Dailydave mailing list archives
Re: APT
From: David Maynor <dmaynor () gmail com>
Date: Wed, 12 Mar 2014 10:23:49 -0400
I'm kinda sad no mentioned Mr. Bejtlich's example from Air Force history. In support if his point he mentions the Air Force became focused on tools and tactics at the cost of strategic thinking. He stopped there because the example fits his point. Dave and other offensive firms are the tools and tactics focused crowd and lack the strategic understanding he has as network a network defender. Continuing forward in Air Force history a major change happened: the expensive programs designed to put pilots in air combat began to be replaced by tools and tactics. The USAF has proven that there is a place in air dominance for cheap, replaceable drones. This doesn't sit well with older AF pilot types who are being replaced by drones. If you look at the A-10 decommissioning you will find a mirror for Mr. Bejtlich's belief in defender superiority and transforming the Air Force into a more agile organization that is representative if offensive approaches to security. I think this mirror is why Mr. Bejtlich has a problem with offensive security. He comes from an org where you have to constantly be moving forward to get promoted and the leadership pretty much comes from fighter pilots. If the AF replaces pilots with drones how will anyone get promoted? Back to IT if offensive security can show value then what will become of his plans/budgets for hundreds of networks sensors, people to deploy them, time to analyze results, and mitigate findings. He will end up in the boneyard right next to the retired A-10s. If somebody wanted to twist the knife the subject of the book referenced in Mr. Bejtlich's post is about John Warden. He is often quoted as saying: "Real exploitation of air power's potential can only come through making assumptions that it can do something we thought it couldn't do...We must start our thinking by assuming we can do everything with air power, not by assuming that it can only do what it did in the past." Doing what Mr. Bejtlich does and adapt Air Force lessons to IT that quote is a glowing endorsement for offensive security types... On Tue, Mar 11, 2014 at 6:18 PM, Moses Hernandez <moses () moses io> wrote:
Something caught my eye: "He emphasizes the role of encryption to defeat many defensive tools, but ignores that security and information technology architects regularly make deployment decisions to provide visibility in the presence of encryption." Meta Data matters, even just the patterns that are used in transmitting data could matter. There potentially could even be signature matching on protocols like voip that could give attackers a signature to match to a person. An argument could be made that Meta Data matters to some people at some level. Encryption is only a finite means to an end. If intelligence data and its importance only has a finite life then encryption may be good enough for the moment that it is needed for. At the same time, you can from a defense point of view understand that bad stuff is happening even if encryption is used. As for the comments above, if I have learned anything in my career it is that I have only been that much better because I have had to be on both sides and have had my offensive skills influence and feed my defensive skills. The same can almost perfectly said of the inverse. Oh and "Look, Richard Beitlitch thinks I don't know anything about "Strategy"<http://taosecurity.blogspot.com/2014/02/the-limits-of-tool-and-tactics-centric.html> ." I will be the first to admit, compared to someone who has lived and breathed warfare, I don't know If I could claim I know anything about strategy. What I can tell you is this, we need better tools to go hand in hand with 'people and process', so I'm excited to see Innuendo in action. m @mosesrenegade Full Disclosure: The opinions here do not reflect the opinions of my Employer. On Tue, Mar 11, 2014 at 12:28 PM, Justin Seitz <justin () immunityinc com>wrote:Weird I couldn't see Richard's response through all the marketing for his products and books. Must have been the thick cloud of big data APT threat intelligence in the way. I guess I also find it funny that there are a number of defense folks who love to use/paraphrase this statement Richard makes: "First, I recognized that it's written by someone who is not responsible for defending any network of scale or significance." Right. Offensive firms (you all should be pissed by this statement by the way) are not responsible for defending networks. Period. Posts like this, Richard, are why I turn off Twitter by 9am most days. Justin _______________________________________________ Dailydave mailing list Dailydave () lists immunityinc com https://lists.immunityinc.com/mailman/listinfo/dailydave_______________________________________________ Dailydave mailing list Dailydave () lists immunityinc com https://lists.immunityinc.com/mailman/listinfo/dailydave
_______________________________________________ Dailydave mailing list Dailydave () lists immunityinc com https://lists.immunityinc.com/mailman/listinfo/dailydave