Information Security News mailing list archives
Re: This computer security column is banned in Canada
From: InfoSec News <isn () c4i org>
Date: Thu, 12 Jun 2003 02:40:01 -0500 (CDT)
Forwarded from: Mark Bernard <mbernard () nbnet nb ca> Nice Tony, You are absolutely correct!! Obscurity does not make a problem go away, if fact it does nothing to solve the problem. What it does do is increase the risk of the vulnerability becoming exploited. Obscurity is not a form of risk acceptance but rather a form of plain ignorance. Like most counter measures we need to understand the problem before solving it. The bad guys are writing malicious code so why don't the good guys learn how to do it to so that they can mitigate the likelihood of exploitation. When we do vulnerability assessments or security assurance reviews we write code, check standards, policies and back doors etc... Learning to write malicious code is just another tool for the old tool box. Best regards, Mark, CISM. ----- Original Message ----- From: "InfoSec News" <isn () c4i org> To: <isn () attrition org> Sent: Thursday, June 05, 2003 5:39 AM Subject: RE: [ISN] This computer security column is banned in Canada
Forwarded from: Tony | AVIEN / EWS <tony () avien org> Cc: steve () entrenchtech com, Rob () vmyths com There are articles and papers everywhere talking about why Security Through Obscurity doesn't work as an effective security measure. It is a bureaucratic dream that if only you pretend the problem doesn't exist or hide its existence from the general population that the problem will go away. Do the students have to develop new viruses to learn about viruses- no. But, to quote Albert Einstein "You cannot solve the problem with the same kind of thinking that has created the problem." I think that to develop the next generation of virus defense we need people to get into the minds of the virus writers and think like them- use their tools, work the way they work. Maybe by doing so they can find the chinks in the armor before the bad guys and develop proactive tools instead of the reactionary virus defense we currently have. Read the article I wrote on this controversial topic: http://netsecurity.about.com/cs/generalsecurity/a/aa060303.htm Tony Bradley, CISSP, MCSE2k, MCSA, MCP, A+ About.com Guide for Internet / Network Security http://netsecurity.about.com Click here to sign up for the weekly Internet / Network Security Newsletter: NetSecurity Newsletter
- ISN is currently hosted by Attrition.org To unsubscribe email majordomo () attrition org with 'unsubscribe isn' in the BODY of the mail.
Current thread:
- This computer security column is banned in Canada InfoSec News (Jun 02)
- <Possible follow-ups>
- RE: This computer security column is banned in Canada InfoSec News (Jun 02)
- RE: This computer security column is banned in Canada InfoSec News (Jun 04)
- RE: This computer security column is banned in Canada InfoSec News (Jun 05)
- Re: This computer security column is banned in Canada InfoSec News (Jun 12)
- RE: This computer security column is banned in Canada InfoSec News (Jun 13)
- RE: This computer security column is banned in Canada InfoSec News (Jun 13)
- RE: This computer security column is banned in Canada InfoSec News (Jun 16)