Re: [Full-disclosure] Getting Off the Patch

["Thor (Hammer of God)" <thor@xxxxxxxxxxxxxxx>]

Ah, so that makes perfect sense then.   Rather than hiring the young hires and 
teaching them to patch, we are supposed to hire highly experienced experts who 
are already supposed to know how to patch because young hires cannot do it.  
However, since the argument is that patching is already incredibly hard, and 
that it creates exponential costs of operations, this must be because the 
experienced experts who set the whole thing up originally did it wrong based on 
their inherited, faulty knowledge. 

So instead of patching, since even the experts can't do to it right without the 
spiraling costs crippling operations, we tell the same people who can't patch 
that they are to " find the right balance of operational controls at each 
interactive point within a vector [to] provide protection against 100% of the 
threats including unknown threats" and to, obviously, do so in such an 
effective manner that the costs of doing so somehow get substantially minimized 
and at a level that justifies the risks of not patching, even given the salary 
difference between noobs and ninjas.   And since the knowledge required for 
those who *can't* patch but *can* balance operational controls at each 
interactive point within a vector is available freely at www.osstmm.org , we 
should stop trying to patch, even though the process detailed and the knowledge 
required in the PDF was compiled by those who obviously also couldn't figure 
out how to patch or else they wouldn't have needed an alternative in 
 the first place.  

All they have to do is read, understand, and act on the information in the PDF 
as opposed to reading, understanding, and acting on patch management. 

It's brilliant!  Where do I sign up?

t

>-----Original Message-----
>From: full-disclosure-bounces@xxxxxxxxxxxxxxxxx [mailto:full-disclosure-
>bounces@xxxxxxxxxxxxxxxxx] On Behalf Of Valdis.Kletnieks@xxxxxx
>Sent: Friday, January 14, 2011 7:01 AM
>To: phocean
>Cc: full-disclosure@xxxxxxxxxxxxxxxxx; Zach C; lists@xxxxxxxxxx
>Subject: Re: [Full-disclosure] Getting Off the Patch
>
>On Fri, 14 Jan 2011 09:25:51 +0100, phocean said:
>> But this is so well known, at least I thought, that I wonder what is
>> the purpose of all of this.
>
>It's a symptom of our industry slowly getting older.  In the '70s and '80s, 
>pretty
>much everybody had 3-5 years experience, and almost nobody had more than
>10, because the field wasn't 10 years old.  Nobody looked down on the
>newbies, because (a) they didn't stay newbies long because there was only 3-
>4 years worth of stuff to learn and (b) the old-timers could still remember
>being newbies themselves.
>
>Now it's different - the guys who were here at the beginning are all old, gray,
>and/or bald, and looking at retirement, and we have to start worrying about
>the collective brain drain that will happen at that time.  Meanwhile, demand is
>surging faster than truly qualified people can be supplied, so we're seeing a 
>lot
>of young hires who only know what they learned in an 18 month course at
>ECPI or similar trade school.  In other words, we're at exactly the same
>position when the great flood of McSE holders happened a few years back.
>
>RFC1925 says: "Some things in life can never be fully appreciated nor
>understood unless experienced firsthand. Some things in networking can
>never be fully understood by someone who neither builds commercial
>networking equipment nor runs an operational network."  We've gotten to
>the point where a large segment of the industry wasn't taught "patching
>doesn't work" in school, and they have yet to experience it themselves out in
>the real world.

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/