full-disclosure - Re: Remote Desktop Command Fixation Attacks

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Sun, 14 Oct 2007 19:26:21 -0400
From: "C Q" <kyle.c.quest@...il.com>
To: full-disclosure@...ts.grok.org.uk, bugtraq@...urityfocus.com
Subject: Re: Remote Desktop Command Fixation Attacks

This wasn't a flame... It was a simple observation.

Having read your reply I also see that you are trying
to reinvent the wheel... when you talk about
crisis management and other planning. Risk analysis,
business continuity and disaster recovery planning,
well prepared incident response procedures and policies, etc
have been practiced by security professionals for quite a while,
so they are not new concepts. There's still a lot of work
to do when it comes implementing proper security and
compliance solutions. Many companies either don't
do it or don't do it effectively, but there has been
some progress over the years. Many companies
don't even have a CSO/CISO because security
and compliance are only starting to gain the recognition
they require. Obviously, there's much
more work to do... and that's good for all of us
in the information security business :-)

As far as defense in depth goes, just like with everything
else it can be improperly implemented to a point
where it's ineffective or prohibitively disrupted to the business.
Your example is a great example of that :-) However,
it doesn't mean that the concept is useless. Simple
analogy... Let's say I pick up a cook book to make
a fancy dish, but I end up with something that
can even turns my dog green :-) Does it mean that
the recipe was bad or does it mean I shouldn't
quit my day job to become a chef?

Content of type "text/html" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/