-2

Assuming the following:

  • Operating arbitrary software in a completely read only environment is impractical. (While some software will operate RO without issue, it can be nigh impossible for other software, particularly if source code is not available as is sometimes the case)
  • Rebuilding any machine in place is trivial and takes a negligible timespan with whatever method is being used, be it prebuilt images or via configuration management tools rebuilding them or any other combination or alternative.
  • Destroying a host will not cause any downtime or service degradation.

Is there any reliable way to estimate how long an OS/Host should be allowed to 'live' before recycling it?

Ideally a way that avoids 'unnecessarily' excessive recycling which regardless of how efficient it is, will be adding overheads and performance penalties which would be best avoided as much as possible.

4

You have a non-question right here.

Let's look at your second and third assumptions. Rebuilding a machine has negligible cost with zero downtime. The logical conclusion in this ideal world is rebuilding after any instruction is executed. After all, it has zero cost.

Then you say,

Ideally a way that avoids 'unnecessarily' excessive recycling which regardless of how efficient it is, will be adding overheads and performance penalties which would be best avoided as much as possible.

You say the costs are negligible, so why will I want to avoid it?

In the real world, while rebuilding can be highly automated, it does have costs. It takes time to spin up a new VM. While there are very solid failover mechanisms out there, they are costly and there probably will be a noticeable impact on performance even if downtime is avoided. So the correct answer is "rebuild only when there is a problem."

  • I added that to avoid any arguments leaning too close to 'rebuild after every transaction/http request/etc/' – Techdragon Mar 14 '14 at 8:24
1

If all your users are on virtual machines (eg using a Citrix farm) then a rebuild from profile on every login can actually provide many security benefits - limiting infections, relatively seamless updates/patches etc.

I would not class age as a security attribute however, as measuring it doesn't give you an indication of security.

0

It strikes me that this question is very similar to "How often should I change my password?".

There is possibly some benefit to a regular password change / machine rebuild, in that any compromises will be destroyed. However, unless you have invested a huge amount of capital into automation, there will be a non-trivial marginal cost for each password change / machine rebuild (I don't think your second or third assumptions can ever be true).

I agree with Terry essentially: do it when an event has made it necessary, not because you're adhering to a schedule.

A strong password is inherently strong regardless of the passage of time; similarly, a well-hardened system doesn't need to be rebuilt just because X months have passed since the last one.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.