Antivirus Inventor Says Security Pros Are Wasting Time 282
talkinsecurity writes "Earlier this week Peter Tippett, chief scientist at the ICSA and the inventor of the progam that became Norton Antivirus, had some interesting things to say about the state of the security industry. In a nutshell, Tippett warned that about a third of the work that security departments do today is a waste of time. Tippett goes on to systematically blow holes in a lot of security's current best practices, including vulnerability research/patching, strong passwords, and the product evaluation process. 'If a hacker breaks into the password files of a corporation with 10,000 machines, he only needs to guess one password to penetrate the network, Tippett notes. "In that case, the long passwords might mean that he can only crack 2,000 of the passwords instead of 5,000," he said. "But what did you really gain by implementing them? He only needed one."' Some of his arguments are definitely debatable, but there is a lot of truth to what he's saying as well."
PBKAC (Score:5, Insightful)
The issue is usually the idiot that becomes the victim of a well done social hack.
As usual, the company is only as strong as it's weakest link.
Re:PBKAC (Score:5, Insightful)
Re:PBKAC (Score:5, Insightful)
Re:PBKAC (Score:5, Funny)
Boss: Great! How'd you pull it off?
DBA: Well, we replaced all queries with 'Select * from tblQuery' which only has 1 row and 1 Column. Then stopped letting people call the queries!
Boss: You're fired...
Re:PBKAC (Score:4, Insightful)
Re:PBKAC (Score:5, Funny)
Re: (Score:2)
Re: (Score:2)
No kidding. The guy was pulling figures (and other sh*t) out of his rectum over and over again.
Re: (Score:3, Insightful)
Re: (Score:3, Insightful)
Re: (Score:3, Funny)
Actually (Score:5, Insightful)
He's saying "aim for as much security as you can get" not "aim for 100% impregnable", there is no such thing. Even Open BSD isn't impregnable, despite their claims. Nothing is impregnable to a determined and resourceful attacker.
He is correct in saying, "rather than bunkering up, strive to be indigestible to AS many potential predators and parasites as you can"... i.e. he is admitting the one fact of the universe... "there is an exception to every rule, just because you haven't found it, doesn't mean it doesn't exist somewhere else, in some form.
The arrow through the roof, for those with the intellectual openness to understand the metaphor is an unlikely incident, but if it does happen, what then. Peter is using that concept, to teach those willing to learn/understand, that for a car to be 100% impregnable, it would have to be arrow, bullet, cannon, nuclear weapon, weather and everything proof, including driver and other driver error proof, road proof, etc. However, the COSTS involved, and the final results are out of reach of even the rich, would make for a rather heavy, expensive and CLUMSY vehicle, and judging by risk, the benefits would far outweigh the costs. Its like flu shots. I travel, talk, do meetings, etc. I get sick very rarely, yet I see so many immediately taking "flu vaccines" out of fear that the flu will kill them. I've never had a relative who either died of the flu or had complications. Neither have I known anyone in my personal life who had these complications, and I have associates who have lived in first, second as well as third world scenarios.
Thus, in similar vein, driver training gives better results than building the bullet proof car. Don't surf porn with internet explorer is FAR better advice than installing the latest antispyware, and "don't accept email except in plaintext format" is far better advice than trying to balance a proper load of antivirus (which the user might not allow to update, or might become broken, etc). There have been plenty of virus samples that hijacked the latest Symantec and McAfee antivirus, why? Because they tried to be everything to everyone, and when you over extend your coverage, you end up leaving holes in your defenses.
Properly trained users is like having the original Citizen Militia, not truly powerful, but if properly trained in guerilla warfare and survival, and properly equipped, they can make ANY invading army's life, VERY difficult, to the point where the invading country finds the "host" or "prey" country to be "indigestible."
Nothing is unassailable, but plenty of plants are poisonous to their consumers, so as to make it a known thing that they are indigestible. The one size fits all solution, from antivirus, to security departments, to everything else, is STILL the same age old problem. No risk can be reduced to 0%. But it can be minimized and compensated for. This is what Peter talks about.
Its disappointing, I expected that those frequenting this board would've had the ability to apply metaphors in design. Good book for all to read. The Art of War. Get it bundled with The Prince. Good way to learn how to think.
