Is a server infrastructure fundamentally possible which the smartest person can't breach?

Question

TL;DR:

Perhaps I've gone overboard with my question's detail, but I wanted to be sure the question was clear since the topic seems very broad. But here it is. The word "smartest" is meant fundamentally, not literally.

Is a server infrastructure fundamentally possible which the smartest person can't breach?

Background:

I've read articles about the servers of massive banks (or cheating sites) being compromised, and in one article based on an interview with an internet security company interested in the case, a specialist claimed that there are highly skilled criminal organizations especially in China and Russia which have vast resources, tools, and some of the "best" hackers in the world at their disposal, and this specialist claimed that there was "no system on earth" (connected to the web, of course) which they couldn't compromise with the resources available to them.

(Web-Server) Information Security is Like Chess:

I'm not much of a Chess player, and I'm not much of an Info Sec. expert, but I am a programmer who writes server software, and I'm interested in this. Disregarding any factors of Chess that might null my scenario, such as maybe the person who moves first has an advantage or something of the sort, imagine Information Security as being a game of Chess between two of the best Chess players in the world.

Classic: If you and I were to play a game of Chess, the one which possesses greater skill, knowledge, and intelligence regarding the game of Chess will win.

Programmed Scenario 1: Or perhaps, if we play the game digitally, the one of us who writes the smartest chess-playing software will win.

Programmed Scenario 2: Or, and here's the key, perhaps it's possible for us to both be so good at both Chess and programming that we both write Chess-playing computer programs so good that neither of our programs can win, and the game ends in a stalemate.

Consider a server infrastructure, for example a banking server, or application server which must communicate with clients on the web, but which must not allow criminal parties to break into its data stores.

• The security of this server infrastructure could either be like Programmed Scenario 1, meaning no matter what, whoever has the best software and knowledge of Information Security, the people who invent the security strategies for example, will always have a chance to break through a server infrastructure's defense, no matter how secure. No perfect defense is fundamentally possible.

• Or it could be like Programmed Scenario 2, where it's fundamentally possible to develop a server infrastructure which uses a security strategy that (fundamentally) cannot be bested by a smarter program. A perfect defense is fundamentally possible.

The Question

So which one is it?

Answer 1

Security can be proven, but you have to understand what is proved

https://sel4.systems/FAQ/proof.pml

Our proof statement in high-level natural language is the following:

The binary code of the seL4 microkernel correctly implements the behaviour described in its abstract specification and nothing more. Furthermore, the specification and the seL4 binary satisfy the classic security properties called integrity and confidentiality.

Integrity means that data cannot be changed without permission, and confidentiality means that data cannot be read without permission.

Our proof even goes one step further and shows that data cannot be inferred without permission – up to a certain degree. So-called information side channels (also called covert channels) are known to exist. The proof only covers those information inference channels that are present in the formal model: the confidentiality proof covers all in-kernel storage channels, but excludes timing channels which must be dealt with empirically.

So, why doesn't everyone just use sel4? (Currently the place where you are most likely to encounter it is on the TrustZone processor of some Apple devices).

The answer is that the proof just covers the kernel, not any of the user-space software that you might want to run. There's no proven-secure webserver, for example, let alone language implementations for the applications that you might want to run on it. And you'd also have to prove your web application secure. Developing these things will require a very large investment, which no large company is interested in making.

High-security systems are usually attacked at the key and login management point

It doesn't matter how secure the system is if your admin leaves his password on pastebin by mistake. Just the other day we saw a TSA employee post a picture of the (physical) TSA master keys to luggage locks on Twitter, so those are now all compromised. Weak passwords, guessable passwords, insecurely stored passwords, bad hardware security tokens, copied fingerprints: all of these are possible attack vectors.

Answer 2

"No perfect defense is fundamentally possible."

In chess, you have 64 squares, 2 people playing, and one set of immutable, commonly known rules.

In server infrastructures, there are an untold number of assets and ways to approach those assets, an unknown number of people playing, and rules that change constantly with players purposely seeking to bend, break, or bypass the rules.

Consider 2 elements that will prove my point: zero days and chocolate bars.

