Slashdot Mirror
Network Penetration Scans and Executive Reaction?
LazloToth asks: "I'm sure some of you have had this happen: your company pays the big bucks for a 3rd-party security audit and, when it comes back, you get called on the carpet for all the supposed 'holes' in your network. When you see the report, you recognize that it comes from a well-known open-source security scanner, and that the 'holes' in question are so obscure as to be meaningless. I told our risk management VP that to fix every item cited - - many of which were false positives or completely out of context - - would be next to impossible for our small IT staff, and that some of the fixes, if implemented, might have deleterious effects on an otherwise smoothly running operation. How do you handle these 3rd-party security people who make mountains out of every molehill?"
Quit your job and start a 3rd party security consulting company.
Toronto-area transit rider? Rate your ride.
How do you handle these 3rd-party security people who make mountains out of every molehill?
Post the company name and URL on slashdot and let them have a 'specialised security audit'...
LazloToth asks: "...How do you handle these 3rd-party security people who make mountains out of every molehill?"
I think we need more details on the severity of your security holes. Give us your company's IP range, and if we find anything significant we'll leave a note for you on your desktop.
When you have nothing left to burn you must set yourself on fire
If you can't be part of the solution, there is good money to be made in prolonging the problem.
"With sufficient thrust, pigs fly just fine." -- RFC 1925
BOFH
See where they did the scan from and drop all packets at the firewall from that domain?
I Am My Own Worst Enemy
In the mid-1990s, I ran IT for a graphic design firm, which consisted of some 50-75 Macintosh computers. Pretty much everything ran on Macs; even the accounting systems used Great Plains for Mac.
At one point, some of the staffers got the idea that network performance might not be optimal, and it was decided that we should do a performance audit. A contractor was brought in to spend a few hours sniffing our network, then go away and do a thorough, in-depth protocol analysis. The result of this analysis was a 20-page report detailing their findings.
The conclusion was that there was, indeed, a lot of unnecessary packets of traffic flying around the network. Their solution?
"Eliminate the Appletalk networking protocol."
Uh, yeah. Thanks guys, here's your $2,500.
(Maybe the best solution is to do whatever you can to educate management and set expectations at appropriate levels.)
Breakfast served all day!
Troll pts for that? I see we have a consultant mod in the house.
The Peanut Gallery, Ubergeek, Biblically Sober
NCAAbbs.com: Thousands of fans, Hundreds of teams, Just one place
Don't look a gift horse in the mouth. This is just the excuse you need to purchase that new equipment you've been lusting over. Just remember to put, "patch security hole", on the purchase req.
Show me on the doll where his noodly appendage touched you.
"How do you handle these 3rd-party security people who make mountains out of every molehill?"
That's not the first step. The first step is for your company to make you VP of risk management.
Here's the real thing!
http://bofh.ntk.net/Bastard_1995.html
Change your qmail banner string to read what an exchange server would read - an old, unpatched exchange server - and then watch the consultant's smile disappear after they list all of the vulnerabilities that you've got and you tell them that you were lying.
A fine is a tax you pay for doing wrong and a tax is a fine you pay for doing all right.
Hire a risk analyst to come in and look at the security report and then attach numbers to all the security issues and what those security issues could potentially lead to...
:)
Then you can hire another consultant to analyze the risk analyst's analysis to see how much it should cost you to clean those things up.
Then you'll have to hire some technical writers or some such to write up what you've done.
Like, duh!
(you'd think I were a consultant still! But no, I'm not anymore!)
-- There is no sig line, only Zuul.
Finding someone good isn't going to be cheap, but then again, if you're concerned about price, fire up Nessus or ISS and run it yourself.
;-)
Whoah... I'm all for good security, but don't you think using the International Space Station is a bit overkill?
Want to improve your Karma? Instead of "Post Anonymously", try the "Post Humously" option.
A shovel, a bag of lime and some carpet.
I'm me. I think.
We had one of these experts come in and look, he said we had huge security holes and gave us an estimate of how long he would take to fix them... I called him on the carpet and said, demonstrate one... so he did, and failed to..
The computer security expert sat there for 30 minutes confused as to why simply pressing escape at the login prompt did not get him into the system on our W2K boxes.
he mentioned to our Director that our systems must be mis-configured and that he noticed that our cisco 2950 switches were also not configured for 1000BaseT and we should enable the gigabit features of that switch.
I am NOT joking. this was the security expert hired by our company to see if we had security problems and to find any networking bottlenecks.
we simply let him leave after thanking him for his expertiese, the CTO of the company reccomended this moron and we cant tell the CTO that his brother-in-law is a complete and utter idiot.
Thankfully this was 3 years ago. and we were owned by a different company then... the executive staff all were sacked during the last merger.... One of the few times I welcomed a merger.
Do not look at laser with remaining good eye.
Could we get some IPs? We would like to independently verify your assertions.
it's surprising how often you can connect two completely unrelated events/actions and make them seem interdependent simply by matter-of-factly asserting that the connection exists.
Manager: How can we fix all these security holes?
You: We can fix them no problem, I'll need another unix box for scanning and a 20% pay rise.
Manager: Ha ha ha...very funny.
You: I'm deadly serious.
Manager: What...you're serious...why a 20% pay rise!
You: Ok...you're right...10% is closer to the reality.
Manager: That's better...thought you could pull one over on ol' Bill, didn't you eh?
You: Yeah...sorry about that.
If you're reading slashdot, what's the poor mechanical engineer doing?
:-)
Christ, man, you even suck at slacking!