Investigating survivability of configuration management tools in unreliable and hostile networks

A configuration management system (CMS) can control large networks of computers. A modern CMS is idempotent and describes infrastructure as code, so that it uses a description of the desired state of a system to automatically correct any deviations from a defined goal. As this requires both complete control of the slave systems and unquestioned ability to provide new instructions to slaves, the private key of the master is highly valuable target for attackers. Criminal malware networks already survive in hostile, heterogeneous networks, and therefore, the concepts from those systems could be applied to benign enterprise CMSs. We describe one such concept, the hidden master architecture, and compare its survivability to existing systems using attack trees.