A strong random number generator doesn’t make a network defence safe. That was the finding Zach Saunders took to ESORICS, the European Symposium on Research in Computer Security, in Rome in September. It’s one of Europe’s leading security research conferences and has run since 1990. The amazing week away more than made up for the long journey over to Italy. In this blog Zach shares insights into his presentation and travel to Rome.
The hidden weakness in network defence
My paper, Strong Entropy, Weak Guarantees: Governance Failures in Distributed Moving Target Defence, grew out of my Master’s thesis at the University of Auckland. I was supervised by Aniket Mahanti and wrote the paper with Parimala Thulasiraman and Ying Ying Liu of the University of Manitoba.
Moving Target Defence (MTD) keeps changing parts of a network, such as host addresses, so an attacker can’t build a stable picture of it. That only works if each change is properly random. Most people assume a cryptographically secure random number generator takes care of that. My work shows it doesn’t.
The problem appears once a system runs across several replicas (copies of the same service). How randomness is coordinated between them matters as much as its quality. I found five ways that coordination fails. The worst is silent failure: the system keeps running on weak randomness and nothing tells you.
That makes it a governance problem as much as a technical one. Someone has to own how randomness is set up, coordinated and monitored. To address this I built DEAD (Dedicated Entropy Assurance Daemon). In testing, it cut cross-replica collisions, where copies pick the same value, from more than 70% to zero, and it caught every silent failure.
Sharing the research and looking ahead
I presented the paper to a room of security researchers, nerves and all, and it is one of the things I am proudest of from the trip. Attendees told me afterwards that the work is important in a niche area that remains under-represented in research. We now plan to develop the paper into a submission to a high-quality security journal, which will introduce DEAD v2.0, a more resilient release of the service, and address the reviewers’ feedback. I also want that version to set out more clearly why the work matters and where it fits in the wider field.
Cybersecurity is about more than technology
My session chair, Tooska Dargahi, and I later talked about how security governance and policy matter more as technologies such as AI make attacks more complex. The wider programme ranged from securing AI systems to cyber-physical security, smart grids and drone security, with adjacent talks on governance and privacy.
AI, hardware security and what stood out
Two keynotes stood out given how quickly AI is being built into systems that now need defending. Atul Prakash (University of Michigan) spoke on *Advances and Challenges in Securing AI-Based Systems*, and Adrian Perrig (ETH Zürich) on *Secure and Predictable High-Performance Connectivity for AI Training and Inference*. Emiliia Geloczi’s *PUF the Magic DRAmGON* was another highlight, repurposing Rowhammer, best known as an attack on DRAM, as a physical unclonable function for persistent storage in volatile memory. Hardware security papers like this often get less attention but are some of the most interesting work in the field, and the presentation was very engaging.
A little Rome and a lot of gratitude
I also managed to make the most of my time between sessions by visiting a few of the city’s attractions, including the Colosseum. This wouldn’t have happened without the incredible support of my friends and family, along with the team at Axenic, whose sponsorship got me to Europe. Thanks so much for your support.
Zach Saunders