Subject: GA-DIGEST V1 #761
From: [email-masked] (GA-DIGEST)
To: [email-masked]

GA-DIGEST         Saturday, September 29 2001         Volume 01 : Number 761

----------------------------------------------------------------------

Date: Fri, 28 Sep 2001 09:02:10 -0700
From: Roeland Meyer <[email-masked]>
Subject: RE: [ga] Net security's a losing battle

|> From: Sandy Harris [mailto:[email-masked]]
|> Sent: Friday, September 28, 2001 8:13 AM

[snip:// many really good references to security]

|> Yes, but there are things that would have a positive impact. 
|> Notably, the
|> IETF has been at work for some years on protocols for a 
|> secure DNS. See:
|> 
|> http://www.toad.com/dnssec/index.html
|> http://www.ietf.org/html.charters/dnsext-charter.html
|> 
|> Currently, DNS is almost completely insecure. All the 
|> servers just accept
|> whatever another server tells them as gospel.

Excuse me. After all that good work, I must object to this. The current
system is actually quite good and it's all IP-based, not by name. Iff you
build to run a RFC2870 compliant server, which all zone server operators
should at least consider. You primary zone servers become non-recursive
vaults. You should have at least two and those two should be the ONLY ones
in the name server registration at the InternNIC and in the root zone file.
Your DNS resolvers should be at another IP address and should be the only
ones referenced in your zone files. Updates should only be allowed from
known IP addresses. TCP Wrappers should protect ALL systems from connecting
to strangers, via hosts.allow and BIND access control lists (ACL). Do not
take zone updates except from known systems and do not allow zone transfers,
except to known systems. Allow queries from anyone. Only use BIND, under
*nix, for public facing DNS servers. Even MS-DNS, as implemented under Win2K
Active Directory, allows this level of control (although I would never use
it to implement a zone server). Most routers are secured similarly.

Now, as to the threat of sniffing, Most modern networks are almost pure
switched, sniffers (including SNORT) don't work very well here or anywhere
else. The perp would have to actually get on the WAN port(s), for a
man-in-the-middle attack. co-opting a insecure host, doesn't buy you much
these days, especially on another switched subnet (you don't even see the
broadcast packets).

|> Currently, if an EvilDoer can intercept DNS queries or 
|> subvert a server,
|> then he or she can do almost anything. Tell you 
|> bigcompany.com does not
|> exist, send anyone who asks for that company to big_company_sucks.org
|> instead, or send everyone to Pornographic Priscilla's 
|> Punishment Pagoda.
|> Or, by subverting the DNS an e-commerce site relies on, send all that
|> site's customers to a bogus bank for their credit card transactions.
|> Or ...
|> 
|> If critical infrastuture relies on the net and therefore on DNS, then
|> clever variants of DNS attacks can do enormous damage. Other measures
|> -- such as PGP-signing any important email and widespread 
|> use of secure
|> IPsec tunnels -- can vastly reduce the risks here, but it is far from
|> certain they can reduce it to zero. 
|> 
|> The obvious fix is to build authentication into the DNS software so
|> that servers can tell what information they can trust. Most of the
|> work of specifying appropriate protocols for this has been done.
|> See the IETF site above. 
|> 
|> I'm not certain what state the implementations are in. Certainly some
|> work has been done, e.g. in BIND 9 (www.isc.org), but I don't know
|> how complete that is, or how widely deployed, or whether other DNS
|> servers have DNSsec support yet.
|> 
|> Once there are viable implementations, questions arise of how to get
|> zone records (especially the root zones) signed, and more generally
|> how to run a secure DNS. These will largely be decided in the IETF 
|> DNS Operations working group:
|> 
|> http://www.ietf.org/html.charters/dnsop-charter.html
|> 
|> However, methinks ICANN might have a role to play in ensuring that
|> the registrars actually act on this in a timely fashion, and that
|> Verisign or others do not attempt to hijack the process into becoming
|> a marketing scheme for proprietary signature technologies.
|> 
|> I raised these questions about a year ago and got responses 
|> indicating
|> that some knowledgable folk considered this out of scope for 
|> ICANN and
|> that, in any case, the IETF work was not finished so the 
|> questions did
|> not arise yet.
|> 
|> That was then, this is now.
|> 
|> If the focus of the next ICANN meeting is to be security, methinks
|> the question of what ICANN needs to do about DNSsec depolyment goes
|> right at the top of the agenda.
|> --
|> This message was passed to you via the [email-masked] list.
|> Send mail to [email-masked] to unsubscribe
|> ("unsubscribe ga" in the body of the message).
|> Archives at http://www.dnso.org/archives.html
|> 
- --
This message was passed to you via the [email-masked] list.
Send mail to [email-masked] to unsubscribe
("unsubscribe ga" in the body of the message).
Archives at http://www.dnso.org/archives.html

------------------------------

Date: Fri, 28 Sep 2001 16:28:45 +0000
From: "Roberto Gaetano" <[email-masked]>
Subject: Re: [ga] Net security's a losing battle

Hi.

