|
View:
New views
19 Messages
—
Rating Filter:
Alert me
|
|
|
Who stay focused? (was: [Fwd: Question])Hi Paul
> From: Paul D. Robertson > Sent: Tuesday, April 14, 2009 5:34 PM > [...] > Once again, I'd like to publicly state that if you want to see > interesting threads on the list, you have to de-lurk and > start some. If nothing else, it'd change the Pix/Interesting > ratio... So, I'll start a new one ;) Why am I now a long time lurker? Mainly because I have quit the infosec field! After 10 years in the infosec field, 5 years ago I decided to quit infosec and came back to infosys architecture, my original field. >From early 90's to begin of 00's [0], I lived the raise of firewalls and DMZs... and their doom: the eBusiness application model where Internet application where only a front-end to internal infosys! In those years, I concluded that there was no way to achieve a good security awareness because people (IT people or users [1]) didn't (or didn't want to) have a global view of IT or infosys. And the marketing buzz words of that time were enought to convince people to stay singleminded (and buy a 'lucky stone' firewall to protect themselves). So, my question is: among all of you, old timer firewall wizards, how many stay focused to infosec (and had kept a global view [2] of infosys) ? For them willing to know why I'm still lurking FW-wiz as I have quit the field, I'm just trying to assess how fast the IT world will collapse in case of a major security threat... (I already know who will survive this, and how ;) ). JDG [0] Not Y2K compliant, so what?!? [1] Or 'lusers' for the BOFH fans ;) [2] Global, but not unfocused! -- Reality is that which, when you stop believing in it, doesn't go away. Philipp K. Dick _______________________________________________ firewall-wizards mailing list firewall-wizards@... https://listserv.icsalabs.com/mailman/listinfo/firewall-wizards |
|
|
Re: Who stay focused? (was: [Fwd: Question])On Tue, 14 Apr 2009, Jean-Denis Gorin wrote:
> So, my question is: among all of you, old timer firewall wizards, how > many stay focused to infosec (and had kept a global view [2] of infosys) > ? I still do a great deal of infosec work. I think my focus has been as broad as ever, as I'm doing computer forensics, incident response, general secrity, general IT, VoIP switches, RFID, IR training, Web hosting, a small amount of development, CRM, networking and nature photography. Paul ----------------------------------------------------------------------------- Paul D. Robertson "My statements in this message are personal opinions paul@... which may have no basis whatsoever in fact." Moderator: Firewall-Wizards mailing list Art: http://PaulDRobertson.imagekind.com/ _______________________________________________ firewall-wizards mailing list firewall-wizards@... https://listserv.icsalabs.com/mailman/listinfo/firewall-wizards |
|
|
Re: Who stay focused? (was: [Fwd: Question])-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1 On Tue, 14 Apr 2009, Jean-Denis Gorin wrote: [SNIP] > > For them willing to know why I'm still lurking FW-wiz as I have quit the field, > I'm just trying to assess how fast the IT world will collapse in case of a major > security threat... (I already know who will survive this, and how ;) ). > I'm not sure it requires a security threat to being down vast areas of the Internet, and for vast periods of time. If either coast was hit with a tsunami, or huge quake, or even a large storm like that which devastated New Orleans <which still has not recovered how many years after?>, the affects of which will be technically devastating as well. Main question is, if the Internet is devastated, to a point it can be 'rebuilt' would the mistakes of the past be redone in the new? Thanks, Ron DuFresne - -- ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ admin & senior security consultant: sysinfo.com http://sysinfo.com Key fingerprint = 9401 4B13 B918 164C 647A E838 B2DF AFCC 94B0 6629 These things happened. They were glorious and they changed the world..., and then we fucked up the endgame. --Charlie Wilson -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.5 (GNU/Linux) iD8DBQFJ5OSFst+vzJSwZikRAmPqAKCf9+MuXiA4zWTt3Y5DA+b4X8I89QCfQLHO mG67d348bTLs3Tm+iCUolPA= =2dqt -----END PGP SIGNATURE----- _______________________________________________ firewall-wizards mailing list firewall-wizards@... https://listserv.icsalabs.com/mailman/listinfo/firewall-wizards |
|
|
Re: Who stay focused? (was: [Fwd: Question])On Tuesday, April 14, 2009 1:22 PM, Jean-Denis Gorin so spoke:
