Never underestimate the potential of a motivated attacker–or a hungry rabbit.
Fairly confident in my beefed up garden security, I entered my garden to commune with my plants. They probably would have preferred water, but I am an earthy kind of guy.
Not five steps into the garden, what did I find? A small, hairy and rather surprised looking rabbit was looking up at me, as if in disbelief that I had entered his compound. But this time was different. He had a mouth full of greens. Oh, yeah. Cold busted.
Being the more intelligent species, I had a stroke of genius rather interesting thought. I would close the gate and chase him around the garden. By blocking his exit, I would now know the exfiltration point.
I closed the gate and turned with a start, confident in my stature. I might have resembled Chuck Norris at that very moment.
Quickly, I darted toward the bunny. He dashed! I pursued. He circled the corn! I matched his gate like a, well, middle-aged geek chasing a rabbit around his over-engineered and under-producing garden.
He stopped. I stopped. We stared at each other for what seemed like an eternity, but must have been only three or five seconds. I heard a noise to my left. I quickly turned my head and turned it back to the intruder’s position. He was gone. In that instant, he had managed to teleport himself to the other side of the fence. I grimaced and admitted losing this battle, but not the war. He had escaped and most importantly, hidden his escape route.
So what’s the security lesson here? This is a security blog after all, and it’s only right that I throw in some kind of security fluff to justify my obsession with hungry rabbits. The lesson, my friends, is that breaches are never truly over. You may have recovered and gone back to business, but there may still be a subtle back door in your network. The information that was lost still has to be accounted for and damages repaired. The lessons learned only build on previous lessons learned and contribute to the overall improvement of your security program. The recovery and lessons-learned stages may be the final stages of handling an incident, but, to borrow upon a favorite phrase of mine, eternal vigilance is the price of security.