Tower Defense
Recently, I have been enjoying the tower defense (TD) genere game on my iPhone. In the game, I try to prevent little animations of monsters from arriving at my castle and doing some malicious deeds like devouring the cute, helpless inhabitants of the castle.
Now I am not aware of any monsters that are scary, so to get into the mood I imagine that the monsters are packets with malware. Scary.
Also, since I have little experience with bows, arrows, cannons, balistrades and other primitive weapons, I imagine a sequence of firewalls, clusters of network IPS/IDS, proxies and host security apps.
After setting up the defenses, I then watch helplessly as those sinister packets slowly (but determined) make their way towards the castle eventually devouring the residents. In the world of TD you mostly fail. Success means you move onto the next level to spend time yet again watching malicious packets devouring your residents. But then nothing happens. This is where my metaphore for security as a TD game collapses:
1. In TD, you have many failed attempts and one success. As a security expert, you’d better succeed more!
2 In TD, the monsters end by eating the residents. In security, the malicious packets must create value for the hacker: either sabotage, or data theft.
In a data theft scenario, the malicious packets will have to walk back past the defenses with the data. That gives us a whole new opportunity to find and disable the attack vectors.
In security, we are usually told that building the anticipated attack trees and ensuring all branches are covered makes for a safer network. Anticipating attack paths is hard. Anticipating intent is easier (steal or damage). Adding the escape path branch to the list of monitored points just makes sense, even if TD doesn’t.
/al