Slashdot Mirror
Antivirus Inventor Says Security Pros Are Wasting Time
talkinsecurity writes "Earlier this week Peter Tippett, chief scientist at the ICSA and the inventor of the progam that became Norton Antivirus, had some interesting things to say about the state of the security industry. In a nutshell, Tippett warned that about a third of the work that security departments do today is a waste of time. Tippett goes on to systematically blow holes in a lot of security's current best practices, including vulnerability research/patching, strong passwords, and the product evaluation process. 'If a hacker breaks into the password files of a corporation with 10,000 machines, he only needs to guess one password to penetrate the network, Tippett notes. "In that case, the long passwords might mean that he can only crack 2,000 of the passwords instead of 5,000," he said. "But what did you really gain by implementing them? He only needed one."' Some of his arguments are definitely debatable, but there is a lot of truth to what he's saying as well."
a small poem (haiku style), it is difficult to type correctly because of intentional typos and a few numbers substituting for letters, i even get it wrong myself about 1/3 of the time even though i know it by heart...
Politics is Treachery, Religion is Brainwashing
..security risks that are more likely to happen, like them getting an email with an attachment, or using a browser other than IE.Um, I must have misunderstood you.. just thought, you want to say, that the IE is a secure browser..
That story has more car analogies than an average /. thread.
Or to put it another way, if car analogies were like cars on a highway...
Blank until
"Peter Tippett, chief scientist at the ICSA and the inventor of the progam that became Norton Antivirus"
I'd be more prone to listen to security practices from the guy who...say...invented cheese string...
From my password file:
That "x" after the first colon indicates that the password is stored elsewhere --- in /etc/shadow, which is not world-readable:
So what does the corresponding entry in the shadow file look like?
Note to ACs: I usually delete AC replies without reading them. If you want to talk to me, log in.
Boss: Great! How'd you pull it off?
DBA: Well, we replaced all queries with 'Select * from tblQuery' which only has 1 row and 1 Column. Then stopped letting people call the queries!
Boss: You're fired...
Ask not what you can do for your country. Ask what your country did to you
And also to recognize that no system is perfect--there will always be the cantankerous guy who is inexplicably "invaluable" to the company who thinks that "fereng1" is an uncrackable password, for instance--and to take steps more along the lines of risk mitigation than risk removal.
Crap. I'd better go and change my password.
God your a tard.
Atheist, eh?
I think it would be better if nobody had the key, and the closet resided in the centre of a distant sun. Even then it's not 100% - that sun is gonna die if a few billion years..
which is totally what she said
Except that one, of course. ...whoa
You sound real nice. Will you be my sysadmin?
So, what you're saying is that we should all just quit putting bugs in our software in the first place? That's brilliant! I wonder why nobody ever thought of it before . . .
SIGSEGV caught, terminating
wait... not that kind of sig.
Nope, can't remember that other stuff either.
Yeah, the only way to 100% secure a PC is to disconnect it from the network, take out the power supply and then lock in a bank vault. You've never watched Alias have you?