Re:Actually (Score:5, Funny)
Except that one, of course. ...whoa
Re: (Score:3, Insightful)
Far more important than any security contractor, is a proper risk assessment. There's no sense in building a million-dollar lock if it's only guarding a half-eaten twinkie. You look at the cost of various types of breaches, and the cost of a security measure times it's % efficiency, and pick the cheaper of the two.
In many cases, simply
Re: (Score:3, Interesting)
And I doubt this guy will have a job much longer if he's going around claiming that 100% security isn't the goal and that he only tries to keep out the 11 year old script kiddies
You missed his whole point. He didn't say anything about 100% security. He said spending exorbitant amounts getting a single aspect of your security working perfectly is a bad idea. For example spending $1,000,000 getting a patch system set up that is 100% effective in keeping every one of your computers up to the minute on patches isn't cost effective. The expense curve goes up exponentially as any given process approaches 100% effectiveness. Think in terms of uptime. You could spend $100,000 on a patch
Re:PBKAC (Score:5, Insightful)
Who here hasn't had people tell them: "Can you help me with my computer? Here's my password..."
Re: (Score:2, Funny)
Re:PBKAC (Score:5, Interesting)
Of course, then I see the same person with their password on a Post-It on their monitor, and all hope of them ever learning the lesson is dashed.
Re:PBKAC (Score:4, Insightful)
Re:PBKAC (Score:5, Insightful)
I wouldn't need to keep my password on a Post-It note if you IT guys didn't make me change it every two weeks!
Re: (Score:3, Interesting)
I used to have computerized randomized alphanumeric 10 digit passwords.
Now since I have to learn the password quickly and it won't last long, I have to have some pattern. Sure I now have symbols (because I'm forced to) but it's now vulnerable to dictionary attack. 22!!SOmeword (followed by ##NEwword11) is much more vulnerable then 92cT6Ars1b
Re: (Score:3, Insightful)
There, fixed it for you - IT guys get pissed off with frequent demands to change their password, too.
Re: (Score:3, Funny)
Re: (Score:3, Interesting)
I scrupulously avoid knowing anyone's password. If they try to give it to me, I attempt to stop them from doing so before they can.
What's interesting is that very little kids are having to be trained in this philosophy as well. Kids and daycare staff sometimes use a password in case there's an unforeseen pickup snafu. Now toy codes and login information (like WebKinz) can have big consequences if they're leaked. I felt good when my daughter tried to explain your point to her friend-- she didn't want to know her friend's login.
Re: (Score:2, Funny)
Atheist, eh?
Re:PBKAC (Score:4, Interesting)
That's not the goal. Security's goal is to get PRODUCTION workstations up and running cleanly and bug free with pretty solid security.
The lab is easy. Let a few users have those machines for a week, visiting the casino sites, clicking on the latest e-greeting, and bringing the USB drive from home with those oh-so-important documents they were working on last night, right after their kids updated all the myspace pages.
Security is, indeed, fairly easy save for two variables. Users and attackers. As an analogy, you can put any sort of locks, grates, fences, alarms, dogs, and flaming trenches around your house. If the kids let in the cable guy without seeing some ID, none of it matters. If all the crook wanted was to steal your mailbox, you'll have to weigh the advantages of fencing it in vs. having mail delivered, or hardening it into a 1/4" plate steel box on a 4x6 I-beam, mounted into a 500-pound footing. Or just replace the damned mailbox when the kiddies bash it with a baseball bat driving by.
Oh, and the plate-steel mailbox? In rural Maine, those are a laugh a minute. Sometimes you see splinters on it, shards of a Louisville Slugger in the ditch, and a brief note in the local fishwrap about some kid at the ER with a broken wrist. Priceless. If only we could do the same thing to the script kiddies...
chicken egg? (Score:5, Insightful)
Why would the hacker need to guess one password from a list of password hashes when he already broke in and was able to elevate his rights to read the password hashes file? He might was well add his own password entry.
Re: (Score:3, Informative)
Re: (Score:2)
Re: (Score:2, Informative)
No. The /etc/passwd file does not actually contain passwords, despite the name. It used to (hence the name), but hasn't in a while, since letting people read the hashes lets people brute force breaking the passwords a lot more easily (basically, hash every word in the dictionary, save it in a file, and compare those hashes against the one in the password file --- though this is less effective if salting [wikipedia.org] is used).
From my password file:
Re:chicken egg? (Score:5, Funny)
From my password file:
That "x" after the first colon indicates that the password is stored elsewhere --- in /etc/shadow, which is not world-readable:
So what does the corresponding entry in the shadow file look like?
