Kinda busy lately and yeah this week (from Monday to Wednesday) I felt like I need another set of me to complete all the required tasks before Chinese New Year Holiday. Thankfully I managed to complete those even though with lots of lots of whining.
Managed to sneak out to the office (btw the boys and gals at my mother in law’s house at Desa Pandan) to check on the progress of our machines (which will be deployed on coming monday) Came across with this article at darkreading tho.
“Antivirus Inventor: Security Departments Are Wasting Their Time” which is really attract my attention. As most of the article content really reminds me to Marcus Ranum’s article about 6 Dumbest Idea in Computer Security .
To quote
“or example, today’s security industry focuses way too much time on vulnerability research, testing, and patching, Tippett suggested. “Only 3 percent of the vulnerabilities that are discovered are ever exploited,” he said. “Yet there is huge amount of attention given to vulnerability disclosure, patch management, and so forth.”
“Tippett compared vulnerability research with automobile safety research. “If I sat up in a window of a building, I might find that I could shoot an arrow through the sunroof of a Ford and kill the driver,” he said. “It isn’t very likely, but it’s possible.
“If I disclose that vulnerability, shouldn’t the automaker put in some sort of arrow deflection device to patch the problem? And then other researchers may find similar vulnerabilities in other makes and models,” Tippett continued. “And because it’s potentially fatal to the driver, I rate it as ‘critical.’ There’s a lot of attention and effort there, but it isn’t really helping auto safety very much.”
Agree on this. Reminds me about “Enumerating Badness” from MJR article tho.
“Tippett also suggested that many security pros waste time trying to buy or invent defenses that are 100 percent secure. “If a product can be cracked, it’s sometimes thrown out and considered useless,” he observed. “But automobile seatbelts only prevent fatalities about 50 percent of the time. Are they worthless? Security products don’t have to be perfect to be helpful in your defense.”
Yeah, and anyway you still need to understand the working mechanism of the product tho. It’s useless to have an SIEM that has super correlation engine if you dun have any idea what and how the heck it correlates.
“Security teams need to rethink the way they spend their time, focusing on efforts that could potentially pay higher security dividends, Tippett suggested. “For example, only 8 percent of companies have enabled their routers to do ‘default deny’ on inbound traffic,” he said. “Even fewer do it on outbound traffic. That’s an example of a simple effort that could pay high dividends if more companies took the time to do it.”
“Default Deny” is a YES
I can’t put much comment tho. My hands are full with our twin and their 2 sisters (sometimes I do feel that they have this some sort of me and wifey’s attention-getting competition”
p/s: Happy Chinese New Year to all my Chinese friends and colleagues