helo;
On Mon, 19 Jun 2000, [EMAIL PROTECTED] wrote:
> Actually
simply "could not resist"
> I disagree with your statement. I think there are many ex-hackers or
> hackers elite that have gained recognition that they would be a
> considerable asset during a penetration study.. Price Waterhouse, Coopers
> now PWC , Ernst & Young created their whole business model and selling
> methodology preying on the fact that Fortune 500 companies cringe at the
The PWC EY and so on feel threatened that perhaps someone has superior
skills to "their process" ;-)) You know i have seen more b$ come from stiff
shirts than ever the jesus boots and jeans crowd. IMHO anyhow.. so their
gameplan "needs 2b" lets dazzle them with glossies and fancy acronyms and
so on to lead them where we want them to go.. so far lost that they have a
addiction to us only solved by money.. but as they say its business .. but
myself i prefer to make my $$ by doing not delaying .. notice how many
"talk story" IYKWIM that is how business is done {unfortunately} by consider
amount of the corps "But not all"
> thought of hiring ex-hackers to conduct a intrusion test. The fact
of the > matter is that "ethical" hackers are no better than ex-chackers. The
> definition of an "ethical" hacker has been written about over ad over
> again. For a really great definition of what a hacker is: check out the
> www.atstake.com FAQ. They have put together a very simple explanation of
> what a hacker is and why they deem it such.
the media has screwed up the whole thing obfuscating the meaning of a
Hacker (meaning someone who loves to rip apart code and so on.. which b.t.w.
i do) to crackers who well crack into things..
> Hiring a Big Six firm to conduct an intrusion study or a Internet
> footprint analysis in my mind is much more dangerous than hiring
> ex-hackers, probably because I worked for one a while back and thought
> their methodology/approach and deliverable was pretty much vapor (lots of
> smoke and mirrors) and no real value.
Well mark they might have some value but most of it is in recognizing a market
that they can basically dominate by being a household name.. that is how much
like a large monopoly recently in court was judged to be.. I have noticed that
they always tend to beat one hands down in the "verbal diarrea" They do know
how to talk the talk.. Ever see those educational speakers that show 2 pictures
one of mr hollywood the other of the guy that looks like he did not ever have a
real job and ask who do you trust?
> The secret to a successful security
assessment is not to point out the > various different ways one can gain
access to a particular organization > but how to state recommendations that
are specific to the organization on > improving their security posture.
IMHO one goes with the other they are married at the hip.. Policy is the
corp key though.. agreed.
> Since my departure from the Big Six world, I have yet to see any
> improvements in their methodology, and I have seen severe plagiarism from
> PWC to E&Y and other non ethical behavior that tend to make hiring an
> ex-hacker a much more pleasurable endeavor, since it is a one time thing.
> Hiring a Big Six firm to conduct a penetration analysis is like swimming
> with piranha.
both can have their downside and i do believe that you need to have someone
that is clueful monitor the process. As for hiring a Big 6 ..hmmm.. i know
where there @ && your right i believe the right solutions come from those that
have at least caught the cold in their labs and also discovered the cure. oh
well enough babbling from the brook:-))
bye
> /mark
--
Reuters, London, February 29, 1998:
Scientists have announced discovering a meteorite which will strike the
earth in March, 2028. Millions of UNIX coders expressed relief for being
spared the UNIX epoch "crisis" of 2038.
_______________________________________________________________________
************** DREAMWVR.COM - TOTAL INTERNET SERVICES ****************
TOTAL DESIGN - DEVELOPMENT - INTEGRATION - SECURITY - Click Here..
<http://www.dreamwvr.com/services/MAX_SEC.html>;
DREAMWVR.COM - The Console of Many... 90 Topics Covered
<http://www.dreamwvr.com/dynamicduo.html>;
<mailto:[EMAIL PROTECTED]>;
->> LINUX-MANDRAKE Solution Provider and North American Distributor<<-
PRODUCT OF THE YEAR!
<http://www.dreamwvr.com/mandrake/mandrake-main.html>;
"===0 PGP Key Available
*************** "As Unique as the Company You Keep."*****************
"If anyone speaks from DREAMWVR.COM its certainly not me:-)"
________________________________________________________________________
================================================================================
To unsubscribe from this mailing list, please see the instructions at
http://www.checkpoint.com/services/mailing.html
================================================================================