Re: (Score:3, Informative)
If you manage to crack that, try it at 127.249.17.156
Re: (Score:2)
Can't everyone read the password hashes file? On Linux at least.
Absolutely not. Shadow password files became common on Linux 12-15 years ago, and other Unix variants around the same time. Only root is allowed to see the hash. If you have root privs, seeing the password hash wouldn't gain you much.
Re:chicken egg? (Score:5, Insightful)
True, but the idea is that if he's working from a SAM or shadow file written to pilfered backup tape, or got the password DB by use of a whole host of tools designed to suck out a Windows AD SAM from a server to your laptop over, say, a wifi network connection made in the parking lot or somesuch... e.g. you have the hash file, but don't have a clue as to what it contains. A lot of tools are designed to exploit holes in Windows' Active directory to get a copy of the SAM without all the bother of logging in (most required physical access to the box and a reboot, but IIRC there were some that didn't, depending on the exploit used).
In the corporate espionage type break-ins, it makes more sense to not poke around too much and break stuff as you go, but instead concentrate on finding the means by which you can return to the network with your presence all dressed up as a legit user or three. This way, you have relatively more time and leisure with which to poke around in. If you add your own account (modify a file) and give it privs, you're liable to get someone's attention (self-audits, internal file integrity sweeps such as AFICK provides, etc...). If you merely copy a file, there's less of a potential fuss.
The tangents and possibilities can go on and on, mostly because security and breaking-in can become less of a science, and more of an art form. :)
Re: (Score:2, Informative)
By the time an attacker has the hashes, the game is essentially over! Do you think a 10 character password is really going to be that much weaker then a 14 character password in the situation where an attacker does *not* have hashes? (And simple controls such as account lockout features are enabled?)
I think Tippet would prefer passwords to be only complicated enough that they aren't susceptible to brute forcing when account lockout features are in place. His point is that anythin
A sane voice is heard... (Score:5, Insightful)
Re: (Score:2)
Re: (Score:2, Insightful)
re: a sane voice? Depends.... (Score:2)
The best examples I can think of of genuinely valid and useful security practices all involve things that don't cost much, if anything. (EG. TrueCrypt 5.0 is free software, yet you can encrypt a whole notebook computer's drive with boot-time password protection with it. This adds an obvious and practical layer of security. Configuring a proxy server to disallow downl
Corporate mouthpiece (Score:3, Insightful)
No. If you mandate long passwords on the server, there are no short passwords. That's sort of the point.
But then, I read on in the article (yeah, I know, it's
Now, don't get me wrong, *any* protection is obviously better than none, but this is basically a surrender - instead of selling the common (wrong, but common) "I have an up-to-date anti-virus package, I am protected" perception, they're now moving towards "Hey, we did the best we could; all those *old* virus's/virii(+) are *definitely not getting through". Woo Hoo.
So perhaps I'm being overly cynical, but it seems to me like a corporate piece with quotable sound-bites (so it gets wide distribution) that tries to deliver the message "hey, we suck, but keep on buying our software", in a more acceptable-to-the-people manner...
Simon
(+) And with this, I hope to equally annoy the grammar and spelling nazis out there. [insert random deity] those people piss me off.
Re:Corporate mouthpiece (Score:5, Insightful)
Maybe he's wrong, but he isn't trying to sell you any software.
Ben
Re: (Score:2)
Re: (Score:2)
Not only that. (Score:5, Insightful)
They are not the same. The defenses are not the same. There may be overlap (a workstation at a company gets infected and sends out spam vs a workstation at a company gets cracked and is used to crack other boxes at that company) but that is all.
All in all, he's 100% backwards on his comments. Just what you'd expect from someone trying to push a specific product from a specific company.
Double Eentendres (Score:5, Funny)
That efficient? (Score:4, Insightful)
Dr. Tippett's old analogy (Score:2)
10 years ago he was saying exactly the same thing. It's still relevant, but nobody has been listening.
1/3 + (Score:5, Interesting)
I honestly feel like 9/11 and it's aftermath has *something* to do with how several sectors of our country are tripping over themselves to implement unnecessary, bloated, counterproductive measures in the name of 'security'.
