From: Craig Wright [mailto:cwright@bdosyd.com.au]
Sent: 23 February 2006 21:10
To: dave kleiman; Darren W Miller
Cc: Al Sutton; defendingthenet
Subject: RE: Why Easy To Use Software Is Putting You At Risk
Hello,
Dave stated; "Craig.. And be gentle Craig will pick apart opinions and bring back \
factual information without batting an eye."
True and I am always open to being proved wrong. The thing is that I have to be \
PROVED Wrong. Opinion and anecdotal evidence is not proof. Validated points and \
correctly collected statistical data are.
As much as many people find this difficult to believe (even my wife) I enjoy being \
proved wrong. It is both a learning opportunity for my self and a demonstration that \
others are engaging in serious peer review processes outside of academe.
In the past 20 years I have performed close to 5,000 engagements. At the moment I am \
conducting one of the largest vulnerability and risk assessments ever conducted in \
Australia in association with the Attorney Generals CNVA programme.
The first issue to address is yes you found a vulnerability and it was exploitable. \
What is the risk? The impact threat vectors and other analysis factors need to be \
considered. Vulnerabilities do not matter by themselves. They create a risk \
potential. When you understand this you will both serve your clients more effectively \
and also add value in a manner they will understand. You need to sell to management. \
They understand finance and risk. Vulnerabilities are FUD. They do not help.
As for engineering something not to fail. This is where I have an issue with people \
who think they are engineers. Engineering is the process of building something to a \
set specification. An example is giving a 95% Confidence Internal of a 5 year \
expected life. It involves the analysis and design of hazard functions and survival \
processes.
Regards,
Craig https://marc.info/?l=security-basics&m=114080882901616&w=2
PS this is about as nice as I get unless people actually seek to open their minds and \
learn.
Sent: 23 February 2006 21:10
To: dave kleiman; Darren W Miller
Cc: Al Sutton; defendingthenet
Subject: RE: Why Easy To Use Software Is Putting You At Risk
Hello,
Dave stated; "Craig.. And be gentle Craig will pick apart opinions and bring back \
factual information without batting an eye."
True and I am always open to being proved wrong. The thing is that I have to be \
PROVED Wrong. Opinion and anecdotal evidence is not proof. Validated points and \
correctly collected statistical data are.
As much as many people find this difficult to believe (even my wife) I enjoy being \
proved wrong. It is both a learning opportunity for my self and a demonstration that \
others are engaging in serious peer review processes outside of academe.
In the past 20 years I have performed close to 5,000 engagements. At the moment I am \
conducting one of the largest vulnerability and risk assessments ever conducted in \
Australia in association with the Attorney Generals CNVA programme.
The first issue to address is yes you found a vulnerability and it was exploitable. \
What is the risk? The impact threat vectors and other analysis factors need to be \
considered. Vulnerabilities do not matter by themselves. They create a risk \
potential. When you understand this you will both serve your clients more effectively \
and also add value in a manner they will understand. You need to sell to management. \
They understand finance and risk. Vulnerabilities are FUD. They do not help.
As for engineering something not to fail. This is where I have an issue with people \
who think they are engineers. Engineering is the process of building something to a \
set specification. An example is giving a 95% Confidence Internal of a 5 year \
expected life. It involves the analysis and design of hazard functions and survival \
processes.
Regards,
Craig https://marc.info/?l=security-basics&m=114080882901616&w=2
PS this is about as nice as I get unless people actually seek to open their minds and \
learn.
Comments
Be the first to add a comment
Log in to comment