New Pentesting TV Show Coming Out

By Daniel Miessler on December 21st, 2007: Tagged as Hacking | Pentesting | Security

Viewing 4 Comments

    • ^
    • v

    I'm an IT professional and see no security value in publicly exposing weaknesses in the world’s most sophisticated security systems. This is not defeating criminals at their own game. It used to be that one had to go to prison to be trained in crime. Just another tactic of spreading fear. There is no such thing as a foolproof cost effective security system. Fix this by enforcing and the law. If I want less hot water I simply turn a knob on my sink.

    • ^
    • v

    Jason,


    The point here is pretty simple: if we don't check ourselves to see if we have weaknesses, someone else will. We should not simply wait to be attacked using various methods that we're too lazy to find ourselves.


    Penetration testing is an excellent way to test mature security programs. It doesn't prove security, but if it uncovers something, that information is often invaluable.

    • ^
    • v

    I've done security audits. To get my point watch "Bowling for Columbine." Watch how the fear Americans feel due to what is programmed on TV for us is juxtaposed against Canadians viewpoint on fear.


    On a side note, I believe hackers who expose security holes publicly are wrong. Such exposures does not allow a vendor time to fix the problem before the exposed hack is likely used by the now informed public. The way I see it, the only right way to expose discovered security holes is to inform the vendor, period. Any further actions are only born from a desire for recognition. A fact for which IT vendors could capitalize.

    • ^
    • v

    On the disclosure point, that's generally accepted to be true. The only question is how long to give the vendor before going public.

 

Trackbacks

(Trackback URL)

close Reblog this comment
blog comments powered by Disqus

    Discovered Content


    About dmiessler.com

    This site is an avatar for my own self-assigned life purpose--an attempt to model the world in the most accurate way possible, and to do so without bias or fear of unpleasant truth. I desire to develop, articulate, and perpetually improve models of how things work, and then to use that understanding to increase happiness and reduce suffering. I seek those on similar paths and thrive on sharing an appreciation of the interesting and beautiful with others.



    Blog
    Study
    Writing
    Infosec
    Technology
    Politics

    Top Original Content


    Security & Technology

    Philosophy & Science

    Culture & Society

    Blog Archives