Browse Definitions :
Definition

offensive security

Offensive security is a proactive and adversarial approach to protecting computer systems, networks and individuals from attacks. Conventional security -- sometimes referred to as "defensive security" -- focuses on reactive measures, such as patching software and finding and fixing system vulnerabilities. In contrast, offensive security measures are focused on seeking out the perpetrators and in some cases attempting to disable or at least disrupt their operations.

At the RSA 2012 conference, Paul Asadoorian and John Strand presented methods that companies can use to frustrate would-be attackers, gather information about them, and cautiously retaliate without illegal actions. The men, both instructors at the SANS Institute, thought that their offensive methods for penetration testing could be used defensively.

Asadoorian and Strand recommend that companies place statements in likely network entrance points warning that anyone attempting to gain access will be subjected to an NAC-like check, which would inform the attacker that their machine data, IP and MAC addresses would be gathered.

The three components of Asadoorian and Strand's method are annoyance, attribution and attack. The annoyance component consists of frustrating the attacker's attempt through tools that establish false ports, services and directories. Once the attacker is lured into the false system, he ends up looping endlessly through it.

Attribution -- accurately identifying the attacker -- is important. One method, as Asadoorian explained, is to put a Web bug in sensitive documents. If the document is accessed, the Web bug sends back information about the system that accessed it.

According to Asadoorian, the attack component should only be an enhancement of the annoyance and attribution capabilities, rather than a truly malicious -- and illegal -- assault on the attacker. 

 

This was last updated in November 2012

Continue Reading About offensive security

SearchCompliance
  • pure risk

    Pure risk refers to risks that are beyond human control and result in a loss or no loss with no possibility of financial gain.

  • risk reporting

    Risk reporting is a method of identifying risks tied to or potentially impacting an organization's business processes.

  • chief risk officer (CRO)

    The chief risk officer (CRO) is the corporate executive tasked with assessing and mitigating significant competitive, regulatory ...

SearchSecurity
  • encryption key

    In cryptography, an encryption key is a variable value that is applied using an algorithm to a string or block of unencrypted ...

  • payload (computing)

    In computing, a payload is the carrying capacity of a packet or other transmission data unit.

  • script kiddie

    Script kiddie is a derogative term that computer hackers coined to refer to immature, but often just as dangerous, exploiters of ...

SearchHealthIT
SearchDisasterRecovery
  • What is risk mitigation?

    Risk mitigation is a strategy to prepare for and lessen the effects of threats faced by a business.

  • fault-tolerant

    Fault-tolerant technology is a capability of a computer system, electronic system or network to deliver uninterrupted service, ...

  • synchronous replication

    Synchronous replication is the process of copying data over a storage area network, local area network or wide area network so ...

SearchStorage
Close