Interesting article

I came across this article as a great metaphor for how people think about security. Original post from http://erratasec.blogspot.com/

Thursday, September 02, 2010
A False Sense of Security
Posted by Robert Graham at 5:14 PM

This article describing Hurricane Earl shows a woman putting a pattern of duct tape on the window. Does this duct tape really help?

No, of course not. Duct tape does nothing to stop the glass for shattering, and does almost nothing to stop fragments flying around.

What it does give people is a false sense of security. For whatever reason, they’ve decided not to buy hurricane shutters (even though they live in a hurricane zone) and not board up their windows with plywood. But they can’t just do nothing, so they resort to sympathetic magic like taping up windows. At least they are putting something on their windows.

Such ignorance is not just useless, but in some cases, can be harmful. Some people believe they should leave their windows open a crack during a hurricane, in order to equalize pressure. The opposite is true: this makes it more likely that the hurricane will pop your roof off. The reason is that wind traveling over your roof creates low pressure above, and wind entering your house creates high pressure inside. This lifts your roof off, in precisely the same manner it lifts an airplane wing when flying.

There are obvious analogies with cybersecurity. People do things, like install anti-virus, firewalls, or WEP, because “doing something” makes them feel good. But they haven’t thought through the cause-and-effect whether doing such things actually work.

0 comments:

Post a Comment

Links to this post

Create a Link

Older Post Home
Subscribe to: Post Comments (Atom)

DNSMadeEasy DDoS

DNSMadeEasy.com suffering a sustained DDoS attack at the moment, somewhere in the region of 50Gb/sec!!

Firewall process map

Another timeline generator

Part of my quest to find a great timeline tool that can be used for both forensics and network investigations.

http://www.learningtools.arts.ubc.ca/timeline.htm

X-Header tool

www.privoxy.org

crunch-server-header

Typical use:

Remove a server header Privoxy has no dedicated action for.
Effect:

Deletes every header sent by the server that contains the string the user supplied as parameter.

Hacking Poster

.htaccess setup on apache2

Set Apache Password Protected Directories With .htaccess File

Step # 1: Make sure Apache is configured to use .htaccess file


Options Indexes Includes FollowSymLinks MultiViews
AllowOverride AuthConfig
Order allow,deny
Allow from all


Save the file and restart Apache

# /etc/init.d/apache-perl restart

Step # 2: Create a password file with htpasswd

htpasswd -c password-file username

Create directory outside apache document root, so that only Apache can access password file. The password-file should be placed somewhere not accessible from the web. This is so that people cannot download the password file:

# mkdir -p /home/secure/

Add new user called remote

# htpasswd -c /home/secure/apasswords remote



Now allow apache user www-data to read our password file:
# chown www-data:www-data /home/secure/apasswords
# chmod 0660 /home/secure/apasswords




Create .htaccess file using text editor:
# cd /var/www/
# vi .htaccess

Add following text:

AuthType Basic
AuthName "Restricted Access"
AuthUserFile /home/secure/apasswords
Require user remote

Save file and exit to shell prompt.
Step # 3: Test your configuration

Fire your browser type url http://ip-address/


When prompted for username and password please supply username remote and password.

Troubleshooting

If password is not accepted or if you want to troubleshoot authentication related problems, open and see apache access.log/error.log files:

# tailf -f /var/log/apache2/access.log
# tailf -f /var/log/apache2/error.log