Subject: Re: Security (SANS) & Monitoring tools

From: "Wilfried Woeber, UniVie/ACOnet" <[email-masked]>
Date: Fri, 09 Jun 2000 15:28:51 +0200

Hi Henk,

>Subject: Re: Security (SANS) & Monitoring tools
>
>On Tue, 6 Jun 2000, Cottrell, Les wrote:
>
>> The FBI, Justice Department, GSA, the CIAO, CERT/CC, SANS and two dozen
>> leading security gurus on Internet Security Threats have created a document
>> on Internet Security Threat. The document is available at the following URL
>> http://www.sans.org/topten.htm I am not sure of the exact status of this
>> document, it is still being updated and Alan Paller the Director of Research
>> of The SANS Institute has said:
>> "I am faced with the following 
>> (a) multiple credible people differ on this issue and 
>> (b) the security issue and the management issue are in conflict
>> (c) I don't know which one matters more
>> (d) the positions are held almost religiously.
>> 
>> I am looking for a community-wide process that could get an answer -- one we
>> could use whenever this type of issue arises. 
>
>I'm not sure if there is a correct answer here.  The problem appears to be
>in (b) and (c) above: there is a conflict between security and management,
>and different sites will come up with a different tradeoff between the
>two.

  From a measurement project's point of view, I fully agree with your
  assessment.

  At the same time I'm a bit worried about the "general direction" of this
  discussion and development, i.e. obviously accepting as a given fact
  that some integral parts of the TCP/IP protocol suite (or better some
  implementations) can be exploited as vulnerabilities in today's
  Internet.
  
  Simply presenting the options to deal with that as an XOR decision
  either in favor of a more secure or a more "Internet - style" site might
  be sending the wrong message to the community. In particular, there
  might be legal implications in the long run, when the document has used
  input from entities like FBI, Justice Department, GSA, the CIAO,.
  
  I'm missing the solution path (recommendation?) to try to make the
  "implementations" less vulnerable, either by improving the coding or by
  tweaking operational parameters, and thus less of an issue.
  
  Wilfried.