full-disclosure - [inbox] Re: Re: E-Mail viruses

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

From: smacdougall at idanalytics.com (MacDougall, Shane)
Subject: [inbox] Re: Re: E-Mail viruses

Puh-lease.

"Having NO security is better then, security by obscurity !!"

Whoever taught you that is an idiot. Some security is always better than no security. Obviously security through obscurity is not a preferred approach, but to say no security is better only proves that you are talking out your ass.

And for the record, a CISSP proves nothing. When I was a white hat I repeatedly tore apart the networks "secured" by CISSP "wizards". The certification means nothing - it's the actual hands on ability of the network managers and engineers that matter.

Hope this helps
Shane

 -----Original Message-----
From: 	bart2k@...hmail.com
Sent:	Fri Mar 05 14:21:11 2004
To:	purdy@...man.com
Cc:	full-disclosure@...ts.netsys.com
Subject:	RE: [inbox] Re: [Full-Disclosure] Re: E-Mail viruses

Curt,

Please tell me that your kidding about your comment:

"An alternative is to allow only a proprietary extension
through, like .inc  Legitimate senders would rename 
the file, be it .exe .doc .jpg, indicate in the body 
of the message what the true extension is,
and the receiver merely renames it."

If your not kidding it furthers the arguement that 
all those certification characters at the end of 
your name are worthless.  

"Having NO security is better then, security by obscurity !!

I would have hoped you were taught atleast that before begin
handed a CISSP certification and you should disclose this view
you have to your employeer so they understand who is protecting
them.

- = FULL DISCLOSURE REQUIRED = -

On Fri, 05 Mar 2004 11:36:10 -0800 Curt Purdy <purdy@...man.com> wrote:
>Ron DuFresne wrote:
>
>> > 1. We use the Draconian technique of stripping all .exe
>> .zip. ,gif .jpg
>> > .scr .bat .pif files.
>
>
>> Very draconian in todays world, and not productive by the way
>> some folks
>> do the work they have to do with limited capabilities these days.
> It
>> seems that we might was well revert back to only allowing
>> e-mail in plain text
>
>Ah, I wish...  An alternative is to allow only a proprietary extension
>through, like .inc  Legitimate senders would rename the file, be
>it .exe
>.doc .jpg, indicate in the body of the message what the true extension
>is,
>and the receiver merely renames it.  A little trouble yes, but it
>virtually
>eliminates email propagated viruses from the corporation.
>
>Curt Purdy CISSP, GSEC, MCSE+I, CNE, CCDA
>Information Security Engineer
>DP Solutions
>
>----------------------------------------
>
>If you spend more on coffee than on IT security, you will be hacked.
>What's more, you deserve to be hacked.
>-- White House cybersecurity adviser Richard Clarke
>
>_______________________________________________
>Full-Disclosure - We believe in it.
>Charter: http://lists.netsys.com/full-disclosure-charter.html
>
>

Concerned about your privacy? Follow this link to get
FREE encrypted email: https://www.hushmail.com/?l=2

Free, ultra-private instant messaging with Hush Messenger
https://www.hushmail.com/services.php?subloc=messenger&l=434

Promote security and make money with the Hushmail Affiliate Program: 
https://www.hushmail.com/about.php?subloc=affiliate&l=427

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html