4 ms·
This is oversimplifying. For example, encryption at rest or in transit essentially eliminates attack vectors. The possible attack avenues necessarily shift as
by antonvs 3mo ago
This is oversimplifying.
For example, encryption at rest or in transit essentially eliminates attack vectors. The possible attack avenues necessarily shift as a result, but only because an avenue was blocked.
That's very different from e.g. adding a layer of protection around something insecure, where the insecure thing remains insecure inside the protection, which I think is what the other commenter was imagining.
Similarly, memory safe languages (including most GC languages, not just a certain language beginning with R) eliminate entire classes of security hole. Again, the possible attack vectors necessarily "shift", but that doesn't capture the fact that you've entirely eliminated a class of attacks.
The same goes for eliminating unnecessary services, firewall holes, etc.
None of these are specifically trying to "shift it to something to something that is more difficult to compromise." They're entirely blocking attack vectors, and the strength or weakness of other parts of the system aren't really a factor.
- ikiris 3mo agoWhat? Encryption has never eliminated attack vectors, it just shifts them to weaknesses in the implementation
- antonvs 3mo agoEliminating an attack vector means stopping a specific path or method that can be used to break into a system. "Shift" in this context means that the attacker has to use a different attack vector. They can no longer just access plain text.
- ikiris 3mo agoYes, those are the definitions everyone is working with.
- madeofpalk 3mo agoDoesn’t encryption shift the attack vector to the key and/or the method?
- antonvs 3mo agoThat's a different attack vector. The attack vector that involves accessing plain text has been eliminated. An attack vector is a specific path or method that can be used to break into a system.
- orf 3mo ago> That's a different attack vector So you’re saying that the attack vector has… shifted.
- antonvs 3mo agoNo. The attack vector has changed to a different attack vector. In English, the word "the" in "the attack vector has shifted" is a definite article that refers to a single attack vector. If your car breaks down and you switch to using a different car, would you say "the car has shifted"? Speaking loosely, one might use "the attack vector has shifted" to mean something like "the possible attack vectors have changed", but that kind of looseness is misleading in an absolute claim like the one I originally responded to, about "all security measures". In fact, it would be more accurate to say that no security measures "shift the attack vector".
- kirab 3mo agoYou are confusing attack target and attack vector I think. A vector here is the attack angle/direction. Of course I can shift my direction and then target another car.