4 ms·

> In my experience, it seems like vendor disclosures, and measures that might impact correcting vulnerable components are insufficient, and slow, if they happen

> In my experience, it seems like vendor disclosures, and measures that might impact correcting vulnerable components are insufficient, and slow, if they happen at all. SAP has a CVE dispute rate of exactly 100%. Just as a fun fact. It gets worse when you look deeper into hardware vendors, where they mark things as fixed even though they aren't. And Debian as a feature frozen distribution has sooo many tags that are similar to "code diverged too much from upstream", yet they mark the CVEs as fixed; even though they are still affected and the old code from 6 years ago on exploitdb still works. That is what led me to building a vulnerability scraper that scrapes and correlates all linux security trackers, and rates them with a confidence value (with Debian obviously having the lowest) in order to be able to discover those issues that have been correctly tagged, deployed and fixed in other distros (e.g. Arch Linux). > They had Mcafee's DLP deployed organization wide(...) Holy shit, that's like every sysadmin's nightmare. I feel for you, man. With a pentester's voice I always like to say that the biggest castle walls are useless when you have an ADFS server running inside it. A lot of DMZ approaches are useless because they underestimate the attack surface of their core IAM infrastructure.

than3 3y ago
> that's like every sysadmin's nightmare. Not worst case scenario, but it definitely was up there. I'll always remember it, both because nothing you normally had access for would work because no access, and my contingencies really paid off. I had just come off a project fully automating configuration and deployment for our more common infrastructure components; auditing and meeting various security baselines. Its nice seeing hard work you had just finished and tested in action working better than you thought. Most of our time spent was ensuring all relevant data was migrated from the sprawl of endpoints to a central fileshare with integrity intact with no malware. Entrypoint turned out to be one of the employees using a dropbox file-share. The previous admin had been directed to allow it by a person in upper management on a one-time basis for WFH. Their home PC had been infected and spread laterally. It was a brief blank stare/mental facepalm moment finding that out. Ultimately everything was back up and running, We made recommendations; and their IT wrapped everything else up.

than3 3y ago

> that's like every sysadmin's nightmare. Not worst case scenario, but it definitely was up there. I'll always remember it, both because nothing you normally had access for would work because no access, and my contingencies really paid off. I had just come off a project fully automating configuration and deployment for our more common infrastructure components; auditing and meeting various security baselines. Its nice seeing hard work you had just finished and tested in action working better than you thought. Most of our time spent was ensuring all relevant data was migrated from the sprawl of endpoints to a central fileshare with integrity intact with no malware. Entrypoint turned out to be one of the employees using a dropbox file-share. The previous admin had been directed to allow it by a person in upper management on a one-time basis for WFH. Their home PC had been infected and spread laterally. It was a brief blank stare/mental facepalm moment finding that out. Ultimately everything was back up and running, We made recommendations; and their IT wrapped everything else up.