Comments on: New Pentesting TV Show Coming Out http://danielmiessler.com/blog/new-pentesting-tv-show-coming-out grep understanding Fri, 25 May 2012 02:15:50 +0000 hourly 1 http://wordpress.org/?v=3.3.2 By: Daniel Miessler http://danielmiessler.com/blog/new-pentesting-tv-show-coming-out/comment-page-1#comment-106104 Daniel Miessler Sun, 23 Dec 2007 06:08:19 +0000 http://dmiessler.com/blogarchive/new-pentesting-tv-show-coming-out#comment-106104 <p>On the disclosure point, that's generally accepted to be true. The only question is how long to give the vendor before going public.</p> On the disclosure point, that’s generally accepted to be true. The only question is how long to give the vendor before going public.

]]> By: Daniel Miessler http://danielmiessler.com/blog/new-pentesting-tv-show-coming-out/comment-page-1#comment-250477 Daniel Miessler Sun, 23 Dec 2007 06:08:00 +0000 http://dmiessler.com/blogarchive/new-pentesting-tv-show-coming-out#comment-250477 <p>On the disclosure point, that's generally accepted to be true. The only question is how long to give the vendor before going public.</p> On the disclosure point, that’s generally accepted to be true. The only question is how long to give the vendor before going public.

]]> By: Jason http://danielmiessler.com/blog/new-pentesting-tv-show-coming-out/comment-page-1#comment-106103 Jason Sun, 23 Dec 2007 06:06:22 +0000 http://dmiessler.com/blogarchive/new-pentesting-tv-show-coming-out#comment-106103 <p>I've done security audits. To get my point watch "Bowling for Columbine." Watch how the fear Americans feel due to what is programmed on TV for us is juxtaposed against Canadians viewpoint on fear.</p> <p>On a side note, I believe hackers who expose security holes publicly are wrong. Such exposures does not allow a vendor time to fix the problem before the exposed hack is likely used by the now informed public. The way I see it, the only right way to expose discovered security holes is to inform the vendor, period. Any further actions are only born from a desire for recognition. A fact for which IT vendors could capitalize.</p> I’ve done security audits. To get my point watch “Bowling for Columbine.” Watch how the fear Americans feel due to what is programmed on TV for us is juxtaposed against Canadians viewpoint on fear.

On a side note, I believe hackers who expose security holes publicly are wrong. Such exposures does not allow a vendor time to fix the problem before the exposed hack is likely used by the now informed public. The way I see it, the only right way to expose discovered security holes is to inform the vendor, period. Any further actions are only born from a desire for recognition. A fact for which IT vendors could capitalize.

]]> By: Jason http://danielmiessler.com/blog/new-pentesting-tv-show-coming-out/comment-page-1#comment-250476 Jason Sun, 23 Dec 2007 06:06:00 +0000 http://dmiessler.com/blogarchive/new-pentesting-tv-show-coming-out#comment-250476 <p>I've done security audits. To get my point watch "Bowling for Columbine." Watch how the fear Americans feel due to what is programmed on TV for us is juxtaposed against Canadians viewpoint on fear.</p> <p>On a side note, I believe hackers who expose security holes publicly are wrong. Such exposures does not allow a vendor time to fix the problem before the exposed hack is likely used by the now informed public. The way I see it, the only right way to expose discovered security holes is to inform the vendor, period. Any further actions are only born from a desire for recognition. A fact for which IT vendors could capitalize.</p> I’ve done security audits. To get my point watch “Bowling for Columbine.” Watch how the fear Americans feel due to what is programmed on TV for us is juxtaposed against Canadians viewpoint on fear.

On a side note, I believe hackers who expose security holes publicly are wrong. Such exposures does not allow a vendor time to fix the problem before the exposed hack is likely used by the now informed public. The way I see it, the only right way to expose discovered security holes is to inform the vendor, period. Any further actions are only born from a desire for recognition. A fact for which IT vendors could capitalize.

