Mike McCarty wrote:
After a machine has been compromised, IMO it must be restored
to a pre-compromise state. Trying to mitigate damage on a
compromised machine is wrong-headed.
Mike,
I agree that compromised systems should be "fixed" so they aren't
compromised anymore. However, I don't agree that it is "wrong-headed"
to attempt to mitigate the damage done to such a system. Things like
fire doors that close automatically when a fire is detected mitigate the
damage a fire can do to a building. Traction control and anti-lock
brakes on vehicles attempt to keep the car from crashing once stability
is compromised. The firewall that contains a car's engine compartment
and the airbag that deploys if the vehicle crashes both attempt to
mitigate the damage done to the driver if something goes wrong. Even
white blood cells protect against pathogens that have breached the
external defenses of our bodies in an attempt to mitigate damage to
surrounding tissues.
None of the mechanisms I have just described work as expected 100% of
the time but that is hardly reason to do away with any of them
entirely. As I'm sure you're aware, any good security posture has
"defense in depth" as part of its scheme because it is historically a
bad idea to rely on a single mechanism for overall security. SELinux
may not the best solution out there but it does serve a very important
purpose - it mitigates system damage in order to preserve as much of the
remaining system as possible. I don't think anyone would argue that it
makes sense to let someone who hacks a web server also get control of
the credit card numbers stored in a database on the same machine.
Likewise, with all due respect, it doesn't make sense to assert that
trying to stop bad guys from doing all the damage they could is the
wrong philosophy. That would be like watching your entire home burn
down from a fire on the stove because you feel the fire extinguisher,
something that would minimize the fire damage, is somehow
philosophically wrong.
Tom
