Re: [HamWAN PSDR] We need to design secure control access
I'm interested in assisting and have some ideas. Experience: I've been doing networking and Linux sysadmin stuff since the late 90s and have been in an infosec role for the past ~7 years.
On Feb 8, 2023, at 03:34, Bart Kus <me@bartk.us> wrote: All of the network's control points are on public non-firewalled IPs. This is the worst security. It was done this way for the sake of simplicity. Our netops volunteers had to get up to speed with unfamiliar concepts like routing, funky netmasks, dynamic routing protocols, policy routing, VRRP, firewalls, MTUs, MSS control, IPsec, etc. We reaped the rewards of KISS from broader volunteer engagement, but lately we've been paying too heavy of a price for the awful security this simplicity creates. In the most recent breach we've lost important source code that will now need to be re-created. We escaped total disaster by the thinnest of margins, as one critical hypervisor just happened to be patched to 1 version higher than exploitable. This simplicity is not a good tradeoff anymore, so the time has come to introduce more complexity to the network to protect all control points.
This is not a simple problem, since there are many fragility vs security tradeoffs, as well as complexity cost concerns. If you have experience or thoughts around this area, and can commit to a few weeks of design and implementation work on this project, please indicate your interest. We'll assemble a small working group in the next few days and start discussions. I expect the working format will involve some virtual meetings, since email is not high bandwidth enough to hash out everything quickly.
Here's hoping we don't make it worse,
--Bart
_______________________________________________ PSDR mailing list PSDR@hamwan.org http://mail.hamwan.net/mailman/listinfo/psdr
I’m happy to share my knowledge. While I don’t have “security engineer” in my profession title, I’ve spent many years designing the core network security features for large public cloud networks and hold a small mountain of patents on topics like network intrusion and mitigation and I like to brag to folks at work that “I’ve forgotten more about iptables firewalls and Linux networking than most people have learned.” -A
On Feb 8, 2023, at 7:46 AM, Nick Kartsioukas <nick@explodinglemur.org> wrote:
I'm interested in assisting and have some ideas. Experience: I've been doing networking and Linux sysadmin stuff since the late 90s and have been in an infosec role for the past ~7 years.
On Feb 8, 2023, at 03:34, Bart Kus <me@bartk.us> wrote: All of the network's control points are on public non-firewalled IPs. This is the worst security. It was done this way for the sake of simplicity. Our netops volunteers had to get up to speed with unfamiliar concepts like routing, funky netmasks, dynamic routing protocols, policy routing, VRRP, firewalls, MTUs, MSS control, IPsec, etc. We reaped the rewards of KISS from broader volunteer engagement, but lately we've been paying too heavy of a price for the awful security this simplicity creates. In the most recent breach we've lost important source code that will now need to be re-created. We escaped total disaster by the thinnest of margins, as one critical hypervisor just happened to be patched to 1 version higher than exploitable. This simplicity is not a good tradeoff anymore, so the time has come to introduce more complexity to the network to protect all control points.
This is not a simple problem, since there are many fragility vs security tradeoffs, as well as complexity cost concerns. If you have experience or thoughts around this area, and can commit to a few weeks of design and implementation work on this project, please indicate your interest. We'll assemble a small working group in the next few days and start discussions. I expect the working format will involve some virtual meetings, since email is not high bandwidth enough to hash out everything quickly.
Here's hoping we don't make it worse,
--Bart
_______________________________________________ PSDR mailing list PSDR@hamwan.org http://mail.hamwan.net/mailman/listinfo/psdr
_______________________________________________ PSDR mailing list PSDR@hamwan.org http://mail.hamwan.net/mailman/listinfo/psdr
participants (2)
-
Andrew Dickinson -
Nick Kartsioukas