Full Disclosure mailing list archives
Re: MS should point windowsupdate.com to 127.0.0.1
From: "vb" <vb () bitsmart com>
Date: Fri, 15 Aug 2003 08:39:33 -0400
leave it up. install NAV corporate, run live update to get the latest virus defs, and, viola....you're done. vb
I just curious how you geniuses would solve this problem. You have a multi-six figure scientific instrument, which is only manufactured by one vendor in the entire world. Your research department depends upon that instrument to do research for which they are being funded handsomely by grants and expected to produce results. There's only one problem. The instrument requires that you run Windows 2000 Server with IIS, and the vendor requires that you not apply *any* patches post SP2. The government certifies the equipment at a certain patch level, and if the equipment is patched then the certification no longer applies, the research is no longer funded and you are now staring a six figure boat anchor. Given that scenario, please apply your scintillating logic to the problem of patching this machine to protect it against threats that were discovered *after* SP2. 1) Minus points if you say "Don't use it." Not an option 2) Minus points if you say "Don't allow access to the Internet. It *requires* access to the Internet. (IOW, it has to be able to connect to "live" IP address ranges, not private IPs.) 3) Bonus points if you can figure out how to maintain this machine with no interruptions of service and with no breakins. 4) Minus points if you say, "I'd patch it anyway. Screw the vendor." 5) Double minus points if you say, "I wouldn't work somewhere if they had those requirements." Take your time. I'm not doing much. (I'm not asking for the solution either. I already have it. I'm just wondering if you can actually think outside the box, or if you're armchair quarterbacks without a nickle's worth of actual enterprise experience.) Paul Schmehl (pauls () utdallas edu) Adjunct Information Security Officer The University of Texas at Dallas AVIEN Founding Member http://www.utdallas.edu/~pauls/ _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
Current thread:
- RE: MS should point windowsupdate.com to 127.0.0.1 Schmehl, Paul L (Aug 14)
- Re: MS should point windowsupdate.com to 127.0.0.1 Blue Boar (Aug 15)
- Re: MS should point windowsupdate.com to 127.0.0.1 Barry Irwin (Aug 15)
- RE: MS should point windowsupdate.com to 127.0.0.1 Steve Wray (Aug 15)
- RE: MS should point windowsupdate.com to 127.0.0.1 Tobias Oetiker (Aug 15)
- RE: MS should point windowsupdate.com to 127.0.0.1 Jason Coombs (Aug 15)
- Re: MS should point windowsupdate.com to 127.0.0.1 Barry Irwin (Aug 15)
- Re: MS should point windowsupdate.com to 127.0.0.1 Michael Renzmann (Aug 15)
- Re: MS should point windowsupdate.com to 127.0.0.1 vb (Aug 15)
- RE: MS should point windowsupdate.com to 127.0.0.1 Jeroen Massar (Aug 15)
- <Possible follow-ups>
- RE: MS should point windowsupdate.com to 127.0.0.1 Schmehl, Paul L (Aug 15)
- Re: MS should point windowsupdate.com to 127.0.0.1 David Hane (Aug 15)
- Re: MS should point windowsupdate.com to 127.0.0.1 vb (Aug 15)
- Re: MS should point windowsupdate.com to 127.0.0.1 Paul Schmehl (Aug 15)
- Re: MS should point windowsupdate.com to 127.0.0.1 David Hane (Aug 15)
- RE: MS should point windowsupdate.com to 127.0.0.1 Richard Stevens (Aug 15)
- RE: MS should point windowsupdate.com to 127.0.0.1 Paul Schmehl (Aug 15)
- Re: MS should point windowsupdate.com to 127.0.0.1 Jeremiah Cornelius (Aug 15)
- RE: MS should point windowsupdate.com to 127.0.0.1 Paul Schmehl (Aug 15)
- RE: MS should point windowsupdate.com to 127.0.0.1 Schmehl, Paul L (Aug 15)
- Re: MS should point windowsupdate.com to 127.0.0.1 Blue Boar (Aug 15)