full-disclosure - Re: Getting Off the Patch

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <58DB1B68E62B9F448DF1A276B0886DF16EBD57D7@EX2010.hammerofgod.com>
Date: Tue, 18 Jan 2011 03:08:03 +0000
From: "Thor (Hammer of God)" <thor@...merofgod.com>
To: "Cal Leeming [Simplicity Media Ltd]"
	<cal.leeming@...plicitymedialtd.co.uk>, "full-disclosure@...ts.grok.org.uk"
	<full-disclosure@...ts.grok.org.uk>
Subject: Re: Getting Off the Patch

Sounds like you've got it nailed :)

Sent from my Windows Phone
________________________________
From: Cal Leeming [Simplicity Media Ltd]
Sent: Monday, January 17, 2011 2:29 PM
To: full-disclosure@...ts.grok.org.uk
Subject: Re: [Full-disclosure] Getting Off the Patch

Apologies if I have completely missed the point here, as I have only skimmed through this.

Most people wouldn't rely solely on patch day to protect their systems/network, they would also employ the use of a NIDS / HIDS to mitigate the risk further (of course, said solutions should have a large community base and/or a record of releasing 0day incrementals in a timely manner). On top of this, workstation based anti virus packages (such as AVG or w/e), to help prevent those pesky drive by kits.

Taking all that into consideration, I would agree that patching shouldn't be considered the "be all and end all" of security, but that's no reason to disable patching completely, surely? The more layers of protection you add, the better your odds are.

The idea of presenting these ideals as a training opportunity is a clever idea, but only if the trainers themselves are established names in the security field, otherwise it will be another case of "the blind leading the blind".

Content of type "text/html" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/