> > List out your threats. Then validate them - measure > > them. Make sure they are actually present and causing > > damage before spending a dime on protecting against > > them. > > How about I do just that... This is just a couple of things from the > past week or so... > > Report just out on sys admin insider attacks, up to 1/3rd have been in > prison...
OK, so insider attacks are serious. I agree with that, and insider attacks are generally the #1 on any list. Now, what's that got to do with browsers, web sites, SSL and the like? Not a lot as insiders are inside, they don't need to do anything fancier than run a few reports to get the data out of the database. Unless you are saying that these sysadms work for ISPs and they are attacking the traffic passing through, that would be a threat. So how many of these sys admins are there? Is the 1/3 a proportion of the ones caught, or a proportion of total sys admins? > Google's proxy system managed to let the website people were visiting > already think they were logged on under someone else's user ID. OK, so this is an accidental artifact of a system, probably badly configured or with aspects that they hadn't thought out. Fixed in the beta, I would guess. > Yup, no problem here at all we should be protecting against... List the threats, then validate them! iang -- http://iang.org/ _______________________________________________ Mozilla-security mailing list [email protected] http://mail.mozilla.org/listinfo/mozilla-security
