspired by ecology: 1. Network connectivity: Crickets 2. Cluster resources: Bees 3. Queues/pipelines: Ants Consider the population of ants on earth is 20*10^15 : One could spend the rest of their life stepping on individuals, but the futile behavior remains meaningless to self-repairing ecosystems. https://www.youtube.com/watch?v=ksZTYRqr444 https://www.youtube.com/watch?v=ksZTYRqr444 (Jimi Hendrix, "Castles Made of Sand" )

Faelian2 2y ago

As a pentester, I would argue that attackers don't think in graphs either. Apart from Bloodhound, I can't think of any tools where we have graphs. For web security, I can't think of something where "graph thinking" applies. But we have a pretty huge list of attacks to test https://portswigger.net/web-security/all-topics https://portswigger.net/web-security/all-topics. And ultimately, what is inside your pentest report ? Not a graph, a list of things to do: - SMB signing. - Don't use the domain admin to manage every machine. - ... The main reason this phrase is so popular, is that it panders to the hacker community: "We are the smart guys, all the defenders do is excel sheets." IMHO, the nugget of truth in this is that defenders can spend considerable amounts of time on things that don't matter. Like doing CIS benchmark by hand on all servers. While missing the low-hanging fruits that would give them a strong security posture. In a lot of companies, the defenders are just sysadmins that don't have any idea of what they should focus on.

syntheticcorp 2y ago
I get your point but I think pentesters are perfectly capable of thinking in graphs, including web security. Bug chains are the immediate example, where a couple of CVSS 4-7 vulns can be turned into a full rce/whatever 9.8 equivalent. This bug chaining fundamentally occurs via elements of compromise i.e a graph traversal. Bloodhound is great, and a nice visual tool for people to conceptualise attack graphs but it’s just a part of the process of understanding the target domain from an attackers perspective. No nice tool like bloodhound exists for web pentesting because a chain of compromise can’t simply be reduced into tool form there because a chain is often specific to the app and not an underlying framework, unlike AD where the security boundaries are well(ish) understood and codified. Pentest reports include stuff like SMB signing and “don’t admin everything with your DA account ” because they are glowing hot nodes very early in a chain of compromise, meaning that is often how stuff gets popped IRL. It’s (hopefully) not that the pentester doesn’t understand graph thinking, it’s just the the first node in the graph represents effectively complete compromise, so why traverse?

hoherd 2y ago

Isn't a defense strategy based on a graph an O(n!) problem, and thus unrealistic? Perhaps it's not quite that bad, but it has to be somewhere in computationally infeasible solutions territory.

talkingtab 2y ago

I feel like this does not go deep enough. :-) "lists" is just short hand for components. "Graphs", shorthand for interoperation. The component view is analysis, the interaction view - well we don't have a really good word for that, and yet as the article points out, that is often the attack surface. Complex adaptive systems (see John Holland's "Hidden Order") have components and a messaging bus which crucially provides a way for the constituent components to interoperate. You can swat ants individually, but if you want to stop them, you destroy the ability to leave pheromone trails. Maybe there should be a word like "analysis" for understanding how things interoperate. Gestaltysis?

nunez 2y ago

"Attackers" usually have a single mission in mind (exfiltrate juicy data, destabilize the target, hold juicy data for ransom, etc.) and have the privilege of exploring as deeply as needed until the mission is accomplished. "Defenders" (like the SOC) have to think in lists because they're tracking many signals and threat vectors at a time and need to prioritize which ones warrant their attention/require action because a regulator told them so (think high-scoring CVEs against code that's been deprecated forever ago). Without having "defenders" post in random places along the graph looking for interesting activity, I don't know how they'll be able to "think in graphs". To wit, the suggestions that the author made would be, you guessed it, signals in a list that a "defender" would check against!

beardedwizard 2y ago
I disagree with this. In my experience we saw the red team use graph techniques to plot paths to high value assets over and over, where defenders were not even thinking about this approach. As soon as they did, they identified potential attacks before the red team launched them. Smart teams will immediately adopt the red team technology that, for example, crawls AWS as a graph looking for paths to from low to high value accounts. Its not a zero sum or sea change thing, but defenders absolutely can think more like attackers and leverage attacker tools more often in the act of defense.
- uberman 2y ago
  How do you define and track high values assets? Perhaps in a list?
  - Jerrrrrrry 2y ago
    High values can exist on different dimensions. The CEO is worth more in some ways than the HR lady. The HR lady is worth much, much more than the CEO in other ways. This added dimension turns the 1D list into a 2D map, or a graph.
  - deleted 2y ago
    [deleted]

uberman 2y ago

Attackers win because they only need to succeed once after proving for weak points. Defends have to guard everything at once.

er4hn 2y ago

Judging by the comments this article seems true in the abstract: "You are only as strong as your weakest link" can be formalized better as "You are only strong if there is no path over your assets for an attacker to carry out their objective." The big problem with "checklist based security" is that it is agnostic to underlying infra and ignores whatever issues a graph based approach might reveal. I'll add another item that defenders use for graphs: SBOMs. You can map out component relationships with them and understand if, for example, there's an issue with openssl, note which end applications are affected.

frays 2y ago

Fantastic analogies useful for cybsercurity here.