Re: Start-up banks on hack-proof Linux

[InfoSec News <isn () c4i org>]

Forwarded from: Dave Wreski <dave () guardiandigital com>

> I don't mean to be rude but EnGarde is far from "secure".
> Duct-taping LIDS on top of the system helps but attackers can still
> compromise services, load code into memory and do naughty things.
> Check out the following list of advisories for 2002 alone. Please
> also note that they haven't issued advisories for the last ~2
> months, leaving users vulnerable to several major issues.

I don't think you're being rude at all, just misguided.

We appreciate your pointing out that we haven't released an advisory
in the past two months. That's because there have not been any
publicized vulnerabilities to any component within EnGarde for at
least the last two months that warranted a public advisory.

Do you have reason to believe we have missed one? Are you thinking the
OpenSSL worm? Our customers were at no point vulnerable to that.

Security is what we do. If there is a program that you think may be
vulnerable to an exploit as shipped with any Guardian Digital product,
please don't hesitate to bring it to our attention, and chances are
we'll have it fixed within 24 to 48 hours.

The protection that LIDS provides is one piece of an overall defense
in depth strategy that EnGarde employs. LIDS is in fact an integral
component of EnGarde, pervasive throughout the entire design of the
operating system, and provides filesystem protection as well as
protection from things like Trojan horse attacks. I don't think anyone
would suggest that because it isn't effective against 100% of the
forms of attacks out there that we shouldn't use it.

Additionally, we have implemented techniques to help limit exposure to
other "naughty things," as you so succinctly stated.

-- 
Dave Wreski
Corporate Manager                           Guardian Digital, Inc.
(201) 934-9230                Pioneering.  Open Source.  Security.
dave () guardiandigital com            http://www.guardiandigital.com



-
ISN is currently hosted by Attrition.org

To unsubscribe email majordomo () attrition org with 'unsubscribe isn'
in the BODY of the mail.