Defenders think in lists, attackers think in graphs (2015)
github.com
github.com
"Defenders" (like the SOC) have to think in lists because they're tracking many signals and threat vectors at a time and need to prioritize which ones warrant their attention/require action because a regulator told them so (think high-scoring CVEs against code that's been deprecated forever ago).
Without having "defenders" post in random places along the graph looking for interesting activity, I don't know how they'll be able to "think in graphs". To wit, the suggestions that the author made would be, you guessed it, signals in a list that a "defender" would check against!
Smart teams will immediately adopt the red team technology that, for example, crawls AWS as a graph looking for paths to from low to high value accounts.
Its not a zero sum or sea change thing, but defenders absolutely can think more like attackers and leverage attacker tools more often in the act of defense.
The CEO is worth more in some ways than the HR lady.
The HR lady is worth much, much more than the CEO in other ways.
This added dimension turns the 1D list into a 2D map, or a graph.
No. This is a very common misconception, but in reality a vast majority of attacks is carried out as "lets look around what we can find and will see how we'll use it". The same actually applies to a lot of attacking activities – intelligence, influence operations, propaganda etc.
Sure, attackers can also exploit CVEs to DOS the entertainment system but who really cares if that happens?
Now should defenders also make dependency graphs too? Sure, but they should be making lists first before dependency graphs and making sure things are up to date, that they assume limited trust, and that resources are isolated. Then they should make dependency graphs.
“Defenders have to think in list and graphs and manage a billion things. Attackers just have to look at a few things.”
You have to have the insight to pivot your list into a graph, otherwise you just have a list of Crown Jewels and play whack-a-mole on the 10000s of ways they can be reached that you didn't consider.
Attackers win for the same reason that Microsoft is better at publishing operating systems than Cisco, because ciscos operating systems are a means to an end. Microsoft’s are the end
It also explains why companies rarely get punished by the markets for data breaches.
You could achieve a perfectly secure system, if and only if you make that system do exactly nothing. If you want to achieve any other outcome you will have to trade some measure of security for the ability to do anything. Or as Matt Levine so aptly put it: the optimal amount of fraud is non-zero
(When concerns of security become the main worry in an organization, the term we historically use to refer to it is "police state".)
Isn't a police state where a government is concerned with security above all else? To my mind, a place where private organizations are above all concerned with security is the exact opposite, anarchy, since there's no collective security framework in place to take the security burden off private organizations.
Mature security teams for example use Bloodhound which uses neo4j to visualize attack paths in AD. Defenders (good ones) don't think in lists.
> "The defender’s job isn’t defense."
Yes, it is. Obviously!
> "It’s a side show, and a distraction from the main business of whatever else the defenders are trying to do"
I'm sorry, but what else are defenders trying to do that isn't defense? are all defenders completely incompetent then?
> "By contrast, an attacker’s entire job is to attack the system."
Yes, and there are people in mature security teams whose entire job is to search for and stop (not just react to alerts) attackers.
> "Attackers win for the same reason that Microsoft is better at publishing operating systems than Cisco, because ciscos operating systems are a means to an end. Microsoft’s are the end"
I think you have an incorrect perception of what security teams do. It is both a matter of strategy and resources. There are security teams whose budget is in the 100's of millions of dollars and who employ some of the brightest cybersecurity strategists and professionals. You rarely (if ever) hear their names in relation to a breach or compromise. There are also much less capable security teams who do well against most attackers, but will inevitably get pwned by an APT, except the good defenders catch the apt's before they cause significant damage.
At well protected organizations, attackers lose 99.9% of the time (probably higher, I'm guessing here). Attackers simply need to win once to succeed, while defenders need to succeed 100% of the time.
This is an uncharitably narrow reading of the post to which you're replying, isn't it? Defenders are trying to ship. To make money to make payroll. Create profit centers, not cost centers.
You can say that security is a feature and a load-bearing one, and I'd agree with you, but not everyone who makes decisions will do the same.
> "You can say that security is a feature and a load-bearing one, and I'd agree with you, but not everyone who makes decisions will do the same."
Maybe it is, but I wouldn't put it that way. Security teams exist because people with bad intent that want to harm you exist. Just like lawyers exist because people who sue you (including the government) exist.
Imagine stating "lawyers don't exist to protect from lawsuits", that's how it sounds to me. If defenders aren't there to defend, then their existence isn't justified.
