The DMZ

12:00 AM

Officially, I've heard 'vulnerability asset management'. But in real life I usually just hear it generically used for vulnerability assessment tools.

Iszi

@packs Guess I just haven't "gotten around" enough to hear that yet. McAfee Foundstone is our current tool of non-choice. But, we've been looking into others that we might use to replace/supplement it.

packs

If you don't need a management platform, we've been really happy with Nessus

At $1,200 per year per scanner, it works out pretty well.

Iszi

12:19 AM

@packs Nessus has been on our radar, but we haven't gotten around to building a good test system.

packs

12:39 AM

About 1.5 years ago they changed the way they license, so be careful.

Basically, now you're only allowed to use the free HomeFeed if you are using it at home.

As near as I could tell, even as a 'test box' you still had to have the Professional feed.

Of course, you could probably get a trial license that's good for a few weeks, or something.

nealmcb

4:01 AM

@packs Funny to see that phrase. Which "vulnerability assets" are you looking to manage? And in fact I saw an excellent talk on the Power of Vulnerability (in the context of social relationships :) youtube.com/watch?v=X4Qm9cGRub0

Feeds

11:17 AM

Stack Overflow Blog: Stack Overflow Search — Now 81% Less Crappy

Posted by Jeff Atwood on January 28th, 2011

Google has ruined search for everyone.

By that I mean they have done it so long, so fast, and so well — despite the recent speed bump — that users simply expect everyone’s search to be as good as Google’s. And that’s … challenging. Particularly considering Google is an enormous company now, with server farms roughly the size of the state of Pennsylvania.

How’s a little startup supposed to compete with that? Or should we even try to, really? From the beginning, Joel and I said that the de facto Stack Overflow home page was a web search. So why, exactly, do we need to dump tons of engineering resources into creating a super-uber-mega excellent search facility, again? …

packs

12:41 PM

@nealmcb I agree. I like having the acronym, but only because it makes it easier to talk about the space, not for what it actually means.

At least it is better than the SIEM, SEIM, SEM, SIM, SEAM, SCEIME, CIM, etc etc debacle

Iszi

3:07 PM

Anyone else think the "defense" tag might be a little redundant?

Rory Alsop

3:24 PM

@Iszi In two minds on it. There are relevant security topics which aren't to do with defence, so I'm thinking this tag is most suited to specific defence solutions if required (ie defensive architecture, IDS/IPS/firewall combinations etc)

Iszi

@RoryAlsop Makes sense. Looking around though, I'm starting to think it's time to review some tags again. Some of them seem redundant to other tags, or to the site, etc.

packs

@Iszi For the number of questions, it seems like we have a boatload of tags.

When it comes to synonyms, can diamond mods just do it?

Or do we still have to go through the various and sundry voting process?

Rory Alsop

simplest is to chat on here with a mod who can just do it then and there (although usually after a chat amongst ourselves to check agreement :-) )

@Iszi - wrt to tags, the general rule of thumb is if it can't work just on its own then it doesn't deserve to be a tag

I agree we seem to have way too many tags (although check out how many exist on SE or SO!!)

Iszi

@RoryAlsop SE/SO have a lot more questions covering much broader territory, though.

Rory Alsop

yeah

packs

3:34 PM

@RoryAlsop Yeah, no kidding. I wonder what the question:tag ratios are

Rory Alsop

ooo - off to get me calculator

packs

I do kind of agree with @Iszi about the [defense] tag, though.

Really, our field is either defense or offense.

Having a special [defense] tag seems a bit overly broad and not entirely useful.

Iszi

@RoryAlsop I'm pretty sure most, if not all questions that would be tagged [defense] either will or should have another tag added onto them.

Rory Alsop

like I said - in two minds. I can only think of a tiny amount of scenarios where it would actually make a difference

@Iszi - yep

packs

@Iszi That's pretty much my thought, and point, as well.

Rory Alsop

3:37 PM

so it probably does count as a meta tag and should be shot at dawn

Iszi

@RoryAlsop I don't think it deserves that much time.

packs

So do we have an agreement? Brutalize the tag with extreme pleasure?

Or should we wait for the old man to weigh in?

Rory Alsop

heh - old man

I think it fails the meta test, and can be brutalised quite happily

Iszi

@RoryAlsop Y'all are a bunch of friggin' tag-sadists - You know that, right?

packs

@RoryAlsop Yeah, I tend not to apply that descriptor exactly as it relates to age. My boss, for example, is the 4th oldest in the department (out of 5), but I still call him that :)

@Iszi Easier to do it now than later.

[defense] is only applied to 22 questions right now.

Iszi

3:42 PM

@packs I'm not disagreeing with that... It's the "with extreme pleasure" bits.

Rory Alsop

I keep scaring he guys in my company and at work - I am the oldest in both camps, but hey :-)

okay - stats on tags.:

SO 28k tags, 1.2M Q = ratio of 0.02

packs

@Iszi It's an easy path to feelings of accomplishment. I'll take what I can get :)

Rory Alsop

SU 5.4k tags 65k q ratio 0.08

SF 5.1k tags 62k q ratio 0.08

Iszi

@packs I'm the youngest in a department of 8, and I get called that. Has something to do with my beard, flip-phone, and preference for cars that are 10+ years old though I think.