I concur with Sandy's post, but would also add a comment.

The most spectacular effect that the terrorist attack has created is the 
collapse of the Twin Towers, and the most sad effect are the thousands of 
casualties, but there is another effect that has not to be underestimated: 
the critical situation in which the western economy has been put. I speak 
about the impact on airline industry, the burden on insurance companies, the 
drop in the stock market, and other things that will impact us for the years 
to come (higher insurance premia, higher cost of travel, longer boarding 
times, etc.).

The terrorists of the new millennium might well concentrate on these kind of 
damages, that are less likely to create horror for their acts, and therefore 
less likely to create a consensus front against them.
Our Net has been built and is being operated in a way that will survive well 
nuclear attacks, but less well electronic sabotage.
Somebody has asked in this forum what would have happened if a root server 
would have been located in lower Manhattan (or, for this purpose, even in 
the Twin Towers). The answer is, IMHO, "Nothing, the other 12 would have 
been more than sufficient". In fact, the Net would have suffered under 
(physical) attack to half a dozen of roots at the same time much less than 
what it suffered under Kashpureff's electronic attack few years ago.

I do believe that it is a responsible answer from ICANN to address these 
issues before the terrorists find out how they can attack the DNS and 
jeopardize its functioning, creating billions of damage to the western 
economy. The big problem is, IMHO, that a lot of people see the DNS as a 
milk cow, and are very little motivated to deploy secure procedures (more 
costly and requiring higher expertise) if they see this as a risk for their 
profits. Therefore the only way to progress on this is to include security 
requirements in the contracts ICANN has with the different parties 
(Registries and accredited Registrars).

I am saddened by the delay that this may have on other issues, on which I am 
contributing and I would see progressing (like the AtLarge), but I am also 
looking forward to see an open debate on security, as a vital subject for 
the survival of the Net as we know it today.

Regards
Roberto
(Sandy's excellent post cut for bandwidth)

_________________________________________________________________
Get your FREE download of MSN Explorer at http://explorer.msn.com/intl.asp

- --
This message was passed to you via the [email-masked] list.
Send mail to [email-masked] to unsubscribe
("unsubscribe ga" in the body of the message).
Archives at http://www.dnso.org/archives.html

------------------------------

Date: Fri, 28 Sep 2001 09:36:32 -0700
From: Kent Crispin <[email-masked]>
Subject: Re: [ga] Net security's a losing battle

On Fri, Sep 28, 2001 at 07:59:48AM -0700, Patrick Greenwell wrote:
> > based on the notion that you can build products to plug the holes," said
> > Schneier. "But we are losing the battle with computer security. We are
> > building new products, but every year gets actively worse."
> 
> F.U.D. The problem is *with* the new products, because organizations are
> so rushed to shove product out the door security if it is considered at
> all is largely an afterthought. This does not render the problem
> unsolvable. 

Whether it is solvable or not, it is a real problem, not FUD. 

> Do away with laughable EULA's(would you buy a car that said
> "may blow up or not run at all but we're not responsible?") and start
> holding companies accountable for the crap they are foisting upon the public
> and I guarantee you'd see a world of change.

If everybody would just get along, we would have world peace.  The 
devil is in the details.

- -- 
Kent Crispin                               "Be good, and you will be
[email-masked]                           lonesome." -- Mark Twain
- --
This message was passed to you via the [email-masked] list.
Send mail to [email-masked] to unsubscribe
("unsubscribe ga" in the body of the message).
Archives at http://www.dnso.org/archives.html

------------------------------

Date: Fri, 28 Sep 2001 12:16:49 -0700
From: Jeff Williams <[email-masked]>
Subject: Re: [ga] Net security's a losing battle

Joanna and all assembly members,

  We don't agree with this particular point of view.  Anytime someone uses
the term(s) "Never" or "Always" they are usually incorrect.

