Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I play in a game which includes normal risks, but also a wide range of supernatural powers which could affect the security of a network. These may be as prosaic as a retrieving data directly from a device's memory with a touch or as dramatic as sending one's mind directly into a network or constructing a small alternate reality where the laws of physics permit construction of a practical large-scale quantum computer. It is impossible to guess the limits of these abilities, as anything that is permitted in any chapter of the game may potentially come up.

Now, obviously, designing a system that can reliably defend itself against arbitrary unknown attacks that don't have to obey the laws of reality is a ludicrous endeavor. What I'm looking for are ways to make the system unknown-arbitrary-attack-resistant.

As an example, all critically sensitive information is kept on a separate network that is air-gapped from anything that connects outside the building. This would normally be an insurmountable obstacle to anyone attempting to compromise the internal network from the outside. However, I cannot discount the possibility that someone could cross the air gap. Ideally, accessing sensitive information should require an attacker to do at least two things that are practically impossible, just in case one of them turns out not to be.

So, without further ado, the parameters of the system:

  • The system has about ten users. They have widely varying levels of computer skills, and these skills may be decades out of date. They will want to run their own software, and they may outrank the sysadmin.
  • The users need to be able to access the internet mostly unfettered.
  • The users need to be access the internal network, but the access controls may be stringent.
  • Some areas of the building are public, but the secure parts are as physically secure as can be. For an attacker to gain physical access to the network can be safely counted as one "impossible thing".
  • Off-site backups are a must. Backup sites cannot be guaranteed to be physically secure.
  • Both networks may be restricted to known devices.
  • The outer network must permit remote logins from certain known mobile devices.
  • Files on the inner network will mostly consist of scanned books and papers. There may be many terabytes of such scans. It does not have to be particularly convenient to transfer data to and from the inner network.
  • Files may need to remain secure for many decades.
  • It may be assumed that there is a skilled individual monitoring the network for anomalies 24/7.
  • The budget for the network is around $100k, plus around $10k/year upkeep, unless there's a good reason to go higher. This excludes all labor costs.

Examples of the sort of defense-in-depth approach I'm going for:

  • Backup tapes are encrypted with AES-256, and then with a one-time-pad that is sent to the backup site beforehand.
  • The building exterior walls are lined with wire to form a Faraday cage.
  • The "panic button" physically detaches external network connections, rather than just deactivating them.
  • Old hardware is erased, degaussed, and set on fire.
  • All of the firewalls are cumulative – if a firewall detects a condition that should have been blocked by another system, it causes a text message to be sent to the sysadmin.

So, then, my question(s): What sorts of measures might be appropriate for a situation like this? What are some good "impossible things" to put in the path of an attacker? How can I design a system to take maximum advantage of defense-in-depth?

share|improve this question
1  
Please edit to include only the relevant elements. Assume only 25% of what you've written is necessary. –  schroeder Jun 27 '12 at 4:09
1  
This is not a real question as magic doesn't exist. If the attack pathway is going to be magic, the defense should also be magic. (E.g., I cast a spell that infinitely protects the data and has no holes and can't be uncast). –  dr jimbob Jun 27 '12 at 4:27
    
Magic isn't his main point, but designing for unknown attack types. Not a bad question, all in all. Edited the title to remove the reference to 'magic' –  schroeder Jun 27 '12 at 4:32
    
@schroeder, I don't think "the unknown" is a reasonable substitution for the "supernatural" or "magic" ("Sending one's mind through a network"?) From the FAQ: "You should only ask practical, answerable questions based on actual problems that you face." We need to stick to real threats, not talk about threats that will never apply to our universe. I'd not vote to close if the hypotheticals were what if P=NP or quantum computing allowed quick/easy factoring of large prime number (Shor's) or discrete logarithms or checking 2^256 AES keys simultaneously, but for the supernatural I say close. –  dr jimbob Jun 27 '12 at 15:21
    
@drjimbob I agree with your point, but the OP used 'magic' as an analogy, not the primary element to his question. His question is about the 'unknown'. If, perchance, it turns out that he really does want us to design a secure network for his fictional game, I'll vote to close in a heartbeat, but the heart of his question, as I understand it, is valid here. –  schroeder Jun 27 '12 at 17:28

3 Answers 3

up vote 7 down vote accepted

Modern day security holds the belief that you cannot make a network infinitely secure - build a better mousetrap and you'll encourage the evolution of mice. Any security system will have to be bounded by the expected capabilities of the attackers, and will have to employ a threat based risk remediation strategy that puts the greatest investment on the occurrence that is most likely to cause the most harm.