> "Defenders are trying to ship"
Defenders are there so that when other teams who "ship" attempt to do so, they don't get the application, system, company or wherever you have protected data doesn't get compromised. And this is before and after "shipping" or deployment. Security is a cost of business, whose RoI is measured by the fact that you are doing business without getting hacked, nothing more.
Yes, that's why companies cut cost on security guards as much as they possibly can. From the product-making company standpoint security is a mostly a cost.
In short, what you and OP commenter describe is incompetency, it should not be taken as the default, those are not defenders, those are mismanaged organizations. We're in 2024, every exec should know better.
Everything in life is a trade off, and no-one is in the business of perfect cyber security defense. Therefore, businesses will *always* trade weaker cyber security defense for better/faster/cheaper/easier/more business in their actual line of business. Just like you do every single day. Do you have ALL traffic on your home network encrypted with mutual serve and client certificate verification? Do you only have your 256 character passwords memorized in your head and not stored in a password manager anywhere or otherwise recored somewhere? Are all of your home systems equipped with strict outbound firewall rules that only allow one time, on demand and confirmed communications with the wider internet? Have you hardened your home network against data exfiltration via DNS queries[1]? If you use 2FA for your accounts, and the objectively weaker password managers to store your passwords, are your 2FA tokens kept on completely separate devices from your password managers? Do you only allow direct console access to any of your systems and have no remote access like SSH enabled? Do you a have every single computer backing up their data into multiple redundant copies, without using the network for data transfer and with at least one if not more of those copies stored off site?
If you answered "No" to any of those questions, you also have chosen the route of "incompetency" and "mismanagement". It's 2024, and every IT person should know better. But of course we do "know better" and choose the objectively weaker options anyway because the stronger options get in the way of actually doing the things we want to use our systems for. You don't choose perfect cyber security defense for your home network because you don't have a home network for the purpose of practicing perfect cyber security defense. So it is with businesses, they don't have their systems for the purpose of practicing perfect cyber security defense either.
[1]: https://www.akamai.com/blog/security/dns-the-easiest-way-to-...
"Should" doesn't mean much. People respond to incentives. Can you explain the incentive function that exists today in the real world to prioritize the security cost center above the profit center?
I mean, I work at a company that I'd say does a pretty good job of this--in a regulated industry and after getting burned a few times. But you can still go full-send with VP approval, and the risk becomes part of the cost of doing business.
In other words, security is necessary for business. Just like how you would want your offices secured from burglars -- because otherwise you can't do business well -- you should want your digital assets secured from hackers, except unlike physical security, it isn't just local malicious actors and competitors after your business but intellectual property thieves, hacktivists, financially motivated cybergangs and more (not just nation state actors).
Failure to give proper priority and funding to cybersecurity, is failure to ensure conditions that make the company profitable and viable in the long term.
It's not, though, that's the thing you aren't picking up. Managing risk to the tolerances necessary to make money is necessary for business. That's what's being done.
You say that it's about the long term, but within epsilon of nobody has gone out of business or even been seriously impacted by bad security posture. Experian gets wrecked on the regular, but it's not going out of business. Azure springs holes regularly enough that Corey Quinn has an ongoing schtick about it, but Microsoft isn't going out of business, either.
If you want security to be necessary for business, you need to make failing to operate securely a legitimate threat to an organization. Waiting for consumers to act collectively means you'll die of old age before seeing a twitch, so you're really talking about legislation. I would be in favor of this, to be clear--I think we as an industry are bad at cybersecurity, terrible even. But I'm describing what is, not what ought.
> Managing risk to the tolerances necessary to make money is necessary for business. That's what's being done.
I agree, but that isn't what is being done at most places. Every organization should spend as much as their risk tolerance allows them to do so on security. My problem is with spending as little as possible without getting into legal trouble.
I didn't say that infosec was a profit center. But they're in tension with profit centers for attention and sway, and by the way--the profit centers are the ones who make money.
I've said it before, I'll say it again: People Respond To Incentives. Lawyers and HR are generally not respected except insofar as they protect companies from visible legal risk, and often not even then. Infosec is so vague as to appear as a tiger rock to people who aren't plugged into it.
> Defenders are there so that when other teams who "ship" attempt to do so, they don't get the application, system, company or wherever you have protected data doesn't get compromised.
