5

I have often heard that if you are the target of a directed hacking campaign by say, a team of government hackers (whether Chinese, NSA, etc.), there is no way to prevent being hacked if they highly value the information they wish to retrieve.

If they're willing to throw their, for these purposes essentially unlimited (is that right?), resources into hacking your server specifically, then you're done. There is nothing you can do to stop them. Even country vs. country it is difficult, since the cost to defend against possible attacks is higher than the cost of developing successful attacks.

So, two questions:

  1. Is it correct that targeted attacks from highly trained and well-funded hacking groups are practically impossible to defend against?

  2. Is there a rule of thumb for what the cost to attack vs. cost to defend against an attack is? Is the cost to defend typically higher?

  • 1
    If they just want some information from you, attacks can be as little as $5. As usual, the weakest element of the security chain isn't the technology, it's the humans around it. – Clockwork-Muse Oct 31 '14 at 6:44
9

Is it correct that targeted attacks from highly trained and well-funded hacking groups are practically impossible to defend against?

For the average person, or even corporation, in my opinion the answer to that question is a resounding YES.

Have you ever seen the types of technology organizations like the NSA have at their disposal? Check out https://nsa.gov1.info/dni/nsa-ant-catalog/

Boom. Mind blown.

Is there a rule of thumb for what the cost to attack vs. cost to defend against an attack is?

Not really.

Is the cost to defend typically higher?

Defending can cover a very broad base of technologies and a very wide network footprint. It can be easy to fall into the "Jack of All Trades, Master of None" scenario.

An attacker can pinpoint and target specifically what they choose.

Defenders have to be right 100% of the time, attackers only have to be right once.

For these reasons I believe we can all agree that the cost to defend is typically higher.

| improve this answer | |
5

The issue is that an attacker typically has unlimited time, and thereby has unlimited resources to eventually find a way in.

It's an error in logic to then conclude that they cannot be defended against. Of course you can defend, which increases the time it would take them. More importantly then, is your ability to RESPOND to an attack, successful or unsuccessful. That's where you have the most important leverage.

As for cost/benefit ratios, it all depends on your organization and the value of the asset. That is something that only the asset owner can determine. Regarding what I said above, a part of that calculation is the response necessary if an attack is successful.

As an example, I always calculate the cost/benefit of no defense at all but simply to replace the targets quickly (data from backups, wipe and re-image workstations/servers, etc.) and then compare that to the loss of the asset. Then I calculate the costs of defending against the most likely threats and figure out the difference between the new situation and the 0-defense scenario. It really focuses the costs, efforts, and understanding of the threats and what can be done.

This kind of response is also a defense, and must be considered. In this way, there is always a way to respond to attacks. Instead of building bigger and thicker walls, treat your Info Sec defense more like an immune system.

| improve this answer | |
5

The response by schroeder boils my blood, and I believe it’s this train of thought, that undermine security as a whole. Here goes my response which is likely to get me either banned, or have this post moderated to below -10000 points.

Schroeder states: The issue is that an attacker typically has unlimited time, and thereby has unlimited resources to eventually find a way in.

This is somewhat misguided and it is often a term I hear passed around by information security managers who often don’t understand technology, threats, and security as a whole. The true issue is that ATTACKERS (more than one) have more time than you will. There is also a cost associated with hacking from a malicious perspective.

For example, Mac owners falsely believe they cannot be hacker, nor infected with viruses, trojans, and worms. They base their beliefs on the notion that there aren’t that many attacks aimed at OSX. This is solely true because it makes more economic sense for an attacker to target Windows based machines. There are far more Windows users than there are for OSX, so for someone spreading say “adware” based malware, their time and efforts are better spent targeting Windows. All it takes is for one attacker to publish an exploitable threat, MS to issue an update, and attackers are doing “patch diffs” to reverse engineer an exploit.

Schroeder says: More importantly then, is your ability to RESPOND to an attack, successful or unsuccessful. That's where you have the most important leverage. This statement too is so far off base. Most security admins that I have had the pleasure to work with and meet often lack in certain areas. Be they networking, system administration, programming, I have yet to meet the uber security admin. When new threats (term I dread: Zero Day) are in the wild, a high percentage (90+ percent) won’t detect it, won’t stop it, until it becomes visible. It is a difficult thing to do to watch for anomalies in large networks.

Schroeder says: As for cost/benefit ratios, it all depends on your organization and the value of the asset. That is something that only the asset owner can determine. Regarding what I said above, a part of that calculation is the response necessary if an attack is successful. More verbiage that is taught in most information security management material. The old: AV * EF = SLE. Let’s look at this hat trick:

Single Loss Expectancy (SLE) = Asset Value x Exposure factor

Define your asset value. How do you calculate it? Simple, the cost of the asset. It’s what all information security managers do. Exposure factor? Calculated with such horrible math. Information security, is not like an automobile, where a car has a set price. Here is how this horrible train of thought works:

AV = 1,000,000.00 (Asset Value)
EF = 20% (Exposure Factor)
SLE = $200,000.00 (Single loss expectancy)

Let’s blow this old house down. According to the LOWEST estimate I have found, the Target breach cost them $148 million USD.

