lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20030729141103.N66131-100000@lithagus.turtleshell.net>
From: salgatt at turtleshell.net (Scott M. Algatt)
Subject: Avoiding being a good admin - was DCOM RPC
 exploit (dcom.c) 

There are other methods of doing patches as well.  I know of one company,
PatchLink, that does a deployment.  You simply install the client software
on a system and then it checks into the master server.

configurations such as those could help reduce the maintenance cost of
patching.  The up front cost of the software and configuration is costly
but after that you are running smooth.

This is a software that we recently deployed and it is working great.  We
are able to see what patches haven't been applied to certain machines.  We
have our machine split into groups, automatic and manual.  This allows for
the onsite administrator to decide when they want to patch.


Regards,

Scott M. Algatt

Behold the turtle. He makes progress only when he sticks his neck out.

On Tue, 29 Jul 2003 Valdis.Kletnieks@...edu wrote:

> On Tue, 29 Jul 2003 10:52:19 EDT, Jason <security@...enik.com>  said:
>
> > $15,600 * 83 = $1.3 million in lost time patching
> >
> > Compared to the very conservative 4 million lost otherwise?
> >
> > Add another million to the 1.3 mil to hire contractors and you still
> > save almost 2 million.
>
> $1.3M to patch MS03-023.
> $1.3M to patch MS03-026.
> $1.3M to patch MS03-030.
>
> Now you're up to $3.9M, and only saving $100K. *MAYBE*.  And if there's
> another advisory, there goes another $1.3M.  If there's 4 advisories a year,
> it actually makes financial *SENSE* to just say "screw it" and accept the
> fact that there will be a yearly worm-and-patch-everything party.
>
> Maybe there's a *REASON* that IT security is underfunded - the cost/benefit
> doesn't work out for the business....
>


Powered by blists - more mailing lists

Powered by Openwall GNU/*/Linux Powered by OpenVZ