3 ms·
Physical security and computer security don't really connect usefully by these kinds of analogies. I suggest you look higher up in the thread for where you brou
by yayana 8y ago
Physical security and computer security don't really connect usefully by these kinds of analogies. I suggest you look higher up in the thread for where you brought up threat actors.
- badrabbit 8y agoOk,better analogy:There's a 0day vulnerability in a specific device driver you happen to be using,crafting a workable exploit requires a significant amount of skill and the exploit can only work under specific configurations. A well organized and talent-resourced attacker performing targeted attacks would exploit the vulnerability. Realistically,you'll have to take into account the likelihood of someone exploiting this vulnerability when prioritizing remediation(grading insecurity). A simpler example: apache2 has a RCE but known exploits require PIE disabled for an exploit to work. You have one apache server in a segregated vlan that is facing your admin vlan with PIE enabled. In contrast you have an IIS server with DOS vuln facing the internet. The IIS server is more insecure because there is a significantly higher likelihood of a security compromise(availability) against it and the org will face reputational and revenue(?) Impact. The whole point I want youbto get is that real (in)security is context aware.