Everyone, infosec included, is trying to ship. Shipping is how you make money, make payroll, and keep people employed. You only don't ship when your risk calculus indicates that the cost of not shipping is less than the cost of shipping.
This us-versus-them thing brings us back to "the most secure system in the world is in an unplugged box". But we don't operate businesses off of unplugged boxes. Risk management exists. If this is how you would argue risk management with the median exec I've known, you'd lose. I have skilled infosec friends who've had better success than this through wise process and product choices, though.
> I'm sorry, but what else are defenders trying to do that isn't defense? are all defenders completely incompetent then?
You've misunderstood me. Defenders aren't the "cyber security team employed by AT&T to keep customer data secure". The Defenders are AT&T, who would rather spend their cyber security budget on just about anything else that could actually generate a profit. The cyber security team that AT&T hires might have the sole job of building the most robust defense system imagined, but even if they do, their efforts will be continuously stymied and reduced because true, complete, robust security will get in the way of actually doing the things the AT&T wants to do.
Or to put another way, a company that spends all their money on perfect cyber security is as useful as the proverbial perfectly secure computer encased in concrete and buried a mile underground with no power or network connections.
Even for individual hackers, there are individual good hackers (commonly called "whitehat" although I deride that term) doing bug bounties and finding CVEs.
The main differences between attackers and the attacked are intent, resources and which side you're on. The NSA and CIA are the good guys from my perspective, but they are the bad guys for defenders working in Russian or Chinese government cyber defense teams.
You've missed my point or I wasn't clear enough. It doesn't matter that they're part of a larger organization. That organization's goal is attacking, or at one step removed, selling/using the resources gained from attacking. Defenders are never in an organization whose business is the Defending.
Or lets use your CIA example, and for the sake of argument, lets pretend there are no other counties in the world other than the USA, Russia and China. In a world where there are no Russian or Chinese Attackers, the CIA would not spend money on defense against Russian and Chinese attackers. But in a world where there are no defenders in Russia and China, the CIA would still spend money on attacking and exfiltrating data from Russia and China. They would just be vastly more successful at it.
Or as a different analogy, mining companies mine because they want to sell the ore and gold in the mountains. But we still call them "minim companies" because thats their job. And they are often opposed by environmental groups working to defend the mountain. In a world where there were no mining companies, no one would be organizing an environmental group to defend the mines because there's no gain to spending time and resources standing around and guarding mountains and ore that no one is trying to get access to. But in a world where there are no environmental groups, there would still be mining companies.
https://github.com/someengineering/fixinventory
I'm one of the people behind Fix Inventory. What scares a lot of developers away from graph-based tools is the graph query language. It has a steep learning curve, and unless you write queries every day, it's really cumbersome to learn.
We simplified that with our own search syntax that has all the benefits of the graph, but simplified a few concepts like graph traversal.
If cyber defence is a sideshow to the actual businesses objectives, then surely the same holds of cyber attack and whatever the actual criminal/strategic goal?
Or put another way, in a world with 0 cyber security attackers, there would be no money or time spent on cyber security defense. But in a world with 0 cyber security defenders, there would still be people attacking resources and taking things the owners would rather they not have.
The org can invest as much as they bring in, they're a profit center, where defense is always a cost center that will be reduced to the minimum acceptable.
This seems like a serious misconception. Cyber attacks absolutely have purpose, whether that’s to steal data, disrupt services, whatever. Your viewpoint might apply to unsophisticated actors who just want to break things and cause chaos, but it’s completely ignorant when considering nation-state actors and financially motivated criminals.
Even less flippantly though, we inherently know this. How many things do we do every day that could be "more secure", but "more secure" gets in the way? Do you use memorize 256 character unique passwords for every site and system and refuse to record them even in a password manager? Do you use GPG encrypted emails and only E2E encrypted messaging services? Are all your home network devices independently fire walled, with strict in AND outbound rules ensuring they can only talk to the specific devices they should be able to talk to and only on specific well defined ports? Have you hardened your home network against data exfiltration via DNS queries? Is all network traffic fully encrypted with mutual client and server cert validations? If you've answered no to any of these questions, you have chosen to prioritize something else over better cyber security defense. And it's probably a good bet that at least some of that is because doing these things would actively get in the way of doing what you actually want to do with your electronic devices. You've knowingly chosen a weaker defensive stance to do something else instead.
