Marcus said:
> On my machine here (switchblade.iwi.com) I'm not running
>any security and it's *GREAT*! I'm not even behind a firewall! I
>refuse to firewall off my own home. :) *BUT* my business papers
>and processing are all done on a different machine and the only
>thing you can steal from my server here is a bunch of source code
>I've mostly posted to the 'net years ago. I believe that is the
>*TYPICAL* Internet connection and I believe this is a perfectly
>good approach. It doesn't scale real well, though.
The problem with this model is that, unfortunately, users who are *used* to
this approach don't seem to understand that once their machine is connected
to a business network, what was a 'perfectly good approach' becomes a
potential network vulnerability. Also, I would imagine that the average user
doesn't have multiple machines with which to play.
> If my machine were the launch console for H-bombs I'd
>strip it to a point of beyond uselessness, to secure it! :)
Or, if you were the typical user, you'd just download
launch-hbomb-winsock.zip
> The point here is that the solutions need to
>match the problems. IF people who buy their computing solutions do it with
>that in mind (they don't!) it's not too bad - you buy an ordinary
>box for ordinary purposes and an CompaqLaunchPro for your H-bomb
>console and suit the engine to the task. Most people use pliers
>to drive nails, too; I know I've done it in the past.
Doesn't this then imply that the solutions need to match the people as much
as, if not more than the problems? Hammers are quite common, Torx[tm?]
screwdrivers aren't. When the user keeps coming up against a Torx screw,
he'll keep reaching for the pliers.
>can get their work done. At one customer site, we started engineering a
>firewall and they wanted to make *SURE* (in the sense of assurance)
>that Web-based virusses could not get in. Suddenly, all the solutions
>become complex, draconian, expensive -- and WORST OF ALL - you can't
>use the Netscape browser anymore.
Not sure that that's a bad thing [No <blink> </blink>] :). This has
always been the problem with information security. Until the Enigma,
devising cyphers that were secure enough to be useful , but easy enough
for an agent in the field to use was the issue.
> My take is that the ACSG have been too "hard core" and
>basically called for "if it's not perfect, don't do it" which
>caused the market to say, "ok." and go someplace else.
I totally agree. Also, most infosec people have the same mindset,
it must be gubbermint brainwashing at work :)
> There's just no way, with computers, to build in the
>invisible redundancy that you can in a bridge. Or maybe there is?
>*THAT* is my challenge to the ACSG: make the security an invisible
>part of the infrastructure, like an engineer can when building a
>house.
What? And put us all out of business?
> I can think of a number of really crude responses I'd
>love to make here. :) I know several people who like to be forced
>to do painful, humiliating, or just plain uncomfortable things.
>But even the masochists I know could't eroticize using a B2 system.
I'll skip the obvious temptation to launch into alt.erotica.tsec.systems.b2
:)
>>in X code that said "hey, I know this is ugly, but I'm a graduate student
>>and I don't have to care." True or not, it makes the point that building
I just couldn't snip this, it's priceless.
> A number of times I have talked to folks who really should
>not be on the 'net. I've listened to their firewall requirements,
>reviewed their designs, and recommended that they cancel the T1,
>and buy everyone at the facility an account on AOL, a modem at
>home, and an extended work policy that lets them spend an hour a
>day at home Internetworking.
Did anyone take this approach? I'm *really* interested in that answer.
> Whenever I hear someone say the kind of thing you're
>saying in the paragraph above, I know I am talking with
>someone who has never had to put a product out under deadline,
>on 4 different platforms, next week, for customers who want
>to pay half what you're charging for it.
Half? You musta been selling to the Goverment!
> I hate to break it to you, but a lot of commercial code
>is complete, unmitigated crap, too. You just don't get to see
>it because it's proprietary. Look at Windows internals and then
Actually, probably most of it. I'd hazard to guess that 80% of commercial
programmers write sloppy code, and I'd probably be under the mark. I bet
you could get hundreds of volumes of "At the last company I worked for as a
developer....." stories. Good programmers write good code, the guys doing it
for fun don't have deadlines, so sometimes they're less constrained that way.
On the other hand, they may not have peer review (Linux, *BSD, et al.
excluded).
> "an answer" that is not "the best answer" is going to be
>a commercial failure. It may be "the right thing" in some people's
Actually, that's not true, marketing can make the worst answer profitable.
>work. There's a tunnel driver for UNIX (Jeff Onions') that sets
>up a virtual network interface. All packets routing to the interface
>appear in /dev/tun0 for read. You simply read each packet at an
>application level, uuencode, and mail. On the other end, you reverse
>the process. It requires a collaborator.
I don't suppose you have a URL? This could make for some interesting
demonstrations at work :)
--
Paul D. Robertson The above text is the author's opinion,
proberts @
moc1 .
gannett .
com which may have no basis whatsoever in fact.
PSB#9280
|
|
