15

I have found some social networking sites that focus on sharing architecture (network maps and diagrams) and configuration.

Does sharing this type of information decrease the security of my network?

Examples:

The idea of setting this site up was not to make it possible for people to vote on the "look" of a network diagram. The purpose of this site is to allow people to learn about computer networking and network documentation by seeing what other people have done with their networks

or this site:

Network Documentation .com provides free online resources and tools to network professionals regarding network documenting, diagramming, and management.

or this social network site:

Make a flow chart, org chart, mind map, network diagram, UML diagram, wireframe and other drawings online with Lucidchart's free flow chart creator and ...

saber tabatabaee yazdi
  • 1,038
  • 5
  • 16
  • 26

3 Answers3

14

If I am attacking a network, having a map helps me target my attack, avoiding possible sensors, honeypots etc and aiming at high value targets or sources of information.

This can speed up an attack immensely, reducing the defender's chance of preventing it.

In summary, yes this is a security risk!

Update:

To reduce risk, some steps you can take are:

  • remove addresses, function titles etc
  • only include sections of the network
  • post under an anonymous profile
  • include fake network sections
Rory Alsop
  • 61,367
  • 12
  • 115
  • 320
  • 1- is there any way to publish our maps with fake profile? that no one can know me? 2- if you decide to publish your network , which elements of your map is more secure and should delete or modify them before publish? – saber tabatabaee yazdi Dec 04 '12 at 08:46
8

Security by obscurity isn't security and so, in theory, knowledge of the network shouldn't make a difference, but being that there are often known issues and that being able to avoid traps helps avoid detection, it is important to ensure that the map is not identifiable or discoverable to a would be attacker of your infrastructure.

That said, there is also a lot to be gained by independent review of your network. There is a reason that fully disclosed algorithms are trusted more (if they hold up) than proprietary closed algorithms. Collectively, people as a whole are smarter than you and many eyes will catch things you miss. Sharing a properly annonymised network map can find holes that would have allowed an attacker in before an attack actually occurs.

Ultimately, as with all things in security, it is a balancing act. Limit your risks while increasing both usability and security, balance those two sides based on the level of risk that is acceptable.

AJ Henderson
  • 41,816
  • 5
  • 63
  • 110
  • I have to disagree with your original premise. Some amount of security is provided by obscurity, but the sentiment is that you shouldn't rely on obscurity alone for security. If you are provably secure, obscurity doesn't matter, but there are always weakness somewhere. – Bradley Kreider Jan 25 '13 at 20:08
  • @rox0r - it is true that obscurity increases difficulty, but it doesn't provide security. You have know way to know if that knowledge is held by your attacker or not and no way to approximate how much effort it may or may not take for them to determine it, thus you have no additional security because of the obscurity. It really comes down to how you define security. When your designs are secret, you have one defender against many possible attackers. When they are public, you have a chance for other smart people to find errors and level the playing field a bit. – AJ Henderson Jan 25 '13 at 20:44
  • @rox0r - there may be exceptions, but generally, if the advantaged gained from obscurity is higher than the disadvantage of not having additional review, something is probably off. That's not to say that secrecy isn't important in some cases. Concepts like honeypots don't work if the honeypot is easily known, so from a detection point, those parts should be more carefully guarded and at least some changed regularly (though you have to be careful not to let someone know what they are by having them change more than the real network as well.) – AJ Henderson Jan 25 '13 at 20:46
  • I agree with your conclusion that review is normally much more valuable than obscurity. I'm just saying using obscurity as a layer can definitely increase security. Obscurity doesn't provide any hard security guarantees, but it can provide real world benefits. – Bradley Kreider Jan 25 '13 at 23:05
6

While there is probably some risk in exposing your network diagram to outsiders, I will asssert strongly that there is enourmous risk is concealing your network diagram from insiders. Usually when I see the security through obscurity policy implemented it has a far larger impact on legitimate insiders than outsiders.

An outsider can firewalk your network if they want to, and there is effectively no penalty for doing so. An insider who is not permitted to see the network diagram cannot discover the network diagram without danger of losing their job. Insiders who can't see the network, can plan, can't advise, can't help predict and resolve problems. Other people have pointed out independent review; I'm talking about review by your partners; people who, if they could see the network diagram, would immediately spot that they'll need a firewall change on these three devices, or that siting the application in this DMZ rather than that DMZ would be much easier. That doesn't mean you immediately yield to their desires, but it does mean that you have the discussion from teh standpoint of two partners who want the business to succeed, rather than beginning on an adversarial footing.

MCW
  • 2,572
  • 1
  • 15
  • 26