Joanna Lane wrote:

> http://www.zdnet.com/zdnn/stories/news/0,4586,2814883,00.html
>
> Expert: Net security's a losing battle
>
> By Wendy McAuliffe
> ZDNet (UK)
> September 26, 2001 11:39 AM PT
>
> "The complexity of the Internet is increasing more rapidly than our ability
> to secure it, according to Internet security expert Bruce Schneier.
>
> At the opening of the annual Information Security Solutions Europe (ISSE)
> conference in London on Wednesday, Schneier, who is chief technology officer
> of Counterpane Internet Security, claimed that the problem of Internet
> security will never be resolved.
>
> "Traditionally, Internet security has been thought of as a technology issue,
> based on the notion that you can build products to plug the holes," said
> Schneier. "But we are losing the battle with computer security. We are
> building new products, but every year gets actively worse."
>
> Regards,
> Joanna
>
> --
>

Regards,

- --
Jeffrey A. Williams
Spokesman for INEGroup - (Over 118k members strong!)
CEO/DIR. Internet Network Eng/SR. Java/CORBA Development Eng.
Information Network Eng. Group. INEG. INC.
E-Mail [email-masked]
Contact Number:  972-447-1800 x1894 or 214-244-4827
Address: 5 East Kirkwood Blvd. Grapevine Texas 75208

- --
This message was passed to you via the [email-masked] list.
Send mail to [email-masked] to unsubscribe
("unsubscribe ga" in the body of the message).
Archives at http://www.dnso.org/archives.html

------------------------------

Date: Fri, 28 Sep 2001 10:50:26 -0700
From: Roeland Meyer <[email-masked]>
Subject: RE: [ga] Net security's a losing battle

[sorry, I wasn't finished, accidently hit send]

|> From: Sandy Harris [mailto:[email-masked]]
|> Sent: Friday, September 28, 2001 8:13 AM

[snip:// many really good references to security]

|> Yes, but there are things that would have a positive impact. 
|> Notably, the
|> IETF has been at work for some years on protocols for a 
|> secure DNS. See:
|> 
|> http://www.toad.com/dnssec/index.html
|> http://www.ietf.org/html.charters/dnsext-charter.html
|> 
|> Currently, DNS is almost completely insecure. All the 
|> servers just accept
|> whatever another server tells them as gospel.

Excuse me. After all that good work, I must object to this. The current
system is actually quite good and it's all IP-based, not by name. Iff you
build to run a RFC2870 compliant server, which all zone server operators
should at least consider. You primary zone servers become non-recursive
vaults. You should have at least two and those two should be the ONLY ones
in the name server registration at the InternNIC and in the root zone file.
Your DNS resolvers should be at another IP address and should be the only
ones referenced in your zone files. Updates should only be allowed from
known IP addresses. TCP Wrappers should protect ALL systems from connecting
to strangers, via hosts.allow and BIND access control lists (ACL). Do not
take zone updates except from known systems and do not allow zone transfers,
except to known systems. Allow queries from anyone. Only use BIND, under
*nix, for public facing DNS servers. Even MS-DNS, as implemented under Win2K
Active Directory, allows this level of control (although I would never use
it to implement a zone server). Most routers are secured similarly.

Now, as to the threat of sniffing, Most modern networks are almost pure
switched, sniffers (including SNORT) don't work very well here or anywhere
else. The perp would have to actually get on the WAN port(s), for a
man-in-the-middle attack. co-opting a insecure host, doesn't buy you much
these days, especially on another switched subnet (you don't even see the
broadcast packets).

|> Currently, if an EvilDoer can intercept DNS queries or 
|> subvert a server, then he or she can do almost anything. Tell you 
|> bigcompany.com does not
|> exist, send anyone who asks for that company to big_company_sucks.org
|> instead, or send everyone to Pornographic Priscilla's 
|> Punishment Pagoda.

[sorry, I wasn't finished, accidently hit send]

In order to intercept queries,or any other packets, one must be in logical
line of transit. That is, ALL packets have to go through Joe Evildoer's
host/router. This is a classic man-in-the-middle attack scenario. It is
amazingly difficult to do. Usually, only your upstream can even think about
it and ONLY if you aren't multi-homed, or running some sort of dynamic
routing protocol, like BGP4, or not using a VPN. In all cases, this scenario
is not so difficult to detect. In fact, SSH based VPNs will detect this
immediately.

|> Or, by subverting the DNS an e-commerce site relies on, send all that
|> site's customers to a bogus bank for their credit card transactions.
|> Or ...