Attackers on the other hand have no need to choose weaker attacks on your defenses in order to do something else instead. The attack is the point of their usage of their devices (and yours).
You might argue that the attacker might choose a lesser profile in order to remain hidden and beneath detection, but I would argue this still isn't the same choice. Given the option, no company would spend any time or money on resources for cyber defense. They would rather spend all that time and money on their actual business. But Attackers would spend time and money and resources on their attacks because those attacks directly serve their goals.
To add to this: I get irrationally irritated when some hack occurs and someone makes the comment: "Their databases weren't even encrypted! Amateurs!"
Okay mister wise-guy, let us see you "encrypt" the database at an organisation where that database produces a billion dollars of revenue annually.
Are you sure you aren't going to lose the encryption keys? Many billions of dollars sure?
Okay, you've made sure that the keys are safely backed up! Good job! Now rotate them. On a schedule. That's a process you will be required to hand over to a secops team to avoid you being a "bus factor of one". Good luck with writing out that process so nobody ever screws up.
Now provide access to the encrypted data to... everything and everyone. Because that's the point of business data. It's supposed to be consumed, reported on, updated, saved, exported, imported, and synchronized. Not just to systems you control either! To the CFO's tablet, to the third-party suppliers' ERP, and to every desktop in the place. There's a hundred thousand of them, across every content bar Antarctica.
It's surely because they're amateurs that they haven't figured this all out already: cheaply, robustly, and securely!
It does not matter if cyber security is at the top or the bottom of your budget list, if the choice is ever "better cyber security" or "do more business", cyber security is always going to lose that battle. You will never convince a company to use E2E encrypted email for all communications with all customers and vendors, no matter how high on the budget list cyber security is, because doing so would actively hinder the day to day operations of the business.
Security vulnerabilities come from the same place they always have. Where IO happens, where transactions happen, and where an operating system does a lot of work. How attackers get to these points, what happens when they do, and then how the system reacts when a malicious event occurs are the factors that matter.
In today's world of complex technologies, I have yet to meet a single organization that is invulnerable to these threats. I've seen a lot of organizations limit damage, patch vulnerabilities, and generally manage their risk profile effectively - but losses are a part of the business.
IMO, the only thing that will really make a difference is when we have technologies that are sufficient enough to male the user more resilient. Only then can we have a truly safer web.
I am not sure I would enjoy working at the second place but I would really hope we weren’t an easy target
Cf. eg., https://www.schneier.com/blog/archives/2013/10/air_gaps.html and https://www.schneier.com/blog/archives/2020/05/ramsey_malwar...
Yes maybe, but now you changed the topic and started talking about money and how expensive things are. Have a nice day anyway
...really?
I find this extremely hard to believe on its face. Sure an attacker can infect a system via a USB drive, but they need to get physically close to the victim (at least at one point in time). That both dramatically decreases the number of possible attackers and increases their personal risk.
It also becomes far more difficult for an attacker to exfiltrate any data.
As for the attack method, there's always the good ol' "flash drive found on a parking lot" vector.
Right, which requires the attacker to be physically near the parking lot at some point! That decreases the number of possible attackers by several orders of magnitude at least.
> Exfil may be tricky if the system is actually airgapped - I take GP's use of scare quotes to mean that most systems are "airgapped" by means of software-enforced security policies, which should correctly be referred to as "not airgapped".
Ah, that makes more sense! I do think tpmoney was quite clearly talking about truly airgapped systems, however.
Very much so. My point being that a truly air gapped system is objectively more secure than one that is networked, and yet, a bank or social network company that only operates with truly air gapped systems will be strictly worse off than their competitors in their actual business of banking or social networking. And so since their actual job is not objectively better cyber security, but banking or social networking, then they are inherently at a disadvantage compared to Attackers whose business IS attacking (or at one step removed, selling the resources obtained from attacking). In the name of making their business better, Defenders will chose weaker security, and attackers will chose stronger attacks.
I have worked at 20+ companies and the ones that had little to no security got ransomwared at LEAST yearly (with 50m+ in revenues) and the ones that had basic and standard security practices got zero network wide intrusions (at least at lower then say, a nation state level.)
Now, COULD they have been exploited with an 0day? Sure, in theory these networks could be both exploited with the same technology or by a dedicated actor likely without an issue - they're internet connected corporate networks mostly with probably out of date tech; and in practice most attacks corporations need to mitigate are the drive by trash that consumers also face.
