On Tue, 7 Oct 2008, [EMAIL PROTECTED] wrote:
You don't want "the securest implementation". You want one that's
"secure enough" while still allowing the job to get done. You also don't
want to be *paying* for more security than you actually need. Note that
the higher price paid to the vendor is
On Tue, 7 Oct 2008, Steven M. Bellovin wrote:
On Tue, 7 Oct 2008 14:07:04 -0400 (EDT)
Sean Donelan <[EMAIL PROTECTED]> wrote:
On Tue, 7 Oct 2008, [EMAIL PROTECTED] wrote:
On Tue, 07 Oct 2008 11:30:11 CDT, "J. Oquendo" said:
What about exceeding the minimum requirements for a change.
(I think
I think I may have found a spin for the political statements: With the
USA government so focused on blaming "axis of evil" countries for all
its woes, perhaps the statement was really meant to say that should
setup some botnet attack against our systems, the USA
would retaliate by setting up a bot
We've got plenty of military toyz we could level at Redmond...
_H*
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1
On Tue, Oct 7, 2008 at 12:05 PM, Marshall Eubanks <[EMAIL PROTECTED]>
wrote:
> Step 0. DON"T PANIC.
>
Good point.
Along the same line, I would like to point out this Ira Winkler article on
the topic:
"Not Much Genius in DHS's Einstein 3.0 Plan"
htt
J. Oquendo wrote:
Too many companies and individuals rely far
too heavily on a false and outdated concept of the definition of
"minimum requirements" when it comes to security. They tend to
think they need to implement the minimum requirements and all will
be fine. This is evident in almost all
On Oct 7, 2008, at 3:01 PM, Paul Ferguson wrote:
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1
On Tue, Oct 7, 2008 at 11:55 AM, <[EMAIL PROTECTED]> wrote:
On Tue, 07 Oct 2008 14:13:08 EDT, "Steven M. Bellovin" said:
Right. The US government is a *huge* operation. Suppose you were
the
C
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1
On Tue, Oct 7, 2008 at 11:55 AM, <[EMAIL PROTECTED]> wrote:
> On Tue, 07 Oct 2008 14:13:08 EDT, "Steven M. Bellovin" said:
>
>> Right. The US government is a *huge* operation. Suppose you were the
>> CIO or the CSO for the US government (excluding
On Tue, 07 Oct 2008 13:23:20 CDT, "J. Oquendo" said:
> Contractors should be held accountable for breaches in an
> infrastructure. Before awarding a contract, I would do my best
> to have the wording changed from "minimum requirements" to
> securest implementation. Whether this securest implementa
On Tue, 07 Oct 2008 14:13:08 EDT, "Steven M. Bellovin" said:
> Right. The US government is a *huge* operation. Suppose you were the
> CIO or the CSO for the US government (excluding the classified stuff)
> -- what is the proper cybersecurity strategy?
Step 1: Figure out what I actually *have* a
On Tue, 07 Oct 2008, Sean Donelan wrote:
> On Tue, 7 Oct 2008, [EMAIL PROTECTED] wrote:
> >On Tue, 07 Oct 2008 11:30:11 CDT, "J. Oquendo" said:
> >>What about exceeding the minimum requirements for a change.
> >(I think you'll find that if somebody is actually willing to *pay* for more
> >security
On Tue, 7 Oct 2008 14:07:04 -0400 (EDT)
Sean Donelan <[EMAIL PROTECTED]> wrote:
> On Tue, 7 Oct 2008, [EMAIL PROTECTED] wrote:
> > On Tue, 07 Oct 2008 11:30:11 CDT, "J. Oquendo" said:
> >> What about exceeding the minimum requirements for a change.
> > (I think you'll find that if somebody is actu
On Tue, 7 Oct 2008, [EMAIL PROTECTED] wrote:
On Tue, 07 Oct 2008 11:30:11 CDT, "J. Oquendo" said:
What about exceeding the minimum requirements for a change.
(I think you'll find that if somebody is actually willing to *pay* for more
security, there's plenty of outfits who are more than happy t
On Tue, 07 Oct 2008 11:30:11 CDT, "J. Oquendo" said:
> What about exceeding the minimum requirements for a change.
It's like any other field - the customer wants more than the minimum, they'll
have to pay more. Almost all contractors will at least act like they're trying
to meet the local buildin
On Tue, 07 Oct 2008, Sean Donelan wrote:
> On Mon, 6 Oct 2008, Buhrmaster, Gary wrote:
> >The Federal Government (through its "Trusted Internet
> >Connection" initiative) is trying to limit the number
> >of entry points into the US Government networks.
> >(As I recall from 4000 interconnects to ar
On Mon, 6 Oct 2008, Buhrmaster, Gary wrote:
The Federal Government (through its "Trusted Internet
Connection" initiative) is trying to limit the number
of entry points into the US Government networks.
(As I recall from 4000 interconnects to around 50,
where both numbers have a high percentage of
> Which is easier to shut down, an attack coming from a relatively small
> number of /16s that belong to the government, or one coming from the
> same number of source nodes scattered *all* over Comcast and Verizon
> and BT and a few other major providers?