I may be a jaded high end security person but your budget is hardly sufficient for what you propose. You can trade labor for equipment up to a point - freeware software encryption tools vs. paid for hardware - processes done by humans instead of automated systems. But several of the things you propose fall well outside your budget range:

  • TEMPEST secure work rooms - essentially the Faraday cages - are going to cost quite a bit more than $100K to install, even if you assume you have free manpower with the right expertise, I'd suspect the supplies will run you higher than that.

  • hardware for panic button - if all you mean is that a guy yanks the one cable to the outside - then it's free. But if you mean cases of devices that are tamperproof (zeroize when inappropriate access occurs) - then you are taking $10K and up per device, depending on device types.

  • data collection - if you want a highly correlated network data store for intrusion detection and anomaly analysis - you are well over $100,000 in the combination of servers, datastores, SAN, database licenses, app server licenses - etc - and that's assuming you are home growing your infrastructure. Cost will vary considerably based on complexity of the network, traffic, and number of vectors you are trying correlate. Price changes if you take some of this to the cloud, but so does the type of risk you will encounter.

All of your options are great ideas for securing high end systems, but you have been given the budget of a high school science project and you are trying to build a space shuttle.

The security best practice to working through this is to look at the data and the assets and figure out what is truly your high value. Is it your reputation? Your information? The availability of your service? The safety of your people? What is it you want to protect?

Then take a look at who (or what) would be antagonistic to that desire? It can be an intentional adversary or something mindless (like natural disasters). What are the capabilities of your highest threats, what will their goals be, and what are their resources? A kid hacking after school (even if he is an evil genius) works differently than a nation state undertaking a cyberwarfare action. It can even vary based on the nation - the way Asian countries conceive of war is different than the context of the Western world. So your enemy makes all the difference.

Then look with the enemy's eye at your system - implement it as straightforwardly as you can, and then see what will be easiest to break. Go with the lowest tech you can get away with and verify that it'll be sufficient.

If you don't have this information yet - spend your time and your money on getting it - don't shoot for the unknown and impossible to imagine.

share|improve this answer
    
imgs.inkfrog.com/pix/gamerlined66/C0024-1_003.jpg panic button <1$, what do you mean 10K$, simple NIDS can start script like ifconfig eth0 down simply on alarm. Little robotics is not 10K$. –  trankvilezator Sep 22 '13 at 20:32

You've hit on the basic premise of IT Security: you can't predict or stop everything, and to try might cost more than what you are trying to protect. Your character is concerned with Mastery of skill to overcome higher-level obstacles, but the race to create obstacles that are higher than other people's skills is foolish in reality.

In reality, you need to ask other questions. What needs protection? What's the risk severity? What's the risk probability? What could be compromised without concern? How are the assets accessed? How can you employ CIA against those assets? You then lower the risks, probabilities, and costs to levels below the costs of the loss of assets.

To address your question directly, your concept of an all-powerful 'technomage' is fine, but it is easily countered with the idea of 'formlessness'. If you build a fortress, you can attack a fortress. However, if you are air, there is nothing to attack. The more you create 'defence in depth' with higher walls and tougher rules, the more fragile it becomes. An adaptive and regenerative system, on the other hand, is resilient to attacks. Least-privilege principles, internal honeypots, monitoring traffic leaving every node in the network, and classifying every piece of data that is to be protected will get you further than innovative design. (of course, all those things are considered 'innovative' by many)

Edit
By 'formlessness' (read The Art of War, Tao Te Ching), consider not having an all-power Admin on the network. Users, even administrators, should only have enough power to do their jobs and no more. When they need more power, give it to them to do the job, then revoke. No Admin means no Admin powers to usurp.

share|improve this answer

One piece of advice I can give is to severely limit what a single person acting alone is allowed to do. In the most extreme security cases, such as issuing or changing authorizations or credentials, don't even let two people alone have the capability to do it. Assume your organization has been infiltrated and at least one person is a spy. Design your systems to limit the damage the spy can do. Then assume that spy can choose someone to blackmail and limit what the two of them can do together. Not only is this a valid real-world scenario, but also protecting against this sort of scenario gives you great security against unauthorized individuals doing anything.

As for encryption, AES-256 encrypted backups are not going to be secure for decades against a practical, large-scale quantum computer. You can ask over on Cryptography what might survive that long; I don't know what that might be.

share|improve this answer
    
AES-256 will be secure for decades against a practical, large-scale quantum computer. Even if such a beast exists one day at all, it cannot do an exhaustive search on a n-bit key faster than time sqrt(n), so AES-256 with a QC is like AES-128 with a classical computer, i.e. quite robust. It is RSA and discrete-log systems (including elliptic curves) which are killed off by quantum computers. –  Thomas Pornin Sep 6 '12 at 21:09

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.