full-disclosure - Avoiding being a good admin - was DCOM RPC exploit (dcom.c)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

From: salgatt at turtleshell.net (Scott M. Algatt)
Subject: Avoiding being a good admin - was DCOM RPC
 exploit (dcom.c) 

There are other methods of doing patches as well.  I know of one company,
PatchLink, that does a deployment.  You simply install the client software
on a system and then it checks into the master server.

configurations such as those could help reduce the maintenance cost of
patching.  The up front cost of the software and configuration is costly
but after that you are running smooth.

This is a software that we recently deployed and it is working great.  We
are able to see what patches haven't been applied to certain machines.  We
have our machine split into groups, automatic and manual.  This allows for
the onsite administrator to decide when they want to patch.

Regards,

Scott M. Algatt

Behold the turtle. He makes progress only when he sticks his neck out.

On Tue, 29 Jul 2003 Valdis.Kletnieks@...edu wrote:

> On Tue, 29 Jul 2003 10:52:19 EDT, Jason <security@...enik.com>  said:
>
> > $15,600 * 83 = $1.3 million in lost time patching
> >
> > Compared to the very conservative 4 million lost otherwise?
> >
> > Add another million to the 1.3 mil to hire contractors and you still
> > save almost 2 million.
>
> $1.3M to patch MS03-023.
> $1.3M to patch MS03-026.
> $1.3M to patch MS03-030.
>
> Now you're up to $3.9M, and only saving $100K. *MAYBE*.  And if there's
> another advisory, there goes another $1.3M.  If there's 4 advisories a year,
> it actually makes financial *SENSE* to just say "screw it" and accept the
> fact that there will be a yearly worm-and-patch-everything party.
>
> Maybe there's a *REASON* that IT security is underfunded - the cost/benefit
> doesn't work out for the business....
>