Re: Getting Off the Patch

["Thor (Hammer of God)" <thor () hammerofgod com>]

Ah, so that makes perfect sense then.   Rather than hiring the young hires and teaching them to patch, we are supposed 
to hire highly experienced experts who are already supposed to know how to patch because young hires cannot do it.  
However, since the argument is that patching is already incredibly hard, and that it creates exponential costs of 
operations, this must be because the experienced experts who set the whole thing up originally did it wrong based on 
their inherited, faulty knowledge. 

So instead of patching, since even the experts can't do to it right without the spiraling costs crippling operations, 
we tell the same people who can't patch that they are to " find the right balance of operational controls at each 
interactive point within a vector [to] provide protection against 100% of the threats including unknown threats" and 
to, obviously, do so in such an effective manner that the costs of doing so somehow get substantially minimized and at 
a level that justifies the risks of not patching, even given the salary difference between noobs and ninjas.   And 
since the knowledge required for those who *can't* patch but *can* balance operational controls at each interactive 
point within a vector is available freely at www.osstmm.org , we should stop trying to patch, even though the process 
detailed and the knowledge required in the PDF was compiled by those who obviously also couldn't figure out how to 
patch or else they wouldn't have needed an alternative in 
 the first place.  

All they have to do is read, understand, and act on the information in the PDF as opposed to reading, understanding, 
and acting on patch management. 

It's brilliant!  Where do I sign up?

t

> -----Original Message-----
> From: full-disclosure-bounces () lists grok org uk [mailto:full-disclosure-
> bounces () lists grok org uk] On Behalf Of Valdis.Kletnieks () vt edu
> Sent: Friday, January 14, 2011 7:01 AM
> To: phocean
> Cc: full-disclosure () lists grok org uk; Zach C; lists () isecom org
> Subject: Re: [Full-disclosure] Getting Off the Patch
>
> On Fri, 14 Jan 2011 09:25:51 +0100, phocean said:
> > But this is so well known, at least I thought, that I wonder what is
> > the purpose of all of this.
>
> It's a symptom of our industry slowly getting older.  In the '70s and '80s, pretty
> much everybody had 3-5 years experience, and almost nobody had more than
> 10, because the field wasn't 10 years old.  Nobody looked down on the
> newbies, because (a) they didn't stay newbies long because there was only 3-
> 4 years worth of stuff to learn and (b) the old-timers could still remember
> being newbies themselves.
>
> Now it's different - the guys who were here at the beginning are all old, gray,
> and/or bald, and looking at retirement, and we have to start worrying about
> the collective brain drain that will happen at that time.  Meanwhile, demand is
> surging faster than truly qualified people can be supplied, so we're seeing a lot
> of young hires who only know what they learned in an 18 month course at
> ECPI or similar trade school.  In other words, we're at exactly the same
> position when the great flood of McSE holders happened a few years back.
>
> RFC1925 says: "Some things in life can never be fully appreciated nor
> understood unless experienced firsthand. Some things in networking can
> never be fully understood by someone who neither builds commercial
> networking equipment nor runs an operational network."  We've gotten to
> the point where a large segment of the industry wasn't taught "patching
> doesn't work" in school, and they have yet to experience it themselves out in
> the real world.

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/