Firewall Wizards: RE: The Morris worm to Nimda, how little we've learned or gained

[Bill_Royds () pch gc ca]

Very well put. Although mandatory safety controls do affect losses because it
also helps those who don't change their habits.
Voluntary ones have exactly the affect you state. Formula 1 drivers love their 3
point harness because it makes cornering against G forces easier.

One thing that you don't mention is the ability to properly assume risk.
This has been the problem with NIMDA in that many of the infected machines are
running insecure default setups because the owners are not aware that they are
even running HTTP servers.
Because of the default install routines of Windows 2000 server, owners of
servers can have software installed that they would not run if they were aware
of the risk.


Bill Royds



|--------+------------------------------->
|        |          "robert_david_graham"|
|        |          <robert_david_graham@|
|        |          yahoo.com>           |
|        |                               |
|        |          01/04/2002 19:38     |
|        |                               |
|--------+------------------------------->
  >----------------------------------------------------------|
  |                                                          |
  |      To:     "'Marcus J. Ranum'" <mjr () nfr com>, "'R.     |
  |       DuFresne'" <dufresne () sysinfo com>,                 |
  |       firewall-wizards () nfr net                           |
  |      cc:     (bcc: Bill Royds/HullOttawa/PCH/CA)         |
  |      Subject:     RE: [fw-wiz] The Morris worm to Nimda, |
  |       how little we've  learned or gained                |
  >----------------------------------------------------------|




Um. Here is some standard free-market economics rhetoric. Marcus will
probably kill this because most of you are NOT free-market libertarians (and
the thread is already getting long), but here goes...

<snip>

The key phrase is: RISK TOLERANCE IS A CONSTANT. This means the level of
hacking, worms, viruses, and so forth are a constant. Firewall's don't
change risk tolerance. Anti-virus programs don't change risk tolerance.
Hiring a security guru won't change your risk tolerance. From Morris to
Nimbda, the reason nothing has changed is that corporations have the same
risk tolerance today that they had 13 years ago.


Applying this Internet wide, the costs of CodeRed and Nimda were certainly
considerable, but the BENEFITS of the open, risky architecture far outweighs
those costs. Our society is hugely better off because of the Internet
technology -- including the increased risks to hacking. As security
professionals, we are paid to be pessimists and believe the glass is
half-empty. However, economic measurements of GNP growth due to Internet
technologies (including costs as well as benefits) indicate a very positive
result (that the glass is half-full). Thus, while most of the industry
laments at the poor security we have, I think the situation is great:
benefits are outweighing the costs. Hacking is an annoyance, but not a
"problem".

Anyway, this is the standard argument from the free-market economists point
of view. I understand that it is NOT the view of most security
professionals.

Robert Graham






_______________________________________________
firewall-wizards mailing list
firewall-wizards () nfr com
http://list.nfr.com/mailman/listinfo/firewall-wizards