{"id":5072,"date":"2018-02-18T20:11:06","date_gmt":"2018-02-19T01:11:06","guid":{"rendered":"http:\/\/www.carnaghan.com\/?p=5072"},"modified":"2019-10-02T11:50:55","modified_gmt":"2019-10-02T15:50:55","slug":"moving-target-defense-mtd","status":"publish","type":"post","link":"https:\/\/www.carnaghan.com\/moving-target-defense-mtd\/","title":{"rendered":"Moving Target Defense (MTD)"},"content":{"rendered":"\n

Organizations continue to struggle with policies and processes to effectively secure their infrastructure to protect their information assets and intellectual property. In recent years, we have seen the increase of cyber-attacks and breaches to the point that they have become common news worldwide. As systems have grown in complexity with increased capacity to store large amounts of data, so to has the appeal of targeting such systems by cyber criminals<\/span><\/span>. Traditional approaches of defense including signature-based detection, behavioral-based detection, and defense in depth<\/span><\/span> strategies are not enough to protect against advanced distributed attacks and zero-day attacks. Current technologies used to detect traffic, whether packet-based, time-based, or behavior-based, can provide some level of defense. Unfortunately, however as our tools and techniques improve, so too do the accuracy and advancements in sophisticated attackers.<\/p>\n\n\n\n

Some of the more sophisticated attacks include Advanced Persistent Threats (APTs) and Distributed Denial of Service<\/span> (DDoS). DDoS can cause a massive impact financially on an organization in terms of availability. A DDoS attack<\/span> by definition is an attack intended to cause a service to become unavailable or unusable (Desai, Patel, Somaiya, & Vishwanathan, 2016)<\/span>. They are sometimes referred to as SYN<\/span> Flood attacks, caused through exploitation of the TCP protocol<\/span>. The attacker sends a large number of TCP\/SYN<\/span> packets using a forged address. Because of this, the destination server<\/span> is unable to successfully establish a proper connection due to the source being unreachable. These types of attacks can also tarnish their reputation to the point of putting them out of business, or severely crippling operations. APTs on the other hand are security threats that use advanced techniques to hide their attack from the target. They are commonly used to target specific information in high-profile companies and governments. APTs usually follow a long-term strategy of attack in order to gather information from the breached system. One of the most complex APTs in recent years was the Stuxnet computer worm, which targeted Iran\u2019s nuclear program (Levi, 2012)<\/span>.<\/p>\n\n\n\n

One of the things that these two types of threats have in common is their ability to bypass traditional defenses by leveraging an arsenal of diverse and sophisticated cyber tools. Malicious actors can use networks of compromised and remotely controlled hosts, known as botnets, to execute a number of different cyberattacks and engage in criminal or otherwise unauthorized activities (Albanese, Jajodia, & Venkatesan, 2018)<\/span>. In order to meet these challenges head on, business organizations must adapt and implement a comprehensive defense strategy to combat threats that continue to evolve. Traditional security hardening measures have focused on reducing the size of the attack surface<\/span> (Zhuang et al., 2013)<\/span>. Topology-aware botnets maintain their stealth by using commonly placed detectors and architecture to their advantage in order to evade detection, while other types of botnet achieve resilience through anti-signature approaches.<\/p>\n\n\n\n

An emerging approach in cybersecurity called Moving Target Defense (MTD) has made a lot of impact in recent years as techniques continue to evolve. The idea behind MTD is analogous to that of having to reset a password every 90 day. The password that was being targeted has \u2018moved\u2019 or changed, further complicating the process for the attacker and better defending the user credentials. In an MTD strategy, attributes of the network become dynamic, instead of static, obfuscating the attack surface<\/span><\/span>. The concept of MTD was popularized in 2011 by Jajodia, Ghosh, Swarup, Wang, and Wang in their publication titled, \u201cMoving target defense: creating asymmetric uncertainty for cyber threats\u201d. Since then much research has taken place in this field and it continues to evolve. Newer technologies including container orchestration coupled with cloud platforms, enable and help drive innovation in building dynamically changing attack surfaces<\/span>. MTD essentially shifts the paradigm of an unfair asymmetric advantage that the attacker has traditionally had, to that the defender by creating uncertainty.<\/p>\n\n\n\n

<\/a>Moving Target Defense Research and Development<\/h2>\n\n\n\n

The premise behind Moving Target Defense (MTD) is that of a dynamic or constantly changing network in terms of configuration in order to increase the difficulty of intrusion as well as maintain illegally acquired privileges for long (Zhuang et al., 2013)<\/span>. While the concept of MTD has been around for several years, it is an emerging methodology that continues to break ground within the cybersecurity community. It provides a great deal of optimism for combatting more advanced threats and botnets by creating asymmetric uncertainty. There are three types of MTD, Network level, host level, and application level. Each of these are designed to dynamically move the attack surface<\/span><\/span> based on a number of configuration changes and are listed in the table below.<\/p>\n\n\n\n

<\/a>MTD Types<\/h3>\n\n\n\n
Network Level MTD<\/strong><\/td>\n
    \n
  • IP Hopping (Changing host IP address)<\/li>\n
  • Obfuscating Port Traffic through random assignment of port numbers, inflated number of non-valid ports<\/li>\n
  • Spoofing host information such as Operating System types and versions through random network services<\/li>\n<\/ul>\n<\/td><\/tr>
Host Level MTD<\/strong><\/td>\n
    \n
  • Changes to the host and Operating System level resources<\/li>\n
  • Changes to naming and configurations<\/li>\n<\/ul>\n<\/td><\/tr>
Application Level MTD<\/strong><\/td>\n