|
SoftBonds -> RE: European Court of Human Rights allows terrorist extraditions to the US. (4/12/2012 9:43:48 AM)
|
quote:
ORIGINAL: Politesub53 Kirata, thanks for the link. If McKinnon could break into US computers so easily, with readily available software, it doesnt say much for US computer security systems. It ain't that easy!!! First, password security. You can require passwords be a certain length, require special characters, and not allow folks to use the 100 most common passwords, and someone will still use "GodIsMyShepard12#$" as a password and get quickly hacked. Or they use their government password as their yahoo mail password too, to make it easy to remember... Second, size of the area you are trying to secure. I used to work at a part of one part of the government that handled purchasing and contracts. Over 1000 virtual servers, each it's own target for a hacker. Now think about the fact that we were one small part of the government. Now granted, we didn't handle top-secret stuff, but still. Third, the patchwork problem. The reason we needed 1000 virtual servers was to run all the different types of support programs that had been determined to be "stable," for a given program. I remember how we were going to have to re-design a program because it was supported by another program that would no longer be supported by Oracle, so no guarantee that future security holes would have patches issued. That said, imagine trying to make sure you patch hundreds of thousands of programs on over a thousand servers. And this ignores the possibility of "zero day," hacks or the time it takes a company to create a patch for a discovered vulnerability. Now someone might say "then redesign it to work on fewer programs and servers, and design with security in mind in the first place," but that takes a lot of money, and frankly we don't have it right now. Anyway, we have to run it all on windows machines, and microcrap still programs everything in C++, which is why so many buffer-overflow hacks work...
|
|
|
|