lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <04F92BA33955D51195B700508B4AB6E91737EDD3@dslak12.dnznet.co.nz>
From: StuartF at datacom.co.nz (Stuart Fox (DSL AK))
Subject: Top 15 Reasons Why Admins Use Security Scan
	 ners

 
 
> > > Question: Should admins be using security
> > scanners?
> > 
> > Someone should be.  Admins should be to confirm that their 
> environment 
> > is in the state that they believe it to be.
> 
> I guess we'll have to agree to disagree.  In my experience, 
> the guy who set a system up shouldn't be the one to inspect 
> it, or verify it.  

Well in some environments that's not an option.  In others, you might
delegate setting up a system to junior techs and you need to confirm that
they've been following correct procedures.  It might also indicate that your
procedures are useless.

> 
> Also, I'm sort of thinking that if someone doesn't know how 
> to set up and maintain a system, what good is it for that 
> same person to run a scanner on it?

Well, it might indicate to them that there are issues with the way they do
things.  Sure, if they're not paying attention or are not switched on, they
might not get anything from running a scanner.  However, if they are
learning, they'll say "Hey, I could improve my process here and make things
better".  The answer to your question is, it depends, and the good will
range from nothing to a  lot.

>  
> > Again, have new types of vulnerabilities been discovered, are there 
> > new best practices.  The reason Code Red hit so hard was because 
> > people didn't know about removing script mappings - it 
> wasn't a common 
> > best practice.  It became one pretty quickly after Code Red.
> 
> Actually, the best practice of removing unnecessary 
> functionality has long been in place, well before Code Red 
> reared it's head.  
> The same is true with the best practice of 
> removing unnecessary script mappings...this was documented by 
> Microsoft and available for free from their site well before 
> Code Red came out.

Removing unnecessary functionality has indeed been in place for a long time.
Code Red indicated that whether Microsoft documented it or not, the best
practice wasn't common.  In fact, before Code Red, it wasn't exactly obvious
that this was a recommended best practice, and the documentation wasn't
really clear.  It's very clear now.

>  
> With regards to the rest of your comments, I think you're 
> missing the point.  I'm not saying that a security scanner 
> shouldn't be run...I just don't think that admins should be 
> the ones to run the scanner.

That's not how it read.  Admins is a pretty blanket statement.  In an ideal
world, security admins should run the scan while others do their work.
However, in a lot of environments, there isn't a dedicated security admin -
it's just a normal admin who has to manage security along with the other 10
million things he has to do.  Is that bad? - yep, it sucks.  However, an
admin running the scanner is better than noone running the scanner. 


Powered by blists - more mailing lists

Powered by Openwall GNU/*/Linux Powered by OpenVZ