NetSky variants spark search for code

TalkBack 5 of 18:

Next »

« Previous

• Thread View
• Flat View

Not so fast!

At first blush what you wrote looked reasonable. However, history has proven you wrong on at least one front. When the telephone company (Bell) began to install electronic switches (ESS System) there were legion vunerabilities in the system (2600 HRz based audio control). And, as a result those with the technical savy to take advantage of those weaknesses did so. Eventually the vendors of those switching system shored up the weaknesses of the switches and the controlling software and cut abuse to next to nothing today.

What grew out of the (original) hacker society was the realization on the part of the telco that they had to improve protections against unauthorized access and operation of the switching system.

Here we have a very similar situation. These worms/virii only work because of the poorly written nature of the operating system(s) they attack. Yes, the action on the part of the authors and deployers of damaging code is at best anti-social, and at worst (maybe) criminal, however there would be nothing to exploit if we insisted on better quality control of the products we purchase and deploy. The responsibility for the resulting down-time, and or chaos, has to be shouldered by those who deploy vulnerable systems nearly as much as those who deploy the attacking code.

Now, someone is going to state (rant?) that the consumer can't reasonably know the quality of the code they purchase/deploy because of their inability to review operating system code, applications code (with vendors like Microsoft, Adobe, etc. - this, by and large does not apply to oper source offerings), etc. True. However, you CAN make reasonable assumptions about what is being offered based on the track record of the vendor.

As a 34 year veteran of the IT industry I do not deploy anything before I have assertained whether or not it will perform as advertised, or a threat-assessment has been made on possible vunerabilities that are known, or can be reasonably extrapolated. Most of my contemporaries still rely on marketing hype, or this millennium's addage, "You'll never get fired for going with Microsoft," (last mellennium's - "No one ever got fired for going with IBM").

A new paradigm is emerging with powerful economic and strategic implications, in addition to bringing back accountability to an industry where the trend was to take what you got with no recourse if it did not perform as promised (read a EULA lately?).

I break the current virus problem down to a simple equation: faulty premise equals invalid onclusion. When you deploy systems on the Internet (including end-user workstations connected to a network) you do so at YOUR own risk. If you do so just paying lip-service at securing theose systems against intrusion or attack, try not to blame someone else for your sloth.

Wm H.

Posted by: Wm_Hayashi   Posted on: 03/15/04 You are currently: a Guest | Members login | Terms of Use

Alert moderator to an offensive message

Subscribe to this discussion via Email or RSS

SponsoredWhite Papers, Webcasts, and Downloads

• Why Isn't Server Virtualization Saving Us More? A Few Small Changes May Dramatically Increase Your Efficiency VMware Companies have rapidly adopted server virtualization over the past few ... Download Now
• Three Steps You Need to Know to Stop Data Loss Varonis Sensitive data exposed to misuse or loss... it is the stuff of nightmares ... Download Now
• Five Steps to Determine When to Virtualize YourServers VMware Server virtualization isn't just for big companies. Entry-level ... Download Now