Network Attacks and Exploitation

Chapter 3The Defender

I really didn't foresee the Internet. But then, neither did the computer industry. Not that that tells us very much of course—the computer industry didn't even foresee that the century was going to end.

—Douglas Adams, author, The Hitchhiker's Guide to the Galaxy

The defense is routinely overworked and outgunned. If you lock the doors to your home, you may feel safe against potential thieves, but you also know that those locks won't keep out an army squad backed by a battalion. Nor are you particularly concerned about that kind of military threat, at least not in the United States. Yet, in terms of resources, that is exactly what a network defense is up against: a well-trained group of 7 to 10 individuals directly supported by hundreds, and indirectly supported by thousands.

It's not a fair fight, but is it more than just numbers? Answering this requires understanding the nature of defense. And just like the Attacker, the defense is guided and restricted by the principles of CNE.

Principle of Humanity

I have used the word target liberally to refer to the targeted network, data, or the people administering and using that network, but the Defender has no such ambiguity. The Defender consists solely of the people actively or passively preventing the Attacker from completing any portion of the operational life cycle. (As with the Attacker, the Defender warrants a proper noun to emphasize the human element.)

Some aspects of the defense are human themselves: ...