- NANOG - lists.nanog.org

Re: How to get better security people
by Roger Marquis 27 Mar '02

27 Mar '02

"E.B. Dreger" <eddy+public+spam(a)noc.everquick.net> wrote: > Service patches were never applied. When some suspicious > happenings left said server inoperable, they just installed > Win2000 and went on, not caring what had happened or why. > > No, I was not the employee. A friend of mine worked there before > getting fed up and quitting. We see this a lot too. It is, IMHO, why good security people who are not in finance, defense or other security-conscious sectors tend to be consultants. Consultant or not IS security gurus are no different than other in-demand technical specialists. You have to 1) pay them appropriately, 2) have a decent working environment (no windowless cubicles, junk food cafeterias, inflexible hours, unskilled management, etc), and 3) provide constant training opportunities (conferences, classes, good assignments). Don't expect them to have programming degrees or be interested in coding. Those would be security developers as opposed to security analysts. Finally, NEVER ask a Unix literate engineer to use an MS Windows PC... -- Roger Marquis Roble Systems Consulting http://www.roble.com/

1 0

FW: How to get better security people
by Jim Popovitch 27 Mar '02

27 Mar '02

Somehow eTrade's following response didn't make it to the list. I think it's important enough to resubmit it given the erroneous info posted earlier. -Jim P. -----Original Message----- From: David Rickling [mailto:drickling@etrade.com] Sent: Tuesday, March 26, 2002 6:02 PM To: 'LeBlanc, Jason'; 'Jim Popovitch'; 'Sean Donelan'; nanog(a)merit.edu Subject: RE: How to get better security people E*TRADE Financial has it's full complement of System and Network Security people still employed. The Director and Sr. Manager of the group have been with the Company for nearly five years and the average length of time within the group is 2 + years. E*TRADE Financial is dedicated to protecting it's customer assets and holds security is a core value for all associates. David Rickling Lead Network Engineer Network Architecture & Integrations E*Trade Financial This e-mail is the property of E*TRADE Group, Inc. It is intended only for the person or entity to which it is addressed and may contain information that is privileged, confidential, or otherwise protected from disclosure. Distribution or copying of this e-mail or the information contained herein by anyone other than the intended recipient is prohibited. If you have received this e-mail in error, please immediately notify the sender by e-mail at drickling(a)etrade.com <mailto:drickling@etrade.com> and telephone at (650)-331-5269. Please delete and destroy any copies of this e-mail. E*TRADE Group, Inc. 4500 Bohannon Drive Menlo, California 94025 -----Original Message----- From: LeBlanc, Jason [mailto:Jml@ebay.com] Sent: Tuesday, March 26, 2002 11:25 AM To: 'Jim Popovitch'; LeBlanc, Jason; 'Sean Donelan'; nanog(a)merit.edu Subject: RE: How to get better security people What eBay does as a business is of little consequence to me, as a network engineer, though it seems they make pretty good decisions based on things I've seen in three years here. That "fact" came from someone who worked for them in Atlanta, was merely an idle comment meant to share a bit of information. The tone of your reply is a bit off. > -----Original Message----- > From: Jim Popovitch [mailto:jimpop@rocketship.com] > Sent: Tuesday, March 26, 2002 11:06 AM > To: LeBlanc, Jason; 'Sean Donelan'; nanog(a)merit.edu > Subject: RE: How to get better security people > > > > -----Original Message----- > > From: LeBlanc, Jason <Jml(a)ebay.com> > > > > On that note, Etrade layed off their entire net sec team a few > > months back. I don't trade there no more. ;) > > Let me guess, eBay is moving into securities trading next.... > Your "facts" about eTrade are wrong, very wrong. > > -Jim P. >

2 1

Re: Exodus/C&W Depeering
by smd＠clock.org 27 Mar '02

27 Mar '02

| This isn't something I really care to make a big argument of, but my point | was that for many ISPs, the path will go from: | | SELF - EXODUS | | to: | | SELF - OTHER BACKBONE - C&W | | for a net increase in average path length. Are we talking AS_Path attributes here? If so, all this means is that now we don't announce OTHER BACKBONE routes to C&W/EXODUS, which we probably weren't doing anyway. Or are we talking forwarding paths, which are _different_ (and not necessarily stable even in the presence of perfect AS_Path stability)? If so, have we added any bottlenecks or sources of packet corruption? If none have been added, a change in the number of links and routers traversed is meaningless. (Note that it is possible that the number of links and routers DECREASES). Sean.

