Re: [fw-wiz] Top Secret DOD Data over the Public Internet? Thoughts?

From: Kevin Sheldrake (kev_at_electriccat.co.uk)
Date: 08/20/04

  • Next message: Bill Royds: "RE: [fw-wiz] NAPT - NAT Port selection" 
    To: "Gary Flynn" <flynngn@jmu.edu>, firewall-wizards@honor.icsalabs.com
Date: Fri, 20 Aug 2004 16:31:35 +0100

    Personally, I would think their greatest threat would come from
    availability attacks. I'm sure they would use appropriate cryptography to
    protect the confidentiality and integrity but DOS attacks on such a
    network could be quite easy:

    1) classic flood attacks, including reflected and zombie attacks, could be
    targetted at their points-of-presence. While the location of these could
    be kept reasonably secure from the general public (using obfuscated domain
    names and unlisted ip addresses, for example), I would expect spotting
    their traffic would be a reasonably simple task for another intelligence
    agency.

    2) Bearing in mind they would essentially use cryptography to maintain
    integrity, continuous packet modification by an intermediary could
    effectively kill a connection (as could some malicious RST packets).

    3) Points of attack could be where their packets utilise portions of the
    Internet in aggressive countries, or at ISPs and core network services
    should an employee be 'purchased' by an aggressive intelligence agency.

    In terms of confidentiality, whereas the packets may be protected
    in-transit, utilising the Internet would essentially mean they would need
    a crypto-gateway between the Internet and their Top Secret networks. This
    must be a major concern for them as compromise of these gateways could
    cause all sorts of upset. I would expect them to only utilise in-house
    products for this service.

    And, for everyone else, you may wish to bear these risks in mind when
    implementing VPNs across the Internet for your commerical customers. Yes,
    the risk to commerical customers is lower (generally because the attackers
    are less well equiped and commercial companies are literally one in a
    million), but they should be considered nonetheless. Particularly
    prominent companies could find their worldwide operations stiffled as fax
    and phone replaces securish email between offices in the event of a decent
    sized attack.

    Just some thoughts...

    Kev

    >
    > http://www.gcn.com/vol1_no1/daily-updates/26971-1.html
    > 

    -- 
Kevin Sheldrake MEng MIEE CEng CISSP
Electric Cat (Bournemouth) Ltd
-- 
Outgoing mail is certified Virus Free.
Checked by AVG Anti-Virus (http://www.grisoft.com).
Version: 7.0.262 / Virus Database: 264.6.4 - Release Date: 19/08/2004
_______________________________________________
firewall-wizards mailing list
firewall-wizards@honor.icsalabs.com
http://honor.icsalabs.com/mailman/listinfo/firewall-wizards
  • Next message: Bill Royds: "RE: [fw-wiz] NAPT - NAT Port selection"

    Relevant Pages

    • Re: Password scrambler program
      ... No one is helped or interested in cryptography that only protects against uninterested and unfunded passers-by. ... Cryptography as much as is possible, resists attacks and attackers who will spend time and money trying to break the system, who don't do the expected and don't play by the rules. ... The software fails at the very first hurdle. ... This program protects you from other people who may have access to your computer by generating them for you with a secure random number generator and protecting those passwords with encryption relying on you needing to remember only one, hopefully better, password and adding to the protection with password stretching. ...
      (sci.crypt)
    • Re: Password scrambler program
      ... No one is helped or interested in cryptography ... environment is harsh but criticisms are not generally personal attacks. ... software fails at the very first hurdle. ... them for you with a secure random number generator and protecting those ...
      (sci.crypt)
    • Re: [PATCH resend][CRYPTO]: RSA algorithm patch
      ... I'd rather code to the PKCS#1 RSA Cryptography Standard ... if not using constant-time crypto implementations) and not ... and combined attacks can give enough information. ... in security there is always a threshold, ...
      (Linux-Kernel)
    • Re: New cryptanalysis book coming out!
      ... Why all of the venom in your hatred-filled email response? ... information about the process of finding attacks. ... required in an extremely basic introductory class in cryptography, oh yeah, ... primary sources are always better than the at least secondary and ...
      (sci.crypt)
    • RE: SYN Attacks - how i cant stop it
      ... # control how network packets are handled after IPFW or IPFILTER ... these MIB. ... # To defend against SYN attacks more commonly known as SYNFLOOD ...
      (freebsd-questions)