Network defense that moves the attacker's target

A new cybersecurity appliance prevents hackers from being able to conduct reconnaissance and move laterally within a network.

Cryptonite’s CryptoniteNXT, which launched Oct. 26, is based on research funded by the Defense and Homeland Security departments into Moving Target Defense, which DHS defines as a way to increase complexity and uncertainty for attackers by “controlling change across multiple system dimensions."

Delivered as a hardware appliance, CryptoniteNXT takes away hackers' visibility into a network, making attacks more difficult and expensive.

It changes an endpoint’s view of the network into a dynamic, abstract structure, by "taking over how IP addresses are issued to the endpoints,” Cryptonite CEO Mike Simon said. That turns a once-static network into a moving target.  It then maps the "obfuscated" network to the real one so legitimate traffic can flow normally across the network, but hackers' east-west, or lateral, movement between endpoints is cut off.

“We enable any network to actively shield itself from cyberattacks by preventing reconnaissance,” an initial source of cyberattacks, Simon said.

CryptoniteNXT issues IP addresses on a temporary basis. As long as a session is active, a legitimate user has a Cryptonite token. But “as a hacker, if I come back later and try to use that temporary address as part of planning and executing an attack, that will not work,” Simon said. In fact, if someone tries post-session to access those temporary addresses or the IP address that was in place before CryptoniteNXT was installed, the tool will trigger an alert.

“It will be an extremely high-value alert because we’ll know that someone was trying to [access] IP addresses they should not be,” Simon said. That alert goes to an organization's security information management program  within 30 seconds of the event occurring. It shows which user and IP source the address request came from, eliminating the need for the IT team to sift through network flow data or end-point analysis to determine the source of the problem, he added.

The appliance address three gaps identified by the National Institute of Standards and Technology’s Cybersecurity Framework, according to Simon. The first is protection. The guidelines ask agencies to install tools that would enable them to investigate and follow attack paths to track down the source. Using Moving Target Defense, CryptoniteNXT Net Guard stops attacks at the endpoint by mapping from the obscured network to the real one, enabling legitimate traffic to flow across the traditional network infrastructure.

The other two gaps are in detection and response. CryptoniteNXT detects blocked attempts by compromised endpoint to access other applications and resources and issues alerts. “We’re telling you whether someone attempted to access something outside of segmentation policy and/or someone tried to access or address IP locations outside of what they’re able to do,” he said. “As soon as that comes into the SIM, you realize … they’ve already been blocked. You don’t have to worry about immediately investigating, but you know it was likely one of two things: a malicious attacker or a misconfiguration.”

Agencies don’t need to change anything about their existing infrastructure to make CryptoniteNXT work, Simon added. “Our approach was no software runs on endpoints, no software runs on servers,” he said. “We can use your existing switching equipment. We’re not going to make you change out anything." Once the product is installed, he said, "immediately, without any configuration, the protection of reconnaissance data starts.”

There’s also no effect on end users because everything happens in the background. For instance, CryptoniteNXT uses FreeRADIUS, which will interact with RSA tokens or another two-factor authentication mechanism, and users will never know Cryptonite is there.

Network performance is a big concern for agencies when they add monitoring tools, but “we operate in some cases faster than the existing network,” Simon said. “That doesn’t mean there isn’t any latency. It means the latency in our device is very similar to another switch … in the network. Users don’t see any latency other than a normal device added to the network.”

Right now, Jason Li, vice president of network and security at Intelligent Automation, which spun off Cryptonite, is working with the Defense Information Systems Agency and DHS on a pilot deployment of CryptoniteNXT. He and a colleague were part of the original research into Moving Target Defense and identified the fundamental problems with existing cybersecurity, namely the ease of reconnaissance and lateral movement by hackers.

It has applications beyond DHS and DOD, he added. “This technology is universally applicable to all enterprise networks,” Li said. “We have totally changed the asymmetric nature of cybersecurity from the attackers have the upper hand to now the defenders have all the upper hand. That’s huge.”

Out of the gate, the company has several customers in the government, manufacturing, energy and internet of things markets, and Simon said he’s working on building more business.

“This has been much needed. We’re approaching cybersecurity from a perspective that is in the hackers’ court. We’re giving them the advantage, and a lot of what we create is simply to track them down,” he said. “We need to be focused more on a defensive platform posture, and stop hackers vs. letting them into our networks.”