4 4

RE: Exodus/C&W Depeering
by smd＠clock.org 26 Mar '02

26 Mar '02

Three men are portrayed sipping a ladle filled from a vat of vinegar. One makes a sour face, because the de-peering policy flies in the face of what is proper and conventional -- abandoning the ancient ritual of zero-fee peering for small networks runs contrary to Confucianism. Another makes a bitter face, because the de-peering reminds him that the world is full of desires and disappointments and that there is an unending wheel of pain for small ISPs, that interferes with their transcendence into a state of sustainable profitability. This change in Exodus's peering policy runs contrary to Buddhism. The third is happy, jovial and smiling. Does he work for C&W? Does he work for C&W's competitors? Does he work for a government regulatory body? Is he a lawyer? Or perhaps he just accepts that changes in policies are the way of the world, and that fighting against them is futile -- it is better to uncloud one's mind and realize for that those working in harmony with the circumstances of peering politics, what people perceive as negative may in fact be positive. Sourness and bitterness come from the interfering and unappreciateve mind. This peering policy, change to a Taoist, is sweet, especially if one is a "Taoist" pundit, prognosticator, contract litigation lawyer or telecommunications regulator! Sean.

2 1

RE: Exodus/C&W Depeering
by smd＠clock.org 26 Mar '02

26 Mar '02

The "universal service" requirement is governmental protection for the incumbent. Or are you suggesting that the requirement for universal service is natural, rather than regulatory? Monopolies (there is nothing natural about them) are normal only when they are socially established and maintained. Thank you governmental economic planners for the frameworks in which each one of them has evolved. As always, you know best! Sean. | repeat after me "Natural monopolies are normal in cerain environments, where | univeral service is required".

2 1

RE: Exodus/C&W Depeering
by smd＠clock.org 26 Mar '02

26 Mar '02

| Won't this just increase the distance and AS count for Exodus outbound traffic, | making Exodus hosting even less desirable? Only in the minds of people who are lied to by Exodus's detractors. I just spoke with the Invisible Hand of the Marketplace, and it signed (in BSL, so the translation may be off) the following: Usage-based billing: less performance -> less traffic -> lower bill. C&W surely does not want to present a lower bill to you, and thus may be motivated to figure out and correct what's going on. Exodus's customers moving less traffic could take a (hypothetical!) smaller bill to mean unpopular/stale content, or poor performance, possibly near the end user, possibly near the on-Exodus source; if the latter is suspected, distribute the content to elsewhere. (If the former, tell all the politicos you can to stop protecting local-loop monopolists!) A (hypothetical!) larger bill could likewise be taken as either increasingly popular content, or as better performance. A _correlation_ with a change in Exodus's routing policy is not the only possible cause -- someone elsewhere may have done something to widen an intermediate bottleneck. Remember that the AS path is only a trail of breadcrumbs used to avoid route-announcement loops. It is NOT a reliable indicator of the forwarding path towards the destination. An AS-to-AS "adjacency" within an AS path *may* be completely meaningless. You can draw no conclusions about performance (in terms of loss, delay, and delay variance) by examining an AS path, although someone might prove that for a given snapshot, from a given test location, there are strong correlations. Likewise, while from one particular vantage point, a "broader" peering policy correlates with better performance (in terms of things which actually affect goodput, namely loss/delay/delay variance), from other vantage points, there is an opposite correlation. This is not anything remotely like a proof that strict routing and forwarding hierarchy leads to better performance than relaxed routing and forwarding hierarchy, with respect to how traffic is attracted towards a given destination. (Note that one can have strict routing hierarchy, yet still observe a relaxed forwarding hierarchy: consider the case where people do not next-hop-self at LAN-style exchange points). Therefore, anyone predicting that the sky is falling, and big chunks are gonna hit Exodus's customers and C&W (or predicting something opposite) would be lying if he or she claimed to have a better view of the future of this peering policy change than the average employee of the psychic friends network. Sean.

3 2

RE: Exodus/C&W Depeering
by smd＠clock.org 26 Mar '02

26 Mar '02

| Okay, okay, when is someone going to start posting as "Dean S. Moran?" It is unnecessary, for I am a self-parody. Sean. ("Moron" is funnier btw)

