Re: Vulnerability Assessment

Hi Dave,

A final point is that concentric layers of protection have to be understood from a risk perspective; in that a vulnerability which requires local login to exploit, or physical presence (ALMOST ANY MACHINE) may be more or less at risk if the employees are trusted and trustable, and the physical access is more ore less controlled. In other words, if a Financial Server or Top Secret Server is running an MS Operating system (already a questionable practice <smile>), and is protected behind umpteen firewalls, AV, IDS/IPS, it may be more vulnerable if any joe could just walk up to it physically and do something like boot it up on CD (BackTrax it) or less vulnerable if there is no unauthorized physical access and the keyboard and monitor are controlled.

Your points before this one are well taken and I do hope some people learn from the DoS mistake of yours you mentioned.

Risk is a concept for choosing security and controls. Testing, however, is verifying to what level that security or those controls exist. To test, you don't make a risk assessment. Doing so would restrict your findings. You make a thorough test of everything within the business requirements, policy, regulations, etc. Remember, you're there to make sure they didn't forget anything. You can't do that if you're making the same guesses they are. That's why the OSSTMM can help you not miss anything.

In terms of analysis, where you need to trust employees or not, I think you make a good point about risk but it's the wrong thing to do. Even the most loyal employee can send the wrong mail by accident to the wrong person or be fooled into clicking on the phisher's link. You need to treat every interaction on the network as one of a business perspective where security provides a means to efficiency, less accidents, and a quicker reaction to mistakes. In that case it's not about who you trust inside or out but what you need to keep the business running efficiently. If locking down all the desktops means less help desk hassles (it doesn't) versus the cost of employee turn-over from unhappy employees, then make your decision that way. Not whether or not you trust Alice or Jack. If you really think we can make good trust choices as human beings, just watch a few daytime talk shows ;)

-pete.

------------------------------------------------------------------------
This list is sponsored by: Cenzic

Need to secure your web apps NOW?
Cenzic finds more, "real" vulnerabilities fast.
Click to try it, buy it or download a solution FREE today!

http://www.cenzic.com/downloads
------------------------------------------------------------------------

Relevant Pages

  • Re: Vulnerability Assessment
    ... IMHO, therefore, I prefer to list ALL the vulnerabilities but prioritize fixes based on my perception of the risk of that vulnerability being exploited in that environment. ... In terms of analysis, where you need to trust employees or not, I think you ...
    (Pen-Test)
  • Re: A repository changed its public key?
    ... so I don't fall in the trap to trust a key from some false contributor. ... At this moment the risk is more academic then real ... I is very well trained to do the same thing in Linux. ... As I do want to keep my internet name as much seperated as my real life ...
    (alt.os.linux.suse)
  • Re: Orphan Drug
    ... The fact that on a single occasion there was an adverse reaction that ... was serious does not mean that drug trials are *in general* ... We cannot evaluate every risk for ourselves, ... you place your trust in the professionals involved ...
    (uk.legal)
  • Re: My "Keepin it Real-o-Meter is in the RED!!!
    ... Making that leap of trust makes for a higher ... It's a risk though and most folks would prefer to be ... still carries risk you may not be able to afford if things go south. ...
    (rec.games.pinball)
  • Re: New Method for Authenticated Public Key Exchange without Digital Certificates
    ... No - use other processes to assess and reduce risk. ... certification and hence CA will ... PKI suck as a process to provide trust or confidence in ecomemrce. ... and a follow up phone call will result in a verisign cert ...
    (sci.crypt)