[Alan Paller, director of research at the SANS Institute in Bethesda, Md., said he also didn't see any ulterior motives in the NIPC's new warning.] Everything I know says that's exactly wrong, ... the largest criminal Internet attack to date. |
[Alan Paller, director of the SANS Institute in Bethesda, Md., isn't so optimistic about how the new money would be used, however.] My concern would be the skill with which Washington consultants and IT vendors in particular might package every pet project as 'security-enhancing,' ... If there were a tough, rational culling process ... I'd be a fan. |
[Saturday's worm] is the recruitment of soldiers, not telling the soldiers where to aim their guns. |
all the new PCs and the new Web servers, multiplied by the fear of top management about security breaches and business-stopping system failures, kept these salaries [growing] three times as fast as salaries [across all industries]. |
American corporations are being riddled by (computer) attacks ? they are being defended very badly. |
CDC's prevention work, such as [administering] flu shots, is especially important, and I see a push by NIPC in that direction as well, |
Data I have says that 20% of the Internet is vulnerable to this, and that's a huge, huge percentage of the BIND servers, ... no reason why it won't skip to other Unix versions. |
Fundamentally, it's an organization that is behind in making security part of its regular operations. It's very dangerous for health care data. |
If an early infectee had an e-mail list with reporters at all the major news services, that would start the cascade. News organizations do not have radical e-mail attachment limits (like a rule banning all picture attachments) because they get legitimate pictures. |
In the past 12 to 15 months, attackers have made a massive shift to attack applications. Automated patching started making it harder to find new vulnerable systems, so they went after applications that users are just not patching. |
It gives anyone on the Internet who comes in as a browsing user the ability to take control of your site. Instead of looking at Web pages, they can make your computer do whatever they want. |
It is a situation where MCSEs had no idea that there is a fundamental vulnerability in IIS and ISAPI mapping and so had no way to protect their systems other than after-the-fact patching, |
It turns out that the vast bulk of the federal information security money is spent on documenting these systems, not on securing or testing them against attacks. Most [agencies] are spending so much on the paperwork exercises that they don't have a lot of money left over to fix the problems they've identified. |
It wasn't just a bunch of paid consultants. |
It would have been terrible (without the widespread patching). That got a lot of systems fixed. |