The 4am Idea
The general idea is that every instance that gets launched on my cluster is preloaded with a 'suicide script' that after a preset
Time To Live (say, 27 minutes) launches a replacement instance, and then terminates itself.
The result is a 'constantly rolling' cluster where no IP address exists for longer than the
TTL of any given instance.
I don't have a comprehension of attack vectors or attack surface theory like I'm sure most of you do, but this sort of approach seems to offer some interesting advantages.
Here's What I'm Thinking Could Be Achieved
- Reduce Overall Intrusion Attempts Per Instance: The short lifespan of each IP would reduce the time available for any intrusion attempts. Once a target IP is found, the attacker has only the
TTLbefore the window closes, thus reducing the overall number of attempts, thus reducing the overall probability of a successful attack.
- Frequent Security Updates: The instances would handle their security updates upon launching, which means they would never be more than 27 minutes out of date with security patches.
- Eliminate Deployment Layer: If you handle app deployment upon launching, which I do, this would automate the process even further by obviating the need for Githooks or Dockerhubhooks, for better or worse.
A quick thought experiment would also reveal that if you reduce the
TTLdown to a point where any given instance only has time to handle starting itself up, handling a handful of requests (the 'suicide script' could also be triggered after a certain number of requests have been handled, like say, 27), and then it goes down it seems to me that it would greatly increase the difficulty of an attack. If the attack requires more than 27 requests then the attacker would never be able to complete all the steps needed to succeed.
So I think those are interesting, good things. There are obviously many more factors to take into consideration, not least of which is the impact this could have on how requests are handled by your router, and whether or not your cloud provider would even allow this considering the extra CPU load it would put on their system.
Would this reduce the attack surface for the following attack vectors?
- Attempts to compromise
- Port Scanning
- HTTP/HTTPS which is listening on 80 and 443 on each instance
It's worth noting the the applications on each instance would be ephemeral apps, the session storage is a remote Mongo cluster (running in the same AWS region), and Nginx would be used on each instance to handle the routing of traffic to the correct IP:PORT of each app installed on the instance, which is why 80 and 443 need to be open.
Thanks in advance for any information you may want to share.