Re: [Full-disclosure] Getting Off the Patch

["Thor (Hammer of God)" <thor@xxxxxxxxxxxxxxx>]

>> Now, what I did there was insulting, confrontational, and a general shitty
>thing to do.
>
>Expected. Nothing that I wouldn't put past you.

It wasn't for your benefit; it was to hopefully prepare PMs for the ensuing 
anal jihad they'll get from management if they present your idea without any 
facts and the illustration of their naiveté in regard to what happens when 
security analysts write checks that operations and management has to cash.  

>> You cannot use the "if you don't like my driving then stay off the
>> sidewalk" defense
>
>Wow, you're still inferring a whole bunch of things there and even saying
>things I didn't say. You are so taking this all out of context.

You said if one doesn't your emails, not to read them, and if we don't like 
your idea, don't do it.  The problem with this selfish logic is that when my 
company applies standards, policies, and requirements to data management and 
risk mitigation, but a vendor to whom I send data decides not to patch based on 
your idea, then it affects me and my customers, and as such, I simply asked for 
what are now tiny little shreds of any evidence you have outside of a couple of 
servers and workstations.   I think the scope of your research has qualified 
the level of consideration it should receive. 

>> I chose that example specifically because it represented an unpatched
>environment
>
>Sorry you were dissatisfied with the examples. I'll try harder for you
>next time.

You really should.  Rather than providing a single suggestion on how your model 
would have protected 100% of this known-yet-unpatched vulnerability, you should 
have taken the opportunity to at least illustrate your assertion by way of 
example.   You have reduced the applicability of your model to instances where, 
as far as the most basic of network controls, "there are none."  There is no 
need for a "new model" here, and in fact, there is nothing new about it in the 
first place other than to think that when it has been illustrated that people 
can't deploy an ACL, that they will be successful in not patching. 

>> Your stating that "you think that op-controls can't protect where patches
>
>Of course your argument is your opinion. One that can be surely backed
>by many stats from many companies making money off that particular
>model. And those stats also show it doesn't work consistently. Why not
>try something different? I am presenting a different model is all.
>Sorry you don't like it. It works for others that have tried.

Yet again, this was the purpose of my example.  What you consider 
"brainwashing" I view as "insight," which I believe is evident by my use of an 
example where I already calculated your responses beforehand. 

The impact of Slammer proved the state of system security at the time in a 
definitive manner.  No theory, not "what would have happened if your model was 
in place," and how basic principles of least privilege and security in depth 
were not applied.   While it doesn't take an Einstein to predict the obvious 
(oh, btw, your relativity example was a complete fail) I would like to point 
out statements of security in depth here:
http://www.securityfocus.com/columnists/174
- and where I not only predicted slammer and warned against it before writing 
the article, but covered your "new" model about 8 years ago (even though I'm 
"brainwashed") here:
http://www.securityfocus.com/columnists/139

You might offer models based on presumed benefits with inferred value 
unsubstantiated by research or cost analysis, but I have illustrated a 
real-life, what-actually-happened, non-theoretical, KNOWN vulnerability that 
had a massive impact on the global internet.  And to prevent it, all someone 
had to do was to install the patch.

For what my position is worth, I totally support you and your research 
organization pushing the age-old model of security in depth and least 
privilege, but I would recommend that you do so with the "don't patch" nonsense 
removed.

I'm more than happy to continue this exchange, but please excuse me if I fail 
to reply to responses empty of substance. 

So, "ttyl," or "thanks, it's been interesting."  

t

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/