Replace "security" with "safety" for, IDK, space engineering or nuclear power. Does it still make sense?
Safety and security need to be integral parts of processes. It is not something you can acquire from a vendor or split out as the responsibility of separate team(s) who have to internally battle for resources and interface with the core development through escalation requests...
Safety systems take over if your chemical reaction overheats the reactor; they prevent your logistics team from moving a train while it's being loaded with dangerous chemicals (real example, the safety system was disabled by the logistics people - ironically the company put those with poor safety record from production to logistics, because they could do no harm there).
You're mixing up safety systems with the property of "doing X is safe by construction" - but most plants inherently are not: e.g. in a small reactor that's manually fed, your employees can just input the wrong recipe by accident; the safety systems should then take care of the mess. Or your junior chemist (who needs an expensive, senior chemist for an established process?) can mess up the improvement to the recipe, resulting in rapid unscheduled disassembly of you poorly maintained reactor, including the building and one of its operators (sadly a real example).
Humans are reckless idiots. If circumventing safety systems means they can go home 15 minutes earlier (or if it's the only/simplest easy to get reach some unrealistic high daily goal dictated from higher ups), some of us will happily risk their own health, and that of a whole city, to do so.
Still though, security is fighting against an opponent who searches for weak points and exploits them to the max. "Safety" protects against random natural accidental events (either internal or external in origin). If someone is just trying to get home, they want to get the job done quickly sure, but their intent is not to cause damage, their actions aren't targeted. It's a different risk profile.
Maybe my examples are bording on sabotage, eg "sabotage by accident".
Here's a question: Why do most safety regulations require the force of law to get companies to enact, but no laws were necessary to get companies to adopt the internet? "Safety" is in a similar boat to security, with the benefit that you usually don't have people actively trying to harm your employees. But Safety often gets tossed out the window when it gets in the way of accomplishing the real goals of the organization. Why is the US military exempt from a number of safety regulations that private companies are beholden to? Because the military believes those regulations will hamper their real mission, which is not keeping individual soldiers safe.
Look at any cloud provider. They get it right because they employ the best security management systems.
Some examples:
https://www.theverge.com/2023/8/3/23819237/microsoft-azure-b...
https://www.theverge.com/2023/9/6/23861890/microsoft-azure-d...
https://www.reuters.com/technology/microsoft-warns-azure-cus...
https://www.bleepingcomputer.com/news/microsoft/microsoft-st...
Well, I'd prefer incapable people to build secure rocks over them building insecure non-rocks.
Is that a joke? Microsoft seems to be in the advertising business. Their OSes are also a means to an end.
Nowadays their purpose has some sort of monetization component, therefore there is consideration as to which attack vectors seem to be the most likely to lead to the kind of a monetization scheme they are targeting on. For example does a group of attackers ransoming companies prefer the same attacks as phishing individuals? Are these the same companies / groups (I prefer companies at this point, they are organized crime, they are a company and have the same sort of problems in that any small company have in deciding where to put their resources - we don't have a phishing division here, we ransom data, we don't denial of service - nobody is paying us for that, we ransom data and that's it!)
I'm pissed this is accepted as normal for the IT sector, while in railroad engineering and aviation (where human lives are at stake) you'd get your licenses and certificates revoked. Therac-25 something.
Therac-25 was a safety event, not a cybersecurity event.
Like, if the code can handle all input correctly, then there is no exploit path. Regardless of whether the input comes from an attacker or not.
Compromising it would simply be a matter of changing a few bytes in the executable, or replacing the executable with another one.
This seems so obvious to me that I think you may have non-standard definitions of either safety or security.
The executable is part of the system that's supposed to be safe. That you have no means to modify it is an aspect of safety.
With your example, imagine that program would be running on an AVR with boot fuses burnt.
\|/ \|/
\ /
You're wrong!
| |
^^^ ^^^
If that's the standard, then no wonder "software safety is near non-existent".
Even with "defense in depth", there's clear separation between parts that do the important stuff, and parts that protect the parts that do the important stuff from being used against the rules.
I'd go as far as dividing cybersecurity into two major areas of concern:
1) The part that constrains software systems to conform to some make-believe reality with rules stricter than natural -- this is trying to make the abstract world function more like physical reality we're used to;
2) The rules and policies - who can access what, when, why, and what for.
