7

I tried following a link from a post on this site and discovered that insecure.org is blocked by our internet proxy.

What are the potential benefits and risks of allowing access to such sites to developers and architects and how might we mitigate these risks? Some benefits:

  • Giving the developers and architects insight into what they are up against.
  • Giving the developers and architects the tools and knowledge to test their systems for vulnerabilities

On the downside, some of these tools may be dangerous and bad things could happen even if there was no ill-intent. I don't see much additional risk (at least not that can't be mitigated) given that the developers are building the actual systems that we are trying to protect. They already have the ability to make bad things happen in much more direct and powerful ways.

Are there aspects here that I have not considered?

  • I've added the tools aspect in the title of your question. It is quite important since, would the proxy let you access the download website, you will then certainly fall with the next problem: "Woops, my shiny newly downloaded security tool has been quarantined by my anti-virus!". – WhiteWinterWolf Dec 15 '15 at 16:46
  • Ask your management if they want to enforce a policy that your security staff knows less than the adversary about every issue? Is it the intent to maintain an ignorant security staff? – Mark C. Wallace Dec 15 '15 at 17:11
  • We have a similar policy but it is based upon block lists from our security vendor that are absolutely nonsensical. For example, downloading a vulnerable virtual machine, such as DE-ICE from vulnhub.org, BLOCKED. Downloading a new distribution of Kali Linux, NOT BLOCKED. – Stone True Dec 15 '15 at 18:22
4

The main issue is that these tools induce suspicious behaviors (suspicious network activity, suspicious files, suspicious process behavior, etc.). From a network monitoring perspective, how would you then reliably detect an actual attacker if its activity is just blending in background noise of "normal" suspicious behavior affecting your network and systems?

Providing the right tool for the right people to do their job remains still possible, but this requires a clear definition of the involved tools, people and job so everyone can agree on what a normal and expected behavior is.

This is called a policy.

Such policy would therefore cover domains like:

  • The tools: Do you really need to allow your developer and architect to download anything from anywhere from the Internet? Certainly not. You may constitute a list of approved security software downloaded from a trusted source, whose authenticity has been carefully verified, and made available internally to the people really needing them.
  • The people: Instead of opening holes in the corporate proxy, having a specific set of tools shared internally from a single location may allow a greater control over the access to these tools. The policy may describe the process which should be followed when someone want to access this repository: who he should contact, what information he should provide, what motive would be considered legitimate.
  • The job: Do your allowed developers and architects really need the ability to scan or hack anything anywhere at any time? Here again, certainly not. You will therefore be able to decide from and against which machines the attack scenarios can occur, you may even plan some kind of confined network dedicated to such usage to ensure that the outer network and system will not be affected.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.