Rory Alsop

ITS 233 tags 455 q ratio 0.5

:-)

packs

3:43 PM

To be fair, I would expect a higher ratio at first, while we build out the batch of tags

Rory Alsop

I'm guessing the ratio should level over time

yep

packs

@Iszi I'm the youngest as well, though they call me 'the kid'. Although, except for one guy, we're all in our 30s.

Right, I'm going to start removing [defense] from all those questions

Iszi

I don't mind being called "old man" though. I am a licensed Amateur Radio operator, after all.

Rory Alsop

when I joined my last company nearly 10 years ago I was nearly the youngest in my team, and when I left last October I was pretty much the oldest

Looking forward to my 40th this summer so I'm happy being an old man

packs

@RoryAlsop high turnaround sucks sometimes

Rory Alsop

3:46 PM

yeah - was a pretty mental environment. well worth it though - really good experience and relationships

packs

@RoryAlsop Yeah, I'm looking forward to 46, when I'll be dumping someone in a dorm.

Rory Alsop

hahaha - think I'll be 48 and doing the same with my eldest

ahh - dreams of peace and quiet again

Iszi

Well, crap... that's why the scan took so long last night.

It took an hour and a half to do a non-credentialed vulnerability scan against 40 boxes. Probable reason? I left 127.0.0.1 in the targets list.

Rory Alsop

LOL - everyone's done it at some point

Iszi

It's frustrating. In order to configure our scan "templates" so that minimal input is necessary to launch a scan, we have to save an actual scan configuration instead of a template. Then, when we go to make a new scan, we select "From an existing scan" instead of "From a template". Problem with this, is the system won't save a scan without any targets - hence, we have 127.0.0.1 as a placeholder.

So, maybe I just need to pick a different placeholder?

Rory Alsop

3:59 PM

pick it carefully - as it'll get hammered every time you forget :-)

Iszi

@RoryAlsop Oh, so 255.255.255.255 is probably a bad idea? ;-)

Rory Alsop

@Iszi ;-P

you know what I do like about the times @packs or others go on a tag blitz...it brings questions bubbling up that I hadn't seen, which is pretty good

Iszi

Hmmm... how about something in the APIPA range?

Nah, 'cause then you'll have that one guy that plugs something in that's having DHCP issues right while I'm running a scan, or something...

Rory Alsop

actually that would be pretty funny - broadcast to the 169.254.0.0 /16 and you'll get those boxes that failed dhcp chat

Iszi

Come to think... Maybe that would be a good question for here? Security benefits/drawbacks of DHCP vs. Static IP?

Rory Alsop

4:12 PM

@Iszi - post it now. If you've had the question you can guarantee others will

Iszi

I hate posting one-liners... but I can't think of much that really needs to go into that question.

Rory Alsop

Best bet might be to ask along the lines of "for an X-sized environment, with [centralised|distributed] IT what are the security benefits and drawbacks of dhcp over static IP addressing"

that makes it more specific and answerable

Iszi

@RoryAlsop Yeah, I'm kind of looking for the general story. Although answers could/should be broken down by that.

packs

@RoryAlsop You'll have to do this one security.stackexchange.com/questions/1656/…

@Iszi Nessus has a checkbox to not scan itself. So even if you give a cidr notation block, it will exclude any address any interface has.

Iszi

4:28 PM

@packs Nice.

packs

RIght, so except for that closed one, they're all done

Iszi

There we go. How's this?

0

Q: DHCP vs. Static IP Addressing

How do DHCP and Static IP addressing compare, from a security standpoint? What are the risks/benefits associated with each? I know the preferred solution between the two will vary with network size and layout, but I'm just looking for a more general explanation of how they compare. Please answ...

dhcp

packs

Oh, @RoryAlsop, do I take your comment on my meta question to mean that you think what I had asked on the main site was an ok question?

I know Jeff didn't like it, but (at the risk of sounding an ass) I don't really care. It's our site now :)

Iszi

@packs Which question? Sounds interesting.

packs

I asked this on the main site, with a pretty broad scope

2

Q: Concerns and Gotcha with Secure Programming Standards Development

I have recently taken on the responsibility of developing a set of secure programming guidelines. My intention is to provide, using the OWASP Development Guide as a basis, several levels of requirements that correspond to our Sensitive Information Classification levels. What kinds of issues shou...

appsec corporate-policy owasp

So then asked this on meta

1

Q: Question Scoping Preferences

Sometimes, when deciding what to ask, the issue of how broadly scoped a question should be is relevant. This would be especially true when regarding policy or standards development as the process can take a long period of time and encompass many aspects. As a site, how broad a scope should we en...

discussion asking-questions

Iszi

4:35 PM

@packs What's a "punching bad"? ;-)

packs

@Iszi punching bad? I'm sorry, I don't follow.

I think you need to have your eyes checked

Rory Alsop

ninja edit

packs

I was actually of a mixed-mind when I figured out you can view the edit history on chat comments

I was actually having fun with the idea of making rather rude and/or crude jokes, then editing them out to be non-explicit afterwards. Oh well.