Firstly, zero days change the rules while the game is being played. While one side gains the benefit of this element, the other side is unaware of the advantage and is possibly still unable to counter these attacks, even if they are eventually known. Each zero day is a new rule that is unevenly applied to the game. Even if a "perfected security strategy" can be devised and perfectly applied, zero days can mean that the strategy is built upon unknown weaknesses that might never be known to the defending side.

Secondly, chocolate bars can do more to break the security of an infrastructure than any other element. What I mean is that people can be bribed or enticed to "switch sides" and grant advantage to the opposing side, sometimes for something as small as a chocolate bar (studies show). Phishing, bribes, data leakage, etc. are all part of the human side of the game that technology cannot account for entirely. As long as there is a human with power in the infrastructure, there will always exist that weakness to the system.

What to do?

In history, we see multiple situations where a massive attempt at defence was defeated by something small and unforeseen (e.g. the Great Wall of China's gates opened to a concubine who was a double agent for the Mongols). The goal, as defenders, is not to mount the perfect defence, but rather to design a resilient and transparent infrastructure where attacks can be seen quickly and responded to completely. Not taller walls, but more alert militia. Not unshakable foundations but a replaceable architecture.

Answer 3

Nobody has found any particular reason to believe they have found such a system.

You mention Chess, which is a nice game on a 8x8 grid. Consider that a modern server is slightly more complicated than that. Let's instead play in a 65536x65536 board, to make it more realistic. Also, in Chess, the more you play, the fewer positions are possible. Instead, a more realistic system is like Go. The more you play, the more entwined the position can get. I'll note that the game of Go makes our work on Chess computers seem puny.

Conway, around 1970 or so, tried to break apart the game of Go. He found that often the board seemed to divide up into subgames, each of which played out in its space to add up to the final winner. He found the way they worked together was very complicated. As a result, he found surreal numbers, a number scheme which is literally more vast than the real numbers we use in physics. No joke, it is actually easier to predict the weather globally than it is to win at Go by divide and conquer. Could there be a "win" case here? Perhaps. Good luck finding it. The only way to know for sure is to account for the entire 65536x65536 board, all at once.

Kevin Mitnick in one of his books commented along the lines of:

The only truly secure computer is one that is disconnected from the internet, powered down, unplugged, stored in a concrete bunker, under armed guard. And even then, I'd check on it every once in a while."

Answer 4

Such a system probably exists, but we probably won't find it

We have many algorithms for use in Security. Some of them probably are correct. Specifically, some them probably are exponentially difficult to break. Indeed, we know some that are outright impossible to break (one time pad.) The problem is implementation.

Security isn't about who's smarter. Security is about the defender's carefulness v.s. the attacker's intelligence and creativity. A defender does not have to be brilliant if they can follow an algorithm extremely carefully. Perfect defense v.s. perfect offense results in defensive victor in security land.

The problem is that server's are often complex machines. You have the OS and mirades of programs, and different protocols and programming languages and AHH. It is nearly impossible to have perfect security in such an environment.

On the other hand, if a system is simple enough, a human probably can make it perfect. For example, I have a message, $M$, encoded as a number from 1 to 6. I will now roll a dice, which will be the key $K$, and will add $M$ and $K$ modular $6$, to get the ciphertext $C$.

The ciphertext is $5$. What was the message?

This is example was so simple, I could plausibly consider all the possibilities. On the other hand, a server is pretty complex.

What advice can we draw from this. Keep it simple, stupid. (The K.I.S.S. principle.) Even though it is probably outside our human capacity to make a perfect server, the more simple the server and our algorithms, the better. Document your code, make it understandable, make it simple. Every line of code has a reason. Use a simple operating system (Note: don't confuse simplicity with ease of use. Think Arch Linux, not iOS.) Keep only the bare minimum of programs. Choose a programming language with a small definition, and without weird rules and such (I'm looking at you, javascript.) Although this won't make it perfect, it will go a long ways to making you more secure.

Answer 5

The comparison with chess is interesting because it shows what protecting a system is not. Compared to chess the play between good and bad guys in IT security has no fixed rules, you don't know who your opponents are and you can be attacked outside of the chess board. And if the opponent loses a figure it can just get a new one while you don't.

