My session for the Atlanta BSides conference was about what I expected in 2011. I might as well have thrown a dart at the wall. But the exercise got me thinking about the newest attacks (like Stuxnet) and the realization of how state-sponsored attackers have penetrated our networks with impunity. Clearly we have to shake up the status quo in order to keep up.
This is a point I hit on in last week’s Incite, when discussing Greg Shipley’s post on being outgunned. Obviously what we are doing now isn’t working, and if anything the likelihood of traditional controls such as perimeter defense and anti-malware agents protecting much of anything decreases with every application moved up to the cloud and each trading partner allowed into your corporate network.
The long-term answer is to protect the fundamental element of data. Rich and Adrian (with an assist from Gunnar) are all over that. As what we used to call applications continue to decompose into data, logic, processing, and presentation we have neither control over nor visibility into the data at most points in the cycle. So we are screwed unless we can figure out some way to protect the data regardless of how, where, or by whom it’s going to be used.
But that is going to be a long, long, long, long slog. We don’t even know how to think about tackling the problem, so solutions are probably a decade away, and that’s being optimistic. Unfortunately that’s the wrong answer, because we have the problem now and need to start thinking about what to do. Did I mention we need answers now?
Since I’m the plumber, I took a look into my tool bag and started thinking about what we could do within the constraints of our existing infrastructure, political capital, and knowledge to give us a better chance. This was compounded by the recent disagreement Adrian and I had about how much monitoring is necessary (and feasible) driven by Kindervag’s ideas on Zero Trust.
I always seem to come back to the idea of not a disappearing perimeter, but multiple perimeters. Sorry Jerichonians, but the answer is more effectively segmenting networks with increasingly stringent controls based on the type and sensitivity of data within that domain. Right, this is not a new idea. It’s the idea of trust zones based on type of data. The military has been doing this for years. OK, maybe it isn’t such a great idea… Yes, I’m kidding.
Many folks will say this doesn’t work. It’s just the typical defense in depth rhetoric, which says you need everything you already have, plus this new shiny object to stop the new attack. The problem isn’t with the architecture, it’s with the implementation. We don’t compartmentalize – not even if PCI says to. We run into far too many organizations with flat networks.
From a network ops standpoint, flat networks are certainly a lot easier to deal with than trying to segment networks based on what data can be accessed. But flat networks don’t provide the hierarchy necessary to protect what’s important, and we have to understand that we don’t have the money (or resources) to protect everything. And realize that not everything needs to be protected with the same level of control.
OK Smart Guy, How?
Metaphorically, think about each level of segmented network as a vault. As you climb the stack of data importance, you tighten the controls and make it harder to get to the data (and theoretically harder to compromise), basically implementing another vault within the first. So an attacker going after the crown jewels needs to do more than compromise a vulnerable Windows 2000 Server that someone forgot about to see the targeted assets. Here’s how we do it:
- Figure out what’s important: Yes, I’ve been talking about this for years (this is the first step of the Pragmatic CSO).
- Find the important data: This is the discover step from all the Pragmatic Data Security research we’ve done.
- Assess the data’s importance: This gets back to prioritization and value. How much you can and should spend on protecting the data needs to correlate to how valuable it is, right? You should probably look at 3-4 different levels of data importance/value.
- Re-architect your network: This means working with the network guys to figure out how to segment your networks to cordon off each level of increasingly sensitive data.
- Add controls: Your existing perimeter defenses are probably fine for the first layer. Then you need to figure out what kind of controls are appropriate for each layer.
More on Controls
Again, the idea of layered controls is old and probably a bit tired. You don’t want a single point of failure. No kidding? But here I’m talking about figuring out what controls are necessary to protect the data, depending on its sensitivity.
For example, maybe you have a call center and those folks have access to private data. Obviously you want that behind more than just the first perimeter, but the reality is that most of the risk is from self-inflicted injury. You know, a rep sending data out inadvertently. Sounds like a situation where DLP would be appropriate.