> So, my question is: among all of you, old timer firewall wizards, > how many stay focused to infosec </quasi-lurker> Don't know that I'm really a true "old-timer[1]," but...I have lived through the waning days of Gauntlet, getting replaced by the *more* secure (yeah, whatever) Checkpoint, getting replaced by the more advanced (ok, cheaper) PIX/ASA. Trying to explain the benefits of App Proxy vs. Packet Filter proxy to layer 8 is obviously futile (at least it was in my case). In this economy, it seems to me that unless one is in a large-to-huge enterprise, I'd bet not many are able to focus *strictly* on only infosec. While that's still my primary function (and has been for over a decade), I'm not able to focus solely on that. Now, along with "infosec" there's Windows server implementation (on VMWare, on standalone hardware, etc.), Unix admin, infrastructure architecture, and managing a variety of security "appliances" that, while not necessarily perfect, are much better than before we had them. And yes, there's always the "do the best you can with what you have to work with" mantra, that, like it or not, does exist blah, blah, blah[2]. > and had kept a global view of infosys) ? Global view of infosys? How can one *not* have a global view. Maybe I take that for granted (but shouldn't), because if I had a nickel for every time a developer/implementer could have made things better if they would have had the "big picture" view... Jeff [1] Definition of "old timer", please? (or perhaps maybe I shouldn't want to know that answer) [2] Not trying to resurrect a previous thread of "you're either secure or your not vs. how much security do you want to buy?" <quasi-lurker> _______________________________________________ firewall-wizards mailing list firewall-wizards@... https://listserv.icsalabs.com/mailman/listinfo/firewall-wizards |
|
|
Re: Who stay focused? (was: [Fwd: Question])Jean-Denis Gorin <jdgorin@...> > So, my question is: among all of you, old timer firewall wizards, how many stay > focused to infosec (and had kept a global view [2] of infosys) ? Infosec is my only focus (as much as I have any) for creeping up on twenty years. As for keeping a global view, I like to think that is the core of my view of the field. If it isn't about how we make things more secure *in the context of the uses that the overall systems are put to* then I'd rather spend my time talking about really weird cheeses or landscaping. > For them willing to know why I'm still lurking FW-wiz as I have quit the field, > I'm just trying to assess how fast the IT world will collapse in case of a major > security threat... (I already know who will survive this, and how ;) ). Oh, I may be proven wrong in the end, but I don't see the IT world collapsing, ever. That may depend on the definition of "collapsing", I suppose - lots of regrettable/foolish/avoidable/nasty things happening at any given moment are always within the realm of possibility - but The Whole Thing Coming Down for any appreciable period of time is not something I expect to live to see. > "Reality is that which, when you stop believing in it, doesn't go away. > Philipp K. Dick" Classic quote! :~) -chris _______________________________________________ firewall-wizards mailing list firewall-wizards@... https://listserv.icsalabs.com/mailman/listinfo/firewall-wizards |
|
|
Re: Who stay focused? (was: [Fwd: Question])On Tue, 14 Apr 2009 15:01:36 -0400 (EDT)
"Paul D. Robertson" <paul@...> wrote: > On Tue, 14 Apr 2009, Jean-Denis Gorin wrote: > > > So, my question is: among all of you, old timer firewall wizards, how > > many stay focused to infosec (and had kept a global view [2] of infosys) > > ? > > I still do a great deal of infosec work. I think my focus has been as > broad as ever, as I'm doing computer forensics, incident response, general > secrity, general IT, VoIP switches, RFID, IR training, Web hosting, a > small amount of development, CRM, networking and nature photography. -- Dr. Everett (Skip) Carter Phone: 831-641-0645 FAX: 831-641-0647 Taygeta Scientific Inc. INTERNET: skip@... 1340 Munras Ave., Suite 314 WWW: http://www.taygeta.com Monterey, CA. 93940 _______________________________________________ firewall-wizards mailing list firewall-wizards@... https://listserv.icsalabs.com/mailman/listinfo/firewall-wizards |
|
|
