Home page logo
/

dailydave logo Dailydave mailing list archives

Re: APT
From: David Maynor <dmaynor () gmail com>
Date: Wed, 12 Mar 2014 10:23:49 -0400

I'm kinda sad no mentioned Mr. Bejtlich's example from Air Force history.
In support if his point he mentions the Air Force became focused on tools
and tactics at the cost of strategic thinking.

He stopped there because the example fits his point. Dave and other
offensive firms are the tools and tactics focused crowd and lack the
strategic understanding he has as network a network defender.

Continuing forward in Air Force history a major change happened: the
expensive programs designed to put pilots in air combat began to be
replaced by tools and tactics. The USAF has proven that there is a place in
air dominance for cheap, replaceable drones. This doesn't sit well with
older AF pilot types who are being replaced by drones.

If you look at the A-10 decommissioning you will find a mirror for Mr.
Bejtlich's belief in defender superiority and transforming the Air Force
into a more agile organization that is representative if offensive
approaches to security. I think this mirror is why Mr. Bejtlich has a
problem with offensive security. He comes from an org where you have to
constantly be moving forward to get promoted and the leadership pretty much
comes from fighter pilots. If the AF replaces pilots with drones how will
anyone get promoted? Back to IT if offensive security can show value then
what will become of his plans/budgets for hundreds of networks sensors,
people to deploy them, time to analyze results, and mitigate findings. He
will end up in the boneyard right next to the retired A-10s.

If somebody wanted to twist the knife the subject of the book referenced in
Mr. Bejtlich's post is about John Warden. He is often quoted as saying:

"Real exploitation of air power's potential can only come through making
assumptions that it can do something we thought it couldn't do...We must
start our thinking by assuming we can do everything with air power, not by
assuming that it can only do what it did in the past."

Doing what Mr. Bejtlich does and adapt Air Force lessons to IT that quote
is a glowing endorsement for offensive security types...


On Tue, Mar 11, 2014 at 6:18 PM, Moses Hernandez <moses () moses io> wrote:

Something caught my eye:

  "He emphasizes the role of encryption to defeat many defensive tools,
but ignores that security and   information technology architects regularly
make deployment decisions to provide visibility in the presence   of
encryption."

Meta Data matters, even just the patterns that are used in transmitting
data could matter. There potentially could even be signature matching on
protocols like voip that could give attackers a signature to match to a
person. An argument could be made that Meta Data matters to some people at
some level. Encryption is only a finite means to an end. If intelligence
data and its importance only has a finite life then encryption may be good
enough for the moment that it is needed for. At the same time, you can from
a defense point of view understand that bad stuff is happening even if
encryption is used.

As for the comments above, if I have learned anything in my career it is
that I have only been that much better because I have had to be on both
sides and have had my offensive skills influence and feed my defensive
skills. The same can almost perfectly said of the inverse.

Oh and

 "Look, Richard Beitlitch thinks I don't know anything about 
"Strategy"<http://taosecurity.blogspot.com/2014/02/the-limits-of-tool-and-tactics-centric.html>
."

I will be the first to admit, compared to someone who has lived and
breathed warfare, I don't know If I could claim I know anything about
strategy. What I can tell you is this, we need better tools to go hand in
hand with 'people and process', so I'm excited to see Innuendo in action.

m
@mosesrenegade

Full Disclosure: The opinions here do not reflect the opinions of my
Employer.



On Tue, Mar 11, 2014 at 12:28 PM, Justin Seitz <justin () immunityinc com>wrote:

Weird I couldn't see Richard's response through all the marketing for
his products and books. Must have been the thick cloud of big data APT
threat intelligence in the way.

I guess I also find it funny that there are a number of defense folks
who love to use/paraphrase this statement Richard makes:

"First, I recognized that it's written by someone who is not responsible
for defending any network of scale or significance."

Right. Offensive firms (you all should be pissed by this statement by
the way) are not responsible for defending networks. Period.

Posts like this, Richard, are why I turn off Twitter by 9am most days.

Justin

_______________________________________________
Dailydave mailing list
Dailydave () lists immunityinc com
https://lists.immunityinc.com/mailman/listinfo/dailydave



_______________________________________________
Dailydave mailing list
Dailydave () lists immunityinc com
https://lists.immunityinc.com/mailman/listinfo/dailydave


_______________________________________________
Dailydave mailing list
Dailydave () lists immunityinc com
https://lists.immunityinc.com/mailman/listinfo/dailydave

  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]