I'm sorry, but it has been standard practice, at MHSC, to outfit an
ecommerce site with it's own DNS cluster, including root-zone authority and
internal TLDs. We charge about $12K for four DNS appliances (2 RFC2870 zone
servers and 2 stub-resolvers) and to configure them (it takes 10 IP
addresses). Anyone doing eCommerce will have their own subnet, or at least a
/27, simply because they are not going to bet the whole farm on a single
host. In fact, for various production operations reasons, you are going to
have at least eight (8) multi-homed hosts (including routers and switches,
each with mutiple IP addresses per NIC), mounted in a colo farm, like
AboveNet. Or have a minimum of a DS1, in your office complex, along with the
rest of your office LAN, also a subnet. Anything less, begs for trouble.

Given that, plus what I stated above that, It is physically difficult to
subvert that site's DNS subsystem or any other part of that site. This is
basic network architecture (see http://www.mhsc.com/roles.htm), along with
multi-tiered LAN architectures (RDBMS hosts shouldn't even be physically
visible to the Internet.  It goes without saying that none of this should be
NAT'd. Those who don't do this, or something like it, will feel (have felt)
the Darwin-Effect.

|> If critical infrastuture relies on the net and therefore on DNS, then
|> clever variants of DNS attacks can do enormous damage. Other measures
|> -- such as PGP-signing any important email and widespread 
|> use of secure
|> IPsec tunnels -- can vastly reduce the risks here, but it is far from
|> certain they can reduce it to zero. 

No security risk can be reduced to absolute zero. But, one can reach a
cost-effective mitigation point. Personally, I feel that every packet should
use strong encryption and every session should use reasonably strong
authentication.

|> The obvious fix is to build authentication into the DNS software so
|> that servers can tell what information they can trust. Most of the
|> work of specifying appropriate protocols for this has been done.
|> See the IETF site above. 

There are infrastructure problems, usually involving NAT, for both IPSEC and
DNSSEC. Most of it due to the lack of PKI standards and systems.

|> I'm not certain what state the implementations are in. Certainly some
|> work has been done, e.g. in BIND 9 (www.isc.org), but I don't know
|> how complete that is, or how widely deployed, or whether other DNS
|> servers have DNSsec support yet.

|> Once there are viable implementations, questions arise of how to get
|> zone records (especially the root zones) signed, and more generally
|> how to run a secure DNS. These will largely be decided in the IETF 
|> DNS Operations working group:
|> 
|> http://www.ietf.org/html.charters/dnsop-charter.html

Many of us have just about given up on the IETF producing anything useful
and non-political these days. Short-sighted geeks clash with business
requirements (and often disregard the latter). Besides, running DNS, inside
of a VPN, obliviates the need for DNSSEC.

|> However, methinks ICANN might have a role to play in ensuring that
|> the registrars actually act on this in a timely fashion, and that
|> Verisign or others do not attempt to hijack the process into becoming
|> a marketing scheme for proprietary signature technologies.

Yes, that is my fear as well. But, I run a CA too<g>.

|> I raised these questions about a year ago and got responses 
|> indicating
|> that some knowledgable folk considered this out of scope for 
|> ICANN and
|> that, in any case, the IETF work was not finished so the 
|> questions did not arise yet.
|> 
|> That was then, this is now.

It's still out of primary scope for ICANN. ICANN needs to secure its own
systems, that is all.

|> If the focus of the next ICANN meeting is to be security, methinks
|> the question of what ICANN needs to do about DNSsec depolyment goes
|> right at the top of the agenda.

No it doesn't. Or, in a more politically correct phrase ... I disagree.

- --
R O E L A N D  M J  M E Y E R
Managing Director
Morgan Hill Software Company
tel: +1 925 373 3954
cel: +1 925 352 3615
fax: +1 925 373 9781 
http://www.mhsc.com
- --
This message was passed to you via the [email-masked] list.
Send mail to [email-masked] to unsubscribe
("unsubscribe ga" in the body of the message).
Archives at http://www.dnso.org/archives.html

------------------------------

Date: Fri, 28 Sep 2001 10:54:24 -0700
From: Roeland Meyer <[email-masked]>
Subject: RE: [ga] Net security's a losing battle

see http://www.mhsc.com/news.htm
thank you.