Next you have some kind of transactional system that drives your business. For the layer, you monitor database and application activity.
Finally you have intellectual property that is the underpinning of your business. This is the most sensitive stuff you have. So it makes sense to lock it down as tightly as possible. Any devices on this network segment are locked down using application whitelisting. You also probably want to implement full network packet capture, so you know exactly what is happening and can watch for naughty behavior.
I’m making this up, but hopefully the idea of implementing different (and more stringent) controls in each network segment makes sense.
None of this is new. As I’m starting to think about my 2011 research agenda, I like this idea of vaults (driven by network segmentation) as a metaphor for infrastructure security. But this isn’t just my show. I’m interested in whether you all think there is merit to this approach, and more importantly the merchandising. Does the concept of a vault make sense? Is it something you’d be able to sell up the stack to your management as an architectural construct?
Let me know (the good, the bad, and the ugly) in the comments.
Reader interactions
4 Replies to “Vaults within Vaults”
I seem to be one of the few that shares this idea, but I’ve always been a fan of more heterogeneous networks. It makes things harder for support and operations folks, but diversifying your OSs, switches, routers, firewalls, AV, SEIM, etc, could help isolate these attacks where the bad guys are pivoting from one section to the next. If the attacker has to move from Win2k8 to SELinux to Win2k3 to RHEL (all while going through snort, McAfee, ArcSight, Symantec, Cisco, HP, Barracuda, and other network devices) it will make sure that only the most determined will get through. It would likely give detection mechanisms more time to detect/prevent, and the security team more time to react. If you’re entire network, with all 10 different security domains, are all Dells running Win7 and Win2k8 all linked by Cisco switches/routers/FW/VPNs and snort IDS – it will be a lot easier to get by undetected.
I would also add that organizations need to stop paying lip-service to user awareness training, and also start holding people accountable for their actions. Sadly, I feel we have reached a point where we need to make some examples out of people to get them to wake up (SysAd surfing the web with his privileged account got a server owned? Take away his admin rights and throw him on the wire team for month. Or fire him.)
Mike, Ron, maybe it’s not a question of security people not understanding the business point of view. Maybe it is due to a knowledge gap about how the internal IT infrastructure works. The business knows what data is important, but they don’t see hwo that data is related to several components of IT infrastructure. So, when security sees, in shock, that the business doesn’t consider the ActiveDirectory servers important, maybe it’s not because they are not, but because the business does not understand the importance of AD to the information repositories where that important data is.
Now, it’s not ony AD. We are increasingly creating ubiquitous infrastructure pieces, specially with all the cloud stuff. There’s so much of that in the organizations today that security spends all its time trying to protect those infrastructure components, what may appear irrelevant to the “business important data” but it’s as necessary as directly protecting that data. I know that may trigger the discussions about data centric security, but if we consider all the security aspects (such as availability and auditability [ugh!]), there’s a lot to be done on the layers below the “critical data”.
My point is, there are lots of things that need to be done independently of where the important stuff is. It doesn’t mean you don’t have to know it, but it’s important to note that most organizations are still figthing to protect the critical infrastructure where that data resides.
So, my suggestion for research is trying to measure how big the problem of securing critical infrastructure is. My initial guess is that in some cases it might be so big it hinders your ability to work on more directed measures to protect important data. The results may indicate the ability to selectively protect data is one of the key design components for IT infrastructure if we want to keep security operations and cost manageable.
If you read leadership blogs, there was a good one last month by Kevin Eikenberry on the Most Valuable Question (http://blog.kevineikenberry.com/communication/the-most-valuable-question/). It is, “What’s most important to you?”
I’ve been asking this question a lot lately to better determine what we need to protect. This goes with the first three parts of your process.
So often, security people think they know what’s important and then can’t understand why “the business” doesn’t agree. You need to look at the world from their eyes, not your own. Once you do that, you can find the best way to protect “what’s important.”
As one of Gunnar’s favorites, Brian Snow, points out in We Need Assurance, computer security requires imposing a “separation paradigm” on top of an architecture built to share.