The first thing that struck me about Mr. Mitnick's article was the prolific use of "possibly", "probably", "maybe", and "might have"...only to have him sum it up by saying only Microsoft and the "hacker" know what really happened. The last thing we (the public, as well as the security community) need is yet another media source promulgating the confusion associated with this incident.

The only things we really know are that (a) SOMETHING happened, and (b) for all of the information and "best practices" available from the Microsoft Security site, Microsoft itself doesn't seem to have a policy for dealing with events such as these. This last one is odd...given that Microsoft is pushing an ASP certification that includes just these measures (as well as others, of course).

I applaud Mr. Mitnick for echoing a common mantra (that for some reason, still doesn't seem to be very well understood outside of the security community) about "protecting valuable information assets" from "physical, technical, and personnel security threats".

[ reply ]

Link to this comment: http://www.securityfocus.com/comments/articles/112/3796#3796