Existence is insecurity. The only way for something to be 100% secure is for it not to exist.
having a lock on my door (Score:5, Interesting)
except it isn't stupid. if someone is determined enough, they will break into my house, no doubt. most of the security features on my house are meant to deter those with a casual interest
same with all of the efforts that tippett pokes holes in. well yeah, duh: every single security effort in the world is surmountable. what's the value in pointing that out? none
that someone can get over your security measures with effort is not an argument against the lowest level of security. the lowest level security practices always has value: against casual transgressions
Re: (Score:3, Interesting)
The biggest effect these lowest level ineffective gratuitous "security" measures have is to annoy everyone and make lots of money for the security companies. Good security is a matter of quality, not quantity.
Let me give you an example: I work downtown in a building of 10 floors, surrounded by buildings of around 50 floors. There are only offices in this building, all very boring and white collar. We already have card-readers on the doors on each floor. You also have to swipe your card in the elevator or
Re: (Score:2)
Personally, I think it'd be more along the lines of putting a X09 [taylorsecurity.com] lock on your door.
Even a fairly cheap lock is going to hold up better than a window - of course, like different methods compromising a computer network, there are variances in detectability, cost, danger, etc... Opening a door is cheap, bypassing a handle-lock takes more skill but is generally hard to detect, a deadbolt even more expensive. Long before you get anyw
Defense In Depth (Score:5, Insightful)
Risk management is the specific practice of minimizing the greatest risks (what will do the most harm and will be the most likely to happen). And for the most part everyone realizes that no risk can be completely eliminated, so we mitigate them as best we can and rely on fundamentally sound access controls et. al. to limit the effect of any breach and hopefully know about and plan for unforeseen circumstances by planning for certain categories of attacks.
Hopefully I'm right, because if I'm not... I'm scared.
my root password is (Score:3, Funny)
Re: (Score:2)
Valid points from article (Score:5, Informative)
2) You're only as secure as your weakest password. We knew that.
3) This guy shouldn't talk about seatbelts.
Dirty Little Secrets (Score:5, Interesting)
We've been fighting the same problem, in the same way, for 35 years. It's time we regrouped and found a better way to attack it.
Here [dc414.org] is a copy of the DefCon version of the speech (I think he's given it a few different places, so there are subtly different versions out there). I'm sure the video is floating out there somewhere, too (though I couldn't find it on YouTube). He's fun to watch.
Re:Dirty Little Secrets (Score:4, Interesting)
Of course they're bandaids on the real problem. So are cars, if you must have another car analogy:
The problem with distance is that it takes so long to travel it. Cars are a bandaid on the distance problem. We've been fighting that problem for a lot longer than 35 years. It's time we regrouped and found a better way to attack it.
The reason antivirus/etc exists is that we have never found a better solution. It's just that simple. I'm all for thinking and planning, but it's no magic. If we all put our heads together right now and work on -nothing- else, we might never find a solution. There's no guarantee that there -is- a better solution.
Re: (Score:2)
It doesn't matter what operating system you use, by its very nature, it is too complicated to completely remove all bugs in any meaningful timeframe. Nobody tries to say Windows, OS X or Linux are bug-free
But it's not just about bugs, it's also about design. At its core, following good software programming practices both to avoid bugs or unforeseen vulnerabilities, but also to ensure that systems are actually designed with security in mind in the first place.
I can't think of a good example offhand, but imagine building a to-do application for yourself, then letting other people use it, then deciding to make it a true multi-user product and bolting on some kind of user authentication system. It's almost ce
A whole talk, with snippets taken out of context. (Score:2)
Lost all credibility at... (Score:2, Funny)
I'd be more prone to listen to security practices from the guy who...say...invented cheese string...
The problem is management (Score:3, Informative)
It's the "war on viruses" (and spam) (Score:2, Insightful)
I see it being more related to the medical field, prevention is great idea (and has been a popular topic lately), but treatment is just as important and not to be forgotten.
I think he's really suggesting that business practices slow down--for instance, sure it's a painful to have a
A better approach to security: (Score:2)
Antivirus 'Inventor'? (Score:2, Insightful)
As I understand it, the first antivirus program ever to have existed (although not marketed as such at the time) was the UNIX rm command. This was followed by clones in other UNIXes, and in the popular DOS operating system in which it was invoked with del.
Used in conjunction with the killall command, it is a very powerful tool indeed. Beats Norton anyways.
Re:What did I gain? (Score:5, Insightful)
Re: (Score:3, Funny)
Um, I must have misunderstood you.. just thought, you want to say, that the IE is a secure browser..
