Subject: Re: [Raven] Fidnet

From: Vernon Schryver <[email-masked]>
Date: Fri, 5 Nov 1999 15:50:02 -0700 (MST)

> From: [email-masked]

> ...
> Any form of encryption makes network based intrusion detection difficult to
> say the least. ...

I disagree with that.  

> ...
> {I find it interesting that network based intrusion detection, which is at
> least commercially relatively recent, is considered as "traditional
> intrusion detection".}

If you think "network based intrusion detection" is novel, then you've
been listening to too many newcomers, or salescritters.  On the other
hand, if by "commercially" you mean that only recently are entrepreneurs
on the Super Hype Way trying to build $B market capitalizations on the
idea, then I agree.

> >Systems managers are no more or less human or corruptible than the local
> >police, FBI, CIA, NSA, etc.  ...
>
> Agreed.  But there may be less systematic pressure on them.  After all,
> most everyone is measured on something.   System managers on up-time.  Cops
> on arrests and tickets.  Prosecutors on convictions.  In general, most
> system mangers are probably less motivated to catch and convict a criminal
> than to keep some intruder from screwing up the availability numbers.

In some places, system managers are measured on the appearance of security
as much as up-time.  If you can't do anything useful about system security
that you haven't already done, but you feel pressure to appear to be doing
something, you're likely to abuse the easy tools.  You can understand some
law enforcement abuses of conventional wiretaps similarly.

> Furthermore, many organizations are disinclined to pursue any form of
> legal action against intruders (if they can find them) over the fear of bad
> publicity.

Whether organizations go public is irrelevant.  How much crime is
actually prosecuted?  Look at the vast secret armies operating in
the War On Drugs, Against Terrorism, and For The Children.

Many system manager's suffer from a kind of voyeurism.  Running systems
generally involves periods where there is nothing to do, such as waiting
for a software to drain from a CDROM into a system or for a backup tape
to finish.  You don't have cops on the beat opening the nearest pedestal
to kill some boredom.  You do have many administrators firing up tcpdump
or similar tools to do a little "traffic analysis" while they sip coffee.

> > ... They are not doing more socially necessary
> >work, ...
>
> While they may not be directly protecting society from terrorists, serial
> killers and organized crime.  I would say that this point is debatable.
> Doesn't a system manager supporting their secure functioning of their
> business and the overall e-commerce infrastructure have a positive impact
> on society?

Sheesh---While I'm not a big fan of government, I don't have any trouble
seeing that most people think of the police as doing far more of the
public's work than a computer system manager, a farmer, truck driver,
grocer, computer programmer, or even used car salesperson.

Vernon Schryver    [email-masked]

_______________________________________________
raven mailing list
[email-masked]
http://www.ietf.org/mailman/listinfo/raven