How would one make a network resistant to the unknown?

Question

I play in a game which includes normal risks, but also a wide range of supernatural powers which could affect the security of a network. These may be as prosaic as a retrieving data directly from a device's memory with a touch or as dramatic as sending one's mind directly into a network or constructing a small alternate reality where the laws of physics permit construction of a practical large-scale quantum computer. It is impossible to guess the limits of these abilities, as anything that is permitted in any chapter of the game may potentially come up.

Now, obviously, designing a system that can reliably defend itself against arbitrary unknown attacks that don't have to obey the laws of reality is a ludicrous endeavor. What I'm looking for are ways to make the system unknown-arbitrary-attack-resistant.

As an example, all critically sensitive information is kept on a separate network that is air-gapped from anything that connects outside the building. This would normally be an insurmountable obstacle to anyone attempting to compromise the internal network from the outside. However, I cannot discount the possibility that someone could cross the air gap. Ideally, accessing sensitive information should require an attacker to do at least two things that are practically impossible, just in case one of them turns out not to be.

So, without further ado, the parameters of the system:

• The system has about ten users. They have widely varying levels of computer skills, and these skills may be decades out of date. They will want to run their own software, and they may outrank the sysadmin.
• The users need to be able to access the internet mostly unfettered.
• The users need to be access the internal network, but the access controls may be stringent.
• Some areas of the building are public, but the secure parts are as physically secure as can be. For an attacker to gain physical access to the network can be safely counted as one "impossible thing".
• Off-site backups are a must. Backup sites cannot be guaranteed to be physically secure.
• Both networks may be restricted to known devices.
• The outer network must permit remote logins from certain known mobile devices.
• Files on the inner network will mostly consist of scanned books and papers. There may be many terabytes of such scans. It does not have to be particularly convenient to transfer data to and from the inner network.
• Files may need to remain secure for many decades.
• It may be assumed that there is a skilled individual monitoring the network for anomalies 24/7.
• The budget for the network is around $100k, plus around $10k/year upkeep, unless there's a good reason to go higher. This excludes all labor costs.

Examples of the sort of defense-in-depth approach I'm going for:

• Backup tapes are encrypted with AES-256, and then with a one-time-pad that is sent to the backup site beforehand.
• The building exterior walls are lined with wire to form a Faraday cage.
• The "panic button" physically detaches external network connections, rather than just deactivating them.
• Old hardware is erased, degaussed, and set on fire.
• All of the firewalls are cumulative – if a firewall detects a condition that should have been blocked by another system, it causes a text message to be sent to the sysadmin.

So, then, my question(s): What sorts of measures might be appropriate for a situation like this? What are some good "impossible things" to put in the path of an attacker? How can I design a system to take maximum advantage of defense-in-depth?

Answer 1

Modern day security holds the belief that you cannot make a network infinitely secure - build a better mousetrap and you'll encourage the evolution of mice. Any security system will have to be bounded by the expected capabilities of the attackers, and will have to employ a threat based risk remediation strategy that puts the greatest investment on the occurrence that is most likely to cause the most harm.

I may be a jaded high end security person but your budget is hardly sufficient for what you propose. You can trade labor for equipment up to a point - freeware software encryption tools vs. paid for hardware - processes done by humans instead of automated systems. But several of the things you propose fall well outside your budget range:

• TEMPEST secure work rooms - essentially the Faraday cages - are going to cost quite a bit more than $100K to install, even if you assume you have free manpower with the right expertise, I'd suspect the supplies will run you higher than that.

• hardware for panic button - if all you mean is that a guy yanks the one cable to the outside - then it's free. But if you mean cases of devices that are tamperproof (zeroize when inappropriate access occurs) - then you are taking $10K and up per device, depending on device types.

• data collection - if you want a highly correlated network data store for intrusion detection and anomaly analysis - you are well over $100,000 in the combination of servers, datastores, SAN, database licenses, app server licenses - etc - and that's assuming you are home growing your infrastructure. Cost will vary considerably based on complexity of the network, traffic, and number of vectors you are trying correlate. Price changes if you take some of this to the cloud, but so does the type of risk you will encounter.

All of your options are great ideas for securing high end systems, but you have been given the budget of a high school science project and you are trying to build a space shuttle.

The security best practice to working through this is to look at the data and the assets and figure out what is truly your high value. Is it your reputation? Your information? The availability of your service? The safety of your people? What is it you want to protect?

Then take a look at who (or what) would be antagonistic to that desire? It can be an intentional adversary or something mindless (like natural disasters). What are the capabilities of your highest threats, what will their goals be, and what are their resources? A kid hacking after school (even if he is an evil genius) works differently than a nation state undertaking a cyberwarfare action. It can even vary based on the nation - the way Asian countries conceive of war is different than the context of the Western world. So your enemy makes all the difference.

Then look with the enemy's eye at your system - implement it as straightforwardly as you can, and then see what will be easiest to break. Go with the lowest tech you can get away with and verify that it'll be sufficient.

If you don't have this information yet - spend your time and your money on getting it - don't shoot for the unknown and impossible to imagine.

Answer 2

You've hit on the basic premise of IT Security: you can't predict or stop everything, and to try might cost more than what you are trying to protect. Your character is concerned with Mastery of skill to overcome higher-level obstacles, but the race to create obstacles that are higher than other people's skills is foolish in reality.

In reality, you need to ask other questions. What needs protection? What's the risk severity? What's the risk probability? What could be compromised without concern? How are the assets accessed? How can you employ CIA against those assets? You then lower the risks, probabilities, and costs to levels below the costs of the loss of assets.

To address your question directly, your concept of an all-powerful 'technomage' is fine, but it is easily countered with the idea of 'formlessness'. If you build a fortress, you can attack a fortress. However, if you are air, there is nothing to attack. The more you create 'defence in depth' with higher walls and tougher rules, the more fragile it becomes. An adaptive and regenerative system, on the other hand, is resilient to attacks. Least-privilege principles, internal honeypots, monitoring traffic leaving every node in the network, and classifying every piece of data that is to be protected will get you further than innovative design. (of course, all those things are considered 'innovative' by many)

Edit
By 'formlessness' (read The Art of War, Tao Te Ching), consider not having an all-power Admin on the network. Users, even administrators, should only have enough power to do their jobs and no more. When they need more power, give it to them to do the job, then revoke. No Admin means no Admin powers to usurp.

Answer 3

One piece of advice I can give is to severely limit what a single person acting alone is allowed to do. In the most extreme security cases, such as issuing or changing authorizations or credentials, don't even let two people alone have the capability to do it. Assume your organization has been infiltrated and at least one person is a spy. Design your systems to limit the damage the spy can do. Then assume that spy can choose someone to blackmail and limit what the two of them can do together. Not only is this a valid real-world scenario, but also protecting against this sort of scenario gives you great security against unauthorized individuals doing anything.

As for encryption, AES-256 encrypted backups are not going to be secure for decades against a practical, large-scale quantum computer. You can ask over on Cryptography what might survive that long; I don't know what that might be.