Your Network Architecture Now on e-Bay for $9.95

Stateless infrastructure and highly dynamic networks may eliminate this issue.

There is great awareness in both consumer and corporate culture with respect to data and second-hand markets. We know that data stored on devices of all shapes and sizes can be a potential source of sensitive information loss if not carefully eliminated before sale or disposal. But consider, too, the potential value of picking up a second-hand switch or router from e-Bay that has not been carefully wiped of all configuration data.

ACLs, routing tables, VLANs, comments. These configuration details are often left on infrastructure even as the devices are put out to pasture and sold on the secondary market. These configuration details hold a wealth of information that can provide insight into the architecture of your organization, and make it much easier for attackers to piece together a successful plan of attack in penetrating your defenses.

A switch formerly used by the UK's air-traffic service which still held networking configurations and passwords has been sold on eBay, raising security concerns.

The £20 Cisco Catalyst switch was bought by security consultant Michael Kemp, co-founder at Xiphos Research Labs, who quickly discovered that it has been used at the National Air Traffic Services (NATS) centre in Prestwick. Data on the switch included supervisor credentials, internal VLAN and other networking configurations and upstream switch addresses as well as domains, gateways and syslogs.

-- Network Switch Bought on eBay Contained Air Traffic Control Data

Decoupling services from IP addresses eliminates topological-based configuration that can lead to the discovery of a path through your defenses to your data.

Imagine that instead of routing and processing decisions being triggered by traffic arriving on a port that some piece of data inside the traffic triggered the execution of the proper policy, including where the next “hop” in the network should be. Essentially, dynamically building the path through the network based on the content rather than on static, preconfigured paths.

Not only would you be able to switch out pieces of infrastructure at any time without disruption, you’d be able to more efficiently process data based on what it is rather than on how the network is connected. Because you’d be making decisions in real-time, changes to the network – especially in cloud computing environments leveraging virtual network components – would have minimal if any impact.

In its most basic form, this was the vision of Infrastructure 2.0; of a highly dynamic network in which decisions were made intelligently and in real-time rather than based on static network designs of the past. The usefulness of such a stateless architecture, however, goes far beyond simply managing volatility in highly virtualized architectures. Eliminating static configurations addresses what is possibly an albeit esoteric security risk, but it is a risk that exists (obviously) nonetheless. Similarly, the inability to scale a network via configuration to meet the demand of a carrier-class environment is challenging, especially as enterprise-class data centers continue to expand and grow to the point that they are as unwieldy as their carrier-class counterparts.

Stateless infrastructure has the potential to address many of the obstacles that stand in the way of the truly dynamic, self-directed network necessary to support the data center of the future.

Published Dec 07, 2011

Version 1.0

dynamic infrastructure

infrastructure

infrastructure 2.0