3 ms·

Quarterly vuln scans don’t really make the cut in the modern world. Take CVE-2020-1350 (MS DNS vuln) as an example - it took about 48 hrs from publicizing the

Quarterly vuln scans don’t really make the cut in the modern world. Take CVE-2020-1350 (MS DNS vuln) as an example - it took about 48 hrs from publicizing the vuln to a working exploit to appear on Github. If you scan per quarter, and it takes you n days or weeks (or months) to fix the critical stuff, it’s quite a window of exposure - per each vuln. Any midsize org will carry hundreds or thousands. Enterprises much more.

rsync 6y ago
Obligatory: https://www.rsync.net/resources/regulatory/pci.html https://www.rsync.net/resources/regulatory/pci.html
- waihtis 6y ago
  Absolutely love it!
- acomjean 6y ago
  PCI compliance helps a little. When I was doing IOT power/temperature monitoring sometimes companies wanted us to show PCI compliance before attaching our hardware to their networks. (we weren't) which meant we had to explain to them to put us on a separate network, without credit card processing devices.
  - krallja 6y ago
    PCI compliance is extremely easy if you don’t handle PANs. Provide a SAQ that says “we don’t handle PANs” and you’re compliant.
    - czbond 6y ago
      Caveat if you are small business. Otherwise, with lots of charges it costs about $100k+ annually in validation, not including labor effort. A startup can hit this quickly, but only under certain circumstances.
      - mahmoudimus 6y ago
        If you're a startup and you need PCI DSS compliance, please contact me - mahmoud [@] verygoodsecurity.com and I'd love to help!
- jcims 6y ago
  Definitely agree from a technical perspective. But I do think it was marginally successful in translating technical risk to business risk, which is something that hadn't been done very well previously and did drive a lot of investment into 'security'. Unfortunately the security industry somewhat predictably responded with snake oil and bullshit that were predictably countered with overpriced Big N assessments, but that's another story.
gruez 6y ago
>it took about 48 hrs from publicizing the vuln to a working exploit to appear on Github. a real one? someone was trolling with a fake one https://blog.zsec.uk/cve-2020-1350-research/ https://blog.zsec.uk/cve-2020-1350-research/
- waihtis 6y ago
  The first two were rickrolls, but around the 48h mark both an identifier scan and a DOS exploit were pushed to GH.
Wohlf 6y ago
This is why defense-in-depth is so important. Very few companies can test and rollout a patch in a few days, and that's not even accounting for regulatory concerns that may add additional time.
- waihtis 6y ago
  Agreed. I run a product company in this area (internal threat/exploit detection) and the lack of any kind of visibilty most orgs have is concerning. It’s partially the security industry’s fault for promoting ineffective and expensive methods as the go-to.
deleted 6y ago
[deleted]

rsync 6y ago

Obligatory: https://www.rsync.net/resources/regulatory/pci.html https://www.rsync.net/resources/regulatory/pci.html

waihtis 6y ago
Absolutely love it!
acomjean 6y ago
PCI compliance helps a little. When I was doing IOT power/temperature monitoring sometimes companies wanted us to show PCI compliance before attaching our hardware to their networks. (we weren't) which meant we had to explain to them to put us on a separate network, without credit card processing devices.
- krallja 6y ago
  PCI compliance is extremely easy if you don’t handle PANs. Provide a SAQ that says “we don’t handle PANs” and you’re compliant.
  - czbond 6y ago
    Caveat if you are small business. Otherwise, with lots of charges it costs about $100k+ annually in validation, not including labor effort. A startup can hit this quickly, but only under certain circumstances.
    - mahmoudimus 6y ago
      If you're a startup and you need PCI DSS compliance, please contact me - mahmoud [@] verygoodsecurity.com and I'd love to help!
jcims 6y ago
Definitely agree from a technical perspective. But I do think it was marginally successful in translating technical risk to business risk, which is something that hadn't been done very well previously and did drive a lot of investment into 'security'. Unfortunately the security industry somewhat predictably responded with snake oil and bullshit that were predictably countered with overpriced Big N assessments, but that's another story.

gruez 6y ago

>it took about 48 hrs from publicizing the vuln to a working exploit to appear on Github. a real one? someone was trolling with a fake one https://blog.zsec.uk/cve-2020-1350-research/ https://blog.zsec.uk/cve-2020-1350-research/

waihtis 6y ago
The first two were rickrolls, but around the 48h mark both an identifier scan and a DOS exploit were pushed to GH.

Wohlf 6y ago

This is why defense-in-depth is so important. Very few companies can test and rollout a patch in a few days, and that's not even accounting for regulatory concerns that may add additional time.

waihtis 6y ago
Agreed. I run a product company in this area (internal threat/exploit detection) and the lack of any kind of visibilty most orgs have is concerning. It’s partially the security industry’s fault for promoting ineffective and expensive methods as the go-to.

deleted 6y ago

[deleted]