Comments on: Integrated Application Security Logging? http://www.thummy.com/roodee/2007/06/14/integrated-application-security-logging/ My Wrong Opinions.. Thu, 08 Jan 2009 19:47:10 +0000 hourly 1 http://wordpress.org/?v=3.2.1 By: roodee http://www.thummy.com/roodee/2007/06/14/integrated-application-security-logging/comment-page-1/#comment-2256 roodee Thu, 14 Jun 2007 21:04:22 +0000 http://www.thummy.com/roodee/2007/06/14/integrated-application-security-logging/#comment-2256 Yes, I agree. I wanted to ensure that there was no confusion about the shortcomings and difficulty of building security instrumentation into applications for the purpose of detection and/or prevention. Sure it can be done and works perhaps in many cases any yet there is this uneasiness with that solution because it is so tightly coupled to the application. Yes, I agree. I wanted to ensure that there was no confusion about the shortcomings and difficulty of building security instrumentation into applications for the purpose of detection and/or prevention. Sure it can be done and works perhaps in many cases any yet there is this uneasiness with that solution because it is so tightly coupled to the application.

]]> By: Richard Bejtlich http://www.thummy.com/roodee/2007/06/14/integrated-application-security-logging/comment-page-1/#comment-2255 Richard Bejtlich Thu, 14 Jun 2007 20:45:47 +0000 http://www.thummy.com/roodee/2007/06/14/integrated-application-security-logging/#comment-2255 Hello, I'm glad you liked my post. Did you read this part? <em>So why isn't security application instrumentation sufficient? The problem is one should not place one's trust entirely in the hands of the target. One of Marcus Ranum's best pieces of wisdom for me was the distinction between "trusted" and "trustworthy." Just because you trust an application doesn't make it worthy of that trust. Just because you have no alternative but to "trust" an application doesn't make it trustworthy either. Trustworthy systems behave in the manner you expect and can be validated by systems outside of the influence of the target.</em> For most of my career my mechanism for determining whether systems are trustworthy has been network sensors. That's why they sit at the top of my TaoSecurity Enterprise Trust Pyramid. In a host- and application-centric world I might consider a second system with one-way direct memory access to a target to be the most trusted source of information on the target, followed by a host reporting its own memory, then other mechanisms including application state, logs, etc. You can't entirely trust the target because it can be compromised and told to lie. Of course all elements of my trust pyramid (or any trust pyramid) can be compromised but the degree of difficulty (should) increase as isolation from the target is achieved. Hello,

I’m glad you liked my post. Did you read this part?

So why isn’t security application instrumentation sufficient? The problem is one should not place one’s trust entirely in the hands of the target. One of Marcus Ranum’s best pieces of wisdom for me was the distinction between “trusted” and “trustworthy.” Just because you trust an application doesn’t make it worthy of that trust. Just because you have no alternative but to “trust” an application doesn’t make it trustworthy either. Trustworthy systems behave in the manner you expect and can be validated by systems outside of the influence of the target.

For most of my career my mechanism for determining whether systems are trustworthy has been network sensors. That’s why they sit at the top of my TaoSecurity Enterprise Trust Pyramid. In a host- and application-centric world I might consider a second system with one-way direct memory access to a target to be the most trusted source of information on the target, followed by a host reporting its own memory, then other mechanisms including application state, logs, etc.

You can’t entirely trust the target because it can be compromised and told to lie. Of course all elements of my trust pyramid (or any trust pyramid) can be compromised but the degree of difficulty (should) increase as isolation from the target is achieved.

]]>