Dealing with resourced and persistent adversaries motivates defenders both to understand the adversaries’ strategies and to have a range of defense strategies available for use. Attack strategies include localized, progressive, and group attacks. Defense strategies include deception, frustration, resistance, and recognition and recovery. This chapter provides a basic outline of both groups of strategies for information security.

Keywords

strategy; deception; frustration; resistance; recognition; recovery; RSA; advanced persistent threat (APT); Robert Morris Jr.; direct attack; progressive attack; misdirection attack; massed attack

■ Security strategies

■ Attack strategies

■ Defense strategies

■ Security controls

Introduction

The motivation of adversaries attacking networks changed during the first decade of the twenty-first century. While there are still hobbyist-level adversaries, more and more became self-sustaining financially. During this time, large botnets were accumulated by a number of adversaries, and the selling of use of these botnets lead to one stream of income; another income stream was the emergence of fraud schemes, including phishing and credit card fraud. These self-sustaining adversaries are much more persistent than hobbyists, and protecting networks against these adversaries, or even making a network relatively difficult to compromise, requires understanding the strategies both that they may use to compromise, and that defenders may use to protect information.

This chapter presents concepts of attack and defense strategies. Some basic strategic options are laid out in the next section. Following that, the application of these strategies to security threats is discussed. Example security controls associated with each defense strategy are then covered briefly, and expanded on in the rest of this book. An example security incident and how the defense strategies could have applied are discussed immediately prior to the chapter summary.

Security Strategies

A strategy is defined as a “method or plan chosen to bring about a desired future” [1]. A security strategy is, therefore, a strategy that affects security, either in defense (often, increasing the security of an organization’s information) or in attack (often, decreasing the security of an organization’s inform-ation). Security strategies form the general approaches to security adopted by an organization, and many organizations employ overlapping security strategies to help prevent gaps.

This chapter will discuss both attack and defense security strategies. While the focus of most of this book lies with defense strategies, there is some value in a high-level understanding of security attack strategies as a context for deploying defense strategies. As adversaries have become better resourced and increasingly systematic, the attack strategies they employ have become increasingly diverse.

Attack Strategies

One motivation to systematically address information security risk (in addition to the legal requirements described in Chapter 1) is that the threats against information security are growing systematic. The RSA case [2] described in the “Case Study: RSA Attack” sidebar shows how adversaries may target trusted security controls as a means of facilitating later attacks. This shows a degree of attack planning beyond what has been typical of past adversaries. Robert Morris Jr., for example, released his malicious software without plans for follow-on activity (see the following sidebar). The revelations about government-sponsored cyber attacks in the 2007–2011 timeframe [3] have opened discussions about such attacks and their extensive planning and serious consequences for organizations. Pervasive fraud attempts have become a routine warning to business users of the Internet, including the dangers of trusting emailed web references or opening seemingly relevant attachments. As targeted frauds have proliferated, users find it difficult to differentiate legitimate and fraudulent financial web pages, to the detriment of organizational security.

Adversaries may threaten information security on multiple levels simultaneously. They attack individual hosts, exploiting weaknesses in the operating system (e.g., the Windows 95 LAND attack [4]), or in the application software (e.g., the Internet Worm, as described in the following sidebar). They attack via networks, using remote contact methods, or by exploiting the trust within networks to propagate from an initial point of compromise. They attack users, either as malicious insiders (e.g., the Chris Harn case [5], described in Chapter 1), or as malicious outsiders (e.g., using fraudulent email). They attack data that organizations use in essential business processes, including compromise, imitation, or redirection of data sources (e.g., phishing), using websites that closely imitate institutions to obtain authentication information used in later frauds [6].

To illustrate the usefulness of understanding attack (and defense) strategies, this chapter employs a brief continuing example. Consider a small nonprofit organization that has a website, a connection gateway providing external access to internal computers for the use of staff and organizational officers, a file server with shared information, several workstations internally for the staff and authorized volunteers, and an internal office server with human resources and financial information on it. A contract with a service provider supports hosting of the website, external-facing domain name system (DNS) service, and email service for the nonprofit. Figure 2.1 illustrates the organization’s logical network structure. After performing a risk analysis, the nonprofit’s staff determines the major security concerns are disgruntled staff or volunteers leading to information theft, external adversaries compromising computers as part of their botnet-building activities, and corruption or unauthorized dissemination of financial information.

An adversary may have diverse malicious goals, including theft of data, misuse of computing time on hosts, consumption of network bandwidth, impersonation of users, and redirection of organization network addresses. Adversaries employ a wide variety of attack strategies to attain these goals. The generic strategies they use include direct attacks, progressive attacks, mass attacks, and misdirection. Most attacks are not launched directly from the host the adversary uses to access the Internet. Rather, adversaries use hosts previously compromised (or acquired legitimately) as launch points for their attacks.

The simplest attack strategy is the direct one. In this case, the adversary strikes against the target from the launch point, without intermediate or third-party hosts involved except in normal traffic routing. Figure 2.2 shows an abstraction of this strategy, where the solid node is the launch point and the patterned node is the...