It seems that the process is not that bad (even though your description does look a lot worse). Subscribe to the Microsoft Security Bulletins and they have a full description of each patch that they put out on Patch Tuesday (e.g., https://technet.microsoft.com/...). The same goes with RHSA. Subscribe to the updates that you are interested in; these will most likely be your OS, web servers, app servers, other software installed. Similarly, most vendors run security patch announcements. There will likely be a lot of noise but in a couple of months you will know how to extract the information the change advisory board needs.
Here's the positive aspect of CAB: if you screw something up, you have someone else to blame!;-)
By the time they fix the clock, it'd be 100 days and the clock would be slower by 100 days! Then they'll try to fix again and the clock would be slower by 100 days again!....ad infinitum...
Better to break that cycle by not embarking on this journey!
Read Avinash Dixit's Thinking Strategically to get started. It's a great book which does not use much math and can make for light reading and a great start.
If they use some kind of domain administrator passwords for this software to run guess what, the domain administrator credentials could be cached in every single computer. If a local administrator was on the machine and wanted to compromise, he/she could run hash stealing software when this "process" runs and compromise the domain.
The least possible privileges for a process that does this data searching will be difficult to determine. A trade-off will have to be done between accessibility of files and a lesser privileged account to be used for an exercise like this on Windows.
The credit card companies and banks are wanting to shift the residual risk to the customers. That's why they want you to pay for "SafeProtect" etc. for which you have to pay in advance so they monitor any ID thefts. My question is shouldn't they already be doing that? If yes, then why do they want you to pay for it? Cost reduction in my humble opinion.
I think apple should launch another ad campaign with the "Cool" mac guy on one side and a security guy on the other! The "Cool" guy could put his head in the sand and shout "Don't make me do stuff!".
Well...he got the money from a by-product of a fringe benefit of the hack (Hack->useful information (insider info)->steal). Would a similar argument be applicable if he was able to siphon money from individuals' accounts had he gained some passwords (Hack ->useful information(passez) -> steal). I wouldn't think so. Agreed, that he was not an insider so he can't be convicted for insider trading...but there should have been at least one more lawsuit going against him!
There have been statistics published all across the news and magazines, for example http://www.foxnews.com/story/0,2933,304456,00.html If apple/at&t wasn't tracking the iPhones through their IMEIs how could they have published these numbers?
Now that they've branded all P2P as illegal, what about someone downloading say linux ISO images or open source software? also, what about internal P2P sharing would that be branded as illegal as well?
What is the definition that they will use for Denial-of-Service attack i.e., when would I be considered under a DoS, if my site completely goes down? Or if I see a 50% drop in performance? Also, who will they arrest? If I had a spyware/malware on my PC without my knowledge would I be considered an offender? These things probably need to be crystallized too.
So now, not only Google but also the terrorists would know which key Indian establishments are located where: Key establishment is a blurred spot! Who knows how complete is the list of key establishments provided to google? Also, there are techniques to get information about the real image out of blurred images. This link http://dheera.net/projects/blur.php is only about numbers but I'm sure there are other ways to get more information out of blurred images.
In fact, if you come online only sometimes and you got infected at one of those times, it is possible that you might not even realise it (because of outdated software). Also, you could potentially become a worm carrier who unleashes a worm on the Internet once in a while. Be upto date, be socially responsible!
Many times it is not necessary that looking at URLs could give you an idea. Sometimes, websites use URL redirection parameters while authenticating clients
eg: www.goodsite.com/login?urlredir=http%3A%2F%2Fwww%2 Esomeothersite%2Ecom%2F
An attacker could exploit this kind of a website authentication mechanism to send someone an obfuscated URL in the urlredir parameter that would redirect the user to a site which looks exactly like www.goodsite.com and says "invalid credentials"... it's very difficult for users not to fall prey to this kind of a situation because, let's face it, most people do not look at the URL for every request. The website creators themselves have to become knowledgeable about how to avoid such attacks.
I think if clients are paying after a host gets infected then it may not be a very good strategy because (I'm n ot sure about this) most spyware removers work after infection...don't they? So the infected hosts may not *stay* infected.
