If a server installed all patches for known bugs and the attacker can't do a 0-day attack, then is the server absolutely safe?

  • 1
    misconfigurations, default passwords, default code, poorly written code all can be leveraged by attackers and have nothing to do with patches or zero days
    – KDEx
    Nov 23 '14 at 1:27
  • @KDEx Thanks! I think there are many other loopholes this kind. Let's say if the goal of the attacker is to gain control of the server and there is nothing like "default passwords" that people with basic security knowledge would avoid to use...
    – user61250
    Nov 23 '14 at 1:57

The question itself relies on some pretty critical, and invalid, assumptions:

  1. We know who the attacker is.
  2. We know what the attacker does and does not know.
  3. We know that the attacker does not know about zero-day vulnerabilities in our system.
  4. The attacker's level of knowledge and skill is static.
  5. A system can be absolutely safe.

We cannot assume to know who the attacker is.
With very rare exception, if any, it is impossible to know who will be attacking your system in the future. Chances are, you don't even know everyone that's attacking your system now. Therefore, you must do what you can (within reason) to prepare for all possible attackers.

We cannot know what the attacker does or does not know.
The second assumption is very much reliant upon the first to begin with. Even if you do know who's attacking you though, it is the very nature of human beings that one person does not comprehensively or authoritatively know everything that another person knows.

We cannot know whether an attacker knows about zero-day vulnerabilities in our system.
The very nature of zero-day vulnerabilities is that we, as defenders do not know about them. That's why they're called "zero-days" - as long as the attacker is the only one with knowledge of a vulnerability, defenders have had "zero days" to develop or apply patches or configuration changes necessary to mitigate them.

Attackers are always learning and developing new skills, tools, and techniques.
Even if you do know who your attacker is and what he knows, and that his knowledge is limited to only the vulnerabilities that are patched on your system, that does not mean that he will not learn something new in the future. If an attacker has studied your system, and realizes that he does not know of an exploitable vulnerability for the software and updates you have installed, the next thing they'll probably do is start to Google for other vulnerabilities that do apply. If nothing turns up there, they may try analyzing the system and software themselves to develop whole new exploit vectors.

No system can be made absolutely safe.
This is just the raw nature of security. No matter what, there will always be something that can compromise your system. It's our job to just make sure that that "something" requires extraordinary effort or resources, so that potential attackers are dissuaded from even trying. We should also put monitoring and alerting systems in place so that we can see when an attacker is successful and respond quickly and appropriately.

  • I understand that there is no invincible shield...I don't know much about security, let me change my wording. If I know 10 bugs, and all of them are fixed on a server, then I can't gain control of the server right (unless there is something like "default password")?
    – user61250
    Nov 23 '14 at 3:49
  • @shidangai Really, the question is not even valuable in the first place because it is so far separated from reality. See my update to the answer - it also would address your suggested revision.
    – Iszi
    Nov 23 '14 at 4:02

Nothing is "absolutely safe" there will always be a way to crack into any system given enough time and resources.

If you have patched all the latest software that's awesome! But that doesn't mean you still don't have to take precautions against weak passwords, spear phishing attacks, or weak code that doesn't prevent vulnerabilities such as SQL injection.

Additionally, you're relying on the premise that there are no 0-day exploits available which misunderstands the concept of what 0-days are. By definition, there is no solution for a 0-day because it is a weakness in a system that remains undiscovered.

Instead of trying to get absolute security, aim to mitigate attacks and develop processes which allow rapid and effective responses to attacks or breaches.

  • No worries! Sorry if I posted after a little redundantly, I think I started writing before you accepted a best answer.
    – Fernando
    Nov 23 '14 at 4:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy