Message-ID: <AANLkTikf-uOS9RDcKeQBMCRn_JqjvjafFtkfm-zcrK+S@mail.gmail.com>
Date: Mon, 17 Jan 2011 21:30:08 +0000
From: "Cal Leeming [Simplicity Media Ltd]"
	<cal.leeming@...plicitymedialtd.co.uk>
To: "Thor (Hammer of God)" <thor@...merofgod.com>
Cc: "full-disclosure@...ts.grok.org.uk" <full-disclosure@...ts.grok.org.uk>,
	Zach C <fxchip@...il.com>,
	"Valdis.Kletnieks@...edu" <Valdis.Kletnieks@...edu>,
	"lists@...com.org" <lists@...com.org>
Subject: Re: Getting Off the Patch

Okay, so there's like 40 odd rather long responses to this discussion, can
someone give a one word answer as to whether or not they are worth taking
the time to read through?

On Mon, Jan 17, 2011 at 8:38 PM, Thor (Hammer of God)
<thor@...merofgod.com>wrote:

>
>
> >> Now, what I did there was insulting, confrontational, and a general
> shitty
> >thing to do.
> >
> >Expected. Nothing that I wouldn't put past you.
>
> It wasn't for your benefit; it was to hopefully prepare PMs for the ensuing
> anal jihad they'll get from management if they present your idea without any
> facts and the illustration of their naiveté in regard to what happens when
> security analysts write checks that operations and management has to cash.
>
> >> You cannot use the "if you don't like my driving then stay off the
> >> sidewalk" defense
> >
> >Wow, you're still inferring a whole bunch of things there and even saying
> >things I didn't say. You are so taking this all out of context.
>
> You said if one doesn't your emails, not to read them, and if we don't like
> your idea, don't do it.  The problem with this selfish logic is that when my
> company applies standards, policies, and requirements to data management and
> risk mitigation, but a vendor to whom I send data decides not to patch based
> on your idea, then it affects me and my customers, and as such, I simply
> asked for what are now tiny little shreds of any evidence you have outside
> of a couple of servers and workstations.   I think the scope of your
> research has qualified the level of consideration it should receive.
>
> >> I chose that example specifically because it represented an unpatched
> >environment
> >
> >Sorry you were dissatisfied with the examples. I'll try harder for you
> >next time.
>
> You really should.  Rather than providing a single suggestion on how your
> model would have protected 100% of this known-yet-unpatched vulnerability,
> you should have taken the opportunity to at least illustrate your assertion
> by way of example.   You have reduced the applicability of your model to
> instances where, as far as the most basic of network controls, "there are
> none."  There is no need for a "new model" here, and in fact, there is
> nothing new about it in the first place other than to think that when it has
> been illustrated that people can't deploy an ACL, that they will be
> successful in not patching.
>
> >> Your stating that "you think that op-controls can't protect where
> patches
> >
> >Of course your argument is your opinion. One that can be surely backed
> >by many stats from many companies making money off that particular
> >model. And those stats also show it doesn't work consistently. Why not
> >try something different? I am presenting a different model is all.
> >Sorry you don't like it. It works for others that have tried.
>
> Yet again, this was the purpose of my example.  What you consider
> "brainwashing" I view as "insight," which I believe is evident by my use of
> an example where I already calculated your responses beforehand.
>
> The impact of Slammer proved the state of system security at the time in a
> definitive manner.  No theory, not "what would have happened if your model
> was in place," and how basic principles of least privilege and security in
> depth were not applied.   While it doesn't take an Einstein to predict the
> obvious (oh, btw, your relativity example was a complete fail) I would like
> to point out statements of security in depth here:
> http://www.securityfocus.com/columnists/174
> - and where I not only predicted slammer and warned against it before
> writing the article, but covered your "new" model about 8 years ago (even
> though I'm "brainwashed") here:
> http://www.securityfocus.com/columnists/139
>
> You might offer models based on presumed benefits with inferred value
> unsubstantiated by research or cost analysis, but I have illustrated a
> real-life, what-actually-happened, non-theoretical, KNOWN vulnerability that
> had a massive impact on the global internet.  And to prevent it, all someone
> had to do was to install the patch.
>
> For what my position is worth, I totally support you and your research
> organization pushing the age-old model of security in depth and least
> privilege, but I would recommend that you do so with the "don't patch"
> nonsense removed.
>
> I'm more than happy to continue this exchange, but please excuse me if I
> fail to reply to responses empty of substance.
>
> So, "ttyl," or "thanks, it's been interesting."
>
> t
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/
>

Content of type "text/html" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Powered by blists - more mailing lists