Re: SCADA

"Marcus J. Ranum" <[email protected]> Wed, 15 Apr 2009 23:28:49 -0500

Newsgroups	gmane.comp.security.firewalls.wizards
Message-ID	<[email protected]>

Paul D. Robertson (noble foil) wrote:
> 1.  I'm not sure "no more" fits in the definition- for instance a system 
> that's designed to send company email can also send personal email- how 
> does that make the system less reliable?

If its purpose is only to send company email, it is flawed if it
sends personal email. Indeed, it then becomes a "spam source" instead
of a "corporate resource." If it is loosely specified it may later
be determined that the company email server is flawed or that the
specification is.

> 2.  An "insecure" system _can_ host hostile activity, but that doesn't 
> mean it does.

It eventually will.

> If I had one beer for every time I've heard that, you'd be out of beer!  
> Again! :)

:) Bask in your victories, Obi-wan!
mjr.

-- 
Marcus J. Ranum		CSO, Tenable Network Security, Inc.
			http://www.tenablesecurity.com