Re: Going meta (was RE: [fw-wiz] Ok, so now we have a firewall...)

From: Dave Piscitello (dave_at_corecom.com)
Date: 06/02/05

  • Next message: Devdas Bhagat: "Re: [fw-wiz] preventing XSS and SQL injection?" 
    To: "Marcus J. Ranum" <mjr@ranum.com>
Date: Thu, 02 Jun 2005 17:35:52 -0400

    If you want to minimize compromise, increase accountability.

    Anecdotal evidence from companies I've observed doing a good job
    securing networks and systems leads me to conclude that improving
    security is a lot like raising children, esp. teens (I have two, lead
    youth mission trips but would not claim to be an authority merely an
    observer of many situations with positive and negative outcomes).

    Given broad choices, little direction, and no consequences, teens are
    more likely to choose poorly. Sounds like a "that which is not
    prohibited is permitted" policy, doesn't it? But the key that I think
    we continue to overlook is that even the practice most list-readers
    here believe is better - that which is not expressly permitted is
    prohibited - is incomplete.

    Where's the accountability and consequence in this policy?

    Why don't we start adding quantitative consequences when we murmur
    our favorite security mantra?

    "that which is not expressly permitted is prohibited

    AND

    1) "the consequence of intentionally doing what is prohibited is
    termination of employment"

    2) "the consequence of repeatedly unintentionally doing what is
    prohibited is also termination (you are too {stupid | impulsive |
    slothful } to be employed here)"

    3) "..."

    (Marcus has been quite creative on occasion regarding consequences so
    he can fill in 3) and beyond).

    I'm not being whimsical here. We live in a society where 70% of
    people willingly revealed their usernames and passwords for Cadbury
    bars. If exposing your organization to attack from an authorized
    account is only worth a few bucks. If folks worried that they might
    never taste chocolate again, well, maybe security might improve

    Google "Low-Tech Password Cracker: ChocolateApril 20, 2004")

    On 2 Jun 2005 at 13:36, Marcus J. Ranum wrote:

    > I am totally sympathetic to the plight of the security
    > practitioner who isn't willing to put his job on the line
    > by telling the CTO he's a moron. I completely understand
    > why people feel they need to compromise. But I still
    > think compromise is for sissies.

    _______________________________________________
    firewall-wizards mailing list
    firewall-wizards@honor.icsalabs.com
    http://honor.icsalabs.com/mailman/listinfo/firewall-wizards

  • Next message: Devdas Bhagat: "Re: [fw-wiz] preventing XSS and SQL injection?"

    Relevant Pages

    • Re: Your Opinion +
      ... and RealNetworks regarding Windows Media Player back in 2003, lets say for discussion, MS now turn around and offer up their 'Security Applications' for free. ... Those things aren't even usually called "security software" -- for example, use of Mozilla-based browser makes Windows desktop more secure not because Mozilla-based browsers are designed as "security software" but because it allows the user to not use Internet Explorer, and it contains less, shorter living or easier to avoid vulnerabilities than the product it replaces. ... Software that runs on potentially compromised computers looking for signatures, altered files, inconsistent responses from system interfaces and other evidence of compromise. ...
      (Bugtraq)
    • Re: recommended Virus Scanner?
      ... > This is totally piling on, but given this recent security compromise, ... you don't need to worry about viruses for GNU/Linux. ... - Yes, security matters. ... - The Debian project compromise, ...
      (Debian-User)
    • Re: Root toolkits on Windows
      ... There are a number security issues with NTFS. ... but this class of tools is by no means a new threat. ... compromise, and how to respond when an exploit occurs. ... Currently the web browser is the #1 tool for exploitation. ...
      (alt.computer.security)
    • Re: Defeating Firewalls: Sneaking Into Office Computers From Home
      ... >> the majority of Residential users of ISP. ... some business services that some of the lamer ISP's provide to ... > some cases where this kind of security is necessary, ... a compromise and places the networkat risk. ...
      (comp.security.firewalls)
    • Re: KDC Hardware
      ... both need _extra ordinary security_ so it's easier to ... has a complete copy of the Kerberos database, including the keys for every ... Recovering from such a compromise requires issuing new ... EVEN IF THE KDC IS SHUT DOWN. ...
      (comp.protocols.kerberos)