Re: (Score:2)
Re: (Score:2)
I would argue that a security setup that relied on IE wasn't really a "security" setup. If it depends on the client, it's pretty much by definition not secure.
This is true, but given the nature of web attacks danger is going to be relative to the safety of the client. If the admin has used group policies and such to lock down IE it can theoretically be made secure. Firefox is more secure in some measures but it does have holes from time to time and no real central management facility like IE. You could
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Re firefox, what I meant was that you cannot enforce, distribute and lock in configuration changes.
To be fair any restrictions on IE could be gotten around, but I do see your point that it would increase the security of a system where the user wasn't actively trying to get around the restrictions. Of course on the other hand a flaw in the IE parser that allows privilege escalation isn't going to be stopped by a policy file preventing the user from changing their homepage or whatever. The lack of a policy tool for Firefox was actually one of the top listed reasons why corporations are hesitant to standar
Re:What did I gain? (Score:4, Insightful)
The more common scenario that he does not mention is that people who are trying to gain access are trying to brute force a login through a network protocol. NOT running something like rainbowcrack on your password hashes. If they've gotten to that point your passwords are essentially worthless already.
BUT this is where defense-in-depth comes in. Security is NOT A PRODUCT. It is a mindset. So if your user accounts aren't all administrators and someone finally manages to brute force a network login, at the worst, that person now can do as much damage as one employee. You do have access controls on your employees, right? Not to mention, most "secure" network protocols nowadays make brute-forcing much harder. SSH, for instance, will timeout the connection after X failed login attempts. They now have to work a lot longer. The login prompt in Windows does the same thing.
So you apply this thinking to everything. Stop using a VPN. Make only the services you want available through your firewall. Do egress filtering. Use a DMZ. Prevent LAN clients from talking to any hosts other than the gateway and servers. When I started, my company originally used VPN to check email on an Exchange server. BAD! Passwords were usually the same as the username. Someone could trivially walk in and have access to the entire WAN. I pointed this out to them and got "But we're using a VPN. Checkpoint says it's secure!" If you have Exchange, take advantage of RPC-over-HTTPS, and then proxy that! There are lots of things you can do. As this guy points out, none of them are perfect, but you never know-- one of those little things might save your ass.
Re:What did I gain? (Score:4, Insightful)
Actually, it's a cost item that gets in the way of the money making work. That is how most people view it.
Re: (Score:2)
Re: (Score:2)
Re: (Score:3, Informative)
Re: (Score:2)
Also, don't think I am picking on you for it, but SSH timeout is almost worthless. All it does is slow you down a small bit. Yes, if I fail login three times, it will boot that session, but unless you have other things set up for reporting/detection and response (again something that you most likely have to pay for), all that needs to happen is that script run continuously, establishing a new session each time, until it sees a prmopt appear.
Fail2Ban [fail2ban.org] will fix that for you.
Re: (Score:2)
That being said, the requirements for passwords at most places go well beyond "good" right into ludicrous (queue spaceballs "they've
Re: (Score:2)
Now, obviously, I can't speak for all IT people. There are the BOFHs out there-- I work with a couple. There are also a fair number of real idiots out there. But in general, of course we understand that computers are a tool for performing work. What happens more often, however, is that users cannot userstand that they are not the
Re: (Score:2)
The chances of an attacker getting the password file are lower than the chances of a user doing something that will infect their computer because the user hasn't been taught correctly, so why focus on the passwords?
Because getting all the users to follow basic security procedures is about as likely to happen as porcine aviation? Essentially it's taken as a given that some moron is going to compromise the system, and strong passwords are equal parts convincing upper management that you're doing something about security, and actually doing something about security that you can control. It's also about corporate CYA with the shareholders, because if your system is compromised you can always say you're following establis
Re:What did I gain? (Score:5, Insightful)
"Attack trees" by Bruce Schneier (Score:5, Informative)
Bruce also wrote about "attack trees". Having long passwords ONLY helps if the attacker has unlimited access to crack them. A simple WordNumberWord combination can give you enough security as long as each login attempt is noted and tracked.
If there is a 15 minute delay between every 3 attempts to login, and a HUMAN reviews the logs every work day, your online security should be sufficient.
You only need the 1024bit security when the attacker can download the file and crack it at his leisure. But then, the failure is that you did not prevent the attacker from downloading that file.
