It's not a major risk. It's not [doing] either of the two things that are terribly damaging. One is hurting people's machines, and one is knocking things [off-line]. |
It's not something we like to do. |
It's something we call collateral damage, but I don't mean that lightly. This thing creates traffic inside a subnet, creates traffic in addition to what comes in from the outside. |
Microsoft's delay is inexcusable. There's no excuse other than incompetence and negligence. |
Most large organizations have a big investment in Symantec tools and wouldn't normally consider switching. This year, however, Symantec's products have repeatedly shown up on the list of the software with critical new security vulnerabilities. Many corporate IT managers are angry and frustrated that their security vendor is as careless as the operating system vendors in writing bad code. And Microsoft has succeeded in persuading many of them that they are far ahead of other software vendors in improving the situation for new products. |
Most of them, ... appear to be just plain thieves. |
Of course it's the government. Governments will pay anything for control of other governments' computers. All governments will pay anything. It's so much better than tapping a phone. |
People have discovered that systems administrators have unfettered access to all the most private information being passed through their systems, ... With it comes a sense that there ought to be some controls on what they see and what they do with it. [However,] I have not yet seen any consensus on what they are going to do about these new discoveries. |
Right now, there are 120,000 [Internet Protocol] addresses out searching for systems to infect. |
someone will let loose. |
Systems integrators pick and choose the parts of the FAR they pay attention to, |
That could be a real wave of traffic that the Internet has not dealt with. |
The bottom line is that security has been set back nearly six years in the past 18 months. Six years ago, attackers targeted operating systems and the operating system vendors didn't do automated patching. In the intervening years, automated patching protected everyone from government to grandma. Now the attackers are targeting popular applications, and the vendors of those applications do not do automated patching. |
The mature model at CDC could offer some wonderful guidelines for long-term planning at NIPC, |
The only viruses using [the hole] aren't very malicious, but that has nothing to do with tomorrow. |