Re: [gentoo-security] RE: help blocking automated ssh scanning attack script

[William Yang]

Sjan Evardsson wrote:
> Brian,
>
> Once you start using scripts to write to automate firewall rules you
> give the hackers control of your firewall.

Yes, but is this necessarily a bad thing?  I'm not convinced this is 
necessarily problematic.  It takes a reactive defense step, hopefully 
mitigating damage before things get too far lost.  The risks may well be 
acceptable in some environments.

There's an awful lot of "intrusion prevention" or "active response IDS" 
[and insert your favorite en-vogue terminology] out there in the market, 
and people buy it.  The real question is what are the goals, the 
acceptable losses, and the actual assessment of what risks are involved. 
  What Brian's talking about is a host-based network "hostility" 
detector with an active response.

I am currently testing some code that does this (and, no, it's not ready 
for release or for production).. but the reason it's written is not to 
solve the general problem.  Rather, it's addressing a very limited 
subset of problems, based entirely on what the defensive stance is and 
needs to be to accomplish business goals.

THAT'S what you really need to take to your senior management... and 
that's how you get funding.  How do I know?  Before I started my 
company, I was the management that people were talking to for this kind 
of thing for a very large entity.  And, by the way, I raised more than 
twice my salary in actual new funds while I was there, plus savings due 
to security measures.  Security is only there to protect business value, 
mitigate risks, and ensure that any losses are actually acceptable to 
the business.

	-Bill	
-- 
William Yang
wyang@××××.net

--
gentoo-security@g.o mailing list