Slashdot Mirror
Splunk CTO Urges Collaboration Against Cyberattacks - And 'Shapeshifting' Networks (itwire.com)
"The cost of cyber attacks is 1/10th to 1/100th the cost of cyber defense," says the CTO of Splunk -- because the labor is cheap, the tools are free, and the resources are stolen. "He says what's needed to bring down the cost of defense is collaboration between the public sector, academia and private industry...the space race for this generation," reports Slashdot reader davidmwilliams.
Splunk CTO Snehal Antani suggests earlier "shift left" code testing and continuous delivery, plus a wider use of security analytics. But he also suggests a moving target defense "in which a shapeshifting network can prevent reconnaissance attacks" with software defined networks using virtual IP addresses that would change every 10 seconds. "This disrupts reconnaissance attacks because a specific IP address may be a Windows box one moment, a Linux box another, a mainframe another."
Splunk CTO Snehal Antani suggests earlier "shift left" code testing and continuous delivery, plus a wider use of security analytics. But he also suggests a moving target defense "in which a shapeshifting network can prevent reconnaissance attacks" with software defined networks using virtual IP addresses that would change every 10 seconds. "This disrupts reconnaissance attacks because a specific IP address may be a Windows box one moment, a Linux box another, a mainframe another."
Depends on the industry. Yahoo? will pay $0 in fines for their breach. If you were a hospital you'd see $50k per patient, which adds up quite fast, and doesn't include stupid things like credit monitoring.
Good infosec doesn't cost a lot - the problem is no one gives a shit until after something happens. Then you shit can your CISO, who you ignored the entire time, because you need someone to take the blame.
It's getting so bad that I can see a forced implementation: Either switch or you're un-connected until you do. Set a switch date and enforce it. Thing is, will IPv6 really be the fix needed? I don't see how anything short of hardware built specifically for security on a secure network can be secure.
Everything in the Universe sucks: It's the law!
What he proposes is infeasible.
Think about a simple shipping trip to amazon. If your DNS cache is wrong after 9.2 seconds, how are you going to maintain your session long enough to finish your purchase?
The CTO here is confused as to how virtual IP addresses work. The virtual IP doesn't change, the actual IP of the servers in the cluster does. Without a reasonably constant IP, the availability portion of the CIA triad does not exist.
Secondly, "reconnaissance attacks"- footprinting, is reasonably handled with traditional techniques. Stopping what comes after is much harder. Stopping the easiest to exploit attack vector, the human factor, is orders of magnitude harder than that.
...to keep them out of your network in the first place?
The shifting addresses could only apply to internal systems. Externally available systems (like, say, web servers) have to have known addresses for access, or you've defeated the entire purpose of having them externally accessible.
Which leads us back to firewalls and IDS and such.
-- sigs cause cancer.
...to keep them out of your network in the first place?
The shifting addresses could only apply to internal systems. Externally available systems (like, say, web servers) have to have known addresses for access, or you've defeated the entire purpose of having them externally accessible.
Which leads us back to firewalls and IDS and such.
Shape-shifting has to "bottom out" somewhere with known addresses, and that's where you're going to be vulnerable. You can test this now with low TTL DNS servers and (assuming your TTL is respected) you just send the traffic over to the new destination. If he's referring to external services, that about covers it. If it's external access to internal networks, then why are you running IPv6? Use NAT and a FW like everyone else and get that stuff off the internet. If he's referring to internal services, they're just as vulnerable for the same reason. Your internal services will have to have a lookup system (DNS, or your super-awesome low latency replacement for DNS because what good is a wheel if it isn't being reinvented), and that can be used for following whatever you need around. You've added one small, boring step for your hackers that's just as HOBE as anything else because the lookup has to be automated to make all your systems work internally.
Hosts aren't going away any time soon because they're an architecture more than anything else. There's this wacky vision some in the industry have of containers running on top of Cisco gear that they seem to think will be a panacea for all of their tech issues. Software-defined stacks won't fix everything, and they really won't fix this.
Hire a Linux system administrator, systems engineer,
Perhaps Snehal Antani's original ideas were interesting, but linked article turns everything into a buzzword collection that makes little sense.
Spare your time, skip article. Slashdot summary contains all relevant information.
Put together a special forces team to find the hackers and the make a video of them being lowered slowly feet first into tree shredders and publish the video online.
IPv6 is a very typical problem, in that if you continue to ignore it, it will eventually go away.
Seriously, Splunk is probably the most expensive SIEM out there so for him to bitch about costs rings hallow to me. Bring the price down on your shit before lecturing me on costs.
Sounds like somebody is pushing an utterly stupid and destructive idea to earn a lot of money.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
This sounds like rotating shield frequencies every 10 seconds to keep the borg from adapting. I saw that episode of Star Trek: V'ger, they end up adapting
Can we ddos any and all people that use the word cyber in any context, i'm willing to take the first hit if it will start a trend.
Does that mean Splunk will no longer charge you through the nose for every fart you might want to pass through their software?
Didn't think so.
Preaching water, drinking wine, thanks, but we have enough assholes that already do that, we'd much appreciate if you just kept your mouth shut, Snehal.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
1) Dodge 2) Duck 3) Dip 4) Dive 5) Dodge. ... 2) Duck 3) Dip 4) Dive 5) Dodge. remember the 5 D's of dodgeball! thats the key to victory
And now you've got to shell out for an SDN infrastructure, too.
That's a cute idea, but he's obviously never had to operate or troubleshoot issues on a production enterprise network. What happens when an machine changes IPs in mid-tcp conversation? I have stuff that maintains ssh sessions for days, the client isn't doing constant nslookups to see where the server has gone. Not to mention the fact that sshd is going to interpret the client IP changing as a session-hijacking attack.
That's just one example, the more I think about it leads me to downgrade my opinion to "dumbass".
J-.
The claim is that breaking security is cheaper than creating security. For $5,000, I can buy a steel safe reinforced with concrete. For $25, I can rent a saw designed for cutting steel and concrete.
Breaking things has always been cheaper than building them, and probably always will be. As you hinted, that's the wrong comparison. The comparison that drives decisions is:
A) The cost to avoid a breech (the cost of security at a given level).
Vs
B) The cost of having a breech (reputation, down time, etc).
In almost all cases, the lowest total cost is a certain degree of security, neither ignoring security nor obsessing about it. You put a lock on your door, you don't normally hire armed guards to guard the door.
One of the best and cheapest approaches to information security is to reduce the cost of a breech - don't store plaintext passwords, don't store credit card numbers and social security numbers of you don't abaolutely have to. They can't steal what you don't have.
"Collaboration between public and private sectors" is word salad that really means he wants taxpayers to fund his enterprise and lifestyle.
Then I guess this generation is well and truly f*cked!