For years now, defenders have been trying to improve the perception of defense relative to offense in the IT security arena. One only has to look at the schedule of talks at the average security conference to see that offense still draws the crowds. I’ve discussed the situation with colleagues, who also point out that much of the entrepreneurial development in information security is on the offense/red team side of the fence.
That made me reflect on the many emails I receive from listeners of the security podcast I co-host. Nearly everyone who has asked for advice, except for a few, was looking for advice on getting into the offensive side of security.
I’ve been pondering why that is, and I have a few thoughts:
Offense captures the imagination
Let’s face it, hacking things is pretty cool. Many people have pointed out that hackers are like modern-day witches, at least as viewed by some of the political establishment.
Offense is about technology. We LOVE technology. And we love to hate some of the technology.
Also, offense activities make for great stories and conferences, and can often be pretty easily demonstrated in front of an audience.
Offense has a short cycle time
From the perspective of starting a security business, the cycle time for developing an “offering” is far shorter than a more traditional security product or service. The service simply relies on the abilities and reputation of the people performing service. I, of course, do not mean to downplay the significant talent and countless hours of experience such people have; I am pointing out that by the time such a venture is started, these individuals already possess much of the talent, as opposed to needing to go off and develop a new product.
Offense is deterministic (and rewarding)
Penetrating a system is deterministic; we can prove that it happened. We get a sense of satisfaction. Getting a shell probably gives us a bit of a dopamine rush (this would be an interesting experiment to perform in an MRI, in case anyone is looking for a research project).
We can talk about our offensive conquests
Offense are often able to discuss the details of their successes publicly, as long as certain information is obscured, such as the name of a customer.
If you know how to break it…
You must know how to defend it. My observation is that many organizations seek out offense to help improve their defense.
…And then there is defense
Defense is more or less the opposite of the above statements. If we are successful, there’s often nothing to say, at least that would captivate an audience. If we aren’t successful, we probably don’t want to talk about it publicly. Unlike many people on the offense side, defenders are generally employees of the organization they defend, and so if I get up and talk about my defensive antics, everyone will implicitly know which company the activity happened at, and my employer would not approve of such disclosure. Defense is complicated and often relies on the consistent functioning of a mountain of boring operational processes, like patch management, password management, change management and so on.
Here’s what I think it would take to make defense sex[y|ier]
What we need, in my view, is to apply the hacker mindset to defensive technology. For example, a script that monitors suspicious DNS queries and automatically initiates some activities such as capturing the memory of the offending device, moving the device to a separate VLAN, or something similar. Or a script that detects outbound network traffic from servers and performs some automated triage and/or remedial activity. And so on.
Certainly there are pockets of this happening, but not enough. It is a bit surprising too, since I would think that such “defensive hackers” would be well sought after by organizations looking to make significant enhancements to their security posture.
Having said all of that, I continue to believe that defenders benefit from having some level of understanding of offensive tactics – it is difficult to construct a robust defense if we are ignorant of the TTPs that attackers use.