]]> By: Daniel Miessler http://danielmiessler.com/blog/new-pentesting-tv-show-coming-out/comment-page-1#comment-106095 Daniel Miessler Sun, 23 Dec 2007 05:18:11 +0000 http://dmiessler.com/blogarchive/new-pentesting-tv-show-coming-out#comment-106095 <p>Jason,</p> <p>The point here is pretty simple: if we don't check ourselves to see if we have weaknesses, someone else will. We should not simply wait to be attacked using various methods that we're too lazy to find ourselves. </p> <p>Penetration testing is an excellent way to test mature security programs. It doesn't prove security, but if it uncovers something, that information is often invaluable.</p> Jason,

The point here is pretty simple: if we don’t check ourselves to see if we have weaknesses, someone else will. We should not simply wait to be attacked using various methods that we’re too lazy to find ourselves.

Penetration testing is an excellent way to test mature security programs. It doesn’t prove security, but if it uncovers something, that information is often invaluable.

]]> By: Daniel Miessler http://danielmiessler.com/blog/new-pentesting-tv-show-coming-out/comment-page-1#comment-250475 Daniel Miessler Sun, 23 Dec 2007 05:18:00 +0000 http://dmiessler.com/blogarchive/new-pentesting-tv-show-coming-out#comment-250475 <p>Jason,</p> <p>The point here is pretty simple: if we don't check ourselves to see if we have weaknesses, someone else will. We should not simply wait to be attacked using various methods that we're too lazy to find ourselves. </p> <p>Penetration testing is an excellent way to test mature security programs. It doesn't prove security, but if it uncovers something, that information is often invaluable.</p> Jason,

The point here is pretty simple: if we don’t check ourselves to see if we have weaknesses, someone else will. We should not simply wait to be attacked using various methods that we’re too lazy to find ourselves.

Penetration testing is an excellent way to test mature security programs. It doesn’t prove security, but if it uncovers something, that information is often invaluable.

]]> By: Jason http://danielmiessler.com/blog/new-pentesting-tv-show-coming-out/comment-page-1#comment-106092 Jason Sun, 23 Dec 2007 05:11:52 +0000 http://dmiessler.com/blogarchive/new-pentesting-tv-show-coming-out#comment-106092 <p>I'm an IT professional and see no security value in publicly exposing weaknesses in the world’s most sophisticated security systems. This is not defeating criminals at their own game. It used to be that one had to go to prison to be trained in crime. Just another tactic of spreading fear. There is no such thing as a foolproof cost effective security system. Fix this by enforcing and the law. If I want less hot water I simply turn a knob on my sink.</p> I’m an IT professional and see no security value in publicly exposing weaknesses in the world’s most sophisticated security systems. This is not defeating criminals at their own game. It used to be that one had to go to prison to be trained in crime. Just another tactic of spreading fear. There is no such thing as a foolproof cost effective security system. Fix this by enforcing and the law. If I want less hot water I simply turn a knob on my sink.

]]> By: Jason http://danielmiessler.com/blog/new-pentesting-tv-show-coming-out/comment-page-1#comment-250474 Jason Sun, 23 Dec 2007 05:11:00 +0000 http://dmiessler.com/blogarchive/new-pentesting-tv-show-coming-out#comment-250474 <p>I'm an IT professional and see no security value in publicly exposing weaknesses in the world’s most sophisticated security systems. This is not defeating criminals at their own game. It used to be that one had to go to prison to be trained in crime. Just another tactic of spreading fear. There is no such thing as a foolproof cost effective security system. Fix this by enforcing and the law. If I want less hot water I simply turn a knob on my sink.</p> I’m an IT professional and see no security value in publicly exposing weaknesses in the world’s most sophisticated security systems. This is not defeating criminals at their own game. It used to be that one had to go to prison to be trained in crime. Just another tactic of spreading fear. There is no such thing as a foolproof cost effective security system. Fix this by enforcing and the law. If I want less hot water I simply turn a knob on my sink.

]]>