Return-Path: <sentto-279987-4866-1024687320-fc=all.net@returns.groups.yahoo.com> Delivered-To: fc@all.net Received: from 204.181.12.215 [204.181.12.215] by localhost with POP3 (fetchmail-5.7.4) for fc@localhost (single-drop); Fri, 21 Jun 2002 12:29:18 -0700 (PDT) Received: (qmail 21344 invoked by uid 510); 21 Jun 2002 19:26:07 -0000 Received: from n21.grp.scd.yahoo.com (66.218.66.77) by all.net with SMTP; 21 Jun 2002 19:26:07 -0000 X-eGroups-Return: sentto-279987-4866-1024687320-fc=all.net@returns.groups.yahoo.com Received: from [66.218.66.96] by n21.grp.scd.yahoo.com with NNFMP; 21 Jun 2002 19:22:00 -0000 X-Sender: azb@llnl.gov X-Apparently-To: iwar@yahoogroups.com Received: (EGP: mail-8_0_3_2); 21 Jun 2002 19:21:59 -0000 Received: (qmail 4170 invoked from network); 21 Jun 2002 19:21:59 -0000 Received: from unknown (66.218.66.216) by m13.grp.scd.yahoo.com with QMQP; 21 Jun 2002 19:21:59 -0000 Received: from unknown (HELO smtp-2.llnl.gov) (128.115.250.82) by mta1.grp.scd.yahoo.com with SMTP; 21 Jun 2002 19:21:59 -0000 Received: from poptop.llnl.gov (localhost [127.0.0.1]) by smtp-2.llnl.gov (8.9.3/8.9.3/LLNL-gateway-1.0) with ESMTP id MAA20403 for <iwar@yahoogroups.com>; Fri, 21 Jun 2002 12:21:57 -0700 (PDT) Received: from catalyst2b.llnl.gov (catalyst.llnl.gov [128.115.222.68]) by poptop.llnl.gov (8.8.8/LLNL-3.0.2/pop.llnl.gov-5.1) with ESMTP id MAA22781 for <iwar@yahoogroups.com>; Fri, 21 Jun 2002 12:21:57 -0700 (PDT) Message-Id: <5.0.0.25.2.20020621115307.04dd6ee0@poptop.llnl.gov> X-Sender: e048786@poptop.llnl.gov X-Mailer: QUALCOMM Windows Eudora Version 5.0 To: iwar@yahoogroups.com In-Reply-To: <200206210519.g5L5JQP02303@red.all.net> From: Tony Bartoletti <azb@llnl.gov> Mailing-List: list iwar@yahoogroups.com; contact iwar-owner@yahoogroups.com Delivered-To: mailing list iwar@yahoogroups.com Precedence: bulk List-Unsubscribe: <mailto:iwar-unsubscribe@yahoogroups.com> Date: Fri, 21 Jun 2002 12:28:11 -0700 Subject: Re: [iwar] [fc:COMPUTER.SECURITY.SOME.THOUGHTS...METHODS] Reply-To: iwar@yahoogroups.com Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit X-Spam-Status: No, hits=-101.2 required=5.0 tests=IN_REP_TO,RISK_FREE,FREE_MONEY,USER_IN_WHITELIST version=2.20 X-Spam-Level: The article is sound, but barely addresses one of the most difficult areas. Except for the very limited "ultra secure" implementations, a globally accessible system will eventually fall prey to a hack. When this happens, the elements of the system may have been so deeply subverted that the only way to really "clean-up" requires a complete rebuild of the system from unadultered media (to include re-application of all subsequent patches.) This can be a wrenching experience, requiring many hours of effort, and then re-establishment of back-up data (DATA, not process-code). If the difference between "poorly secured", and "moderately-well secured" translates only to a marginal increase in the "mean time between successful hacks", there is little motivation to make the adjustment. I can see two elements to accommodate such an environment: 1. There needs to be a way to distinguish "data" from "code". This is problematic, since the distinction depends as much on the context as it does on the content. But "back-ups" should cover only "data", which for our purposes here means "content whose subversion is unlikely to subvert automated processing". 2. A system should be designed with a physical switch that toggles between parallel sets of disks, and allows no exchange between them. When a system is seen to have been compromised, one would re-boot with the "clean" disk, while setting into motion the process that does a "clean-re-install and backup" to the affected disk. Thus, down-time is minimized. Just some more thoughts ... ____tony____ ------------------------ Yahoo! Groups Sponsor ---------------------~--> Free $5 Love Reading Risk Free! http://us.click.yahoo.com/3PCXaC/PfREAA/Ey.GAA/kgFolB/TM ---------------------------------------------------------------------~-> ------------------ http://all.net/ Your use of Yahoo! Groups is subject to http://docs.yahoo.com/info/terms/
This archive was generated by hypermail 2.1.2 : 2003-08-24 02:46:32 PDT