COI Report – Part VII Page 265 of 425 surface available for the attacker to pivot 61 in if one of the hosts on the network segment is compromised. 768. By contrast, a flat network infrastructure, while easy to manage, provides a greater prospect for malicious activity. Ina flat network, all servers and workstation are on the same local area network (“LAN”), which maybe unnecessary, as inmost cases, the systems have no reason to talk to or trust each other. The principles of least privilege and need-to-know should be used. If a host, service or network does not need to communicate with another host, service or network, it should not be allowed to. If a host, service or network only needs to talk to another host, service or network on a specific port or protocol, and nothing else, it should be restricted to that. Allowing open communication between hosts, services or networks, when it is unnecessary, offers multiple pathways for an attacker to pivot from one system to another, and allows malware to propagate across the network. 769. Gen. Alexander, Vivek, Richard, and Dr Lim have all recommended network segmentation as a means of limiting an attacker’s ability to move laterally in a network. In essence, according to these experts, network segmentation makes the attacker’s job exponentially more difficult it makes it much harder for an attacker to move laterally within a network as systems are not all interconnected. An attacker would have to exploit segments one at a time, resulting in afar longer time to compromise the network as a whole. The additional time it takes an attacker to break into a network is valuable time given to the defenders to stop the attacker from succeeding. 770. In fact, in the wake of the FY GIA penetration test, GIA too had recommended network segmentation, in the form of a separate management virtual LAN (“VLAN”) that should be established for administration access. This recommendation was made after the penetration testers observed that administrative access to critical infrastructure was possible from the employee Pivoting refers to the use of a compromised system to attack other systems on the same network.
|