Re: Responsibility

[Paul Schmehl <pauls () utdallas edu>]

--On May 22, 2006 8:05:47 AM +1000 Greg 
<full-disclosure3 () pchandyman com au> wrote:

> Large motel/hotel chain I recently acquired wants to sue previous company
> who did their I.T. work for them as a customer's wifi connected machine
> infected their network and caused loss of booking data thus money.
>
> My question then is - if you have done the utmost to lock down your
> customer but someone connects an infected machine and somehow it gets in,
> is the customer right in suing you?

There's way too many unanswered questions here to provide an intelligent 
answer.

1) What was the nature of the virus?  New and undetected?  Or old and well 
known?
2) What was the status of patching?  Current?  Or way behind?
3) What was the response to the infection?  Rapid and effective?  Or slow 
and ineffective?
4) Where the critical assets protected from the rest of the network?  Or 
exposed?
5) What was the nature of the security effort?  Organized and focused? 
Disorganized and unfocused?

Those are just some starting questions.  You would need to know much more 
to accurately assess the culpability of the previous company.

Paul Schmehl (pauls () utdallas edu)
Adjunct Information Security Officer
The University of Texas at Dallas
http://www.utdallas.edu/ir/security/

Attachment: _bin
Description:

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/