>
> Hint 1: Consider the number of entr
Matlock, Kenneth L wrote:
"The system "would literally, like an anti-aircraft weapon, shoot down
an attack before it hits its target," he said. "And that's what we call
Einstein 3.0."
Correct me if I'm wrong, but doesn't even a basic firewall or ACL
provide the same functionality? Drop the packe
"The system "would literally, like an anti-aircraft weapon, shoot down
an attack before it hits its target," he said. "And that's what we call
Einstein 3.0."
Correct me if I'm wrong, but doesn't even a basic firewall or ACL
provide the same functionality? Drop the packet, drop the attack? I'm in
t
William Hamilton wrote:
> If it's going to "literally" shot down an attack like an AA weapon, are
> they planning on physically launching projectiles at compromised machines
> across the world and destroying them?
The politician saw the episode of Star Trek where "7 of 9" typed in a
few computer
On Sun, 05 Oct 2008 18:30:11 BST, n3td3v said:
> You guys are living in cloud cuckoo land. The rogue government
> wouldn't have their bot nets in home computers that you could shut
> down easily.
Which is easier to shut down, an attack coming from a relatively small
number of /16s that belong to
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1
On Mon, Oct 6, 2008 at 5:24 AM, Steve Church <[EMAIL PROTECTED]> wrote:
> I'm surprised that no one has made a Skynet reference yet, perhaps
> because such a reference would be trite and predictable. I'm feeling
> trite and
> predictable this morning
> I'm feeling trite and
> predictable this morning, so allow me to be the first. Homeland Security is
> planning to launch Skynet.
Too late, we did that already
http://en.wikipedia.org/wiki/Skynet_(satellites)
brandon
-Original Message-
From: Steve Church [mailto:[EMAIL PROTECTED]
Sent: Monday, October 06, 2008 8:24 AM
To: nanog@nanog.org
Subject: Re: cnn.com - Homeland Security seeks cyber counterattack
system(Einstein 3.0)
> If it's going to "literally" shot down an attack like
I'm surprised that no one has made a Skynet reference yet, perhaps because
such a reference would be trite and predictable. I'm feeling trite and
predictable this morning, so allow me to be the first. Homeland Security is
planning to launch Skynet. I hope you guys have your nuclear bunkers
stock
> The system "would literally, like an anti-aircraft weapon, shoot down an
> attack before it hits its target," he said. "And that's what we call
> Einstein 3.0."
Oh dear.
I cringe whenever I read such a massacre of correct English like this.
If it's going to "literally" shot down an attack like
ea going through.
>>
>> http://lists.grok.org.uk/pipermail/full-disclosure/2008-May/062517.html
>>
>> All the best,
>>
>> n3td3v
>>
>> ------ Forwarded message --
>> From: Tony Patti <[EMAIL PROTECTED]>
>> Date: Sun, Oct 5, 2008 at 5:20 PM
&
Jean-François Mezei wrote:
I have a big problem with politicians making technical decisions that
may look good at the politicial level but make no sense at the technical
level.
Works in the financial world, doesn't it.
--
Eppure si rinfresca
ICBM Targeting Information: http://tinyurl.com/
I have a big problem with politicians making technical decisions that
may look good at the politicial level but make no sense at the technical
level.
"fighting back" implies that your own facilities will be busy pinging
thousands of bots to death around the world. Yeah, smart. Looks good
during a
> http://lists.grok.org.uk/pipermail/full-disclosure/2008-May/062517.html
>
> All the best,
>
> n3td3v
>
> ------ Forwarded message ------
> From: Tony Patti <[EMAIL PROTECTED]>
> Date: Sun, Oct 5, 2008 at 5:20 PM
> Subject: cnn.com - Homeland Security seeks cyber counterattac
Oct 5, 2008 at 5:20 PM
Subject: cnn.com - Homeland Security seeks cyber counterattack system
(Einstein 3.0)
To: "nanog@nanog.org"
I presume this CNN article falls within the "Internet operational and
technical issues" (especially security) criteria of the NANOG AUP,
in
s sufficiently fanatical on my machine that its uninstaller
committed suicide.
-Original Message-
From: Joel Jaeggli [mailto:[EMAIL PROTECTED]
Sent: Sunday, October 05, 2008 12:47 PM
To: Tony Patti
Cc: nanog@nanog.org
Subject: Re: cnn.com - Homeland Security seeks cyber counterattack
syste
Tony Patti wrote:
> I presume this CNN article falls within the "Internet operational and
> technical issues" (especially security) criteria of the NANOG AUP,
> in terms of "operat[ing] an Internet connected network",
> especially where Chertoff refers to " like an anti-aircraft weapon, shoot
> d
I presume this CNN article falls within the "Internet operational and technical
issues" (especially security) criteria of the NANOG AUP,
in terms of "operat[ing] an Internet connected network",
especially where Chertoff refers to " like an anti-aircraft weapon, shoot down
an [Internet] attack bef
34 matches
Mail list logo