There will ALWAYS be some risk. What's to stop the attacker from kidnapping your CEO's daughter and demanding that he let the attackers use his laptop to access your databases? The key is REDUCING the threat. If 99.99% of the attackers out there are not skilled enough or motivated enough to get through your security, are you "secure"?
Re: (Score:2)
Re: (Score:3, Informative)
Re:What did I gain? (Score:5, Funny)
Crap. I'd better go and change my password.
Re:What did I gain? (Score:4, Insightful)
12 digit change-montly lower+upper+number+ symbol passwords written on sticky notes (or similar) for 75% of users and freely shared due to complete lack of security training
or
6 character passwords that only prohibit patters and the username from being used changed every 6 months that people know not to write down or share?
Re: (Score:3, Interesting)
And it's hardly fair to assume that complex passwords are more likely to be shared than simple passwords. Sharing passwords is a separate behavior entirely. Not to mention the complex passwords are harder to share for the same reasons they are harder to remember.
How about a password generation algorithm that works like this: select two or more short dictionary words, append or prepend
Re: (Score:2)
Yes, they only need one password to get in, you only need one crack in the armor to deliver a damaging blow... But if you have strong armor around you, you look like a less appealing target as to try to find the one weak scale under your wing. People are more likely to jump on an open WAN then try to break into a hidden one with at least WEP. It sounds more like a lot of what we put in to place is us
Re: (Score:3, Informative)
He didn't say stop doing these things he is saying work smarter not harder. Taking the time to educate people about what is safe is far more effective then using that same time to deal with the constant password problems you would have with a high security password policy.
Re: (Score:2)
Re:What did I gain? (Score:4, Insightful)
"It is hard for the users it's going to at least be that much harder for the hacker"?
Up to a point of diminished returns, at which point it's impossible* for the legitimate user, so they cheat and defeat the whole scheme. (Witness the archetypal "I can't remember this stupid password" sticky-note-under-the-keyboard situation.)
(*"Impossible" is dependent on the user's level of apathy, forgetfulness, or hostility to the security regime.)
But if you have strong armor around you, you look like a less appealing target as to try to find the one weak scale under your wing.
That presumes an equal level of interest and intent between the "soft" target and the hardened one. If the hard target contains the more valuable goodies, well, that's just "crunchy on the outside, tender and tasty on the inside."
Also, for some in the cracking community, an apparently-hard target is an personal challenge to their 1334 hax0r skills, and quite appealing.
People are more likely to jump on an open WAN then try to break into a hidden one with at least WEP.
Again, assuming the values of the targets behind the protection schemes are equal. If all you want is free wireless, then one WAP is as good as another. If you want that WAP for a particular reason, you'll target it no matter what its apparent hardness. Every security scheme is fallible; the real value is measured in terms of effectiveness versus the value of what's protected.
It sounds more like a lot of what we put in to place is useless once they're in, but that doesn't mean to weaken our defenses.
I suspect the author is arguing that we should strengthen our defenses by implementing effective measures (non-self-defeating, like the too-complicated password example above; or "security theater" measures that sound tough and look effective but can be easily defeated by ignoring their fundamental premise, like complete isolation from the outside except for trusted partners, but then trusting those partners unreservedly--if they get pwn'd so do you)
Re: (Score:2)
He specifically states that companies should reconsider spend $1 millio
Re: (Score:2)
Allow me to paraphrase an associate of mine, "Good security comes down to lawyers and baseball bats, everything is is just jerking off."
Re:Car Analogies (Score:5, Funny)
Or to put it another way, if car analogies were like cars on a highway...
Re: (Score:2)
Like when the check engine light comes on and...
Re: (Score:3, Insightful)
What do you lose with a strong password policy? Good user hab
Re: (Score:2)
"If we made seatbelts out of titanium instead of nylon, they'd be a lot stronger. But there's no evidence to suggest that they'd really help improve passenger safety."
They would be stronger, and raise the fatalities number. Seatbelts are voluntarily made distortable so they can help diffusing kinetic energy.
Not to mention the fact that, in this case, the security measure is strong enough to successfully mitigate the threat. When is the last time that you remember hearing about a wreck when the occupant tore through the seatbelt and proceeded through the windshield?
Re: (Score:2)
Re: (Score:2)
Routers, "default deny," and training (Score:2)
But if the base for the 8% figure is all routers in, say, the top 2000 companies, then I might believe it. It's not uncommon to trust all internal traffic, even though a stricter security model might be more appropriate there as well. Co