<div dir="ltr">On Tue, Dec 10, 2013 at 12:24 PM, Dave Aitel <span dir="ltr"><<a href="mailto:dave@immunityinc.com" target="_blank">dave@immunityinc.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">
People are strange. For example, they often say "You have to assume you<br>are compromised!" and then in the very next breath they are buying more<br>perimeter equipment like Fireeye and WAF and whatnot. </blockquote>
<div> </div><div>To your first point, I would rephrase it as "You have to assume YOU CAN BE BREACHED" and then accept that of {protection,detection,reaction} (or per NIST, {identify, protect, detect, respond, and recover}), you spent far too much money on trivially defeatable "protection" and "detection", and seriously (to your detriment) UNDERFUNDED "reaction" or "respond and recover." Information sharing helps inform when "protection" and "detection" fail, but you still are left with needing to shift resources to the neglected "respond and recover" capabilities.</div>
<div><br></div><div>And yes, people are "strange" to keep buying more detection capabilities, as if the new ones are any more of a silver bullet than were the old ones.</div><div class="gmail_extra"><div><br></div>
-- <br>Dave Dittrich<br><a href="mailto:dave.dittrich@gmail.com">dave.dittrich@gmail.com</a>
</div></div>