Area 1) should very much be a bolt-on third-party thing everyone should ideally take for granted. Area 2) is a responsibility of each organization/project individually, but it also small and mostly limited to issues specific to that organization/project.
It maps to physical reality like this:
Area 1) are the reinforced walls, floor and ceiling, and blast doors that can only be opened via a key card[0];
Area 2) are the policies and procedures of giving and revoking keycards to specific people in the company.
--
[0] - Or by crossing some wires deep in the reader, because accidents happen and cutting through blast doors cost money. I.e. real-life security and safety systems often feature overrides.
Is that true? The safest train is the one which is stationary. Cut off the wheels, and drop the rail cars on secure foundations (carefully) and you just protected yourself from 90% of possible accidents. If you remove everything flamable and weld the doors shut you got rid of 9% more.
Do you see why this is silly? Because the main business of rails is to transport people and stuff. You won’t be railroad engineering long if you don’t keep that in mind.
You're confusing a statement of the way the world *Is* as an endorsement of the way it *Ought* to be. Ask yourself this: WHY do you get your licenses and certificates revoked in railroads and aviation? Because without that threat of punishment, the railroad and aviation companies would choose to spend their money on other things that are their actual business and not on the distractions that safety and security are otherwise. It takes the force of law to mandate that the companies do something that is contrary to their actual interests and goals. See also Boeing.
I think one way to drive home the point is defenders are cost centers and attackers are profit centers.
"lists" is just short hand for components. "Graphs", shorthand for interoperation. The component view is analysis, the interaction view - well we don't have a really good word for that, and yet as the article points out, that is often the attack surface.
Complex adaptive systems (see John Holland's "Hidden Order") have components and a messaging bus which crucially provides a way for the constituent components to interoperate. You can swat ants individually, but if you want to stop them, you destroy the ability to leave pheromone trails.
Maybe there should be a word like "analysis" for understanding how things interoperate. Gestaltysis?
I briefly worked for a "cyber security" company and couldn't quite put my dinner on why I ultimately hated the product and felt that the approach that they took -- and a large part of the industry -- was ultimately a sham.
I couldn't quite put it into words, but now I get it: we were building the tools to support the most useless of cybersecurity practices -- org-level checklists.
All activities have lists and recurring calendar entries at their heart.
You have to regularly show up and do the things.
I agree that deeper / better approaches are required during the "do the things" steps.
I onboarded a new client recently, and within five minutes of guessing a Wi-Fi password I had sensitive financial data using stock tools. Anyone with physical access to the office could do the same. Contrast an existing client, after a month of trying and writing custom shellcode loaders, spear phishing campaigns, my entire team had... some graduate CVs.
Really, you're saying that because the NSA could probably do a better job with the latter than us by intercepting and hardware-hacking networking gear, that no value has been provided?
If companies cared about security they would hire red teams instead of paying for useless scanners with a <1% signal to noise ratio.
Ultimately you end up having to clean up the mess after either way but at least there’s a paper trail of responsibility passing to CYA.
Granted, however, having a checklist for no good reason other than to say that you have a checklist, or not regularly reviewing and updating the checklist based upon real-world conditions, is meaningless.
A lot of companies get it wrong. They think the checklist is the security. But really, the checklist is just there to remind you that you did something right before and you need to keep it up. Treating the checklist like it’s the goal is where things go off track.
Apart from Bloodhound, I can't think of any tools where we have graphs.
For web security, I can't think of something where "graph thinking" applies. But we have a pretty huge list of attacks to test https://portswigger.net/web-security/all-topics.
And ultimately, what is inside your pentest report ? Not a graph, a list of things to do:
- SMB signing.
- Don't use the domain admin to manage every machine.
- ...
The main reason this phrase is so popular, is that it panders to the hacker community: "We are the smart guys, all the defenders do is excel sheets."
IMHO, the nugget of truth in this is that defenders can spend considerable amounts of time on things that don't matter. Like doing CIS benchmark by hand on all servers. While missing the low-hanging fruits that would give them a strong security posture.
In a lot of companies, the defenders are just sysadmins that don't have any idea of what they should focus on.
