Re: Handling new vulnerabilities like WebDav

For me, the most time is spent determining whether or not the vulnerability
is really a risk or not out of the hundreds of other security alerts issued
each week.  Once that process is done, those who already have a good handle
on their system inventory should be in the position to know their exposure
right away.  My approach is to know what you have and where you have it
ahead of time so you won't need to manually check your systems.  While
initially a lot of work, it pays off in the long-run.  Of course,
maintaining such as inventory is also difficult if you don't have the right
policies and procedures in place.  Regular scanning for non-inventoried
systems helps identify rogue boxes.

Darren Van Booven
Director, Information Security

=======================================================================
CONFIDENTIALITY NOTICE: This email message and any attachments hereto
are confidential and may also be privileged. If you are not the named
recipient, please notify the sender immediately by reply email and
delete the contents of this email and any attachments without
disclosing the contents to anyone, using the contents for any purpose,
or storing or copying the contents in any medium.
=======================================================================


----- Original Message -----
From: <[email protected]>
To: <[email protected]>
Sent: Thursday, March 20, 2003 9:49 AM
Subject: Handling new vulnerabilities like WebDav


> I am curious as to how people in large organizations are handling new
vulnerabilities like the WebDAV recently released.  Specifically, I'm trying
to gauge how people are determining their exposure, or risk level.  Upon
learning of a new vulnerability are folks scanning their entire environment
to look for the vulnerability?  Or are folks going through their inventory
to look for IIS web servers and having folks manually check them?
>
> Just looking for input.  Please reply directly to me and I will sum up and
post.
>
> Thanks,
>
> Bob
>
>
> **********************************************************************
> This transmission may contain information that is privileged, confidential
and/or exempt from disclosure under applicable law. If you are not the
intended recipient, you are hereby notified that any disclosure, copying,
distribution, or use of the information contained herein (including any
reliance thereon) is STRICTLY PROHIBITED. If you received this transmission
in error, please immediately contact the sender and destroy the material in
its entirety, whether in electronic or hard copy format. Thank you
> **********************************************************************
>
>