|> -----Original Message-----
|> From: Roberto Gaetano [mailto:[email-masked]]
|> Sent: Friday, September 28, 2001 9:29 AM
|> To: [email-masked]; [email-masked]
|> Subject: Re: [ga] Net security's a losing battle
|> 
|> 
|> Hi.
|> 
|> I concur with Sandy's post, but would also add a comment.
|> 
|> The most spectacular effect that the terrorist attack has 
|> created is the 
|> collapse of the Twin Towers, and the most sad effect are the 
|> thousands of 
|> casualties, but there is another effect that has not to be 
|> underestimated: 
|> the critical situation in which the western economy has been 
|> put. I speak 
|> about the impact on airline industry, the burden on 
|> insurance companies, the 
|> drop in the stock market, and other things that will impact 
|> us for the years 
|> to come (higher insurance premia, higher cost of travel, 
|> longer boarding 
|> times, etc.).
|> 
|> The terrorists of the new millennium might well concentrate 
|> on these kind of 
|> damages, that are less likely to create horror for their 
|> acts, and therefore 
|> less likely to create a consensus front against them.
|> Our Net has been built and is being operated in a way that 
|> will survive well 
|> nuclear attacks, but less well electronic sabotage.
|> Somebody has asked in this forum what would have happened if 
|> a root server 
|> would have been located in lower Manhattan (or, for this 
|> purpose, even in 
|> the Twin Towers). The answer is, IMHO, "Nothing, the other 
|> 12 would have 
|> been more than sufficient". In fact, the Net would have 
|> suffered under 
|> (physical) attack to half a dozen of roots at the same time 
|> much less than 
|> what it suffered under Kashpureff's electronic attack few years ago.
|> 
|> I do believe that it is a responsible answer from ICANN to 
|> address these 
|> issues before the terrorists find out how they can attack 
|> the DNS and 
|> jeopardize its functioning, creating billions of damage to 
|> the western 
|> economy. The big problem is, IMHO, that a lot of people see 
|> the DNS as a 
|> milk cow, and are very little motivated to deploy secure 
|> procedures (more 
|> costly and requiring higher expertise) if they see this as a 
|> risk for their 
|> profits. Therefore the only way to progress on this is to 
|> include security 
|> requirements in the contracts ICANN has with the different parties 
|> (Registries and accredited Registrars).
|> 
|> I am saddened by the delay that this may have on other 
|> issues, on which I am 
|> contributing and I would see progressing (like the AtLarge), 
|> but I am also 
|> looking forward to see an open debate on security, as a 
|> vital subject for 
|> the survival of the Net as we know it today.
|> 
|> Regards
|> Roberto
|> (Sandy's excellent post cut for bandwidth)
|> 
|> 
|> 
|> _________________________________________________________________
|> Get your FREE download of MSN Explorer at 
http://explorer.msn.com/intl.asp

- --
This message was passed to you via the [email-masked] list.
Send mail to [email-masked] to unsubscribe
("unsubscribe ga" in the body of the message).
Archives at http://www.dnso.org/archives.html
- --
This message was passed to you via the [email-masked] list.
Send mail to [email-masked] to unsubscribe
("unsubscribe ga" in the body of the message).
Archives at http://www.dnso.org/archives.html

------------------------------

Date: Fri, 28 Sep 2001 11:01:46 -0700
From: Roeland Meyer <[email-masked]>
Subject: RE: [ga] Net security's a losing battle

|> From: Kent Crispin [mailto:[email-masked]]
|> Sent: Friday, September 28, 2001 9:37 AM

|> On Fri, Sep 28, 2001 at 07:59:48AM -0700, Patrick Greenwell wrote:
|> > > based on the notion that you can build products to plug 
|> the holes," said
|> > > Schneier. "But we are losing the battle with computer 
|> security. We are
|> > > building new products, but every year gets actively worse."
|> > 
|> > F.U.D. The problem is *with* the new products, because 
|> organizations are
|> > so rushed to shove product out the door security if it is 
|> considered at
|> > all is largely an afterthought. This does not render the problem
|> > unsolvable. 
|> 
|> Whether it is solvable or not, it is a real problem, not FUD. 

The real problem is net admins that don't keep up with the notices and
upgrades. I have a number of Win2K and Linux host that have survived both
Code Red and Nimda. NO ONE writes absolutely secure software, just like NO
ONE writes 100% bug-free systems. With millions of lines of code, it would
take millions of years for exhaustive testing. We can do 100% unit testing,
but current problems are integration level issues. Do multiple units
interact securely?. No one can find all of those permutations prior to
product release, or even post-release.

see http://www.netcraft.com/Survey/

|> > Do away with laughable EULA's(would you buy a car that said
|> > "may blow up or not run at all but we're not 
|> responsible?") and start
|> > holding companies accountable for the crap they are 
|> foisting upon the public
|> > and I guarantee you'd see a world of change.
|> 
|> If everybody would just get along, we would have world peace.  The 
|> devil is in the details.