Rory Alsop

Hahaha

I have been confused in the past by people doing that

got really confused by one of the mods in the mod chat area for stackexchange who during work hours can't post, but can edit so replies as an edit in other people's posts

packs

4:51 PM

wtf

How finely does one have to cut that hair to get to that point?

Rory Alsop

very odd

packs

There's lots of chatter about PCI-DSS over in the Comms Room

Iszi

@packs Wait... in chat?

packs

Oh sure you betcha

Iszi

@packs What about deleted posts?

packs

4:54 PM

Hover your cursor on the left hand side of the message till you get a drop down, then select history.

I don't think so. Let's find out.

I can't, though a room owner might check.

Iszi

@packs Looks like no. Maybe room owner, diamond mod, etc.

packs

Speaking of which.

Rory Alsop

heh - you said 'garbage post'

packs

Time for a pub lunch.

Rory Alsop

and I need to head off and take the kids to taekwon do

catch you folks later

have a good weekend

packs

4:56 PM

@RoryAlsop You too!

Iszi

@packs Lucky you. I'm stuck with the downstairs crapeteria today.

@RoryAlsop Same to you!

nealmcb

5:26 PM

@packs Re the "SIEM, SEIM, SEM, SIM, SEAM, SCEIME, CIM, etc etc debacle" - what are SEAM and SCEIME, and are you just noting the similarity in pronunciation for CIM?

packs

7:09 PM

@nealmcb At that point, I was just being silly. SIEM, SEIM, SEM, and SIM are the only ones I've actually seen in use.

@Iszi Normally I go home for lunch, but on Friday's I meet up with friends. Today just happened to be a pub.

packs

8:48 PM

So, we have [detection], [threat-detection], and [intrusion-detection]. Intrustion is a synonym to ids, so that's fine.

What about the other two?

Iszi

@packs Detection can be considered quite broad. Haven't looked at the questions, but I'm sure they can be re-tagged.

threat-detection is maybe(?) synonymous to intrusion-detection?

packs

@Iszi That was my idea too.

Rory Alsop

I think detection is pointless - but threat detection and intrusion detection I think are non-synonymous

as a threat is not an attack, but the potential for an attack

oh - and hiya again

(will have to vanish off again)

packs

hiya

Rory Alsop

will try and get back once all kids asleep

Iszi

8:57 PM

@RoryAlsop Right, but how do you "detect" the potential for an attack?

packs

Yeah, and now reading the 1 threat-detection tag, it is a bit ambiguous

2

Q: What are the pros/cons of using a threat detection system?

What are the pros/cons of using a threat detection system for a web app? What does a properly implemented threat detection system do and how does it behave when it detects an attack? What else do I need to know?

attack-prevention threat-detection

Rory Alsop

threats are possible attacks - erm let's think:

Iszi

You can detect the attacks themselves, and possible vectors of attacks...

Rory Alsop

You identify threat actors - ie those who may wish to attack or cause damage

Iszi

The attack vectors would be known as "vulnerabilities"

Rory Alsop

8:58 PM

then the possible attack vectors

packs

That question reads like a HIDS or something similar.

Rory Alsop

then understand the likelihood or risk of them happening

which helps you work out your impact

Iszi

The question actually says "...detects an attack..."

Rory Alsop

yes - for that question I think intrusion detection is more appropriate

Iszi

Definitely IDS.

Rory Alsop

8:59 PM

@Iszi yep

right - back in a bit

packs

@RoryAlsop Good luck

As I get time I'll look through the [detection] question and see about retagging them

At this rate I'll eventually edit every dang Q on the site.

As I recall retags don't count towards the editing badges.

packs

9:24 PM

I'm not entirely sure on how to retag this one

1

Q: IP reputation services – valuable tool for detecting compromises?

anyone have anecdotes on how subscribing to an IP reputation service led them to discover internal compromises? services like: https://www.iptrust.com/ http://ipremoval.sms.symantec.com/lookup/

network detection

[intrusion-detection] feels a bit too loaded to be right, but linguistically works.

Feeds

Stack Overflow Blog: Area 51 Gets Organized. Let’s Talk!

Posted by Robert Cartaino on January 28th, 2011

Dust off your tuxedo; notify the paparazzi. You are invited to the hottest ribbon-cutting ceremony this side of Rovio. Stack Exchange is launching the long-awaited Discussion Zone of Area 51!

The Discussion Zone is similar to a meta forum where users can bandy about proposal ideas, discuss promotions, and decide how to best mix and match these proposals into great sites. For example:

But there’s so much more going on under the hood than a new discussion forum. The Area 51 proposals have also been organized and grouped into a series of “Categories.” …

Iszi

@packs I'm really not sure that's actually an IDS question.

packs

That's kind of my point.

Iszi

And really, I'm not sure a question looking for "anecdotes" is something that actually belongs on SE.

Anecdotes are useful to support an answer, but they shouldn't be the answer.

packs

I concur.

I was, honestly, wondering if it was even an acceptable question, but I was willing to give it a pass until convinced otherwise.

Iszi

9:40 PM