Re: Home network security WAS Re: upgrade from 98 to XP

[Andrew Plato <intrepid_es -at- yahoo -dot- com>]

--- eric -dot- dunn -at- ca -dot- transport -dot- bombardier -dot- com wrote:

> The issue is not that BlackIce updated its signatures. Instead of
> improving
> their product to answer customer concerns over a test that said their
> system was
> not secure they simply foiled the test. Instead of telling customers how
> to
> install a complimentary program or including the functionality they
> simply tried
> to silence the complaints and give their customers a false sense of
> security
> because their updated systems now 'passed' the test. From Gibson's
> account all
> BlackICE detects is the destination of the packet not source. It's all
> sort of
> equivalent to a student memorizing the answers to a multiple choice test
> without
> learning the material. It's called cheating.

So therefore, everytime Norton AntiVirus issues an update to catch a new
kind of virus, that is a cheat. The product should have been innately
built to stop the virus. Uh huh. 

> The fact that BlackICE detected the test shows that the company agrees
> with the
> stand of Steve Gibson or at least was concerned enough about the
> negative
> publicity and customer inquiries and concerns. That shows that there is
> a lack
> in the software that the company would rather hide than fix or explain.
> That
> attitude then raises a lot of questions, valid or not,  as to what else
> they
> might be hiding or how much else of the program is simply 'fudging'
> functionality.

The issue is Steve has a standard and he expects every product made to
live up to that standard. The problem is, he is comparing different
things. I won't argue that ISS maybe mis-markets some products. But Steve
is asking a pick-up truck to behave, look, and respond like a sports-car.
It doesn't work that way. Different products have different features. Now,
as time goes along those products will begin to cross those boundaries -
like cars. We have sport trucks and truck cars. But in the beginning, you
either bought a sports car or a truck. And if you expected your truck to
behave like a sports car, you would be disappointed.

Furthermore, Steve's utter refusal to participate in any of the
well-respected security forums is demonstrative of his unwillingness to
engage the professional security industry at a technical level. If Steve
was so concerned about BlackICE's "cheats" why didn't he post a message to
SecurityFocus? Why didn't he submit a bug to Bugtraq? Why didn't he give a
speech at BlackHat or DefCon on this problem? Why doesn't he engage the
security community in a lively and productive debate on this issue? 

Its really quite simple. Accomplished and respected security people would
quickly grind him into a fine paste. Steve's arguments are designed to
raise the emotional ire of people but have minimal or very dubious
technical information. That is why he attracts a loyal following. He preys
upon people who want to believe there are dark forces out there who are
going to get you. Its the oldest trick in the book. You prey upon people's
fears and get them to believe that only you have the answer. This is
exactly what cult leaders do. The only way to salvation is through them.

The other trick of a cult leader is isolation. A cult leader has to get
his followers isolated from the rest of the world. He also has to isolate
himself from the outside world to prevent being challenged by more
intelligent people. Hence, Steve's web site has NO links to any security
resources and Steve adamantly refuses to come out and engage the security
community, preferring instead to post "news updates" to his heavily
censored and controlled newsgroups. In a sense, Steve is just a cult
leader and you have willingly signed on to his propaganda. You have fallen
for his half-truths and emotional arm-twisting like so many other people. 

The only dark force that will get people is ignorance. Security is a
complex issue that is not easily solved with a single technology or single
solution. Security is also not an absolute. There is no such thing as
absolute security. Its a matter of risk reduction. 

And there are competing interests. And those interests want money and
attention. Some products perform one function very well, but suck at
others. We don't use Word to produce music? It wasn't designed to do that.
Likewise, don't use an IDS to lock down your PC. This is a natural process
that all technologies go through, but if you listened to the rhetoric of
Steve (and others) you might think there is some grand conspiracy. There
isn't. 

Andrew Plato 



__________________________________________________
Do You Yahoo!?
Send FREE Valentine eCards with Yahoo! Greetings!
http://greetings.yahoo.com

^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
Collect Royalties, Not Rejection Letters! Tell us your rejection story when you 
submit your manuscript to iUniverse Nov. 6 -Dec. 15 and get five free copies of 
your book. What are you waiting for? http://www.iuniverse.com/media/techwr

Have you looked at the new content on TECHWR-L lately?
See http://www.raycomm.com/techwhirl/ and check it out.

---
You are currently subscribed to techwr-l as: archive -at- raycomm -dot- com
To unsubscribe send a blank email to leave-techwr-l-obscured -at- lists -dot- raycomm -dot- com
Send administrative questions to ejray -at- raycomm -dot- com -dot-  Visit 
http://www.raycomm.com/techwhirl/ for more resources and info.