RE: [fw-wiz] Vulnerability Response (was: BGP TCP RST Attacks)

From: Dave Piscitello (dave_at_corecom.com)
Date: 05/27/04

  • Next message: cs 2004: "[fw-wiz] Problem with Cisco VPN client behind a NATed Netscreen" 
    To: "Marcus J. Ranum" <mjr@ranum.com>, "Ben Nagy" <ben@iagu.net>, "'Claussen, Ken'" <Ken@kccweb.com>
Date: Thu, 27 May 2004 09:29:45 -0400

    At 06:30 PM 5/26/2004 -0400, Marcus J. Ranum wrote:
    >Ben Nagy wrote:
    > >there are two evolving solution spaces that solve real problems. Host
    > based vulnerability mitigation
    >
    >The big problem with host based anything is that the management effort
    >scales with the number of hosts.

    Agreed. Done in a vaccuum, host vulnerability assessment illustrates how
    poorly you are configuring and maintaining your hosts. Moreover, if
    vulnerability mitigation is addressed per host, based on scanning results,
    you have to question whether you ever achieve uniform security policy. But
    don't you think you can manage risk better if you mitigate by central
    policy definition and patch management? I've used the CIS security tool
    (includes HFnetchk) and templates one-off with both MMC plug-in and local
    policy editing. This is hours per computer, and does not scale even in my
    home office. But if you use a template and push a configuration from a
    central policy server to all clients, it's more efficient, and uniform.

    > > and anything that allows an organisation to condense and
    > >prioritise information about where they are exposed to known vulnerabilities
    > >in realtime.
    >
    >Asset management, change control, and security workflow are all
    >good, yes. Condensing and prioritizing is just part of it. I'm not
    >at all convinced that it's enough. After all, if you condense and
    >prioritize the "must fix: disaster" list for many companies you'll get
    >a list so long that they'll decide to do something else, instead.
    >Anything else, in fact. :)

    Perhaps initially, but this is a systemic problem, no? Anyone with kids
    knows the "clean the room" syndrome, and security operations are like
    parents with lots of messy children. Each child does little or nothing for
    a long long time, until the only way to clean his or her room is to
    literally empty it and restore order and cleanliness. But if the effort to
    establish the baseline is followed by more disciplined administration and
    housekeeping, the must fix disaster list is shorter, and more suitable to
    prioritization.

    >"None of our users would accept that kind of solution!" they cried.

    If this attitude is pervasive, then the client wasted your time and spent
    their money unwisely.

    >Therein lies the rub.

    Hamlet, Act III,
    "To die, to sleep; To sleep, perchance to dream-there's the rub;...

    >You *think* host-based vulnerability mitigation (what *is* that,
    >by the way? it sounds like marketing...) is going to work. But
    >that's just because not enough users have TRIED it enough to
    >figure out how to politically sandbag it, yet. But don't worry, they
    >will. Remember, users are supposed to be running host-based
    >antivirus, too. :P

    Curmudgeon factor is high today, eh Marcus?

    _______________________________________________
    firewall-wizards mailing list
    firewall-wizards@honor.icsalabs.com
    http://honor.icsalabs.com/mailman/listinfo/firewall-wizards

  • Next message: cs 2004: "[fw-wiz] Problem with Cisco VPN client behind a NATed Netscreen"

    Relevant Pages

    • CERT Advisory CA-2002-12 Format String Vulnerability in ISC DHCPD
      ... The Internet Software Consortium provides a Dynamic Host ... have not seen active scanning or exploitation of this vulnerability. ... NSUPDATE allows the DHCP ... significant impact on your normal network operations. ...
      (Cert)
    • CERT Advisory CA-2002-12 Format String Vulnerability in ISC DHCPD
      ... The Internet Software Consortium provides a Dynamic Host ... have not seen active scanning or exploitation of this vulnerability. ... NSUPDATE allows the DHCP ... significant impact on your normal network operations. ...
      (Cert)
    • RE: More on VMWare poor guest isolation design
      ... Microsoft why a vulnerability that discloses physical paths is a big enough ... but they needed to know the physical path first. ... especially if you are not a full administrator on the host machine. ...
      (Bugtraq)
    • [NT] Kerio Personal Firewall Denial of Service Vulnerability
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Kerio Personal Firewall 2.x.x for the Windows platform contains a Denial ... This vulnerability allows an attacker to cause ... the host to hang-up and to cause its CPU utilization to jump to 100%. ...
      (Securiteam)
    • Re: SourceFire RNA
      ... So the active probe actually did its job well. ... > system that relied solely on this information for vulnerability management. ... MSRPC packets there is a good reason for that. ... Also, if a host changes ...
      (Focus-IDS)