[Message Precedent sur la mailing
][Message Suivant sur la mailing
][Precedent dans le fil
][Prochain dans le fil
][Index par Date
][Index par fil
Re: [Full-disclosure] What the f*** is going on?
> "Doing security" really isn't that hard. Behind all the fancy appliances
> and gee-whiz technology, the underlying principle is, don't unnecessarily
> expose your assets to attack.
eyeroll, thanks for the clarification.
> This boils down to a few simple things:
> 1) Don't allow users to create simple passwords.
> 2) Don't allow admins to forego routine patching
> 3) Don't allow poor configuration of applications
> 4) Don't allow services that aren't vetted and authorized
to think I wasted all this money on SANS...
(how come no one ever points out that rate-limiting failed logins is probably more important than password complexity?)
> Those four simple rules will go a long way toward reducing your attack
> surface enough that the "routine" "hackers" will move on to easier targets.
> Depending upon your infrastructure, some of this can be automated, but the
> bottom line for good security is auditing. Know what your assets are.
> Know what the weaknesses are. Do everything you can do to avoid
> unnecessary exposure.
> You're not going to stop a determined adversary from getting in. There is
> always a weakness somewhere that can be leveraged to gain further access.
> But if you forgo routine patching, allow lousy passwords, allow poor
> configuration practices and run services that aren't vetted and authorized,
> then, well, you're an HBGary clone..
Okay, I think I got it, doing security is not hard, duh! You should listen to me, but hey, youre still gonna get owned, but really... this security stuff is e-z.
Full-Disclosure - We believe in it.
Hosted and sponsored by Secunia - link://[click]
Archives de la liste de diffusion Secunia
Archives de la liste de diffusion Full Disclosure
|Mini-Tagwall des articles publiés sur SecuObs : || |
| || |
| | sécurité, exploit, windows, attaque, outil, microsoft, réseau, audit, metasploit, vulnérabilité, système, virus, internet, usbsploit, données, source, linux, protocol, présentation, scanne, réseaux, scanner, bluetooth, conférence, reverse, shell, meterpreter, vista, rootkit, détection, mobile, security, malicieux, engineering, téléphone, paquet, trames, https, noyau, utilisant, intel, wishmaster, google, sysun, libre
|Mini-Tagwall de l'annuaire video : || |
| || |
| | curit, security, biomet, metasploit, biometric, cking, password, windows, botnet, defcon, tutorial, crypt, xploit, exploit, lockpicking, linux, attack, wireshark, vmware, rootkit, conference, network, shmoocon, backtrack, virus, conficker, elcom, etter, elcomsoft, server, meterpreter, openvpn, ettercap, openbs, iphone, shell, openbsd, iptables, securitytube, deepsec, source, office, systm, openssh, radio
|Mini-Tagwall des articles de la revue de presse : || |
| || |
| |security, microsoft, windows, hacker, attack, network, vulnerability, google, exploit, malware, internet, remote, iphone, server, inject, patch, apple, twitter, mobile, virus, ebook, facebook, vulnérabilité, crypt, source, linux, password, intel, research, virtual, phish, access, tutorial, trojan, social, privacy, firefox, adobe, overflow, office, cisco, conficker, botnet, pirate, sécurité
|Mini-Tagwall des Tweets de la revue Twitter : || |
| || |