RE: sircam removal

[Erek Adams <erek () theadamsfamily net>]

On Thu, 30 Aug 2001, Graeme Fowler wrote:

> I have to stick my head above the parapet here... I'm prepared to be shot
> at!

*bang*  ;-)

> It's interesting to see so many Snort users who want to use Snort to stop
> <whatever> getting into their networks. Remember that it's an Intrusion
> Detection System, and although Marty et al have spooged some cool features
> in - flexresp being one of them - it should only be a single, small part of
> your armoury in keeping your network/systems safe.

[ Youngsters, close your eyes... ]

Abso-fu**-ing-lutely!

[...snip...]

> but you get the idea...  The response after the bollocking? "But it was from
> a mate!". The jury's still out on this one ;-)

*sigh*  User education--The bane of most admins...  Oh, Graeme, would you have
ever spent any time in the UK?  ;-)

Too bad we can't have snort notice when a luser reads said virii email, then
send a 'get a clue email' right after beating them soundly with a clue stick.
*sigh*  One more thing for the wish list Marty!  :)

<soapbox>

User Education is the toughest thing that folks in the security arena face.
No matter how good our IDS signatures are, no matter how tight the firewalls
rules, no matter how many screened subnets, no matter..... ad nasuem...  The
security community can _not_ ever enforce learning upon it's users.  You will
be seen as a(n) 'overbearing, egotistical, power-hungry person with a
attitude.' [ That's an acutal user quote, when I had to remove his M$ computer
from the network. ].  Boy, isn't this job fun?

</soapbox>

I'm getting some more OJ.  If I have coffee right now, I'll kill'em.

-----
Erek Adams
Nifty-Type-Guy
TheAdamsFamily.Net


_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
http://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users