"Endpoint hostile" networks are designed with a single use case in mind: accessing remote servers, usually via HTTP/HTTPS. Other use cases are prohibited or broken.
Here are some of the characteristics that would label a network as endpoint hostile:
- "Device isolation," which prohibits local LAN device communication. This is common on some WiFi networks. It's forgivable on a public WiFi but not elsewhere.
- Symmetric NAT
- Multiple levels of nested NAT e.g. consumer routers plugged into consumer routers. It's important to note that this makes everything flaky due to weird interactions and timeout behaviors. In our experience it's disturbingly common. We talked to one person whose company had at least five levels of this, requiring things like "ServerAliveInterval 10" in ssh_config.
- Lack of support for NAT hairpinning. (NAT can't NAT-traverse with itself.)
- Short NAT/firewall stateful connection timeout (120s is the RFC recommendation, but 30-60s is common and we've seen 15.)
- IPv6 absent (assuming it's available upstream) or deployed in a silly way (e.g. IPv6 NAT).
- Lack of support for local multicast or broadcast
- Aggressive edge firewall rules that prohibit UDP, non-standard TCP ports, etc. or that DPI traffic and attempt to block anything other than HTTP, SSH, and SSL.
- Badly implemented NAT ALGs for things like FTP and SIP that break other traffic.
- Lack of uPnP or NAT-PMP support.
- Mandatory proxy configuration.
- Middle boxes that modify traffic in general. This includes things that bork TCP in a misguided attempt to "optimize" it, things that inject HTTP headers (or worse JavaScript), things that modify DNS to strip A/AAAA records for "private" IPs or strip TXT records, etc.
Some of this stuff is just stupidity or brokenness, but much of it is implemented for "security" reasons.
I personally consider reliance on network edge controls for security to be a borderline-obsolete cargo cult practice, since the vast majority of today's vulnerabilities and attack vectors are unaffected by it and involve things like cloud services, e-mail, web, app updates, etc. I've worked in netsec/infosec and have seen a number of intrusions, and so far I have yet to see one in the past 10 years that was mitigated in any way by the presence of a firewall. Yet a generation of IT people thinks "firewall equals security" and I'm increasingly thinking this generation will have to just pass along.
Basically you have a 2000 mile data path to your light bulb because routers suck and networking engineers are cargo cult morons.
Let badly written junk burn. Then people will learn it's junk and stop using it or the developers and vendors will be forced to fix it.
It's unnecessary if everyone drives competently, but it also successfully prevents people crashing through no fault of their own.
It also breaks or complicates use cases like "changing which direction you're going on the highway".
This is remarkably similar to defeatable traction-control; people who care enough to figure out what that button does will push it and have fun. People who don't won't and they'll be safe.
If we're building endpoint networks to prohibit local traffic, we are forcing a terrible architecture with terrible long-term privacy and security implications. Because of this, we will have a future where the NSA (and vendors, and advertisers, and the Chinese PLA, and ...) will literally know when you flush your toilet. In the future every interaction you have with every device in your house will be broadcast to third parties across multiple national boundaries and clouds.
... because we had to protect Windows XP machines from rare, marginal threat profiles. (Has anyone actually seen malware spread this way in the past 10 years in the wild?)
The potential criminal and totalitarian applications of a cloud-powered IoT world are incredible. Look into "nudge theory" for a starting point, and then consider things like:
http://www.theatlantic.com/technology/archive/2014/02/when-y...
http://www.ibmbigdatahub.com/blog/power-behavioral-fingerpri...
The decision of how to architect our communications infrastructure today and whether to, for example, permit local traffic could in the future determine whether or not we evolve into a borg-like totalitarian collective or a cooperative society of sovereign individuals. Communications infrastructure affects... well... how we communicate... which in turn affects every single aspect of human society and culture over very long spans of time.
It's a special case of a larger phenomenon called path dependence. Small choices that you make today based on what seem like rational reasons today can have huge differences in the long term outcome of things in the distant future. While the future isn't fully knowable, sometimes conceptual reasoning from first principles can tell us what the likely outcome of a particular path might be.
> Has anyone actually seen malware spread this way in the past 10 years in the wild
Yup, had several IR cases (trending up) where this was determined to be the initial vector. Related: stop making this argument. Nothing is seen in the wild until it is (go back a few years and realize this argument was made about cryptowall-style malware).
I think you should re-read the end of my first paragraph; isolation should have an off switch. Give people the option and let them choose. Sorry if that's bad for your business model.
Network node security should not be delegated to the network. Not only would this necessitate forgoing very useful features that networks enable, you won't improve node security. Devices that are vulnerable by merely sharing a network with other nodes tend to have other more sever security lapses.
I agree that a button is simple way to switch between modes, but it will also make point-to-point the default. People don't change defaults, and companies will eventually cease to implement network capability as a result.
I'm all for better network security, but not at the expense of discarding the network itself.