Bloodhound is great, and a nice visual tool for people to conceptualise attack graphs but it’s just a part of the process of understanding the target domain from an attackers perspective. No nice tool like bloodhound exists for web pentesting because a chain of compromise can’t simply be reduced into tool form there because a chain is often specific to the app and not an underlying framework, unlike AD where the security boundaries are well(ish) understood and codified.
Pentest reports include stuff like SMB signing and “don’t admin everything with your DA account ” because they are glowing hot nodes very early in a chain of compromise, meaning that is often how stuff gets popped IRL. It’s (hopefully) not that the pentester doesn’t understand graph thinking, it’s just the the first node in the graph represents effectively complete compromise, so why traverse?
As I type this, I realize it sounds a bit like some of the evil all-powerful corporations in sci-fi, although they usually also go to the lengths of assassinating their enemies.
Well, Google no longer has a mandate of “don’t be evil” and Microsoft never did…
Also interesting that the author implies the problem is about thinking of defense in lists then provides a list of items to consider to improve defense.
A lot of core confidentiality and integrity security problems come down to 'safety property' verification (a notion from model checking), which in turn comes down to reachability on a program flow graph (a notion from program analysis). This is also true of access control verification, but that's a topic for another day.
Imagine a dataflow or points-to analysis on a program, and extend it all the way to include the code in your OS and the cloud and the database. These analyses create a graph, and the question is can an attacker get from an entrypoint and precondition of some node A (a line of code) and traverse to the assets on point B (another line of code.)
Interestingly, the security field is increasingly getting there, with ideas like CNAPP, IAM/Cedar, AD/bloodhound, where we are getting these basic access graphs modulated by estate, identity, access policy, etc. Often we don't even really need the programs, because it's more about a distributed system where we can focus just on identities and policies across trust zones. (Eg, If a box gets hacked, that exposes other credentials on the same box.)
At the same time, anyone working in these things also knows graph reachability is simplistic 80's & 90's stuff: there can be complex logical policies at each node, So we're seeing things like modeling those harder points, not just as pure reachability, But also things we can actually peek into and more richly verify, such as by modeling fancy ABAC policies using smt solvers.
I don't think that's really where the author is coming from, but it's a reason the article resonated with me for so many years from a principled perspective, and I think it's incredibly practical and important today.
(Disclaimer: we do crazy GPU graph AI power tools for folks in the space at Graphistry / Louie.AI, in my first verification papers here were almost 20 years ago, so I've been thinking about this a lot.)
(Note: I genuinely have no idea if that would be done outside of an authoritarian / autocratic regime. So I'm not remotely advocating it at this point.)
"Security" has a cost. The only question is whether the cost of security exceeds the cost of lack of security. Currently, lack of security has very little cost.
It would be easier and more effective to start putting CEOs in jail for security breaches of personal information. Suddenly the executive suite would be very interested in security and would start spending an appropriate amount of money on it.
- some hackers are state actors, and pointing the finger to North Korea won't help much
- some live in precarious conditions from the start, in areas where gov is unreliable. Even if you catch a bunch of them, it might not disuade others to try their chance if there's no other obvious jackpot to them.
- When the risk increases the reward can also increase as the barrier to entry is that much higher. You get a hacker scene with more high profile, super professional actors that will get more organized. Think "war on drug" style of underground actors building cell networks to manage their operations.
My take as an attacker: it goes directly against the security 101 of "defence in depth". Sure, we only have to win once for a specific step, but then there are more steps to complete for us to reach our goal. This is the same for most occupations that I can think of anyway, no one reaches their goal with one step.
I understand that this can be taken to mean there are multiple avenues to achieve a certain objective (e.g. I can find a password on disk multiple ways), but I still wouldn't agree. Develop a defence that makes sense (e.g. MFA is a good mitigation for password theft). Detect / alert on the usage rather than the endless list of methods to retrieve a password.
For example, maybe the attacker is after trade secrets but compromises the CMS (content management system) of your public website. It has no connection to your intranet, but they were able to change download links and inject scripts for visitors of your website. Still a "win" as they now have a place to pivot from or just use to their liking. It gives the attacker options while your system is left weakened with less options.
They both run Windows. The protection class between the two is identical. You can draw as many graphs and lists as you want, but the security of this arrangement is mostly down to timely and accurate Windows Updates.
> Learn to Spot List Thinking
I think in terms of "diffs." I want to know what is _changing_ on my network. I don't ever need an enumeration of things in any particular arrangement and as a human being, whether graph or list, I'm not equipped to use it in any meaningful way.
