7 Myths of Network Security

Found this tonight .. thought it would be a good base for discussion..

Quote:

---

7 Myths about Network Security

So this evening I was doing the dew and catching up on some reading when I came across an interesting article on Security Pipeline about the "7 Myths of Network Security". It is well worth the read. In summary, the article breaks down the 7 Myths as:

1. Myth: Encryption guarantees protection
2. Myth: Firewalls will make you bulletproof
3. Myth: Hackers ignore old software
4. Myth: Macs Are safe
5. Myth: Security tools and software patches make everybody safer
6. Myth: As long as your corporate network is unbreached, hackers can't hurt you
7. Myth: If you work for a security enterprise, your data is safe.

---

#5 has me thinking

Full Artical : http://www.securitypipeline.com/show...0401820&pgno=1

there you go have a read... and discuss

If security software patches don't make you safer then why would they distribute them?

Obviously nothing makes you inpenetrable but patching helps :)

"8. Myth: So long as the box is updated, patched and secured, end-user knowledge of security is irrelevant. "

bah - or just a myth *I* must refute on a day-to-day basis, anyway...

-Wiski C.

I wonder if #5 refers to a false sense of security. Just because you patch doesn't mean you're 100% safe. There have been Microsoft patches and linux kernel fixes (e.g., ptrace exploits) where the patch worked but the attackers figured out new ways around the patch. This might be partially why MS made the statement that exploits are only created after the patch is released.

Maybe they meant they don't make you safer because there is always another way in. Still though they do make you safer

Quote:

---

If security software patches don't make you safer then why would they distribute them?

---

a coder reverse engineering a patch to create a work around..in other words look for a hole in the patch.

I think wiskic10_4 covers it with this reply..

Quote:

---

"8. Myth: So long as the box is updated, patched and secured, end-user knowledge of security is irrelevant. "

---

the weakest link in any system is the end user.. perhaps that should be Myth # 9 ..
The weakest link is our assuming that the end user has an intelligence.. perhaps I am harsh.
In a business enviroment the first weak link is insufficient training, the assumption that computer litterate means knows the difference between Executable and a Image file, that a *.PIF and *.SCR are files that could be harmful. (dont get me on the subject of trainers.. ****ing **** some of these dont know the difference between an operating system and an application, what hope is there for correct information on security.. and the lessons are taught as this is it.. all you need to know)
Follow this with Poor Policey and even poorer enforcement..
then we get down to the systems themselves..

I think #5 refers to the fact that just because a patch is release, doesn't mean everyone has it applied. In a lot of cases there would be little to no exploit code released if the patch/exploit was never released at all. There would be a large hole, but noone would know it was there.

Everthing with security is constant viligance. There is no, and proably will never be, an install and forget method. Everything should be checked : Log files, AV updates, OS patches. Admin policies and procedures should be double checked. The end users normal day to day practices should be checked and, if needed, informed why a certain activity is not acceptable in the office.

Nice article. Thanks for the link.

~Halv

Since you pointed to #5, that is what I will address, but I did not think the article referenced was well written or well thought out.

Quote:

---

Myth #5: Security tools and software patches make everybody safer

---

Incorrect and naive, no stupid statement. Of course they make everybody safer, the question is to what extent.

Just because security tools can be used by hackers does not mean they are not used to tighten security by those that give a damn. Hackers can use them to exploit systems managed by the sick, lame, and lazy, granted. But they can also be used to tighten systems, even systems that the average user ( those who I imagine the article was written for ) doesn’t even know affects their system(s).

And just because someone can reverse engineer a patch does not mean they are going to find another exploit, it means they can find the one the patch fixed. So if the exploit wasn’t released they may be able to find a way to exploit un-patched systems. If it was released, they do not need to reverse engineer it from the patch.
But if ( yeh, right ) people patched properly it won’t make a difference, it will help “ everybody” , especially if the upgrades are for things like DNS servers *** time stamp here *** .... anyone remember the advisories to update to latest version of BIND ???? Recent DNS cache poisoning come to mind here? ( Also has to do with Myth #3 )

Perhaps it could have been worded better.

Security tools and software patches prevent exploits

Just my thoughts.

Quote:

---

Security tools and software patches prevent exploits

---

No they don't. They only prevent exploitation of existing and known vulnerabilities. I still view it as a false sense of security, almost like those firewalls that claim to be 100% hacker-proof. Load of crap. Too much FUDing is a bad thing as is too much blind faith in patches being the be-all-end-all solution. Patches have been known to make things worse (some open up old holes inadvertantly or create new paths to those holes). IMO the statement should be:

Security tools and software patches may prevent exploitation of your system. But you should double check everything regularly to be sure.


Maybe I'm too paranoid.

Quote:

---

Perhaps it could have been worded better.

Security tools and software patches prevent exploits

Just my thoughts

---

Security tools and software patches -WHEN APPLIED- prevent -THE USE- of exploits.


like zengger said, patches just publicly announce the exploit. If an admin doesnt patch the whole then all the patch release is doing is advertising an opening. This of course all falls back to the replies about lack of user security practices.

