It's all about buffer space--a disposable safety net with a redo button. If they "own" a dozen machines between them and their target, they can attack with the confidence that only a cyborg in a time machine could ever gather enough info to snag them--only a handful of organizations have the manpower or expertise to catch intruders who leave no trail. Attack, clean, reattack--and gain as much net space as possible.

Auditor? Cracker? Strung-out administrator? The roles can be interchanged and the distinction blurred, with one exception: The crackers have the easiest task. They need find only one open doorway; the defenders must check every lock.

"It takes one to know one" may be cliché, but it holds up in the network security arena. Understanding how attackers operate is invaluable--in fact, it's your best defense. The concept of "hacking" into your own network for security purposes isn't new. Dan Farmer published a paper in 1995 entitled "Securing Your Site by Breaking Into It" (www.fish.com/security/admin- guide-to-cracking.html). Network Computing published a similar article a few years ago (see "Intrusion Detection Provides a Pound of Prevention" at www.networkcomputing.com/815/815ws1.html).

Many of the time-tested security principles still hold true. However, attackers' tools and talent have taken giant leaps. Each time security products mature, so do attack methodologies, and if you fall behind on either, you're setting yourself up for a nightmare.

Cracking Some Myths
Before we even think about sitting down in front of a computer, let's debunk some common assumptions about crackers and excuses for reduced vigilance.