Re: Who stay focused? (was: [Fwd: Question])If the final technical decision is being made by non-technical and obviously clueless person, you seem to just work in a wrong place. I'd quit immediately. On Tue, Apr 14, 2009 at 02:37:59PM -0500, Behm, Jeff wrote: > On Tuesday, April 14, 2009 1:22 PM, Jean-Denis Gorin so spoke: > > So, my question is: among all of you, old timer firewall wizards, > > how many stay focused to infosec > > </quasi-lurker> > > Don't know that I'm really a true "old-timer[1]," but...I have lived > through the waning days of Gauntlet, getting replaced by the *more* > secure (yeah, whatever) Checkpoint, getting replaced by the more > advanced (ok, cheaper) PIX/ASA. Trying to explain the benefits of App > Proxy vs. Packet Filter proxy to layer 8 is obviously futile (at least > it was in my case). _______________________________________________ firewall-wizards mailing list firewall-wizards@... https://listserv.icsalabs.com/mailman/listinfo/firewall-wizards |
|
|
Re: Who stay focused? (was: [Fwd: Question])>> > So, my question is: among all of you, old timer firewall wizards, how
>> > many stay focused to infosec (and had kept a global view [2] of infosys) I am NOT an old-timer (heck, I use Twitter which bans me for life [of twitter] from the ranks of old-timers...), but I want to answer it too. Many people get bitter and negative after doing security for a few years - and then they BURN OUT and go do something else [1] However, the trick is to do what [supposedly] spies [2] are trained to do when tortured: you get to like it! Negative? Sure, I'll give you negative :-) Cynical? Let's make Diogenes proud! [1] ... what about long walks on the beach ? puppies ? CRM? :-) [2] "Inside the Aquarium: The Making of a Top Soviet Spy" by Viktor Suvorov -- Anton Chuvakin, Ph.D http://www.chuvakin.org http://chuvakin.blogspot.com http://www.info-secure.org _______________________________________________ firewall-wizards mailing list firewall-wizards@... https://listserv.icsalabs.com/mailman/listinfo/firewall-wizards |
|
|
Re: Who stay focused? (was: [Fwd: Question])On Tue, Apr 14, 2009 at 5:10 PM, ArkanoiD <ark@...> wrote:
> > If the final technical decision is being made by non-technical and > obviously clueless person, you seem to just work in a wrong place. > I'd quit immediately. > NO!!!!!!!!!!!!! DO NOT QUIT!!!!!!!!!!! Have you not been paying attention to the economy?!!!! Instead use your change management policy to request the changes you want to make or the access a user wants. Then if bad decisions are made by other people they are documented as to who is responsible for the resulting evil! I could care less what my employer wants to do, so long as I have informed them of my opinion and accountability for their stupidity has been assigned to someone else. _______________________________________________ firewall-wizards mailing list firewall-wizards@... https://listserv.icsalabs.com/mailman/listinfo/firewall-wizards |
|
|
Re: Who stay focused? (was: [Fwd: Question])On Tuesday, April 14, 2009 5:10 PM, ArkanoiD said:
> I'd quit immediately. It wasn't immediately, but I am now in a different place than I was then. Thankfully! _______________________________________________ firewall-wizards mailing list firewall-wizards@... https://listserv.icsalabs.com/mailman/listinfo/firewall-wizards |
|
|
Re: Who stay focused? (was: [Fwd: Question])On Tue, Apr 14, 2009 at 08:22:25PM +0200, Jean-Denis Gorin wrote:
> > So, my question is: among all of you, old timer firewall wizards, how > many stay focused to infosec (and had kept a global view [2] of infosys) ? I am not really an infosec person. I am more of a sysadmin who dealt with infosec issues (and still does). My current role is dealing with malicious registrars, spam, fixing bugs in code, database problems, random Windows issues, crypto, DNS, security and data integrity vs application performance, version control, system configuration management, user problems, logging (and lack thereof), ... I am a fairly young un here too. Focussed? I prefer to be a generalist and let the specialists deal with the smaller problems. Devdas Bhagat -- Slumdog sysadmin _______________________________________________ firewall-wizards mailing list firewall-wizards@... https://listserv.icsalabs.com/mailman/listinfo/firewall-wizards |
|
|
Re: Who stay focused? (was: [Fwd: Question])Well, i am one of the old-timers (yes, if you started as security professional
