November 2003 - Test - lists.nanog.org

Re: Cost of Worm Attack Protection
by kgraham＠rogers.com 13 Nov '03

13 Nov '03

Back Ground: I come from a company of 5K users spread across a large campus with several remote sites. We have had various worms intrude on our day to day activities. Without anything other than up to date anti-virus and some simple PIX type configurations it has been unpleasant. Time cost: One attack slowing Internet traffic to a crawl. Manpower: 2-3 Network 2-3 Data fairly dedicated over the course of a few days. Do the math for the cost of 6 senior people finding and cleaning infected machines. Quotes todate to implement a NIDS solution that encompasses external, DMZ, internal, server farms, 6 mid range devices 100K. Quotes on HIDS solutions vary as per desktop and server but basically you are looking at 1-2K per server and 50-80 dollars per desktop licence. Kim > > From: sgorman1(a)gmu.edu > Date: 2003/11/13 Thu AM 09:35:47 EST > To: nanog(a)merit.edu > Subject: Cost of Worm Attack Protection > > > > I was hoping to get some estimates from folks on the costs of defending networks from various worm attacks. It is a pretty wide open question, but if anyone has some rough estimates of what it costs per edge, manpower vs. equipment costs, or any combination thereof it would be of great assistance. We are doing some simulations of attack and defense strategies and looking for some good metrics to plug into a cost benefit model. We'd be happy to share the results if anyone is interested as well. > > Thanks in advance, > > sean > >

1 0

Cost of Worm Attack Protection
by sgorman1＠gmu.edu 13 Nov '03

13 Nov '03

I was hoping to get some estimates from folks on the costs of defending networks from various worm attacks. It is a pretty wide open question, but if anyone has some rough estimates of what it costs per edge, manpower vs. equipment costs, or any combination thereof it would be of great assistance. We are doing some simulations of attack and defense strategies and looking for some good metrics to plug into a cost benefit model. We'd be happy to share the results if anyone is interested as well. Thanks in advance, sean

3 2

Re: The Internet's Immune System
by Jamie Reid 13 Nov '03

13 Nov '03

It would be useful if these sites allowed you to query them with CIDR ranges to see if your site had originated any traffic that triggered their sensor arrays. The IDS community never seems to have wrapped its collective head around routing information. Looking up single IP addrs is just cosmetic. A real service would allow for concerned sites to check their entire address allocations. The solution we have takes a massive amount of data munging of a routing table and is still experimental, but until attacks can be mapped to meaningful Internet topographical information, the real value of these distributed IDS efforts cannot be fully exploited. I can forsee the argument that people shouldn't be able to look up other sites which might be compromised, but if they are really so concerned, they should get their sites patched. -- Jamie.Reid, CISSP, jamie.reid(a)mbs.gov.on.ca Senior Security Specialist, Information Protection Centre Corporate Security, MBS 416 327 2324 >>> "Bryan Bradsby" <Bryan.Bradsby(a)capnet.state.tx.us> 11/12/03 04:25pm >>> > Devise a system that assumes owners of IP space WANT to know about problems. > report --open-proxy 192.168.1.1 <logfiles > and have a report sent to whoever needed to know about it. http://www.Incidents.org http://www.Dshield.org/howto.php http://www.MyNetWatchman.com -bryan bradsby

7 6

Re: Reachability problems for www.listen-to.com
by Fisher, Shawn 13 Nov '03

13 Nov '03

We received a 69.144/16 from ARIN and spent the following few months requesting numerous operators to take that space out of their filters. Apparently for various historical reasons many operators filter the entire 69. Block. That could be part of the problem. -------------------------- Sent from my BlackBerry Wireless Handheld

2 2

Reachability problems for www.listen-to.com
by Adam Atkinson 13 Nov '03

13 Nov '03

Some of my users are saying they cannot get to www.listen-to.com, www.talk-servers.com and www.electro-tech-online.com One of them claims he's observed a pattern and that things hosted by ev1servers.net aren't working. I can get to them from several different places, but I notice that e.g. www.listen-to.com has a 69.* address, which might still be listed as bogus by some people. -- Adam Atkinson Damovo UK What I say may or may not represent the opinion of Damovo UK: I wouldn't know.

1 0

Re: GFI Security Suite
by neil＠DOMINO.ORG 13 Nov '03

13 Nov '03

> Has anyone or does anyone currently or recently used any of the products by > GFI? What are your thoughts about these products if you have. > > Thanks for your input. I've not used the security suite but: I used the GFI fax suite on an exchange server and I couldn't believe how well it worked and how good the local support was, they proactively helped me resolve a number of modem issues that were not really an issue with GFI's software. They seem to understand how to properly interface to Exchange. Regards, Neil.

1 0

Re: GFI Security Suite
by Michael A Tomasura 12 Nov '03

12 Nov '03

My company is using GFI MailSecurity for Exchange/SMTP 8 now. We have tested GFI MailEssentials for Exchange/SMTP. They work like they say they do. They give us very little trouble. It seems like the products from GFI are getting better. I wouldn't say they are perfect. http://kbase.gfi.com/showarticle.asp?id=KBID001840 They are building a knowledge base which is helpful. On Wed, 12 Nov 2003 14:38:24 -0500 "Wesley Vaux" <Wesley.Vaux(a)globalknowledge.com> writes: Has anyone or does anyone currently or recently used any of the products by GFI? What are your thoughts about these products if you have. Thanks for your input. Wes Vaux, CCNA, CCDA Network Security Engineer, 9000 Regency Pkwy Ste 500 Cary, NC 27511 t 919.463.6782 f 919.463.1290 Global Knowledge Experts Teaching Experts http://www.globalknowledge.com

1 0

Google down?
by Jim Wood 12 Nov '03

12 Nov '03

Looks like google is down too

3 2

Re: Portable Cooling
by David Lesher 12 Nov '03

12 Nov '03

Speaking on Deep Background, the Press Secretary whispered: > > > There are air to water a/c units or chillers. We used one such unit. > They can be located just about anywhere since they can pump, or be fed > water through a hose, and drain via another hose. > > In fact we have the unit still for sale if anyone is interested they may > contact me privately and I'd be glad to give you any details you may need. > The manuf. is Koldwave BTW. I recall a company called ADEPT in Springfield VA stocked the H2O based systems. They are useful for buildings where the central AC is off at night, etc. as well as a hot-spare. -- A host is a host from coast to coast.................wb8foz(a)nrk.com & no one will talk to a host that's close........[v].(301) 56-LINUX Unless the host (that isn't close).........................pob 1433 is busy, hung or dead....................................20915-1433

1 0

ARIN, where art thou?
by Haesu 12 Nov '03

12 Nov '03

Does any one know if ARIN just went down? I am trying from different locations and its not connecting.. traceroute dies after arin-gw.customer.alter.net Thanks, -hc -- Haesu C. TowardEX Technologies, Inc. Consulting, colocation, web hosting, network design and implementation http://www.towardex.com | haesu(a)towardex.com Cell: (978)394-2867 | Office: (978)263-3399 Ext. 170 Fax: (978)263-0033 | POC: HAESU-ARIN

4 4