- --
This message was passed to you via the [email-masked] list.
Send mail to [email-masked] to unsubscribe
("unsubscribe ga" in the body of the message).
Archives at http://www.dnso.org/archives.html

------------------------------

Date: Fri, 28 Sep 2001 13:56:43 -0400
From: Joanna Lane <[email-masked]>
Subject: Re: [ga] Net security's a losing battle

HI Patrick,

Your comments are interesting, but what caught my attention was Scheier's
comments about having enough data, but not knowing how to use it, and his
viewpoint that companies are reluctant to report cyberattacks because of the
stigma, making things worse. These appear later in the article.

I don't mean to split hairs, but on a point of order, when replying to my
post, you deleted all reference to the publisher of the original article,
ZDNet (UK) and the article's writer, Wendy McAuliffe. The casual observer
might think I had written the quote, or that it expressed my views, whereas
my intention was only to post a reference to an independant source of
information without personal comment.

FYI, the URL of the full article is at
http://www.zdnet.com/zdnn/stories/news/0,4586,2814883,00.html.

Regards,
Joanna 

on 9/28/01 10:59 AM, Patrick Greenwell at [email-masked] wrote:

> On Fri, 28 Sep 2001, Joanna Lane wrote:
> 
>> "Traditionally, Internet security has been thought of as a technology issue,
>> based on the notion that you can build products to plug the holes," said
>> Schneier. "But we are losing the battle with computer security. We are
>> building new products, but every year gets actively worse."
> 
> F.U.D. The problem is *with* the new products, because organizations are
> so rushed to shove product out the door security if it is considered at
> all is largely an afterthought. This does not render the problem
> unsolvable. Do away with laughable EULA's(would you buy a car that said
> "may blow up or not run at all but we're not responsible?") and start
> holding companies accountable for the crap they are foisting upon the public
> and I guarantee you'd see a world of change.
> 
> 
> 
> 
> /\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\
> Patrick Greenwell
> "There should be warning labels for politicians."
> --  Derek Smalls
> \/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/
> 
> --
> This message was passed to you via the [email-masked] list.
> Send mail to [email-masked] to unsubscribe
> ("unsubscribe ga" in the body of the message).
> Archives at http://www.dnso.org/archives.html
> 

- --
This message was passed to you via the [email-masked] list.
Send mail to [email-masked] to unsubscribe
("unsubscribe ga" in the body of the message).
Archives at http://www.dnso.org/archives.html

------------------------------

Date: Fri, 28 Sep 2001 11:14:59 -0700 (PDT)
From: Patrick Greenwell <[email-masked]>
Subject: Re: [ga] Net security's a losing battle

On Fri, 28 Sep 2001, Joanna Lane wrote:

> HI Patrick,
>
> Your comments are interesting, but what caught my attention was Scheier's
> comments about having enough data, but not knowing how to use it, and his
> viewpoint that companies are reluctant to report cyberattacks because of the
> stigma, making things worse. These appear later in the article.

It's not just stigma, it's a potential liability issue as well.

I do believe that the idea that Internet security is a losing battle is
alarmist hogwash.

Hit something with a stick for long enough and eventually the object of
attention is going to take steps to avoid getting hit.

> I don't mean to split hairs, but on a point of order, when replying to my
> post, you deleted all reference to the publisher of the original article,
> ZDNet (UK) and the article's writer, Wendy McAuliffe. The casual observer
> might think I had written the quote, or that it expressed my views, whereas
> my intention was only to post a reference to an independant source of
> information without personal comment.

My apologies regarding the redaction.

/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\
                               Patrick Greenwell
                 "There should be warning labels for politicians."
                            --  Derek Smalls
\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/

- --
This message was passed to you via the [email-masked] list.
Send mail to [email-masked] to unsubscribe
("unsubscribe ga" in the body of the message).
Archives at http://www.dnso.org/archives.html

------------------------------

Date: Fri, 28 Sep 2001 17:25:31 -0400
From: Joanna Lane <[email-masked]>
Subject: Re: [ga] Net security's a losing battle

on 9/28/01 2:14 PM, Patrick Greenwell at [email-masked] wrote:

> On Fri, 28 Sep 2001, Joanna Lane wrote:
>> what caught my attention was Scheier's [...] his viewpoint that companies are
reluctant to report cyberattacks because of the stigma, making things worse.
> 
> It's not just stigma, it's a potential liability issue as well.

