Re: Vulnerability Response (was: BGP TCP RST Attacks)

[David Lang <david.lang () digitalinsight com>]

On Wed, 2 Jun 2004, George Capehart wrote:

> > The cost of risk is very important.
>
> Hear, hear!

unfortunantly this is much easier to say then to define, especially when 
you have disagreements between departments over the liklyhood of something 
beign exploited "Vendor BIDNAME says that their equpiment that will span 5 
networks is perfectly safe and can't possibly be comprimised becouse they 
don't run an OS" from the folks who want to install something vs the 
security departments view of the same hardware "these are x86 based nodes 
plugged into every network with an ethernet backplane between them, they 
are a very high risk"

let alone the more subtle issues of how expensive the risk is to open one 
more port through a firewall.

David Lang

--
"Debugging is twice as hard as writing the code in the first place.
Therefore, if you write the code as cleverly as possible, you are,
by definition, not smart enough to debug it." - Brian W. Kernighan
_______________________________________________
firewall-wizards mailing list
firewall-wizards () honor icsalabs com
http://honor.icsalabs.com/mailman/listinfo/firewall-wizards