We recently gave a talk at the ITWeb Security Summit entitled “Offense Oriented Defence”. The talk was targeted at defenders and auditors, rather then hackers (the con is oriented that way), although it’s odd that I feel the need to apologise for that ;)

The talks primary point, was that by understanding how attackers attack, more innovative defences can be imagined. The corollary was that common defences, in the form of “best practise” introduce commonality that is more easily exploited, or at least degrade over time as attackers adapt. Finally, many of these “security basics” are honestly hard, and we can’t place the reliance on them we’d hoped. But our approach doesn’t seem to want to acknowledge the problem, and much like an AA meeting, it’s time we recognise the problem.

If you had to look at the average security strategy or budget items, you often end up with a list containing a couple of these:

• Compliance/GRC – building policies, auditing against them, responding to audits
• Risk Management – enumerating and ranking all the info sec risks, prioritising them, and justifying spend to mitigate
• Best Practises – strengthening passwords, pushing patches, configuration management, etc.
• Technology – cue buzzwords – UTM, WAF, DLP, DAM, SIEM, IPS, AV
• Staff – everyone needed to get the above stuff done: compliance specialists, risk specialist, security managers, device ops managers

But, the truth is many of these items don’t actually block attacks, or the few that do, don’t really counter the common bypassed used to side-step them. For example:

• It’s really hard to link risk-based priorities to meaningful technical priorities.
• Compliance drives a “teach the test” approach with little incentive to create contradictory measurements.
• Then how can we have a bunch of things called “best practise” when we can’t honestly say we know how to defend. Even then, some BPs are practically impossible to achieve in anything but a point in time. And the main point of this talk; common practises have common bypasses.

The current place we seem to be in is akin to having everyone build a wall. Attackers get to evaluate the wall, figure out how to get over it, and add to their capability (i.e. get a longer rope). But once they have a longer rope, they can use it over and over again, and against more than one wall. So attackers, who are quite good at sharing, get to keep building their tool chain, while all defenders can do it to keep building a higher wall, and maintaining the increasingly untenable structure. By understanding how attackers attack, we can break out of this and try more innovative approaches.

The talk is illustrated with four broad examples: Passwords, Patches, Anti-Virus and DMZs. For each, the belief around specific configurations is discussed, and how those don’t stand up to how attackers actually attack. For example, the way AV’s believed to work doesn’t seem to correspond with how easy they are to bypass, or the common configuration of standard password controls such as lockout, don’t seem to take into account horizontal brute-force attacks.

The point I want to make here is somewhat subtle; if you walk away thinking I’ve described new attacks, then you’ve missed it, if you think I’m recommending “the basics” then you’ve missed it. Truthfully, maybe it’s just that I didn’t make it very well … decide for yourself, here are the slides: