Rats in the security world

Rats in the security world
Mark Burnett, 2005-06-30

Not too long ago my wife and I decided to try out a Chinese restaurant in our area we had never visited before. I was looking at the menu and my wife gasped, then laughed a bit. I looked up and she pointed out a rat crawling right under the restaurant's buffet table.

Colapse all | Post comment

Rats in the security world 2005-07-01
Richard

A couple more 'rats' to add to the list;

1) Servers with excess baggage. Do you really need a media player, web browser and 3d gaming support library installed on your server by default? More surface area may mean a bigger target.

2) Field techies with domain admin or full directory tree rig...

[ more ] [ reply ]

Rats in the security world 2005-07-01
Anonymous

Very nice article, I think you bring up many good points, but you were wrong on one stance about irc not being encrypted. Almost all irc clients support ssl for irc encryption....

[ more ] [ reply ]

Rats in the security world 2005-07-04
Alexey Vesnin

Quite right! Everywhere - in real or virtual world - there is a lot of ghosts, old-fashioned standarts and conceptions. This business world is unready to realize, that they are responsible for something else than billing us for another security patch. It's not matter, that the patch they offering yo...

[ more ] [ reply ]

Were all in it together? 2005-07-04
Anonymous (1 replies)

Someone please tell that to microsoft.

what do they have against open source/protocols anyway?...

[ more ] [ reply ]

Re: Were all in it together? 2005-07-05
Alexey Vesnin

What the Microsoft or another huge software companies have against an OpenSource? Just three things - money, big money and really big money. Big companies, who've already placed their spot in software market, becoming idle and unchanging. They're so stone-brained, that they can't even realize that s...

[ more ] [ reply ]

Rats in the security world 2005-07-04
David Sutton (SecurityPost.net)

Having just spent 4.5 yrs of our lives building a secure recorded delivery email system to kill off that particular brand of rat, we find that a significant number of people today seem so all too used to rats. It?s only when someone comes down with a nasty (and public) dose of the bubonic plague tha...

[ more ] [ reply ]

Rats in the security world 2005-07-05
Anonymous

I don't believe Email can be changed overnight. You would need to convert every ISP! Not to mention all clients who need to support it. It just doesn't work that way. Otherwise, why doesn't everyone switch to IPv6 overnight?...

[ more ] [ reply ]

Email encryption 2005-07-05
Anonymous

If people want it, it's there. Has been for years. Encryption, by its very nature, needs to be done at the endpoints, so all you really need to get encrypted transmission and encrypted storage is to get people to use something like PGP or S/MIME. There seems to be very little demand for such thin...

[ more ] [ reply ]

Open Source Security Information Database 2005-07-05
Brennan

You talked of the need for an open source security information database. Such a thing already exists, and it is quite stellar.

http://www.osvdb.org/...

[ more ] [ reply ]

What is the purpose ..?... 2005-07-05
Anonymous (2 replies)

I see no purpose in helping others with there security models. Do we simply help the weak so they can compete with the strong.. I like cracking the stack and finding procedural errors..
Secure OS, maybe it is not simply the OS, but the Admistrators that we laugh at.. I started crashing ISP's now i ...

[ more ] [ reply ]

Re: What is the purpose ..?... 2005-07-06
Anonymous

Using your analogy, we should not have to pay taxes to fund the public school system. Those with the Money can pay to educate their children, and those without, well, they become our servants.

That is akin to NOT sharing security information. If we don't teach everyone how to do it, then it won...

[ more ] [ reply ]

Re: What is the purpose ..?... 2005-07-07
Alexey Vesnin

Cracking - it's a tax for they stupidity. Nothing more - and nothing less. the person who can't crush and destroy something will NEVER be able to administer or protect it. There's no one-sided swords, you're right. I've seeked and used code mistakes too - now I'm making a security solutions and perf...

[ more ] [ reply ]

Encryption 2005-07-05
PT Barnum (1 replies)

Encryption is not idiot proof. IOW until people who dont live and breathe technology can use it, it'll never reach critical mass. The presentation is far behind the amount of research and development put into making the technology as robust as it is.

The reason SSL "works" as a product/servic...

[ more ] [ reply ]

Re: Encryption 2005-07-07
Alexey Vesnin

Yes, people often like tha sense of security itself, rather than makin a sense what it is to themselves... SSL lock in a browser - it's a semi-automated procedure for 'em, they just need to go to the link they've wrote in their notepad. Until there won't be a sense of mechanisms and methods of secur...

[ more ] [ reply ]

Rats in the security world 2005-07-05
Dalibor Straka (1 replies)

I kindly disagree with a lot of things mentioned in the article. You can develop and implement the best rules for drivers, but they'll crash and crash and crash again until they know how to drive.

99% of spam comes from hacked OSes by spam worms. Not because of SMTP. I like FTP and telnet for its...

[ more ] [ reply ]

Re: Rats in the security world 2005-07-07
Alexey Vesnin

admin is ALWAYS the one who was hacked... Installed latest( and not yet debugged enough ) patch without hardware security devices? wrote TOO open firewall policy? Got exploited with your cheap software firewall? .... And where was your mind, when you've developed and implemented the server - from dr...

[ more ] [ reply ]

Rats in the security world 2005-07-06
Anonymous

This article strikes me as a rant, especially the second page where you just spew 2-3 sentence long "justice" on what you feel indignant about.

Once again, people need to be reminded that there is a balance to be struck between security and usability. You can't just lock up the castle and throw a...

[ more ] [ reply ]

Encryption 2005-07-08
Anonymous (1 replies)

It'll be awfully hard to inspect all that encrypted traffic. Just keep in mind - you've got to be able to inspect traffic. Then there's the CPU cycles to keep it humming. It takes a lot of umph to encrypt everything.

Best,

Richie...

[ more ] [ reply ]

Re: Encryption 2005-07-09
Alexey Vesnin

You're right - it'll cost you a lot of CPU resources. But remember, that there's a special device for special purpose - encryption is one of the oldest tasksk in IT world. And there's a lots of hardware encryption cards, some NIC's even have an encryption chip on 'em... Use proper devices for your p...

[ more ] [ reply ]