offensive security

Offensive security is a proactive and adversarial approach to protecting computer systems, networks and individuals from attacks. Conventional security -- sometimes referred to as "defensive security" -- focuses on reactive measures, such as patching software and finding and fixing system vulnerabilities. In contrast, offensive security measures are focused on seeking out the perpetrators and in some cases attempting to disable or at least disrupt their operations.

At the RSA 2012 conference, Paul Asadoorian and John Strand presented methods that companies can use to frustrate would-be attackers, gather information about them, and cautiously retaliate without illegal actions. The men, both instructors at the SANS Institute, thought that their offensive methods for penetration testing could be used defensively.

Asadoorian and Strand recommend that companies place statements in likely network entrance points warning that anyone attempting to gain access will be subjected to an NAC-like check, which would inform the attacker that their machine data, IP and MAC addresses would be gathered.

The three components of Asadoorian and Strand's method are annoyance, attribution and attack. The annoyance component consists of frustrating the attacker's attempt through tools that establish false ports, services and directories. Once the attacker is lured into the false system, he ends up looping endlessly through it.

Attribution -- accurately identifying the attacker -- is important. One method, as Asadoorian explained, is to put a Web bug in sensitive documents. If the document is accessed, the Web bug sends back information about the system that accessed it.

According to Asadoorian, the attack component should only be an enhancement of the annoyance and attribution capabilities, rather than a truly malicious -- and illegal -- assault on the attacker.