• You have limited resources (time, money, knowledge) to protect your systems. The attackers have limited resources too but if you are an interesting target there will be enough hackers interested which in total might have more resources than you.
• With these limited resources you have to secure everything. This means to close every possible (and probably unknown to you) way/exploit an attacker might use to get into. The attacker must only find one way in and use it.
• Apart from that you have a conflict between usability and security. Just have a look at access control with passwords, ways to reset forgotten passwords etc. These are by design not 100% secure because they are a trade-off between security and usability. You could move all your users to more secure methods like two-factor authorization, client certificates, smart cards etc but these might then be too inconvenient for the users and you would lose customers. And they are not 100% secure either, only more secure than passwords.
• You also have a conflict between security and performance. The harder you analyze all the incoming data to detect attacks the slower it will be. While you can throw more hardware at the problem it will not scale linearly so you have to find a balance between speed and depth of analysis.
• And you have to deal with software which is insecure. It might be closed source so you cannot look and fix it but even with open source you don't have the time and experience to find out any accidentally or deliberately hidden bugs or back doors. Even if you would have all the money and the best experts you could get for the money you have a limited time to do the evaluation and analysis does not scale linearly with the number of experts (i.e. it does not help to get 1000 experts if you have to analyse 1000 lines of code, because these 1000 lines are not independent from each other).
• And finally there are the people who protect your infrastructure and have access too it. They are humans so they can be attacked with social engineering, bribed, blackmailed...

In summary: while in theory you might have unlimited resources (time, money, knowledge, unlimited fast hardware) to protect a system and only have customers who are such experts too and prefer secure to convenient access methods - in reality you don't. There will always be a way to get into so you should be prepared for it. Don't believe that you will ever achieve a 100% secure infrastructure but instead create an infrastructure which is not only robust against attacks from outside but where you can detect a compromise and recover from it as fast as possible. Harm might be done but it should be limited.

Answer 6

Suppose security is like chess

Unlike most people here, I actually know quite a bit about chess and just enough about security to make this a usefull answer.

If you consider chess you will find that:

The number of possibilities is so large that no practical strategy covers them all explicitly

Therefore, as also we see in practice, the strongest participant is most likely to win. But even so, there is always the chance that a strong person/computer player will lose to a (much) weaker one.

So to conclude:

Unless you know the right move in every possible situation, no perfect defence is possible

Answer 7

A perfect defense is fundamentally possible.

I am actually mediocre in chess, but it is trivial for me to stalemate the greatest players in the world and I can even stalemate the fastest, best chess playing computers.

I just sit on my hands and wait for the time to run out and the chess grandmaster can not claim a victory over me.

Similarly, the impenetrable server never responds to client requests and can not be defeated by even the most clever hacker.

Despite its perfect security, it is totally useless.

Answer 8

Information security is fundamentally unlike chess. Chess is a poor model to apply to Information Security, though the differences between the two can be enlightening.

Chess is a game of perfect information. Both parties know exactly where all the pieces are at all times. In information security much of the information is hidden, and one party can gain an advantage by having more information than the other. "Smartest" has nothing to do with this.

Chess is a game where all the rules are known and set. In information security the existence of rules is questionable at best. The "Rules" are better thought of as an environment and thus a moving target.

Chess is a zero sum game. In information security everyone can lose, everyone can win, nobody can win, and winning and losing can mean nothing.

Chess is a game with two players. Information security has multiple actors with different motivations (see "not a zero sum game").

Chess has a clearly defined win and loss. Wins are complete, and losses are complete. Information security is far more muddy and not at all black and white. The system can be partially compromised and losses are mitigated.

Answer 9

Yes. A null server infrastructure is fundamentally impossible to breach.

No server = nothing to breach = fundamentally impossible to breach.

Anything else is fundamentally possible to breach.

Answer 10

Obviously, there's no perfect technical solution to prevent human error, or prevent an attacker from bribing your sysadmin. But if we look at the purely deterministic technical side of this, then the answer is (trivially) yes.

You can look at a network-connected system as a function. You have some function that you want to compute, where the inputs are a system state and bits coming in over the wire and the outputs are a new system state and bits sent over the wire. If the function is computable, then there is a system implementation that will do exactly that.