Quote:

---

Myth #5: Security tools and software patches make everybody safer

---

I think that this statment is relatively true. Security tools and patches are published in order to preven black hats from exploiting them. They will find another way to break into systems though. This circulation won't stop, it is the war between the good and the evile.

Why this statment is really rational?? Because many vulnerabilities have been patched after exploiting them over real companies... Black Hats won't work hard and then tell vendors and OEMs about this vulnerability. Am I right here? They will take the most out of it {Untill they know about this vulnerability}. What would prevent them from accessing your data after finding new vulnerability and apply it on your system... This statment can't be more accurate than here.... Here I am not encouraging people not to patch thier systems, no. But rather saying truth... Who imagned that one day Yahoo!, CNN, Amazone would stop serving people because of DoS attack??? It is just about finding new ways into things...

We have to keep our systems updated and patched, we have to linger bad people and make things harder for them....

Just my $0.02

Cheers

What I said was, perhaps that Myth #5 should have been reworded to

Quote:

---

Security tools and software patches prevent exploits

---

Again, these are Myths.

Quote:

---

No they don't. They only prevent exploitation of existing and known vulnerabilities.

---

Tsk, tsk. I'm very surprised MsMitts. Your statement is false. HPING, a security tool that I use all the time to document unkown vulnerabilities is one example of a security tool used to find unkown vulnerabilities. This is one example of many...

;)

This article on SecurityFocus expands a bit on myth #4 in particular.

http://www.securityfocus.com/columnists/313

Tools can also be used to detect changes in normal patterns to alert of a possibility of an unkown issue. For example, a 100 percent increase in normal email traffic. An overload of NEW files shares. Etc...

Quote:

---

Your statement is false. HPING, a security tool that I use all the time to document unkown vulnerabilities is one example of a security tool used to find unkown vulnerabilities.

---

I was thinking of the scanning tools specifically. Mea culpa

We'll let you slide just this once. ;)

I don't like where he seems to be going with #5, about patches not making
you safer. His argument seems to be that the bad guys will "reverse engineer"
the patch in order to "discover" the vulnerability it was written to fix.
HELLO! The vulnerability already exists and you must presume that if they don't
already know it on their own, they will figure it out soon enough. This is more "security by obscurity"
reasoning. Since the patch can't be distributed secretly, your choice is to distribute
it publicly, risking that someone (horrors!) will study it, or not at all.
Just ignore those holes and maybe they'll go away.
:cool:

Quote:

---

Originally posted here by rcgreen
I don't like where he seems to be going with #5, about patches not making
you safer. His argument seems to be that the bad guys will "reverse engineer"
the patch in order to "discover" the vulnerability it was written to fix.

---

I think the article was suggesting that the black hats will/can study the patch to see if it truly fixes what it is supposed to (not all patches to work as intended) and also to see if it opens up any new holes in the OS.

~Halv

Quote:

---

His argument seems to be that the bad guys will "reverse engineer"
the patch in order to "discover" the vulnerability it was written to fix.

---

I saw it differently.. Just because a patch has been released dosent mean that there isnt a hole still in the system.. The Coder will be looking for a weakness, or an overlooked weakness, that still exists or an extra weakness introduced by the modified code. Isnt this among the reasons that Sys Admins will test patches and updates before rolling out on a network?

I regularly encounter systems with Virus infestations, the clients first complaint is "BUT!! I HAVE ANTI VIRUS", that is like "BUT I HAVE PATCHED MY SYSTEM", If your expecting one or 2 of the safe methods to protect the integrity of your network your a bloody fool.. And even when you follow all the steps, you cover all the bases.. IF YOUR NOT VIGILENT YOUR NOT SECURE.. the best , IMHO, you can expect is 99%.. (and that is with an excellent staff training and policies in place)..

Here is a Question.. Knowing where your weakness lie, the best guide to securing your network.. Myth or a good fact?
And: What would you consider the top Ten USer Myths for PC or Personal information Security? (yes that can be seen as a double question..2 lists?)

tools and patches help to some degree but maybe their effectiveness is, like beauty, in the eye of the beholder.

Quote:

---

I saw it differently.. Just because a patch has been released dosent mean that there isnt a hole still in the system.. The Coder will be looking for a weakness, or an overlooked weakness

---

Indeed Undertaker ,,, Indeed ...

Kernel Level Vulnerabilities, Behind the Scenes of 5th Argus Haking Challenge

A seperate discussion.. a windows security check list..

http://www.antionline.com/showthread...hreadid=267554

Quote:

---

Here is a Question.. Knowing where your weakness lie, the best guide to securing your network.. Myth or a good fact?
And: What would you consider the top Ten USer Myths for PC or Personal information Security? (yes that can be seen as a double question..2 lists?)

---

Quote:

---

There is no, and proably will never be, an install and forget method.

---

Errr...

format %systemdrive%

and follow the prompts... You can then be _absolutely_ assured that you have an operating system that has no vulnerabilities except physical access.

Specious argument? Yeah, probably...

The point is that there are mitigation techniques to all vulnerabilities. You presented an extreme scenario.... As did I. If you don't want to be vulnerable don't run any software. Of course, that would make your PC a doorstop but it works... If you want the doorstop to be somewhat functional then you need that "software" stuff which brings "risk" into the equation.

It's all relative....