in mid-90s this counts as old-timer now) and i am still here. I was too young and too idealistic those days and lost all opportunities to get rich (there were plenty of those), so now i am still forced to work for living, not for fun. And even that is not so easy - as i there is quite strange new breed who do that really better. Have you noticed those? Those guys who started in early 2000s and who are *experienced professionals* now? They are not visionaries, nor scientists (not am i, though), they are not bright minds either. You do not see them on any security conferences (well, actually there *are* conferences they attend, they are just different ones we consider boring), they do not show up on any workgroups or technical commetees, they do not invent and more, they do not really have a clue to stay on the leading edge (how ridiculously does it sound when applied to our pretty conservative field, but there *is* something like that). They just do their *carreer*. And they do it quite well, even more: they do not give a shit about who you are and what can you do - there are other things that count, like "did you have a senoir management job at company we do respect" (no one even cares if you performed there good enough, the signle fact that you were there is what that counts) and they are always welcome in the corporate world. So i am just a loser who did not get into that pack in time and now it is too late. I did not care about money much and i did not care about the carreer much, i just tried to do something to make this crazy world a little bit sane. And i failed epically. There are some positive changes like all that DLP stuff is something we talked about for 20 years before and i guess it is something that people with clue was talking about several other decades before. But there is nothing in those positive changes i can count as personal achievement - that's not because the world finally learned to leasten, that's just because everything other fails too obviously even for this insane world. On Tue, Apr 14, 2009 at 08:22:25PM +0200, Jean-Denis Gorin wrote: > Hi Paul > > > From: Paul D. Robertson > > Sent: Tuesday, April 14, 2009 5:34 PM > > > [...] > > Once again, I'd like to publicly state that if you want to see > > interesting threads on the list, you have to de-lurk and > > start some. If nothing else, it'd change the Pix/Interesting > > ratio... > > So, I'll start a new one ;) > > Why am I now a long time lurker? Mainly because I have quit the infosec field! > > After 10 years in the infosec field, 5 years ago I decided to quit infosec and > came back to infosys architecture, my original field. > >From early 90's to begin of 00's [0], I lived the raise of firewalls and DMZs... > and their doom: the eBusiness application model where Internet application where > only a front-end to internal infosys! > > In those years, I concluded that there was no way to achieve a good security > awareness because people (IT people or users [1]) didn't (or didn't want to) > have a global view of IT or infosys. > And the marketing buzz words of that time were enought to convince people to > stay singleminded (and buy a 'lucky stone' firewall to protect themselves). > > So, my question is: among all of you, old timer firewall wizards, how many stay > focused to infosec (and had kept a global view [2] of infosys) ? > > > For them willing to know why I'm still lurking FW-wiz as I have quit the field, > I'm just trying to assess how fast the IT world will collapse in case of a major > security threat... (I already know who will survive this, and how ;) ). > > > JDG > > [0] Not Y2K compliant, so what?!? > [1] Or 'lusers' for the BOFH fans ;) > [2] Global, but not unfocused! > -- > Reality is that which, when you stop believing in it, doesn't go away. > Philipp K. Dick > _______________________________________________ > firewall-wizards mailing list > firewall-wizards@... > https://listserv.icsalabs.com/mailman/listinfo/firewall-wizards > > email protected and scanned by AdvascanTM - keeping email useful - www.advascan.com > > _______________________________________________ firewall-wizards mailing list firewall-wizards@... https://listserv.icsalabs.com/mailman/listinfo/firewall-wizards |
|
|
|
|
|
Re: Who stay focused? (was: [Fwd: Question])On Thu, Apr 16, 2009 at 08:09:05PM +0400, ArkanoiD wrote:
<snip> > > Have you noticed those? Those guys who started in early 2000s and who are > *experienced professionals* now? They are not visionaries, nor scientists Hey, I resemble that remark. > (not am i, though), they are not bright minds either. You do not see them > on any security conferences (well, actually there *are* conferences they > attend, they are just different ones we consider boring), they do not show Honestly, if I could afford to travel to a security conference (or two), I would. At this point, all conference funding comes out of my pocket and my personal budget is highly limited. > up on any workgroups or technical commetees, they do not invent and more, > they do not really have a clue to stay on the leading edge (how > ridiculously does it sound when applied to our pretty conservative field, That depends on what bits of infosec you consider bleeding edge. For most applications, the security rules are fairly well known and attacks don't change all that often. If you can't fix the holes, and bandages don't work very well, you have to give up and work on where you can make a change. My current areas of focus are on outbound filtering (rather than inbound) and education. Applying Postel's law to networks and networked applications is useful. The nicest thing about the stock market collapse is that it is a glaring example of bad things happening. "It would never happen to us" does not apply in the real world. Don't try and sell things because they are the right thing to do. That doesn't work. Pointing out how their lack of security will impact operations helps (You will be infected by a virus, it will try to propagate and consume expensive internet bandwidth. You will be blocked for spamming.) Management doesn't understand security, but they understand reputation. Most people don't think in terms of worst case scenarios. That's what I learnt from The Black Swan. We are exceptions to that rule. We think almost solely in terms of rare, worst case scenarios. I have moved to waiting for disaster to strike, and then recovering the pieces. Take my advice and don't blow up, don't take my advice and blow up spectacularly. If you are lucky, you will be too big to fail. > but there *is* something like that). They just do their *carreer*. And > they do it quite well, even more: they do not give a shit about who you > are and what can you do - there are other things that count, like "did > you have a senoir management job at company we do respect" > (no one even cares if you performed there good enough, the signle fact > that you were there is what that counts) and they are always welcome in > the corporate world. > > So i am just a loser who did not get into that pack in time and now it > is too late. I did not care about money much and i did not care about > the carreer much, i just tried to do something to make this crazy world > a little bit sane. And i failed epically. There are some positive changes Meh. Epic failure is better than not trying at all. You never know when success will happen. Or why. Or how. Devdas Bhagat -- Slumdog sysadmin _______________________________________________ firewall-wizards mailing list firewall-wizards@... https://listserv.icsalabs.com/mailman/listinfo/firewall-wizards |
|
|
Re: Who stay focused? (was: [Fwd: Question])Well, i guess role-based data control and entitlement management is something
that can (applying necessary frameworks like WS-* and embedding security tokens into all data flow both in- and intersystem) change the security landscape. If it ever will be applied properly. I doubt so. On Mon, Apr 20, 2009 at 04:53:02PM +0530, Devdas Bhagat wrote: > > > up on any workgroups or technical commetees, they do not invent and more, > > they do not really have a clue to stay on the leading edge (how > > ridiculously does it sound when applied to our pretty conservative field, > > That depends on what bits of infosec you consider bleeding edge. For > most applications, the security rules are fairly well known and attacks > don't change all that often. > > If you can't fix the holes, and bandages don't work very well, you have > to give up and work on where you can make a change. My current areas of > focus are on outbound filtering (rather than inbound) and education. > Applying Postel's law to networks and networked applications is useful. > firewall-wizards mailing list firewall-wizards@... https://listserv.icsalabs.com/mailman/listinfo/firewall-wizards |
|
|
Re: Who stay focused? (was: [Fwd: Question])-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1 On Wed, 15 Apr 2009, Brian Loe wrote: > > Instead use your change management policy to request the changes you > want to make or the access a user wants. Then if bad decisions are > made by other people they are documented as to who is responsible for > the resulting evil! > > I could care less what my employer wants to do, so long as I have > informed them of my opinion and accountability for their stupidity has > been assigned to someone else. This assumes two poiots though, that the BIG guys up there have integrity and have taken responsiblity for their decisions. I seldom find either f those to be the case and have seen cases whence the "stupidity" still rests on the techies shoulders as "they failed to properly inform me of the error of my ways". Thanks, Ron DuFresne - -- ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ admin & senior security consultant: sysinfo.com http://sysinfo.com Key fingerprint = 9401 4B13 B918 164C 647A E838 B2DF AFCC 94B0 6629 These things happened. They were glorious and they changed the world..., and then we fucked up the endgame. --Charlie Wilson -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.5 (GNU/Linux) iD8DBQFJ8NT2st+vzJSwZikRAoykAKDWimA7PIbs24RiAmzsF02XvxXrfQCgnrPh idbeb9eDqgQz5WYiKjqhwDY= =ORUK -----END PGP SIGNATURE----- _______________________________________________ firewall-wizards mailing list firewall-wizards@... https://listserv.icsalabs.com/mailman/listinfo/firewall-wizards |
