Re: FW: *ICN - A Conspiracy of Inertia?

From: Michal Zalewski (lcamtuf@coredump.cx)
Date: 03/19/02 

Date: Tue, 19 Mar 2002 12:23:56 -0500 (EST)
From: Michal Zalewski <lcamtuf@coredump.cx>
To: Benjamin Tomhave <falcon@cybersecret.com>

On Mon, 18 Mar 2002, Benjamin Tomhave wrote:

> Has anybody else heard about this? It seems to uphold a principal that
> I've tried to consistently apply throughout my security career --
> working with known quantities whenever possible and configuring systems
> to only accept those known quantities. Even if the software is
> ficticious, it represents the possibility for a paradigm shift from the
> perspective of IDS, among other things. Thoughts?

Don't see a new paradigm here, really. The fact that current attacks are
very often not subtle does not imply it is possible to build a formal
model of "acceptable" behavior and reject everything else to prevent all
sorts of attacks. It will surely stop most obvious ones, but so what? It
gives you little added security and severely impairs functionality, boosts
deployment costs. It is used right now in certain mission-critical
applications.

It is a question of acceptable security-to-functionality ratio. For most
systems, it is fairly low. Flexibility decreased ten times, deployment
costs increased 100 times is not the way for a typical webserver owner to
get rid of "most obvious attacks" - having a good sysadm is probably much
better. The guy is coming from the world of very well founded, carefully
developed (sometimes for years), precisely defined single-purpose systems
that do not evolve over time and are supposed to do very specific tasks
and nothing else. And yes, if you have a very specific critical database
installation, enormous funds, lots of time and so on, you should and
probably will build a custom, well-controlled system with very strong
execution flow control and so on and so on. But most of us do not live in
such reality, and most of people want programs featured, flexible, cheap
and delivered fast. It is the market, not the vendor conspiracy. The
comment I noticed, "This guy simply has no idea how big and stupid the
world is" probably summarizes my feelings about it pretty well. 

-- 
_____________________________________________________
Michal Zalewski [lcamtuf@bos.bindview.com] [security]
[http://lcamtuf.coredump.cx] <=-=> bash$ :(){ :|:&};:
=-=> Did you know that clones never use mirrors? <=-=
          http://lcamtuf.coredump.cx/photo/

Relevant Pages

  • Re: Pelosi & Reid Will Not Like Progress Cited in Iraq Quarterly Report
    ... This is from 4 pages, less than 10 percent, of the report. ... Reid has called General Petraeus a liar for saying progress had been made in Iraq, and more recently he has called Petraeus and outgoing chairman of the Joint Chiefs,Marine Gen. ... Assessment of the Security Environment— ... the frequency and intensity of attacks on the ...
    (soc.retirement)
  • Re: Pelosi & Reid Will Not Like Progress Cited in Iraq Quarterly Report
    ... This is from 4 pages, less than 10 percent, of the report. ... Reid has called General Petraeus a liar for saying progress had been made in Iraq, and more recently he has called Petraeus and outgoing chairman of the Joint Chiefs,Marine Gen. ... Assessment of the Security Environment— ... the frequency and intensity of attacks on the ...
    (soc.retirement)
  • Re: Cracking WEP and WPA keys
    ... SecurityFocus wi-fi security mailing list. ... >>802.11G PCMCIA card, and the Linux server was running Samba to talk to ... >>Audit your website security with Acunetix Web Vulnerability Scanner: ... Cross site scripting and other web attacks before hackers do! ...
    (Pen-Test)
  • RE: Vulnerabilites in new laws on computer hacking
    ... This damages all security professionals. ... Vulnerabilites in new laws on computer hacking ... "advanced societies" will have no clue about how remote computer attacks ...
    (Bugtraq)
  • RE: Pen-Test and Social Engineering
    ... "see...your network security is penetrable". ... Audit your website security with Acunetix Web Vulnerability Scanner: ... Hackers are concentrating their efforts on attacking applications on your ... Up to 75% of cyber attacks are launched on shopping carts, forms, ...
    (Pen-Test)