full-disclosure - Re: Fwd: Rate Stratfor's Incident Response

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <144279.1325984714@turing-police.cc.vt.edu>
Date: Sat, 07 Jan 2012 20:05:14 -0500
From: Valdis.Kletnieks@...edu
To: Laurelai <laurelai@...echan.org>
Cc: full-disclosure@...ts.grok.org.uk
Subject: Re: Fwd: Rate Stratfor's Incident Response

On Sat, 07 Jan 2012 18:24:04 CST, Laurelai said:

> Well enjoy your doomed industry then. Ill continue to take great
> pleasure as the so called experts get owned by teenagers.

I'm not sure why you consider it "doomed".  It's only "doomed" if you have
some silly notion that a company needs to have 100% security.

We've not managed to totally secure the roads, there's still bad drivers out
there.  We've not managed to totally secure the credit card system, there's
still fraud.  But neither of those are "doomed" either - we just accept there's
bad drivers and buy car insurance, and the credit card companies accept
that there will be 2% to 6% fraud write-offs and chargebacks, budget
accordingly, and get on with business.

And it's the same in computer security - if you've figured out it's going to
cost you $250K/year (remember, salary, bennies, *and* overhead) to hire a
security geek, but there's only a 5% chance you'll get hacked in a given year
and you've got a business plan on how to *recover* for $100K, and swallow the
$600K in lost sales the week your website is down, you're still better off *not
hiring the expert and risking getting hacked*.

Just like any other business - banks, gas stations, and minimarts all accept
the chance of armed robbery as part of the risk of doing business.  Most will
deploy *some* countermeasures to lower the risk (usually a video camera or two,
and tell the clerks to hand over the money and try not to get shot), and at
some point say "Meh, that's enough. Time to get back to selling stuff and
making money".  Nothing different just because it's a cyber attack rather than
a physical one.

Content of type "application/pgp-signature" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/