from Hacker News

The NSA's worst nightmare

by cws on 2/17/16, 9:07 PM with 12 comments

• by runn1ng on 2/17/16, 9:47 PM

  I am not an expert on network security and I have no idea what "out of band network tap" means... If I read it right, the article is saying that in order to have a secure network, you should monitor what is going on in it and detect anomalies, ok?

  That's a good point, I guess.

  (however, the blog is on a page of a company, that seems to me to be selling network monitoring devices.)

• by molecule on 2/17/16, 10:29 PM

  > The out-of-band network tap that Joyce describes is exactly what a product like ExtraHop delivers.

  ...

  > Well? Can you see those intrusions, and see where they try to go next? Do you have the visibility into the East-West traffic that Joyce describes as being so crucial to stopping advanced, persistent threat actors from exploiting you?

  > ExtraHop can give it to you. Our platform auto-discovers and classifies every device, every interface, and every application that touches your network, and can observe and analyze ever transaction in real time. We give you all the information you need to stay one step ahead of anyone who might be trying to break into your network.

  > Read our security operations use cases or try our free demo to see how.

  This reads like an advertisement.

• by nickpsecurity on 2/18/16, 12:10 AM

  I disabled taps in the past because they were directly connected to the line and predictably ran Linux or BSD. High assurance field long solved this problem with one technique: one-way links (data diodes). They dont physically allow the monitor to write the network.

  So, definitely use taps. Just use them with one way cables on air gapped machines. Dont trust OS or router-level isolation against High Strength Attackers.

  Note: Does anyone know if this one uses a one-way cable? I didnt delve into details too much.

• by jostmey on 2/17/16, 9:35 PM

  Is this what the top brass at the NSA fear the most, or what the developers working behind the scenes fear?

• by tsupasat on 2/18/16, 12:37 AM

  I think what the "worst nightmare" comment really meant was observation/monitoring that they (the NSA) could not disable. Hackers can turn off logging or even exploit monitoring agents as an attack vector (the Target breach a couple years used BMC agents as an attack vector). However, if a copy of all the network traffic is being passively analyzed by a monitoring appliance, then there's no way that they can hide from that or turn it off.