Re: Avoiding being a good admin - was DCOM RPC exploit (dcom.c)

[Valdis.Kletnieks () vt edu]

On Tue, 29 Jul 2003 10:52:19 EDT, Jason <security () brvenik com>  said:

> $15,600 * 83 = $1.3 million in lost time patching
>
> Compared to the very conservative 4 million lost otherwise?
>
> Add another million to the 1.3 mil to hire contractors and you still 
> save almost 2 million.

$1.3M to patch MS03-023.
$1.3M to patch MS03-026.
$1.3M to patch MS03-030.

Now you're up to $3.9M, and only saving $100K. *MAYBE*.  And if there's
another advisory, there goes another $1.3M.  If there's 4 advisories a year,
it actually makes financial *SENSE* to just say "screw it" and accept the
fact that there will be a yearly worm-and-patch-everything party.

Maybe there's a *REASON* that IT security is underfunded - the cost/benefit
doesn't work out for the business....

Attachment: _bin
Description: