Re: Deutsche-Telekom sets the standard for network security! (??)

From: gr8matt (gr8rmatt@pacbell.net)
Date: 12/18/01 

From: "gr8matt" <gr8rmatt@pacbell.net>
Date: Tue, 18 Dec 2001 07:59:04 GMT

I am rather new to the entire security field (I became interested when I got
cracked) and find the whole "religious debate" quite amazing. I had no idea
that people were so hardcore (for lack of a better word) on security.

Several of you say that you report port sniffers almost every time. Are you
telling me that you go through and research each and every IP address that
sniffs your system? I am asking this in all honesty - not trying to be
sarcastic. I have only had a server up for 2 months now and get at least
5 - 10 hits a night. Do you have some type of script that sends an email
out or how do you handle all that traffic? I assume that you block IP's in
the hosts.deny file. Are there ranges that you block?

If your job is strictly security, I might be able to see being able to do
this. However, I have a two man shop and don't have enough time in the day
to get my regular duties done muchless track every port sniffer running a
script kitty.

Please tell me if you think I am off base here. The way it sounds, I may
need to focus more attention on what I considered to be "almost innocent"
sniffs.

Matt

Ian Jones <ian@dsl081-056-052.sfo1.dsl.speakeasy.net> wrote in message
news:m3vgf5p3kz.fsf@mobile.lan...
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
>
> This is not a religious debate, but it is often treated as one around
> here. Sometimes people (myself included) fail to put it in perspective.
>
> My take on it is that some sites/networks will be better off reporting
> EOI for a number of reasons, not least of which is to help justify the
> security department's existence. It can also help lay the groundwork
> for prosecution or justify the banning of particular networks and
> traffic types. In an altruistic sense you are helping everyone by
> putting your detects out there for others to correlate activity
> patterns with abusers. If you have the sensors and time why
> not...especially if it is your job. Not only that, it is fun!
>
> On the other hand, sometimes reporting everything is just plain
> stupid. If you can not possibly make a case for abuse given the
> information you can provide you had better take it easy when you
> report your events. If it is causing you more stress than damage you
> should probably consider filtering your data for actual incidents as
> opposed to detects...not everyone is obligated (or, ahem...qualified)
> to separated the wheat from the chaff. My best example of this is Code
> Red. It couldn't possibly hurt my computers except for making me spend
> time filtering noise. I only report the ones on my netblock to my ISP
> as a courtesy to the owners of those machines.
>
> -----BEGIN PGP SIGNATURE-----
> Comment: Keeping the world safe for geeks.
>
> iD8DBQE8HsKbwBVKl/Nci0oRAorTAJ4vLWgiHWz6lGsuIhGxuhvfaCeeggCgpELv
> om8y8DeMZwM8LTzcPcWSXus=
> =XrYe
> -----END PGP SIGNATURE-----

Relevant Pages

  • RE: what to do it illegal activity found during pen-test
    ... My initial thought was report it to the police ... designated in the contract at the start of the engagement. ... email you encrypt it using the public key of the security contact given to ... managed service can help you: http://www.cenzic.com/news_events/wpappsec.php ...
    (Pen-Test)
  • Portcullis Advisory 05-006 Update, Webseries Payment Application
    ... Portcullis Security Advisory ... Bottomline acknowledge that there is a slight risk of exposure of data ... via unauthorised report generation. ...
    (Bugtraq)
  • Foot and Mouth. The truth for America
    ... Homeland Security released June 20. ... "If DHS believes Plum Island is truly going to be significantly safer, ... foot-and-mouth disease - facts noted in the Homeland Security report. ... The only scenarios described in the report where an outbreak could ...
    (uk.business.agriculture)
  • Malicious Code On Rise: Web Sites Responsible
    ... In the first quarter of 2007, security firm Sophos ... day infected with so-called malware. ... The report was released during InfoSec, ... Sophos reported that 70% of infected websites were legitimate sites ...
    (comp.dcom.telecom)
  • London The PC Zombie capital
    ... Get breaking Security news straight to your desktop - click here to ... taken from Symantec's Global Internet Threat Report ... Symantec reckons the likely cause of this rise is down to the rapid ...
    (uk.telecom.broadband)
Quantcast