The problem is that deciding whether a given system perfectly computes a function is impossible in general, and impossible to determine with certainty in practice when the system's behavior is complex. So a person whose system is truly impenetrable (again, from this limited technical perspective) could never be sure of it. Conversely, someone who is completely certain of the security of a very complex system almost certain holds that belief irrationally.

Answer 11

The true question behind this is rather: how much resoures are you willing to spend to break the defense? And what is even the minimum level of security that it can be considered perfectly secure? No access whats so ever? Accessig any random data? Or only accessing the data that can be used for profit is considered a breach?

To use your example of chess: sometime in the future, we will build a computer that holds all positions of all possible games of chess. Pitted against itself will probably result in 100% draws/stalemates. With a "limited" set of possible moves this is a valid assumption of a perfect defense.

Reality has too many options to bypass rules and possible situations. Maybe you don't want to steal the data, maybe you just want all backups to cease to exists. So you bomb the server facility - and are happy with the non functional debris.

In real life, solutions like intrusion detection systems, cold storage (storage systems that aren't live on the web), aggressive account & password management processes, defensive application design and usage behaviour analysis can rise the costs to hack those systems to such a level, only very deep pockets could even think to attack it.

And you would need "James Bond"-like abilities and well trained tactical skillsets to pull it off. For a certain very large part of the hacking community, this would be considered a "near" perfect defense.

The most hacked sites in the news even don't know who is on their "digital lawns". Many hackers spend weeks or month in their systems, undetected. They simply didn't think to spend millions of dollars in minimum defense, because its not required by law and the lawsuits are potentially cheaper than starting the game of 'hacking defense' chess.

Answer 12

It proves much easier designing a system to keep the smartest people out than designing one to keep the nameless, shameless, creative, and persistent people out.

Smart people proceed in an identifiably patterned manner, along predictable avenues of effort and exploration, and rely on a miserably predictable and similar set of assumptions. A genius seems to always assume that when utilizing the function of addition that 2 and 2 is always 4, and never 22, or 2 & 2.

The greatest threat to an empirical, rational system -- in human terms -- proves to be an adversary who possesses less than a genius level IQ, tends to be a maverick or dances to the beat of their own drum rather than follow the social norms of the herd, and scarce never is identified as being the smart one in social groups. Well adjusted, comfortable in their own skin and in who they are and accepting of their status as not the pack leader in any area, this person is not swayed by nor engages in the frivolous personal competition that might encircle them. Self-driven, self-starter, inspired and driven by the inner reality within, this individual couples a certain spark of spontaneity and genuine, non-rational creativity with an unwavering persistence and inner, tempered, disciplined volition or will.

They don't need your social validation, so a whole host of social engineering exploits prove useless. They often go unnoticed in crowds, as they neither care for nor compete for anyone's attention save those who they themselves identify as interesting or worthy of their effort and attentiveness.

I have personally witnessed a chance few precious times in life a person like I describe defy, violate, and invalidate the design and implementation specs of the smartest of geniuses.

Again, I'd rather have to design a system against the smartest of people than against even one person like that which I have described.

Answer 13

If there is a legitimate way in, there is an illegitimate way in.

The only server that is fundamentally impossible to breach is one that is fundamentally impossible to access. In network security, this is known as "air-gapping"; a server or subnet is physically disconnected from any other network including the outside world. Combined with physical security of the components of this airgapped network, which prevents an unauthorized persons being able to reach out and physically touch any piece of computing hardware connected to the network, computers on this network are unassailable by a hacker.

... Kind of. Again, if there is a legitimate way in, there is an illegitimate way in. Physical security is ultimately a human endeavor and therefore ultimately fallible. Social engineering can be used to bypass face-to-face security protocols, either by tricking a "gatekeeper" into letting an unauthorized person in, or by tricking an authorized person into doing something they shouldn't on behalf of an unauthorized person. The better the humans involved are trained to follow the physical security protocols, the less likely any of this is, but there is always a non-zero chance of bypassing physical security up to and including brute force (something like the Zero Dark Thirty raid, while not subtle in the slightest, could theoretically be perpetrated against any corporate headquarters on the planet; it's just a matter of having the right people with the right equipment to do the job).