1 0

RE: PacBell Security/Abuse contact
by Cheung, Rick 26 Mar '02

26 Mar '02

Does anyone have an opinion on a decent ISP out there that's proven to work with the customer during a DDOS storm? Rick Cheung -----Original Message----- From: Jeremy T. Bouse [mailto:Jeremy.Bouse@undergrid.net] Sent: Monday, March 25, 2002 2:46 PM To: nanog(a)merit.edu Subject: Re: PacBell Security/Abuse contact More specifically I belive this is a Distributed Reflection DoS like what hit GRC.COM back on Jan 11th... Basically a flood of SYN packets to well known ports from IPs which appear to be spoofed. I've actually been riding it out now for over 2 weeks... The tech support is completely inept and trying to contact security/abuse is pointless. Final realization of this was when I was investigating another PacBell customers box which had been compromised via another PacBell customer machine. After the forensics to get back logs and track the intrusion I tried contacting PacBell to no avail and then resulting it tryin to get in contact with their customer directly. Which I managed to do and resolve the issue... I've never dealt with such an inept company before. Jeremy On Mon, Mar 25, 2002 at 11:18:23AM -0800, Daniel M. Spielman wrote: > > At 11:11 PM 3/24/2002 -0800, you wrote: > > > Anyone have a telephone number that can reach a live person > >within Pacific Bell's Security/Abuse department? PacBell's technical > >support is completely inept with trying to help their customers when > >under any form of network attack other than passing you to a toll-free > >number which informs you to send email to an address that goes without > >answer. > > > > Respectfully, > > Jeremy T. Bouse > > UnderGrid Network Services > I've had a similar experience with their tech team. I was being > dos'd from a college in Chicago so I contacted them to have it filtered out > and they had no idea what I meant. They suggested I email the Admin at the > college to get it resolved. I started screaming at them how am i going to > email someone when I am being attacked. Then they transferred me to their > supervisor who was even more inept then they were. Frankly i gave up and > just waited out the dos attack which lasted 2 1/2 days. >

7 6

RE: How to get better security people
by LeBlanc, Jason 26 Mar '02

26 Mar '02

What eBay does as a business is of little consequence to me, as a network engineer, though it seems they make pretty good decisions based on things I've seen in three years here. That "fact" came from someone who worked for them in Atlanta, was merely an idle comment meant to share a bit of information. The tone of your reply is a bit off. > -----Original Message----- > From: Jim Popovitch [mailto:jimpop@rocketship.com] > Sent: Tuesday, March 26, 2002 11:06 AM > To: LeBlanc, Jason; 'Sean Donelan'; nanog(a)merit.edu > Subject: RE: How to get better security people > > > > -----Original Message----- > > From: LeBlanc, Jason <Jml(a)ebay.com> > > > > On that note, Etrade layed off their entire net sec team a few > > months back. I don't trade there no more. ;) > > Let me guess, eBay is moving into securities trading next.... > Your "facts" > about eTrade are wrong, very wrong. > > -Jim P. >

2 1

RE: How to get better security people
by Rowland, Alan D 26 Mar '02

26 Mar '02

A knowledgeable investor would ask your HR department a few questions: 1. Which half of the resume do you believe? 2. Is it really more economical to ignore half your talent than spend a little checking resumes? 3. What does it say about your company's ethics that you accept that all your employees are liars? but then you have to find that knowledgeable investor first... Just my 2¢ and in similar circumstances, -Al USAF Ret. -----Original Message----- From: James Smith [mailto:jsmith@PRESIDIO.com] Sent: Tuesday, March 26, 2002 12:03 PM To: 'smd(a)clock.org'; 'lists-nanog(a)silverwraith.com'; 'sean(a)donelan.com' Cc: 'Jml(a)ebay.com'; 'nanog(a)merit.edu' Subject: RE: How to get better security people -----Original Message----- From: smd(a)clock.org [ mailto:smd@clock.org <mailto:smd@clock.org> ] Sent: Tuesday, March 26, 2002 2:41 PM To: lists-nanog(a)silverwraith.com; sean(a)donelan.com Cc: Jml(a)ebay.com; nanog(a)merit.edu Subject: RE: How to get better security people | The problem right now is if you advertise for a job, you will get | blasted with literally tens of thousands of resumes. What should I | be telling the HR department to look for? New careers. Sean. ============= That's the problem. Too many folks seeing the big money going to the tech weenies, and upon taking an MCSE boot camp, think they now qualify for a senior Admin/Security job. That and resume inflation, real or percieved. Too much noise in the system and inefective noise reduction methods... My resume is factual, and when I got out of the military, I was penalized by my first civilian employer. When I stated I could in fact set up a needed DNS, I was told they would hire it out. I asked why hire it out when I could do it. I was told, "we only believe half of any resume we get, and we don't think that you have the necessary experience." If setting up and running <deleted>.af.mil (now gone), and doing the very first <deleted>.af.mil DNS located on the base (complete with off-site secondaries), and running it until transitioned about a year later to the comm squadron folks I trained didn't count, then what did? Not bitter, though. Got a new employer... James H. Smith II NNCDS NNCSE Systems Engineer The Presidio Corporation

1 0