mailing list archives
Re: Getting Off the Patch
From: "Thor (Hammer of God)" <thor () hammerofgod com>
Date: Fri, 14 Jan 2011 15:32:24 +0000
Ah, so that makes perfect sense then. Rather than hiring the young hires and teaching them to patch, we are supposed
to hire highly experienced experts who are already supposed to know how to patch because young hires cannot do it.
However, since the argument is that patching is already incredibly hard, and that it creates exponential costs of
operations, this must be because the experienced experts who set the whole thing up originally did it wrong based on
their inherited, faulty knowledge.
So instead of patching, since even the experts can't do to it right without the spiraling costs crippling operations,
we tell the same people who can't patch that they are to " find the right balance of operational controls at each
interactive point within a vector [to] provide protection against 100% of the threats including unknown threats" and
to, obviously, do so in such an effective manner that the costs of doing so somehow get substantially minimized and at
a level that justifies the risks of not patching, even given the salary difference between noobs and ninjas. And
since the knowledge required for those who *can't* patch but *can* balance operational controls at each interactive
point within a vector is available freely at www.osstmm.org , we should stop trying to patch, even though the process
detailed and the knowledge required in the PDF was compiled by those who obviously also couldn't figure out how to
patch or else they wouldn't have needed an alternative in
the first place.
All they have to do is read, understand, and act on the information in the PDF as opposed to reading, understanding,
and acting on patch management.
It's brilliant! Where do I sign up?
From: full-disclosure-bounces () lists grok org uk [mailto:full-disclosure-
bounces () lists grok org uk] On Behalf Of Valdis.Kletnieks () vt edu
Sent: Friday, January 14, 2011 7:01 AM
Cc: full-disclosure () lists grok org uk; Zach C; lists () isecom org
Subject: Re: [Full-disclosure] Getting Off the Patch
On Fri, 14 Jan 2011 09:25:51 +0100, phocean said:
But this is so well known, at least I thought, that I wonder what is
the purpose of all of this.
It's a symptom of our industry slowly getting older. In the '70s and '80s, pretty
much everybody had 3-5 years experience, and almost nobody had more than
10, because the field wasn't 10 years old. Nobody looked down on the
newbies, because (a) they didn't stay newbies long because there was only 3-
4 years worth of stuff to learn and (b) the old-timers could still remember
being newbies themselves.
Now it's different - the guys who were here at the beginning are all old, gray,
and/or bald, and looking at retirement, and we have to start worrying about
the collective brain drain that will happen at that time. Meanwhile, demand is
surging faster than truly qualified people can be supplied, so we're seeing a lot
of young hires who only know what they learned in an 18 month course at
ECPI or similar trade school. In other words, we're at exactly the same
position when the great flood of McSE holders happened a few years back.
RFC1925 says: "Some things in life can never be fully appreciated nor
understood unless experienced firsthand. Some things in networking can
never be fully understood by someone who neither builds commercial
networking equipment nor runs an operational network." We've gotten to
the point where a large segment of the industry wasn't taught "patching
doesn't work" in school, and they have yet to experience it themselves out in
the real world.
Full-Disclosure - We believe in it.
Hosted and sponsored by Secunia - http://secunia.com/