@Ladadadada it's an interesting idea indeed, but i'd say it might backfire on them. If a new site starts to be used by their users and the cert isn't trusted they'll get the warnings and then there's a risk that they just associate the warning with the CA removal process "ah that's just another one of those certs that IT removed the CA for" and get used to clicking through the warnings....
an interesting follow-up would be actually blocking sites using untrusted certs...
Hi everyone. I'm starting to look at security monitoring solutions to keep an eye out for vulnerabilities. Been doing an evaluation of Security Center + Nessus. Seems pretty functional (although the software feels a bit enterprisey). Anyone have any thoughts on Security Center / Nessus, or recommendations of other stuff to look at that is along the same lines?
It's a trade-off. Risk of a CA compromise vs. the risk that your employees accept a cert from an attacker. I'd love to know those numbers...
But the methodology they have detailed there allows them to detect when someone visits a site using a CA that they have removed and do something about it.
@KyleBrandt We've been a Nessus shop for about 6-ish years, and Security Center since February. We've also done a reasonable bit of development around it.
@KyleBrandt Take into account those tools are only on the infrastructure, and will do next to nothing for anything above HTTP (i.e. the web app itself... )
@AviD: Ya, that is pretty specialized, right now it is more getting our arms around all the basic stuff that comes out that would hit workstations and all our one off stuff
@PeterGrace The biggest problem with Nessus is that each scan is totally separated from every other scan. SecurityCenter is the glue to bring multiple scans together.
@PeterGrace hehe, TL of the sysadmin team on a previous job, he had been climbing around behind the machine (and you probably know, its a biiig machine), and as hes climbing out, the flap from his pants zipper gets stuck on that big switch IBM likes to put there.
anyway, I'm not the one to help with those networky type thingies. When you want application-level scans - or static analysis code scanning - give me a ping.
@ScottPack Yeah, Kyle and I have been surfing around in this demo license of securitycenter. At the moment, I'm trying to bang out a useful vulnerability report.
Historically the sysadmins would request a scan from us, we would do the scan then attach the Nessus report to the ticket. I build that report to as closely match the old standalone reports as possible.
So that it would be an easier transition.
Oh...that will generate a global report. So every machine you've scanned will be included.
Jul 16, 2013 5:39:25 PM org.apache.fop.events.LoggingEventListener processEvent
INFO: An fo:block-container (See position 1:1865) is wider than the available room in inline-progression-dimension. Adjusting end-indent based on overconstrained geometry rules (XSL 1.1, ch. 5.3.4)
The thing I find most annoying about this question isn't that he's trying to start a pointless discussion about the hypothetical future, but that he actually goes to the effort to tell you to support your bullshit position with concrete evidence.
Security is a process not a product
Of course, any serious security expert will agree with the following statement. Security is not a product but an everyday work. Currently, you just can not manage all risks with a ready-to-use product such as Antivirus, Firewall ect...
But in the future and i...
It already is - insurance. A way to pay someone else to assume the impact of risks being realized. From that angle, yes, I expect better digital security related packages will evolve. — bethlakshmi16 mins ago
@Beth is fun.
and @ThomasPornin is well on his way to a Reversal badge.
@AviD It won't work, though. Questions below -3 do not appear in the main site list (you have to click on the "questions" tab to see them) which severely stunts upvoting of answers.
@AviD Another issue is that when there is a good answer (one which would gather at least 20 upvotes), people tend to also upvote the question, probably on the basis that a question which attracts a good answer cannot be that bad.
See the CRIME question: terrible question, but it got to more than +100 anyway.
@ScottPack this guy had offensive flags on a post, very justified, so I deleted it (was a zero content question anyway) so he commented that it was a common phrase where he comes from and wanted to chat in a private room with me about it...
"Space Exploration" is the default name for our chat room, but that's a little on the bland side. What would be a fitting name for the default SpaceEx room?
"Space Exploration" is the default name for our chat room, but that's a little on the bland side. What would be a fitting name for the default SpaceEx room?
