Full Disclosure mailing list archives
RE: Re: Microsoft Security, baby steps ?
From: "Schmehl, Paul L" <pauls () utdallas edu>
Date: Thu, 18 Mar 2004 10:18:06 -0600
-----Original Message----- From: full-disclosure-admin () lists netsys com [mailto:full-disclosure-admin () lists netsys com] On Behalf Of Full-Disclosure Sent: Thursday, March 18, 2004 2:17 AM To: full-disclosure () lists netsys com Subject: RE: [Full-disclosure] Re: Microsoft Security, baby steps ? In an corporate environment, you will have SUS or SMS running. If so, no need for internet access.
I'm seeing statements like this more and more, on this list and others, and it's really starting to bug me. (Not picking on you personally.) Most of the attacks on corporate boxes come from the inside. Blocking internet access does very little to protect you. Don't believe it? Then explain how Slammer and Sobig and Mydoom and Nachi and Blaster managed to spread in corporate environments that have very good firewalling. Putting up a firewall is one small step in a very large process that gets you some semblance of security. You are not "safe" simply because the firewall is up and running. All it take is *one* improperly maintained box on the inside to be compromised/infected, and the hacker is off to the races. What will SUS/SMS do for you then? By all means, automate patching. But for god's sake, don't think that once you've done that you're done! You've only just begun. Paul Schmehl (pauls () utdallas edu) Adjunct Information Security Officer The University of Texas at Dallas AVIEN Founding Member http://www.utdallas.edu/~pauls/ _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
Current thread:
- Re: NEVER open attachments, (continued)
- Re: NEVER open attachments Paul Schmehl (Mar 19)
- Re: NEVER open attachments Jimmy Mitchener (Mar 19)
- Re: NEVER open attachments Nico Golde (Mar 20)
- Re: NEVER open attachments Troy (Mar 20)
- RE: NEVER open attachments Bill Royds (Mar 20)
- Free x.509 Certs (WAS Re: NEVER open attachments) Jeremiah Cornelius (Mar 21)
- Re: NEVER open attachments Nico Golde (Mar 21)
- Re: NEVER open attachments Troy (Mar 21)
- Re: Re: Administrivia Ron DuFresne (Mar 19)
- Re: Re: Microsoft Security, baby steps ? William Warren (Mar 18)
- Re: Re: Microsoft Security, baby steps ? Cael Abal (Mar 18)
- RE: Re: Microsoft Security, baby steps ? Paul Schmehl (Mar 19)