[Dailydave] APT

David Maynor dmaynor at gmail.com
Wed Mar 12 10:23:49 EDT 2014


I'm kinda sad no mentioned Mr. Bejtlich's example from Air Force history.
In support if his point he mentions the Air Force became focused on tools
and tactics at the cost of strategic thinking.

He stopped there because the example fits his point. Dave and other
offensive firms are the tools and tactics focused crowd and lack the
strategic understanding he has as network a network defender.

Continuing forward in Air Force history a major change happened: the
expensive programs designed to put pilots in air combat began to be
replaced by tools and tactics. The USAF has proven that there is a place in
air dominance for cheap, replaceable drones. This doesn't sit well with
older AF pilot types who are being replaced by drones.

If you look at the A-10 decommissioning you will find a mirror for Mr.
Bejtlich's belief in defender superiority and transforming the Air Force
into a more agile organization that is representative if offensive
approaches to security. I think this mirror is why Mr. Bejtlich has a
problem with offensive security. He comes from an org where you have to
constantly be moving forward to get promoted and the leadership pretty much
comes from fighter pilots. If the AF replaces pilots with drones how will
anyone get promoted? Back to IT if offensive security can show value then
what will become of his plans/budgets for hundreds of networks sensors,
people to deploy them, time to analyze results, and mitigate findings. He
will end up in the boneyard right next to the retired A-10s.

If somebody wanted to twist the knife the subject of the book referenced in
Mr. Bejtlich's post is about John Warden. He is often quoted as saying:

"Real exploitation of air power's potential can only come through making
assumptions that it can do something we thought it couldn't do...We must
start our thinking by assuming we can do everything with air power, not by
assuming that it can only do what it did in the past."

Doing what Mr. Bejtlich does and adapt Air Force lessons to IT that quote
is a glowing endorsement for offensive security types...


On Tue, Mar 11, 2014 at 6:18 PM, Moses Hernandez <moses at moses.io> wrote:

> Something caught my eye:
>
>   "He emphasizes the role of encryption to defeat many defensive tools,
> but ignores that security and   information technology architects regularly
> make deployment decisions to provide visibility in the presence   of
> encryption."
>
> Meta Data matters, even just the patterns that are used in transmitting
> data could matter. There potentially could even be signature matching on
> protocols like voip that could give attackers a signature to match to a
> person. An argument could be made that Meta Data matters to some people at
> some level. Encryption is only a finite means to an end. If intelligence
> data and its importance only has a finite life then encryption may be good
> enough for the moment that it is needed for. At the same time, you can from
> a defense point of view understand that bad stuff is happening even if
> encryption is used.
>
> As for the comments above, if I have learned anything in my career it is
> that I have only been that much better because I have had to be on both
> sides and have had my offensive skills influence and feed my defensive
> skills. The same can almost perfectly said of the inverse.
>
> Oh and
>
>  "Look, Richard Beitlitch thinks I don't know anything about "Strategy"<http://taosecurity.blogspot.com/2014/02/the-limits-of-tool-and-tactics-centric.html>
> ."
>
> I will be the first to admit, compared to someone who has lived and
> breathed warfare, I don't know If I could claim I know anything about
> strategy. What I can tell you is this, we need better tools to go hand in
> hand with 'people and process', so I'm excited to see Innuendo in action.
>
> m
> @mosesrenegade
>
> Full Disclosure: The opinions here do not reflect the opinions of my
> Employer.
>
>
>
> On Tue, Mar 11, 2014 at 12:28 PM, Justin Seitz <justin at immunityinc.com>wrote:
>
>> Weird I couldn't see Richard's response through all the marketing for
>> his products and books. Must have been the thick cloud of big data APT
>> threat intelligence in the way.
>>
>> I guess I also find it funny that there are a number of defense folks
>> who love to use/paraphrase this statement Richard makes:
>>
>> "First, I recognized that it's written by someone who is not responsible
>> for defending any network of scale or significance."
>>
>> Right. Offensive firms (you all should be pissed by this statement by
>> the way) are not responsible for defending networks. Period.
>>
>> Posts like this, Richard, are why I turn off Twitter by 9am most days.
>>
>> Justin
>>
>> _______________________________________________
>> Dailydave mailing list
>> Dailydave at lists.immunityinc.com
>> https://lists.immunityinc.com/mailman/listinfo/dailydave
>>
>
>
> _______________________________________________
> Dailydave mailing list
> Dailydave at lists.immunityinc.com
> https://lists.immunityinc.com/mailman/listinfo/dailydave
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.immunityinc.com/pipermail/dailydave/attachments/20140312/6abd21e9/attachment-0001.html>


More information about the Dailydave mailing list