It’s Time To Move Past Vulnerability Scanning To Anti-ExploitationBy Rich
Wow. It’s 2008. How did that happen?!?
When I was younger I couldn’t wait for the future. What geek can? We all grew up on entirely too much science fiction; far more of which is now reality than I expected (other than the space program; hello? NASA? Anyone home?). Now that I get older I realize that while the future is great in concept, the reality is eventually I won’t be around for it anymore. Every year is a smaller fraction of life, and thus every year passes relatively more quickly.
Aw hell, I’m far too young to be thinking about garbage like this.
As 2007 closed many of us pundit types devoted our time to looking at current trends and predicting the next few years. If you’ve been following me and Hoff at all, you also know some of us are always thinking about how we can do security differently. Not that we’re doing it “wrong” today, but if you don’t look for what’s next you’ll always be playing from behind.
One big trend I’ve been seeing is the shift towards anti-exploitation technologies. For those who don’t know, anti-exploitation is where you build in defenses to operating systems and platforms so that when there is a vulnerability (and there will be a vulnerability), it is difficult or impossible to exploit. Java was my first introduction to the concept at the application level (sandboxing), and Vista at the operating system level.
There’s no single anti-exploitation technology, but a bunch of techniques and features that work together to make exploitation more difficult. Things like ASLR (library/memory randomization), sandboxing, and data execution protection.
Most of the anti-exploitation focus today is on operating systems, but conceptually it can be applied anywhere. One of my big concepts in Application and Database Monitoring and Protection (ADMP) is building anti-exploitation into business and (especially) web applications. I’ve even converted from credit monitoring to credit protection (via Debix) for anti-exploitation against identity theft.
There was a lot of focus in 2007 on vulnerability scanning and secure coding. While important, those can never solve the problems. The bad guys will always find some vulnerabilities before we do. Our programmers will always make exploitable mistakes- no matter how much we hammer them with training and the code with tools.
When designing security controls we must assume vulnerabilities will exist and we won’t always identify and mitigate them before they are discovered by attackers.
Not that anti-exploitation is some mystical perfect remedy; it too will fail, but the goal is for it to fail slowly enough that we are able to discover, detect, and mitigate vulnerabilities before they are exploited.
You’ll be hearing a lot more about anti-exploitation at all levels of the industry over the next few years, especially as we start seeing it outside of operating systems. It’s the one thing that gets me jazzed that we might be able to get a leg up on the attackers.