41 ms·
I think the theory is that once you have any beachhead onto a system, that existing local priv escalation exploits and network mapping techniques are almost alw
by mpyne 13y ago
I think the theory is that once you have any beachhead onto a system, that existing local priv escalation exploits and network mapping techniques are almost always sufficient to complete the exploitation of your corporate network.
So if you have 5 people using 5 different email clients, all 5 of those must be kept secure from spear phishing or email-viewing vulnerabilities to avoid having a hacker get a beachhead on your network.
But if those 5 people are using 1 email client, you only have to keep that 1 safe (and you'd have to keep it safe anyways).
Monocultures are probably bad for drive-by automated hacking though, so I suppose it's a matter of deciding what threat model you're most at risk from.
- niels_olson 13y ago> you only have to keep that 1 safe This argument may appeal to the self-indulgent system administrator who believes he alone knows perfection. In reality, there is no perfection. One must know there are things one does not know. If China is stock-piling zero days against Outlook, how are you to know? In fact, if there is anything we have learned from biological systems, surely it is that when a monoculture falls, it falls harder and faster than any other variation.
- danielweber 13y agoI know it's appealing, but don't try too hard to apply biological analogies to computers. If you are trying to mitigate against all your computers being taken down at once, diversify. If you are trying to keep intruders out of your network, reduce your surface area.
- mpyne 13y agoWell, let me reiterate: "(and you'd have to keep it safe anyways)". You're right that no one is perfect, but that's no reason to expand the number of directions threats can come from.