A company that sets out to hide from legal responsibilities is not one the
industry should be defending. Reluctance to share reports amongst colleagues
for any reason would hamper the industry's overall ability to exercise
damage limitation. I'm not sure that's an acceptable position for an
organization that is accountable to the public for regulating the security
of the industry's critical infrastructure.
 
> I do believe that the idea that Internet security is a losing battle is
> alarmist hogwash.
> 
> Hit something with a stick for long enough and eventually the object of
> attention is going to take steps to avoid getting hit.

Hit hard enough, the object is going to suffer catastrophic failure from a
single event.

> My apologies regarding the redaction.
Thank you.

Regards,
Joanna
> 
> 
> /\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\
> Patrick Greenwell
> "There should be warning labels for politicians."
> --  Derek Smalls
> \/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/
> 
> 

- --
This message was passed to you via the [email-masked] list.
Send mail to [email-masked] to unsubscribe
("unsubscribe ga" in the body of the message).
Archives at http://www.dnso.org/archives.html

------------------------------

Date: Fri, 28 Sep 2001 14:40:44 -0700
From: William X Walsh <[email-masked]>
Subject: Re[2]: [ga] Net security's a losing battle

Friday, Friday, September 28, 2001, 2:25:31 PM, Joanna Lane wrote:

> on 9/28/01 2:14 PM, Patrick Greenwell at [email-masked] wrote:

>> On Fri, 28 Sep 2001, Joanna Lane wrote:
>>> what caught my attention was Scheier's [...] his viewpoint that companies are
> reluctant to report cyberattacks because of the stigma, making things worse.
>> 
>> It's not just stigma, it's a potential liability issue as well.

> A company that sets out to hide from legal responsibilities is not one the
> industry should be defending. Reluctance to share reports amongst colleagues

A company who doesn't think about protecting itself from liability is
a foolish company who probably won't be around long.  Not to mention,
that if they are a corporation, they have a responsibility to do so.

We live in a litigious society, it's a simple reality.

- -- 
Best regards,
William X Walsh <[email-masked]>
Userfriendly.com Domains
The most advanced domain lookup tool on the net
DNS Services from $1.65/mo

- --
This message was passed to you via the [email-masked] list.
Send mail to [email-masked] to unsubscribe
("unsubscribe ga" in the body of the message).
Archives at http://www.dnso.org/archives.html

------------------------------

Date: Fri, 28 Sep 2001 14:43:02 -0700 (PDT)
From: Patrick Greenwell <[email-masked]>
Subject: Re: [ga] Net security's a losing battle

On Fri, 28 Sep 2001, Joanna Lane wrote:

> on 9/28/01 2:14 PM, Patrick Greenwell at [email-masked] wrote:
>
> > On Fri, 28 Sep 2001, Joanna Lane wrote:
> >> what caught my attention was Scheier's [...] his viewpoint that companies are
> reluctant to report cyberattacks because of the stigma, making things worse.
> >
> > It's not just stigma, it's a potential liability issue as well.
>
> A company that sets out to hide from legal responsibilities is not one the
> industry should be defending. Reluctance to share reports amongst colleagues
> for any reason would hamper the industry's overall ability to exercise
> damage limitation. I'm not sure that's an acceptable position for an
> organization that is accountable to the public for regulating the security
> of the industry's critical infrastructure.

Joanne,

I was speaking of individual private corporations, and not ICANN.

/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\
                               Patrick Greenwell
                 "There should be warning labels for politicians."
                            --  Derek Smalls
\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/

- --
This message was passed to you via the [email-masked] list.
Send mail to [email-masked] to unsubscribe
("unsubscribe ga" in the body of the message).
Archives at http://www.dnso.org/archives.html

------------------------------

Date: Fri, 28 Sep 2001 17:36:47 -0400
From: Joanna Lane <[email-masked]>
Subject: [ga] FW: Energy and Commerce Markup Session:  10/3/2001

From: Energy and Commerce Press <[email-masked]>
Reply-To: "Energy and Commerce News" <[email-masked]>
Date: Fri, 28 Sep 2001 16:10:59 -0400
To: "Energy and Commerce News" <[email-masked]>
Subject: Energy and Commerce Markup Session:  10/3/2001

The Full Committee will meet in OPEN MARKUP SESSION at 10:00 a.m. on
Wednesday, October 3, 2001 in 2123 Rayburn House Office Building, to
consider the following measures:

H.R. ____, a Committee Print, to amend the Antiterrorism and Effective Death
Penalty Act of 1996 with respect to the responsibilities of the Secretary of
Health and Human Services regarding biological agents and toxins, and to
amend title 18, United States Code, with respect to such agents and toxins;

H.R. ____, a Committee Print, to strengthen security at certain nuclear
facilities, and for other purposes; and,

H.R. ____, a Committee Print, to clarify the application of cable television
system privacy requirements to new cable services.

