Breaking then Fixing...

How to Win Friends and Influence Testing

Yesterday I encountered and interesting issue that demonstrated the real necessity behind good network testing. To give some background on this story, I have previously contacted a testing vendor and have them give a very good presentation on the ins and out of good Q&A testing. The organization that saw this presentation sought this to be a bit much for their environment.

This organization has a pair of IPS Sensors in which are leveraging spanning-tree in order to have fail over. The figure below illustrates the design. 

 

Now the vendor that supplied the IPS code is having a problem with their few latest builds. The vendor's most stable release still has a bug with the SMB portion of their engine. What is interesting is that when a particular type of SMB traffic passes through the engine the engine will fail. Now this particular organization has several tools to view the health of certain things but the IPS sensors are not one of the ones they can easily view. What happened to this particular organization was that the sensors failed, both of them. The primary sensor failed and the secondary sensor failed upon seeing the traffic conditions. It was 9 days different between the primary and secondary failure. 

The beautiful thing about this design is that you leverage spanning-tree to complete fail over and the reason that is important is because the switches and routers are participating in a load sharing mode for increased performance.

The vendor is now suggesting to this team that an engineering release that can be specially developed for them that will address the issue is the way to go. So what does this organization do? Do they install code that is not completed vetted? Can they test the code thoroughly first? Do they rely on blind faith and risk complete IPS failure?

They now see the need for better network and system testing before go live and production. You see they could put the new IPS code on the secondary sensor and see if it crashes the 'passive' node, however they have not run traffic through that release since its a passive node.

This was good opportunity to win friends...and influence testing.

Recession Security, or back to basics?

About a year and a half ago I took on a job at a government sanctioned enterprise. When I took on the role it was very simple. Do in 12 months what would normally take 48. It took my past roles as an engineer and a security professional and molded them together. It was a good gig when we had an unlimited budget. In one sense we were judicious in our needs. We were modest, as well as concious not to purchase what could not be implemented in 12 months. This last few months we were given the opportunity to look at the spending and had a modest chance finish the job this year. As I look at a real recessionary time I started to consider the realities of how great of an opportunity that is. On one hand, many look at it and say, that they are going to have it hard with budget cuts. My more frugal side is now looking at it as a grand opportunity to go an improve on the softer and, in my opinion, more important portions of the project.

The first questions I ask myself are:
Can we audit the implementation? Do we have in production not just everything we put on paper but also everything we asked for?

Are all of our devices put in correctly?

Did we layer in enough security?

What operational processes do we have?

I hope I can answer these in upcomming posts in the next few months.

Have I been lazy?

Yes I have. I purchased this system several months ago thinking I would motivate myself into keeping a working journal. What happened? I imagine life happen. But I told myself. Write. Write everyday. Don't Stop and do it.

So here we go.

The state of the information world today, how we got here, where we are going.

I think that this year we will be seeing a mixture of threats that will be both social in nature and digital in attack. First of all the upcoming recession and possible depression will make an impact to the state of IT as a hole. I think we will be seeing a possible uptick in theft virtual and physical. I think we will be seeing an uptick in foreign and domestic threats. There maybe some disenfranchisement happening within the states. While all this may spell 'good news' in the eyes of some security consultants, I think that there are not enough 'good' guys to help out. Unfortunately Information Security is a difficult field, it requires a specific type of person and its possibly easier to attack in some aspects than defend. What should this mean to you?

Well first of all I think we really need to put many of our ongoing projects on hold. Why should we continue to roll out insecure architecture, products, or designs if the attack vectors become larger? I hope that companies take this time re-categorize the importance of information security as a whole, however I find that many will be reactionary in effort. These next few months will be challenging, and many in the world are watching and waiting. I do apologize if this post is rather morbid, but brutally honest. At the end of the day it will be a struggle, but consider that it may be a good thing. I found that the largest learning experiences in my life are when I have struggled t

Make the best of it!