Re: Software vendor clueless

From: H Carvey (keydet89_at_yahoo.com)
Date: 08/17/03

  • Next message: Ken Eichman: "Increasing ICMP Echo Requests" 
    Date: 17 Aug 2003 17:06:04 -0000
To: incidents@securityfocus.com
    ('binary' encoding is not supported, stored as-is) In-Reply-To: <GFEFLNCAJHGGEBHHGMIBAEPDCAAA.kirt@futamatagawa.net>

    >Explain:
    >1) That the clients setup is very insecure for the
    following reasons
    > a) The admin password is too short
    > b) The admin password does not contain special characters
    > c) The admin password should be changed regularly
    >

    I fully agree with these recommendations, but they
    should also be considered in the context of the
    infrastructure. You must be prepared to answer the
    customer's questions regarding firewalls blocking
    ports, etc.

    >2) The current information security environment.
    VIGILANCE IS NO LONGER AN OPTION.
    >
    >3) Explain that the system involved is a client of
    both. Then explain that
    >the client's information security/safety should come
    first.
    >
    >4) Recap on #1. Highlight on #2 and repeat #3 until
    you make your point and
    >can move on.
    >
    >5) Candidly explain to the vendor that if a serious
    > security incident should occur, and the weak
    > password was the root cause, that the vendor could be
    > held legally liable.

    While this is a valid concern, some research should be
    done regarding the firewall settings. If the firewall
    blocks ports 139 and 445, then someone accessing the
    system may not be the most immediate concern. Also,
    investigation into the firewall rulesets should be done
    to ensure that the pcAnywhere connections are
    restricted to both source and destination IP addresses.

    >6) Explain to the customer that if privacy and
    financial information should
    >leak, the client could be held legally liable.
    >
    >7) Explain to both that a security 'incident' has
    already occured. Repeat #5
    >and #6 until you have made your point.

    Back the turnip truck up one second! What incident has
    occurred? If you're referring to the Exchange server
    set to being an open relay...what evidence do you have
    regarding this? Yes, there is significant risk
    associated w/ open relays, particularly if they're used
    to rely porno and/or spam. But what evidence is there
    to show that this change in the system is the result of
    an incident? Unless, of course, you're saying that
    someone accidently or unknowingly enabled relaying is
    the incident.

    >8) Then close the meeting with a remediation timeline.
    (This is the goal of the meeting!)

    It's always a good plan for a security professional to
    present options and a plan for resolution, rather than
    just problems. Take your customer solutions, not problems.

    Harlan

    ---------------------------------------------------------------------------
    Captus Networks - Integrated Intrusion Prevention and Traffic Shaping
     - Instantly Stop DoS/DDoS Attacks, Worms & Port Scans
     - Automatically Control P2P, IM and Spam Traffic
     - Ensure Reliable Performance of Mission Critical Applications
     - Precisely Define and Implement Network Security and Performance Policies
    **FREE Vulnerability Assessment Toolkit - WhitePapers - Live Demo
    Visit us at:
    http://www.securityfocus.com/sponsor/CaptusNetworks_incidents_030814
    ----------------------------------------------------------------------------

  • Next message: Ken Eichman: "Increasing ICMP Echo Requests"

    Relevant Pages

    • [REVS] Bypassing Client Application Protection Techniques
      ... Get your security news from a reliable source. ... protection programs. ... * Kerio Personal Firewall 4.0 ... And we got actually nothing in the field of client application ...
      (Securiteam)
    • Re: SBS 2008 - Firewall Appliance?
      ... Cisco ASA 5510 Appliance Content Security Edition Bundle ... 250 IPsec VPN peers, ... But "firewall services" are simply listed as included. ... If you don't need AV or VPN then this is overkill....and I recommend running client AV on a server that can handle monitoring anyways....not using an edge device as the client AV manager...but that's another conversation. ...
      (microsoft.public.windows.server.sbs)
    • Re: SBS2003 and XP SP2 (again!)
      ... Install XP SP2 on clients ... The Security Centre will be on, but the firewall can't be manually switched ... Right click Small Business Server Windows Firewall and Edit ... Had to reboot the client in question, ...
      (microsoft.public.windows.server.sbs)
    • Re: OT: An email triumph
      ... He can use it to build a little client application that you would run in ... gives him full remote control of your PC. ... What is the security like on this? ... through the firewall) and afterwards, I made sure he closed the hole again. ...
      (uk.tech.digital-tv)
    • Re: Systems behind NAT - port scanning etc.
      ... >>>Due to the upsurge in broadband, I encourage as many people as possible to go>>>to a router with NAT rather than a cable modem/soft client/ICS setup. ... Some people incorrectly say "it's a firewall"> because it blocks certain traffic. ... >> security device doesn't understand IP or security. ... A good consultant can explain things to a> client, in terms their little minds can comprehend. ...
      (comp.security.firewalls)
    Loading