For the latest scheduling information, please visit
http://www.house.gov/commerce/schedule.htm

- ----------------------------------------
The House Committee on Energy and Commerce
W.J. "Billy" Tauzin, Chairman
(202) 225-2927
http://www.house.gov/commerce

- --
This message was passed to you via the [email-masked] list.
Send mail to [email-masked] to unsubscribe
("unsubscribe ga" in the body of the message).
Archives at http://www.dnso.org/archives.html

------------------------------

Date: Fri, 28 Sep 2001 14:57:46 -0700
From: Roeland Meyer <[email-masked]>
Subject: RE: [ga] Net security's a losing battle

|> From: Joanna Lane [mailto:[email-masked]]
|> Sent: Friday, September 28, 2001 2:26 PM
|> 
|> on 9/28/01 2:14 PM, Patrick Greenwell at 
|> [email-masked] wrote:
|> 
|> > On Fri, 28 Sep 2001, Joanna Lane wrote:
|> >> what caught my attention was Scheier's [...] his 
|> viewpoint that companies are
|> reluctant to report cyberattacks because of the stigma, 
|> making things worse.
|> > 
|> > It's not just stigma, it's a potential liability issue as well.
|> 
|> A company that sets out to hide from legal responsibilities 
|> is not one the
|> industry should be defending. Reluctance to share reports 
|> amongst colleagues
|> for any reason would hamper the industry's overall ability 
|> to exercise
|> damage limitation. I'm not sure that's an acceptable position for an
|> organization that is accountable to the public for 
|> regulating the security
|> of the industry's critical infrastructure.

A slight correction here, A company's accountability is to its shareholders
and/or investors. This means that it must avoid unnecessary litigation
expenses as a part of the unwritten charter. Those that don't may suffer a
rapid change of leadership. No one reports all cyber-attacks, exactly for
liability reasons. Minimizing legal exposure. Employees have gotten fired
for this in the past. I've personally done some of the firing.

We are not talking about ICANN here, rather a corporation that provides
Internet services (ICANN arguably doesn't, being political and all).
Security standards were NEVER a part of the ICANN charter, BTW.

|> > I do believe that the idea that Internet security is a 
|> losing battle is
|> > alarmist hogwash.
|> > 
|> > Hit something with a stick for long enough and eventually 
|> the object of
|> > attention is going to take steps to avoid getting hit.
|> 
|> Hit hard enough, the object is going to suffer catastrophic 
|> failure from a
|> single event.

Be that as it may, they become some of my better customers. Afterwards,
those are the ones that actually listen. Complacency is one of the larger
problems here.
- --
This message was passed to you via the [email-masked] list.
Send mail to [email-masked] to unsubscribe
("unsubscribe ga" in the body of the message).
Archives at http://www.dnso.org/archives.html

------------------------------

Date: Fri, 28 Sep 2001 18:27:06 -0400
From: Sandy Harris <[email-masked]>
Subject: Re: [ga] Net security's a losing battle

Joanna Lane wrote:
> 
> HI Patrick,
> 
> Your comments are interesting, but what caught my attention was Scheier's
> comments about having enough data, but not knowing how to use it, and his
> viewpoint that companies are reluctant to report cyberattacks because of the
> stigma, making things worse. These appear later in the article.

The classic paper on this is Ross Anderson "Why Cryptosystems Fail"
http://www.cl.cam.ac.uk/users/rja14/wcf.html

He surveyed a number of failures, mainly in British banikng systems, and
found that nearly all were due to flawed procedures or poor management,
not to either techinical flaws or simple "human error" by staff.
- --
This message was passed to you via the [email-masked] list.
Send mail to [email-masked] to unsubscribe
("unsubscribe ga" in the body of the message).
Archives at http://www.dnso.org/archives.html

------------------------------

End of GA-DIGEST V1 #761
************************