|
|
|
|
|
Re: Who stay focused? (was: [Fwd: Question])On Fri, Apr 24, 2009 at 10:19 AM, hermit <hermit921@...> wrote:
> I really have to agree with Ron on this. I see this all too often: > Tech: "If you do that, this important functionality will break." > Manager does that. Functionality breaks. > Manager: "It is all your fault." > Tech: "I warned you that would happen." > Manager: "You didn't persuade me to not do it, so it is your fault." > Manager spreads his version of fault around the company. > > hermit921 Sounds like you guys need to learn to use the email tool a little more effectively. I have never just advised against something verbally. I will ALWAYS follow up a verbal comment with an email. I will copy anyone who might be helpful or interested on that email, brief history of the discussion thus far (i.e. "as we discussed earlier in our meeting, after such and such was realized and such and such suggested, I respectfully...") and, if necessary, provide evidence in support of my argument. _______________________________________________ firewall-wizards mailing list firewall-wizards@... https://listserv.icsalabs.com/mailman/listinfo/firewall-wizards |
|
|
Re: Who stay focused? (was: [Fwd: Question])Ultimately, though, most of us work in a business environment that's generally governed by business decisions. One of the lessons I learned long ago as a software developer is that the customer only wants good enough, not perfection, even though as a software developer I always knew I could make the product better with a bit more time.
Security's no different. There's a sweet spot somewhere between wide-open and ratcheted down so tight nobody can use it. That sweet spot is always different, and as a security professional, my job is to identify the exposures, the technology and processes to address them, and to work with management to measure the risk. Ultimately, though, I have to sell it, knowing the business climate (a tough sell these days). Sometimes the customer doesn't want to pay for the perfect solution, and I will be held partially accountable for the fallout. But if you've done the front-end work correctly, you will have identified the potential for problems up front. Hopefully, with your credibility still intact, you'll be able to use the opportunity to move closer to the ideal solution. > On Wed, 15 Apr 2009, Brian Loe wrote: > > > > > Instead use your change management policy to request > the changes you > > want to make or the access a user wants. Then if bad > decisions are > > made by other people they are documented as to who is > responsible for > > the resulting evil! > > > > I could care less what my employer wants to do, so > long as I have > > informed them of my opinion and accountability for > their stupidity has > > been assigned to someone else. > > > This assumes two poiots though, that the BIG guys up there have > integrity and have taken responsiblity for their decisions. I seldom > find either f those to be the case and have seen cases whence the > "stupidity" still rests on the techies shoulders as "they failed to > properly inform me of the error of my ways". > > Thanks, > Ron DuFresne I really have to agree with Ron on this. I see this all too often: Tech: "If you do that, this important functionality will break." Manager does that. Functionality breaks. Manager: "It is all your fault." Tech: "I warned you that would happen." Manager: "You didn't persuade me to not do it, so it is your fault." Manager spreads his version of fault around the company. hermit921 _______________________________________________ firewall-wizards mailing list firewall-wizards@... https://listserv.icsalabs.com/mailman/listinfo/firewall-wizards _______________________________________________ firewall-wizards mailing list firewall-wizards@... https://listserv.icsalabs.com/mailman/listinfo/firewall-wizards |
| Free embeddable forum powered by Nabble | Forum Help |