A difference list is typically very short, reveals intrusion patterns quickly, and is something you can automate easily.
1) Use separate accounts and machines for administration tasks. Basically, IT people should never use their e-mail, web browsing, and development machine for system management tasks. They should use a separate machine with a different account for these tasks. The main reason is the system management machine has a much smaller attack surface. Ideally, it should only run a communications program (IRC, Slack, MS Teams, etc.), and the tools the person needs to do their job. Examples of tools people need include SSH, Remote Desktop, kubectl (Kubernetes tool to manage a cluster), etc. The machine should have a web browser BUT the web browser should be restricted to the bare minimum number of sites needed to administer the systems. Examples of acceptable sites include the Azure Portal, the AWS web site, web sites to configure equipment, etc. Examples of things which are not allowed include web mail, documentation, etc. The goal is to have the smallest possible attack surface.
2) People need to be mindful of what they install on their machines. I have seen a lot of people who will install anything which looks useful on their machine. This is a great way to get hacked. Here are the questions people need to ask before installing software.
- Why do I trust the people who wrote the software? - Why was the software created? What was the motivation of the author? - How does the author support himself or herself? What would happen if one of the authors was in financial distress? - How will I know when the software needs to be updated? - What are the capabilities of the software's authors? Do the authors understand how to write secure software? How do the authors handle security bug reports?
Basically, you ask these questions because you want to avoid malware, and you want to use software which fixes its security problems.
3) Consider putting system management machines on a different network or VPN. Basically, it's harder to hack a machine if you can't easily communicate with it.
4) System management machines should not be listening on any ports (or should have a firewall which blocks all connection attempts). It's harder to break into a machine when an attacker cannot connect to it.
5) Put the system management machines behind a firewall.
6) Consider what happens when an account is eventually hacked. Many people assume that only dumb or incompetent people get hacked. Unfortunately, this is not true. Systems should be designed to assume accounts will get hacked. The best designs limit the blast radius (damage) of account attacks.
7) All users should have limited privileges. Basically, they should get the privileges they need to do their jobs. Very few people should be allowed to have the equivalent of root/Administrator for the entire system (obviously, people may have these permissions for some machines but almost no account should be able to do anything on any system the organization runs).
Because of this I can't consider the security of the AD as any better or worse than the desktop that connects to it and it's pointless to pretend that you can even have this.
We did have a crypto locker that spread on our network this way between our AD machines. It was launched from an email in the sales department, but due to an unpatched RDP credential attack, it quickly got onto the ADs then spread across the entire WAN.
I'm not saying don't do the things you're suggesting but you should prepare the scenario where none of it matters. So one thing you missed which we now have is: WAN KILL SWITCH.
Case in point, to contradict the author of this post directly:
https://github.com/BloodHoundAD/BloodHound
BloodHound is primarily a defender tool, that uses graph theory to help defenders find attack paths. But attackers also use it to help them find the shortest path to owning an AD domain. BloodHound is used in by a lot of threat actors as part of those news stories where the entire company is ransomwared. But what you don't see is, in a lot of companies that don't get totally ransomwared, there is a chance defenders are also using BloodHound to find and fix attack paths.
I'll add another item that defenders use for graphs: SBOMs. You can map out component relationships with them and understand if, for example, there's an issue with openssl, note which end applications are affected.
Defenders think in lists. Attackers think in graphs - https://news.ycombinator.com/item?id=9442565 - April 2015 (7 comments)
1) regulatory games
2) compliance games
3) CV optimization games
4) political games and finally
5) actual security work games within their organization
Those visualizations of network graphs enhanced by segmentation/clustering data are at least a decade old. As is studying how attackers traverse.
Here’s something I find my true:
Defends think in cheap cliches, attackers think like professionals — so attackers win.
1. Network connectivity: Crickets
2. Cluster resources: Bees
3. Queues/pipelines: Ants
Consider the population of ants on earth is 20*10^15 : One could spend the rest of their life stepping on individuals, but the futile behavior remains meaningless to self-repairing ecosystems.
https://www.youtube.com/watch?v=ksZTYRqr444 (Jimi Hendrix, "Castles Made of Sand" )
Defenders usually have to justify their work to management and balance "real" defense work with things that reduce liability. This ends up being a prioritized list.
I blame JIRA for giving the attackers an advantage.