Re: [fw-wiz] concerning ~el8 / project mayhem

From: Dave Piscitello (dave@corecom.com)
Date: 08/22/02 

From: Dave Piscitello <dave@corecom.com>
To: Anton J Aylward CISSP <aja@si.on.ca>
Date: Thu Aug 22 17:05:05 2002

At 02:22 PM 8/22/2002 -0400, you wrote:
>Indeed. So what you are saying is that the scanners are a crutch that
>lets you avoid raising your competency.

Not at all, and in fact, quite the opposite. Not certain if you're trying
to bait me here, but of course, there's a "let the tool help the lazy avoid
improving himself" aspect to scanners, but lazy is as lazy does. I'm not
lazy, and I find them useful.

They are tools. People with experience in one OS can get a jumpstart on
appreciating and learning the vulnerabilities of others.

The more useful ones not only identify vulnerabilities, but they provide an
explanation of the vulnerability. Many offer URLs to online documentation
explaining the risk, the nature of the vulnerability, exploits associated
with the vulnerability, locations where the vendor has posted the security
fix, service pack, whatever. I gather you've not used any of these?

>Perhaps you could compare it to
> - reading books with the term "hack" or "hackers" in the title
> (search amazon.com for examples...)

Personally, I think these books tell you more about how to be as clever as
the kiddies that attack systems than they do about improving security of
systems. I prefer the "securing foo" titles. But quality scanners educate
you in similar ways to such books, if you take the time to do more than
"recommended action: change registry value X to Y".

> - reading the vuln-dev mailing list

This is a good resource and very helpful when a scanner doesn't tell me
enough about the vulnerability to help me understand.

> - reading the LINUX source code

Oh, come down from the lofty perch...this is an entirely elitist
perspective. The ratio of people who must be engaged in securing systems
vs. those capable of evaluating whether source correctly bounds data
structures approaches infinity.

> - Following up on the Linux vendor advisories to see what changes they
> made to the source to overcome the problems mentioned in the
> advisories.
> - Trying to fix the problems in the advisories yourself then comparing
> with the published solutions

Begs the issue of having the skill to do this absent some additional
guidelines that some scanners do provide in a kinder, gentler step by step
manner than "read the F'in advisory and patch the source, or aren't you the
manly 'I grok Linux and C' type?"

> - Reading the CVE database

If the CVE entry is referenced in the scanner, is this sufficient?

> - Reading papers by Bhoem, Parnas, Hansen and the like (or perhaps
> "Software Tools") on good technique and comparing it with some
> published code.
> (Some of the 'open source' code is exemplary in its grotty-ness)

This is unfortunately a luxury for many daily ops folks. Have you run or
worked in a NOC?

>I don't drink beer, and besides, it doesn't pay the mortgage.

No, but I am guilty of frequently doing work out of friendship and I have a
charitable nature.

David M. Piscitello
Core Competence, Inc. &
3 Myrtle Bank Lane
Hilton Head, SC 29926
dave@corecom.com
843.689.5595
www.corecom.com

Relevant Pages

  • Re: Vulnerability Scanning Doesnt Work
    ... Vulnerability scanners are akin to AV. ... automated tool, but will probably wrap his/her methodology - into ... automation while being much more through than an automated tool. ...
    (Security-Basics)
  • Re: [WEB SECURITY] [TOOL] moth - vulnerable web application vmware
    ... I haven't had a change to look at what apps compose this test suites, ... Testing Web Application Security Scanners ... Giving an introductory course to Web Application Security ... For almost every web application vulnerability in existance, ...
    (Bugtraq)
  • RE: Views and Correlation in Intrusion Detection
    ... The biggest problem with VA scanners is determining what *really is* a ... > is to use distributed scanning (multiple, tiered Nessus scanners) so you ... > vulnerability scanner which determines vulnerabilities and topology ... Adjunct Information Security Officer ...
    (Focus-IDS)
  • Re: Vulnerability scanners dont work
    ... between the pen-test shop I recently left and Real Networks for a ... vulnerability in one of their products. ... Web Application Vulnerability Scanners ... If the service stops responding then the script ...
    (Security-Basics)
  • Re: Vulnerability scanners dont work
    ... between the pen-test shop I recently left and Real Networks for a ... vulnerability in one of their products. ... Web Application Vulnerability Scanners ... If the service stops responding then the script ...
    (Pen-Test)