Vendor notification

From: Susan Bradley, CPA aka Ebitz - SBS Rocks [MVP] (sbradcpa_at_pacbell.net)
Date: 03/30/05

  • Next message: Susan Bradley, CPA aka Ebitz - SBS Rocks [MVP]: "Re: Vendor notification" 
    Date: Wed, 30 Mar 2005 12:13:45 -0800
To: incidents@securityfocus.com

    Just a question...on your security incident checklist is there a step
    for vendor notification? Example secure@microsoft.com for Microsoft
    products.

    Like for example on this list... when you report something unusual here
    ...is there a point in time that reporting it to the security department
    of Redhat, SuSe, Microsoft, etc. would be a valid exercise?

    I find sometimes that it's on these listserves that are the first
    'indicators' of issues and that vendors will grab these threads and
    emails and pull in a case that should have had vendor notification much
    earlier.

    I've seen this happen twice personally to me where a email thread that I
    spotted got the attention of a vendor and when the poster was contacted
    they hadn't even thought it was worthy enough to report it to the
    vendor, yet in reality it was.

    At what point do you notifiy? Do you have criteria for notification?
    [heck do you have the vendor email contacts listed on your incident
    checklist?]

    Susan

    http://www.redhat.com/security/team/contact/

    Microsoft TechNet Security - Microsoft Security Response Center PGP Key:
    https://www.microsoft.com/technet/security/bulletin/pgp.mspx 

    -- 
Chapter 4 of The Complete Patch Management Book: 
https://www.ecora.com/ecora/jump/pm149.asp
So why is it the only book on NT Event Logging is out of print?
http://tinyurl.com/3kwc2
And if you don't know about www.eventid.net You should!
  • Next message: Susan Bradley, CPA aka Ebitz - SBS Rocks [MVP]: "Re: Vendor notification"

    Relevant Pages

    • Re: [fw-wiz] Security dumming down - the kings clothes
      ... >page index or their security index which goes back to Nov. 25. ... >great lengths to avoid criticizing the vendor in question. ... Even you avoided naming Microsoft, ... point about marketing bullsh*t applied to computer security. ...
      (Firewall-Wizards)
    • Re: Security newbie: how to get test certificates?
      ... > effective for evaluating both the vendor, ... I do know that Verisign at one time provided test certificates. ... > that might give you a good foundation would be Network Security Essentials ... Microsoft offers coursework on ...
      (microsoft.public.sqlserver.security)
    • RE: Security newbie: how to get test certificates?
      ... effective for evaluating both the vendor, ... I do know that Verisign at one time provided test certificates. ... that might give you a good foundation would be Network Security Essentials ... Microsoft offers coursework on ...
      (microsoft.public.sqlserver.security)
    • Re: September 2003, Cumulative Patch - Possible Warning!
      ... Microsoft Outlook, Microsoft Outlook Express, and ... Support Services Security Team is issuing this alert to advise customers to ... Please contact your Antivirus Vendor for additional details on this virus. ...
      (microsoft.public.security)
    • [NEWS] Wonderware SuiteLink Denial of Service Vulnerability
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Get your security news from a reliable source. ... Vendor Information, Solutions and Workarounds ... Core sends the advisory draft to Wonderware support team. ...
      (Securiteam)