Re[6]: "portscans" (was Re: Arbor Networks DoS defense product)

[Allan Liska <allan () allan org>]

Hello Ralph,

Sunday, May 19, 2002, 11:22:08 AM, you wrote:


> > If they don't give a satisfactory bank somewhere else (or offer your
> > services ;)).  Certainly that is a better approach than scanning to
> > see what you can find out.  The organization receiving the scan has
> > no way of knowing what your intentions are -- and should interpret
> > them as hostile.

RD> I think that's pretty stupid.  If I had my network admin investigate every
RD> portscan, my staff costs would go up 10x and I'd quickly go bankrupt.
RD> Instead we keep our servers very secure, and spend the time and effort
RD> only when there is evidence of a break in.

I didn't say investigate every portscan, I said assume every portscan
is hostile.  There is a big difference.


allan
-- 
allan
allan () allan org
http://www.allan.org