full-disclosure - Calcuating Loss

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

From: hdw at kallisti.se (Anders B Jansson)
Subject: Calcuating Loss

Well if you fail to take proper preventive action and a couple of 
offices go down for a day or two you will have a loss.

Or as you correctly state, a lack of income.

But the resources used to clean up and/or reinstall some hundred boxes 
after such an incident can even technically be indentified as a loss.

Can you blame that loss on the virus/worm writer?
Even if you didn't take the recommended preventive action?

I think you can.

If you take you car for a drive, and is killed by a drunk driver, the 
drunk is to blame, even if you didn't wear your seatbelt.

If you leave your house unlocked and someone walks in and steals your 
computers, the theif is still to blame.

The fact that you have to be an idiot to leave your house unlocked, 
drive without your seatbelt or neglect preventive security doesn't 
really shift the blame or negate your loss.

// hdw

Michael Schaefer wrote:
> Loss?
> 
> One of my biggest complaints is the way the industry "loses billions" 
> whenever a virus or worm breaks out.
> 
> I mean, securing and maintain your server is not a loss. Installing and 
> updating your anti virus or IDS package is not a loss. All of these 
> things should have been done anyway.
> 
> If a server goes off line, I guess you could measure the revenue it may 
> have produced as a loss, but technically, that is lack of income, not 
> true loss.
> 
> If you see someone complaining about all the money they lost doing what 
> they should have been doing all along, I just see spin. And politics.
> 
> M
> 
> 
> 
> 
>> Michal Zalewski wrote:
>>
>>  
>>
>>> If we must toy with bogus marketspeak "equations", shouldn't E - at the
>>> very least - numerically correspond to the consequences (loss?) 
>>> caused by
>>> an event, rather than being an event itself?
>>>   
> 
> 
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.netsys.com/full-disclosure-charter.html
>