 original message from crispin cowan mailto crispin wirex com sent wednesday september NUMBER NUMBER NUMBER NUMBER pm to ben mord cc webappsec securityfocus com secprog securityfocus subject re use of base image delta image for automated recovery from attacks ben mord wrote original message from crispin cowan mailto crispin wirex com sent wednesday september NUMBER NUMBER NUMBER NUMBER pm to ben mord cc webappsec securityfocus com secprog securityfocus subject re use of base image delta image for automated recovery from attacks ben mord wrote my proposed solution to the first two problems you mention is to be less ambitious the idea is that you never commit instead you simply revert to base state on reboot ah in that case you can use something considerably less powerful than vmware all you need is a machine configured to boot from cd rom and use a ram disk for scratch space numerous linux distros are available that let you boot a stateless but functional system from cd rom but ram is expensive and the directory structures of many systems e g windows are not sufficiently organized and standardized to make this combination of bootable cds and ram drives practical even if you are fortunate enough to be using linux or another fhs compliant nix you still can t fit a lot on a cd its not unusual today to have gigabytes of static multimedia content on the web server this particular problem can be alleviated somewhat by using dvds but this is a temporary solution at best which will become outdated quickly as our data requirements grow and hard drives become cheaper obviously you can t do this with partitions that accrue important state e g a partition that stores database table data but if you do want some state to persist then you need a mountable writable partition to protect it you need some kind of access control management to decide who can do what to the writable partition blah blah blah and before you know it the security problem starts to look just like it does for conventional servers right this is why you would consolidate all state of any long term significance on just a couple partitions and why you would not put static application code on these changeable partitions fortunately most large client server application physical architectures do this anyhow because these are two fundamentally different kinds of state with two very different sets of administrative security raid and backup requirements people also tend to do this anyhow because layered logical architectures are popular with the gui at one end business logic in the middle and persistence services at the other this logical architecture maps naturally to a physical architecture that has a static web server a static application server and a database server that has static and changeable partitions i use the word static versus changeable instead of writeable versus unwritable because the unchangeable partitions might be written to for temporary swap space who knows what windows does internally my point is that there should be a market out there for a hardware raid device that can split designated partitions into a permanent base image partition and a temporary delta image partition that has some simple but solid security measures to prevent the unauthorized remote modification of base images and that can be configured to clear the delta image when the server is rebooted if some vendor wished to implement this they could then market this as a mechanism to help frustrate broad classes of attack that rely on the permanent modification of system or application files via buffer overflows platform and middleware bugs etc the prevention of unauthorized modification of application data of course would not be addressed by this particular product but there are many other techniques out there to defend application data but those techniques all assume that your system itself has not been compromised at a lower level which is where this product could help i would have to think that these features would be relatively easy for a hardware raid vendor to implement i m just guessing of course with no knowledge of how hardware raid works internally if anyone knows of such a product i d love to hear about it ben 