The response by schroeder boils my blood, and I believe it’s this train of thought, that undermine security as a whole. Here goes my response which is likely to get me either banned, or have this post moderated to below -10000 points.
Schroeder states: The issue is that an attacker typically has unlimited time, and thereby has unlimited resources to eventually find a way in.
This is somewhat misguided and it is often a term I hear passed around by information security managers who often don’t understand technology, threats, and security as a whole. The true issue is that ATTACKERS (more than one) have more time than you will. There is also a cost associated with hacking from a malicious perspective.
For example, Mac owners falsely believe they cannot be hacker, nor infected with viruses, trojans, and worms. They base their beliefs on the notion that there aren’t that many attacks aimed at OSX. This is solely true because it makes more economic sense for an attacker to target Windows based machines. There are far more Windows users than there are for OSX, so for someone spreading say “adware” based malware, their time and efforts are better spent targeting Windows. All it takes is for one attacker to publish an exploitable threat, MS to issue an update, and attackers are doing “patch diffs” to reverse engineer an exploit.
Schroeder says: More importantly then, is your ability to RESPOND to an attack, successful or unsuccessful. That's where you have the most important leverage. This statement too is so far off base. Most security admins that I have had the pleasure to work with and meet often lack in certain areas. Be they networking, system administration, programming, I have yet to meet the uber security admin. When new threats (term I dread: Zero Day) are in the wild, a high percentage (90+ percent) won’t detect it, won’t stop it, until it becomes visible. It is a difficult thing to do to watch for anomalies in large networks.
Schroeder says: As for cost/benefit ratios, it all depends on your organization and the value of the asset. That is something that only the asset owner can determine. Regarding what I said above, a part of that calculation is the response necessary if an attack is successful. More verbiage that is taught in most information security management material. The old: AV * EF = SLE. Let’s look at this hat trick:
Single Loss Expectancy (SLE) = Asset Value x Exposure factor
Define your asset value. How do you calculate it? Simple, the cost of the asset. It’s what all information security managers do. Exposure factor? Calculated with such horrible math. Information security, is not like an automobile, where a car has a set price. Here is how this horrible train of thought works:
AV = 1,000,000.00 (Asset Value)
EF = 20% (Exposure Factor)
SLE = $200,000.00 (Single loss expectancy)
Let’s blow this old house down. According to the LOWEST estimate I have found, the Target breach cost them $148 million USD.
SLE = $148,000,000.00
AV = What number would you like to assign here? Define the asset. Was
it the computers compromised collectively? Should employees, their
salaries and overtime be included in the asset value? Surely client
data could at some point be considered not only an asset but a
EF = How do you want to sugar coat this?
Percentage wise, an "asset" in the case of a target breach would range from $1,480,000.00 to as high as 1,480,000,000.00 in which case a security manager doing their budgets, would have to spend yet another percent to defend this one device/asset. Pick your poison, lower this to say $14,800.00 per dollars per ONE asset. Do you think Target would spend 1% of this, against 10,000 ASSETS? It wouldn't be a lot of money to spend at $14k ($1,480,000) So how much sense this horrible AV*EF formula make. The security manager in his wisdom will tell you, as sorts of warm tales to defend this formula.
The methods security managers follow is god awful horrible and based on traditional MANUFACTURING models. Someone decided long ago they could manipulate it to work on IT, security managers have been running with it all along, and the breaches still occur.
Schroeder says: As an example, I always calculate the cost/benefit of no defense at all but simply to replace the targets quickly (data from backups, wipe and re-image workstations/servers, etc.) and then compare that to the loss of the asset. Then I calculate the costs of defending against the most likely threats and figure out the difference between the new situation and the 0-defense scenario. It really focuses the costs, efforts, and understanding of the threats and what can be done.
I was a dear in headlights on that one. Might I had been back at Blackhat Briefings, I may have applauded to follow the crowd. Enough rambling though, there are plenty of things you can do to protect yourself. Firstly, stop following the herd, and think outside of the box. As I’d like to say: “sorry herd, can’t follow you, most cattle end up as burgers. I’m going the other way.”
The first step I would take if I were you, would be to define what it is you need to protect, allocate the appropriate resources not only to defend it, with the appropriate security controls, and applications, but also MONITOR what is going on. Rinse, and repeat. This is (monitoring( the most crucial and overlooked aspect of information security. It is also HIGHLY misunderstood by even the most seasoned security professionals.
You should know how your systems, and networks are supposed to work. What they are configured to do, and configured NOT to do. Monitor everything, set up baselines of how they NORMALLY behave, and look for the anomalies. Not only on the applications, and systems themselves, but on the NETWORK. Without any networking, the likelihood of being compromised is lowered forcing an attacker to be on premise (there is no network). Create ACLs based on what your machine is supposed to do, who is supposed to be connecting to it, and again, study the anomalies. “Hey it’s 4AM on a Sunday, no one in the office, why is my machine sending OUT data.” While this is an EXCELLENT alarm/aert, it also shows that you overlooked the FACT that locally on that machine, you could have implemented a firewall rule to outright BLOCK all connections. After all, it’s your network/asset, you should know whether or not it really needs to be networked.
It is not that complicated, it all boils down to your approach. This is something that ONLY you can implement/apply/fix because no one should know your network, its assets more than you. Especially not any other security professional pounding the pulpit with verbiage that can be dissected to dust.
Anything can be hacked, but everything can also be defended effectively. I have yet to have had the unfortunate circumstances of having a network, computer breached, infected with malware, viruses. PERIOD.
Schroeder, and others, sincerest apologies this is NOT a personal attack, I highly respect others, but immensely disagree with ad populum security theater.