Re: [Full-disclosure] Getting Off the Patch

["Thor (Hammer of God)" <thor@xxxxxxxxxxxxxxx>]

I'm sure it will all be cleared up when we see the reporting...

t

From: Christian Sciberras [mailto:uuf6429@xxxxxxxxx]
Sent: Friday, January 14, 2011 7:45 AM
To: Thor (Hammer of God)
Cc: lists@xxxxxxxxxx; phocean; full-disclosure@xxxxxxxxxxxxxxxxx; Zach C
Subject: Re: [Full-disclosure] Getting Off the Patch

Thought I should point out that they seem to have forgotten the main function 
in mass/distributed computer control and management.
What otherwise would be a "huge" waste, it's done in little time and tested 
reliable in as much little time. According to the reliability of the patch, one 
would also assume that worst case scenarios involve *just* rolling back 
changes, again, not really loosing anything at all.


On Fri, Jan 14, 2011 at 4:39 PM, Thor (Hammer of God) 
<thor@xxxxxxxxxxxxxxx<mailto:thor@xxxxxxxxxxxxxxx>> wrote:
>We disagree. Patches changes code which has already been operationally and
>functionally tested. This requires additional testing for each update and patch
>and that takes time, money, and other resources away from other things.
>Therefore no wonder when operations scale upward, the cost of security
>goes exponential. It's because of all the waste.
Please share the research you have that backs up this statement.  I would be 
very interested in knowing the details that that provide the foundation for 
this argument.  I'm particularly interested in the cost points and 
identification of the exponential cost of security from patching and the money 
saved by not patching in your environment.

I presume that you have empirical evidence of the vast savings based on 
concurrent operational models in an enterprise environment, so I'm curious as 
to how many thousands of servers you are operationally responsible for, because 
that information is not only critical, but required for this model to be 
considered.  IOW, if you could share the analysis you presented to management 
that they bought off on, that would extremely helpful.

Thanks!

t

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/