  • SLE = $148,000,000.00

  • AV = What number would you like to assign here? Define the asset. Was it the computers compromised collectively? Should employees, their salaries and overtime be included in the asset value? Surely client data could at some point be considered not only an asset but a liability.

  • EF = How do you want to sugar coat this?

Percentage wise, an "asset" in the case of a target breach would range from $1,480,000.00 to as high as 1,480,000,000.00 in which case a security manager doing their budgets, would have to spend yet another percent to defend this one device/asset. Pick your poison, lower this to say $14,800.00 per dollars per ONE asset. Do you think Target would spend 1% of this, against 10,000 ASSETS? It wouldn't be a lot of money to spend at $14k ($1,480,000) So how much sense this horrible AV*EF formula make. The security manager in his wisdom will tell you, as sorts of warm tales to defend this formula.

The methods security managers follow is god awful horrible and based on traditional MANUFACTURING models. Someone decided long ago they could manipulate it to work on IT, security managers have been running with it all along, and the breaches still occur.

Schroeder says: As an example, I always calculate the cost/benefit of no defense at all but simply to replace the targets quickly (data from backups, wipe and re-image workstations/servers, etc.) and then compare that to the loss of the asset. Then I calculate the costs of defending against the most likely threats and figure out the difference between the new situation and the 0-defense scenario. It really focuses the costs, efforts, and understanding of the threats and what can be done.

I was a dear in headlights on that one. Might I had been back at Blackhat Briefings, I may have applauded to follow the crowd. Enough rambling though, there are plenty of things you can do to protect yourself. Firstly, stop following the herd, and think outside of the box. As I’d like to say: “sorry herd, can’t follow you, most cattle end up as burgers. I’m going the other way.

The first step I would take if I were you, would be to define what it is you need to protect, allocate the appropriate resources not only to defend it, with the appropriate security controls, and applications, but also MONITOR what is going on. Rinse, and repeat. This is (monitoring( the most crucial and overlooked aspect of information security. It is also HIGHLY misunderstood by even the most seasoned security professionals.

You should know how your systems, and networks are supposed to work. What they are configured to do, and configured NOT to do. Monitor everything, set up baselines of how they NORMALLY behave, and look for the anomalies. Not only on the applications, and systems themselves, but on the NETWORK. Without any networking, the likelihood of being compromised is lowered forcing an attacker to be on premise (there is no network). Create ACLs based on what your machine is supposed to do, who is supposed to be connecting to it, and again, study the anomalies. “Hey it’s 4AM on a Sunday, no one in the office, why is my machine sending OUT data.” While this is an EXCELLENT alarm/aert, it also shows that you overlooked the FACT that locally on that machine, you could have implemented a firewall rule to outright BLOCK all connections. After all, it’s your network/asset, you should know whether or not it really needs to be networked.

It is not that complicated, it all boils down to your approach. This is something that ONLY you can implement/apply/fix because no one should know your network, its assets more than you. Especially not any other security professional pounding the pulpit with verbiage that can be dissected to dust.

Anything can be hacked, but everything can also be defended effectively. I have yet to have had the unfortunate circumstances of having a network, computer breached, infected with malware, viruses. PERIOD.

Schroeder, and others, sincerest apologies this is NOT a personal attack, I highly respect others, but immensely disagree with ad populum security theater.

| improve this answer | |
  • 2
    I'm afraid the raised temperature of your blood led you to misunderstand my intent. I never said that you can't or shouldn't defend yourself, but you need to know where your best leverage is. – schroeder Oct 29 '14 at 22:01
  • 1
    I also agree that the AV * EF = SLE model is flawed, but the cost of public information is lower than sensitive intellectual property. – schroeder Oct 29 '14 at 22:02
  • 1
    In the end, your proposal appears in line with my own. I'm sorry if I hit hot-button terms that made it appear otherwise. – schroeder Oct 29 '14 at 22:04
  • 3
    Wow...dude... you went off the deep end. :) Schroeder's response is obviously coming from a real world corporate background - at least that's what I'm seeing in his response. – k1DBLITZ Oct 30 '14 at 19:22
  • 2
    I don't agree that everything can be defended effectively from a targeted attack. Yes, you can defend against buffer overflows, SQL injection, etc type attacks. But if some gov't agency with nearly unlimited resources wants to get into your computers -- they can. They may have to bribe people to steal trusted certificates or make "honest" mistakes like heartbleed or just give you access, steal and alter your incoming packages to modify your hardware, break-in and covertly insert hardware keyloggers, threaten someone with access with imprisonment for non-compliance, etc. – dr jimbob Oct 30 '14 at 19:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.