Securing the Virtual Environment: How to Defend the Enterprise Against Attack, Included DVD

Chapter 2

Attacking from the Outside

You can't be an outsider and be successful over 30 years without leaving a certain amount of scar tissue around the place.¹

—Rupert Murdoch

I would never join a club that would have me as a member.

—Groucho Marx

Computer security, as explained in Chapter 1, is all about managing risk. There are no guarantees from controls that a perimeter will be secure or that attacks will be thwarted. Mitigating risk depends on a set of controls, which tend to be built into a barrier with an inside and an outside. This chapter reviews where and how controls work in order to address the risks found most often in a virtualized environment.

Who Is an Outsider?

Many books have been written on the concept of an outsider, not least of all The Stranger by Albert Camus. A simple explanation, for the purposes of this book and security in a virtual environment, is that an outsider is someone unknown and untrusted. The outsider becomes an insider when he becomes “known.” You can determine whether a person is an insider or an outsider through one or more factors. An insider might be identified because he has something. He also might be identified because he is something or knows something. The outsider, conversely, can be defined as someone who lacks trust because he does not have some or all of the factors you require for verification; he is a stranger.

One's origin could be a route to becoming an insider (for example, clubs only accept locals). But the outsider has ...