full-disclosure - CyberInsecurity: The cost of Monopoly

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <133653243.1064751628@[192.168.2.119]>
From: pauls at utdallas.edu (Paul Schmehl)
Subject: CyberInsecurity: The cost of Monopoly

--On Sunday, September 28, 2003 8:14 AM -0400 Karl DeBisschop 
<kdebisschop@...rt.infoplease.com> wrote:
>
> Crunchy shell, soft-chewy insides?
>
I don't think "we" as a "security community" have even begun to tackle this 
problem.  We talk about it, but who is *really* doing it?  For example, if 
you want to network machines you *have* to use SMB/NetBIOS for Windows, NFS 
for Unix, CIFS, or something similar.  Who is really looking at how to be 
secure while still allowing internal machines to talk to each other? 
Certainly none of the above protocols qualify as secure.

When a machine is problematic, for whatever reason, the usual reaction is 
"block it at the firewall".  But that doesn't protect that machine from 
*other* internal machines.  It only protects it from the outside.  Oh, you 
might have a firewall that cordons off accounting from the rest of the 
enterprise, but *inside* accounting, you still have the "soft, chewy" 
problem.

I haven't really seen anything that addresses this problem, and I'm not 
aware of anyone who is working on solving it.  For the most part security 
thinking is still in the middle ages - build a castle with moats and outer 
defensive rings, and staggered entrances to make it hard for the enemy to 
get it.  Once he gets in, what does current security thinking offer?  Not 
much.

What we need is a paradigm shift in thinking.

Paul Schmehl (pauls@...allas.edu)
Adjunct Information Security Officer
The University of Texas at Dallas
AVIEN Founding Member
http://www.utdallas.edu