lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Mon, 24 Nov 2008 03:23:28 +0000 From: "disco jonny" <discojonny@...il.com> To: Valdis.Kletnieks@...edu Cc: full-disclosure@...ts.grok.org.uk, soc@...cert.gov Subject: Re: Fwd: Comment on: USB devices spreading viruses On 21/11/2008, Valdis.Kletnieks@...edu <Valdis.Kletnieks@...edu> wrote: > On Fri, 21 Nov 2008 18:13:27 GMT, n3td3v said: >> Its sad when it comes to the state of affairs when random folks on a >> mailing list need to advise the u.s department of defense because >> their IT security staff suck. > > Yeah, especially when the random folks don't even understand the problem > space. > > You ever consider the possibility that some of those machines *need* the > removable media, because they are sneaker-netting highly sensitive data > around (the sort that you'd be upset if it was on a network-accessible > machine)? That puts constraints on what you can and can't do to secure > the removable media. > > It's a bad idea to epoxy-glue the USB slots when that's the only way to > get data in or out of the machine. Kinda boat-anchors it. > > Having said that, it *is* a good idea to configure the box so the removable > media is flagged non-execute - unless the removable media includes the > executable that's the machine's reason for being, but the media has to go > back into the GSA-rated safe when you're done working with it. > > (And yes, there *are* boxes out there that don't *have* permanent storage - > you > have to check the removable storage in and out of the vault.) > _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Powered by blists - more mailing lists