Slashdot Mirror
It seems that the process is not that bad (even though your description does look a lot worse). Subscribe to the Microsoft Security Bulletins and they have a full description of each patch that they put out on Patch Tuesday (e.g., https://technet.microsoft.com/...). The same goes with RHSA. Subscribe to the updates that you are interested in; these will most likely be your OS, web servers, app servers, other software installed. Similarly, most vendors run security patch announcements. There will likely be a lot of noise but in a couple of months you will know how to extract the information the change advisory board needs. Here's the positive aspect of CAB: if you screw something up, you have someone else to blame! ;-)
By the time they fix the clock, it'd be 100 days and the clock would be slower by 100 days! Then they'll try to fix again and the clock would be slower by 100 days again! ....ad infinitum...
Better to break that cycle by not embarking on this journey!
Read Avinash Dixit's Thinking Strategically to get started. It's a great book which does not use much math and can make for light reading and a great start.
If they use some kind of domain administrator passwords for this software to run guess what, the domain administrator credentials could be cached in every single computer. If a local administrator was on the machine and wanted to compromise, he/she could run hash stealing software when this "process" runs and compromise the domain. The least possible privileges for a process that does this data searching will be difficult to determine. A trade-off will have to be done between accessibility of files and a lesser privileged account to be used for an exercise like this on Windows.
http://carnal0wnage.blogspot.com/2010/03/fking-with-foursquare-goes-msf-style.html
The credit card companies and banks are wanting to shift the residual risk to the customers. That's why they want you to pay for "SafeProtect" etc. for which you have to pay in advance so they monitor any ID thefts. My question is shouldn't they already be doing that? If yes, then why do they want you to pay for it? Cost reduction in my humble opinion.
Better than being called Dilbert.
I think apple should launch another ad campaign with the "Cool" mac guy on one side and a security guy on the other! The "Cool" guy could put his head in the sand and shout "Don't make me do stuff!".
Well...he got the money from a by-product of a fringe benefit of the hack (Hack->useful information (insider info)->steal). Would a similar argument be applicable if he was able to siphon money from individuals' accounts had he gained some passwords (Hack ->useful information(passez) -> steal). I wouldn't think so.
Agreed, that he was not an insider so he can't be convicted for insider trading...but there should have been at least one more lawsuit going against him!
There have been statistics published all across the news and magazines, for example
http://www.foxnews.com/story/0,2933,304456,00.html
If apple/at&t wasn't tracking the iPhones through their IMEIs how could they have published these numbers?
So isn't this theory anti-evolution? The younger children are less smarter than the oldest one.
Now that they've branded all P2P as illegal, what about someone downloading say linux ISO images or open source software?
also, what about internal P2P sharing would that be branded as illegal as well?
What is the definition that they will use for Denial-of-Service attack i.e., when would I be considered under a DoS, if my site completely goes down? Or if I see a 50% drop in performance? Also, who will they arrest? If I had a spyware/malware on my PC without my knowledge would I be considered an offender? These things probably need to be crystallized too.
So now, not only Google but also the terrorists would know which key Indian establishments are located where:
Key establishment is a blurred spot!
Who knows how complete is the list of key establishments provided to google?
Also, there are techniques to get information about the real image out of blurred images. This link http://dheera.net/projects/blur.php is only about numbers but I'm sure there are other ways to get more information out of blurred images.
Obsoloscence does not provide you any security.
In fact, if you come online only sometimes and you got infected at one of those times, it is possible that you might not even realise it (because of outdated software).
Also, you could potentially become a worm carrier who unleashes a worm on the Internet once in a while. Be upto date, be socially responsible!
Many times it is not necessary that looking at URLs could give you an idea. Sometimes, websites use URL redirection parameters while authenticating clients eg: www.goodsite.com/login?urlredir=http%3A%2F%2Fwww%2 Esomeothersite%2Ecom%2F
An attacker could exploit this kind of a website authentication mechanism to send someone an obfuscated URL in the urlredir parameter that would redirect the user to a site which looks exactly like www.goodsite.com and says "invalid credentials" ... it's very difficult for users not to fall prey to this kind of a situation because, let's face it, most people do not look at the URL for every request. The website creators themselves have to become knowledgeable about how to avoid such attacks.
I think if clients are paying after a host gets infected then it may not be a very good strategy because (I'm n ot sure about this) most spyware removers work after infection...don't they? So the infected hosts may not *stay* infected.