Way to Go Joanna
Still, she worries that security technology and research is too prevention-oriented and doesn't emphasize detection enough. "The whole industry is focusing on prevention, and we have all those anti-exploitation technologies, which are very helpful indeed. But I'm so surprised that no one cares about detection," she says. "Every time there's prevention, there is some bypass method" created.
Without detection, there's no way to know if an attacker has grabbed administrative access to a machine, she says. And if you can't see that an attacker has infiltrated the system, nothing in that system will be "reliable" anymore. "The scary part is that once an attacker [gets] into the system, we can't reliably read system memory, neither using software-based, nor hardware-based, methods. That means we can't answer the question of whether the system is clean or not," she says. (emphasis added)
Wow. I am so pleased to read someone of Johanna's caliber stressing the need for detection. I have been working on slides for ShmooCon and I plan to talk about this very subject, and you probably know I've been saying for years that prevention eventually fails. Her comment about reliability of evidence relates to my TaoSecurity Pyramid of Trust, where I mentioned Johanna with respect to her techniques to defeat memory capture.
Comments
Now I know Joanna is most likely stating this from the point of view of commercial applications, which in itself answers the question of "why aren't we seeing detection"? And from the perspective of most users/IT shops, the push is for vendors to produce prevention products, because that means once something's prevented, the incident is done and over with, and no more work is required. Any detection product is going to point you to a problem, requiring additional time and resources to investigate. Until senior management starts taking security and IR more seriously, there won't be a push for detection.
Harlan
http://windowsir.blogspot.com
http://hackathology.blogspot.com/