Re: [fw-wiz] PCI DSS & Firewalls

Interesting thread.

The reality is that companies have not followed best practices in terms of
network and internet services.

Over and over in my 17 years in security people whining for the next unsafe
app, protocol, etc have won out over sound security.

Not to mention poor design practices that put ring 0 devices on the edge
rather than in a tiered design.

How many companies have the payroll and money transfer machines located so
any user can touch them, both physically and logically.

How many bandaids has the so called security industry come up with to
compensate for poor practices. E.G. The clueless demand a PIX so we need an
IDS and whatever other protocol aware device.

Good design and having the balz to say no goes a long way in keeping
environment simple and secure.

As far as testing, some is needed but the ill informed would assume that a
successful PT means you are OK. Not to mention 9 times out of 10 the
testers exploit low hanging fruit - lets be real here we are dealing with
the soft chewy core of M$. Add distributed offices and physical security
weakneses into the mix and successful attacks, for the determined, becomes a
cake walk.

Also as far as PCI standards and all other regulations is, I believe, the
anount of interpretation that is allowed. Try defining scope under PCI,
very ambiguous.

Tony Miedaner
eroc emit eno

-----Original Message-----
From: firewall-wizards-bounces@xxxxxxxxxxxxxxxxxxxxx
[mailto:firewall-wizards-bounces@xxxxxxxxxxxxxxxxxxxxx]On Behalf Of
Brian Loe
Sent: Sunday, April 05, 2009 1:50 AM
To: Firewall Wizards Security Mailing List
Subject: Re: [fw-wiz] PCI DSS & Firewalls


On Fri, Apr 3, 2009 at 3:36 PM, Paul Melson <pmelson@xxxxxxxxx> wrote:


At the end of the day, offensive security (scanning, pen-testing,
auditing,
etc.) is testing.  And some testing is ALWAYS better than no testing.
 Show
me a company that doesn't require testing before moving a system into
production and I'll show you a company that can afford lots of downtime.

And I'll show you every company I've ever worked for - including the
one that's handling your prescriptions and likely the one handling
your 401k.

Then again, I guess it depends on what you call testing. If it means
"it turns on, given expected input it returns expected output" then
never mind - you're "safe". Otherwise you're living as big of a make
believe world as Marcus. And as everyone knows I'm quite the realist!

Then again I'm also the manager who, while trying to get an updated
security program approved by the "IT Steering Committee", removed the
part about certification and accreditation for new systems because,
frankly, if you're our size it's stupid and overly costly. What I
would VERY MUCH LIKE is a "checklist" like the first set of
instructions I got for (well, it's late and I can't remember the
acronym - and it's since been changed anyway - DoD crap)....

I prefer a standard tell me EXACTLY what it want as a minimum and then
my midldle management idiot self can busy myself doing BETTER than
that standard...
_______________________________________________
firewall-wizards mailing list
firewall-wizards@xxxxxxxxxxxxxxxxxxxxx
https://listserv.icsalabs.com/mailman/listinfo/firewall-wizards

_______________________________________________
firewall-wizards mailing list
firewall-wizards@xxxxxxxxxxxxxxxxxxxxx
https://listserv.icsalabs.com/mailman/listinfo/firewall-wizards

Relevant Pages

  • Re: Another opinion on using extreme programming for security
    ... that it forbids all practices that are not explicitly ... security, then the security requirement should be stated. ... Extreme Programming is not fundamentally different from other ... You still do design; you just continue to refine the design ...
    (SecProg)
  • Re: [Full-Disclosure] DCOM RPC exploit (dcom.c)
    ... ** The r00t of the problem is a failure to follow best practices from ... > server; security HAS to come second to that. ... > As for how many are protected - not enough, which is again a cost issue. ...
    (Full-Disclosure)
  • RE: MBSA and MSs attempts at "security"
    ... > the end make us all more secure and make for better software design. ... MS doesn't intentionally create security problems. ... Best Practices would dictate that MS ...
    (Focus-Microsoft)
  • Re: Another opinion on using extreme programming for security
    ... it difficult to argue with any of these practices from a security ... The argument against XP and security appears to be something like "if you ... even if you do design it all up front, you'll still run into issues along ... Another opinion on using extreme programming for security ...
    (SecProg)
  • Re: Access Control Best Practices for shared hosting seem at odds with Web Site Starters
    ... The practical implementation of security measures is an exercise for the ... reader -- but best practices is not. ... With respect to DotNetNuke and the Community Server, yes, these are not ... > permissions because the app requires it or I use an Access database. ...
    (microsoft.public.inetserver.iis.security)