|
|
|
|
|
|
|
|
|
|
|
|
| home | help | back | first | fref | pref | prev | next | nref | lref | last | post |
Date: Sat, 18 Oct 2003 13:28:50 -0400
From: Leo Bicknell <bicknell@ufp.org>
To: nanog@nanog.org
Mail-Followup-To: nanog@nanog.org
In-Reply-To: <20031018122621.B29105@roxanne.org>
Errors-To: owner-nanog-outgoing@merit.edu
--+HP7ph2BbKc20aGI
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable
In a message written on Sat, Oct 18, 2003 at 12:26:21PM -0400, Eric Gauthie=
r wrote:
> Again, I definitely agree with the IAB's recommendation. However, its=20
> difficult to defend this point of view in practice since most of the=20
> equipment does basic packet filtering in hardware or with minimal cost to=
=20
> peformance. So, I just can't figure out how to sit in front of our=20
> administration and justify the replacement of a zero-cost solution with=
=20
> the cost of added staff and equipment to mitigate these security risks,=
=20
> especially when the up side is just not "limiting the potential for=20
> deployment of future applications".
Well, but you've hit the nail on the head. The fitler solution is
_NOT_ zero cost, it is deferred cost. I suggest you phrase it that
way. It's a way of deferring the cost to later, with interest.
The longer you use it, the higher that interest payment will be,
in the form of new and different attacks you can't block.
Phrasing it to the bean counters that it is deferring the cost,
with interest, and suggesting that simultaneously some money be
spent on user education, better software, or whatever is appropriate
to insure you don't have a "huge baloon payment" later might help
put it in terms they can understand.
Similar parallels can be drawn to antibiotics -- the over use will
eventually render them ineffective. It's a very similar situation,
and sometimes you have to just invest in not getting sick in the
first place (wash your hands...patch your system).
--=20
Leo Bicknell - bicknell@ufp.org - CCIE 3440
PGP keys at http://www.ufp.org/~bicknell/
Read TMBG List - tmbg-list-request@tmbg.org, www.tmbg.org
--+HP7ph2BbKc20aGI
Content-Type: application/pgp-signature
Content-Disposition: inline
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.1 (FreeBSD)
iD8DBQE/kXhSNh6mMG5yMTYRAi/4AJ4snwWr4sK2TpA3NGDhVFSEdFEsvACgiJCN
tjjTIdwnyU20AtPaL+oTVts=
=ddmq
-----END PGP SIGNATURE-----
--+HP7ph2BbKc20aGI--
|
|
|
|
|
|
|
|
|
|
|
|
| home | help | back | first | fref | pref | prev | next | nref | lref | last | post |