Re: [Patient] Requested Feedback - Protecting Endpoints

[Bret Jordan <[e-mail]>]

Pat,

These are excellent points.  

Bret


> On Dec 14, 2017, at 08:54, Patrick Maroney <[e-mail]> wrote:
> 
> Brian,
> 
> Per your request for comment*:
> 
> I'm glad to see this discussion.
> 
> Having directly observed nation state adversaries enjoying the benefits of "legitimate" channels, there's an oft overlooked aspect of the dichotomy of secure channels.
> 
> An adversary controlling an endpoint may simply wait for establishment of a secure channel (with strong Multi-factor Authentication from the legitimate user/application) to the target endpoint to obfuscate their presence, activities, and objectives.  The strongest secure channels can be exploited - giving all of the advantages of same to the adversary.  Though typically the case for many tunneling attacks, the adversary does not need interactive command and control of the initiating endpoint.  They merely need to be able to sense/test the state/existence of the secure channel to execute "store and forward" command and control.
> 
> 
> Patrick Maroney
> Principal Engineer - Data Science & Analytics
> Wapack Labs LLC
> [phone]
> [e-mail] <mailto:[e-mail]>
> 
> Public Key: http://pgp.mit.edu/pks/lookup?op=get&search=0x7C810C9769BD29AF <http://pgp.mit.edu/pks/lookup?op=get&search=0x7C810C9769BD29AF>
> * "If you get a chance, please read the v00 Internet Draft which we just posted to IETF ( https://www.ietf.org/id/draft-witten-protectingendpoints-00.txt <https://www.ietf.org/id/draft-witten-protectingendpoints-00.txt> ) then send a quick comment, like "hate it," "love it," "glad to see the discussion," or (apparently popular) "why you hate the IETF" type comment to [e-mail] <mailto:[e-mail]> mailing list."
> 
> _______________________________________________
> PATIENT mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/patient