Hacker News Reader

Comment by bell-cot | Hacker News Reader

Let's say your security budget is pretty limited, and you can say with relative certainly that there's only a 0.1% chance of any adversary bothering to check the known flaws in your FossileWare(tm) Firewall in a given month.

Vs.how many dire flaws have been found in big-name security products in the past year, that even a low-budget adversary is likely to be regularly checking for?

View on HN

There is no human making a decision on what attacks to run. They check for literally everything. 20 years ago, I ran a web server and would run 'tail -f' on the access logs. I watched the bots sending requests for files that only exist on linux, then send requests for files that only exist on windows. They don't know what kind of system they are hacking. They just know that there is a computer at that IP address.

There are databases that list every known flaw in existence, and the bots just go down the list checking each and every one. And if it doesn't work, in 5 minutes, they'll run those same tests again as if something changed in those 5 minutes.

Yep, this kind of stuff is easily automated these days and bots don't get bored.

> a 0.1% chance of any adversary bothering to check the known flaws in your FossileWare(tm) Firewall in a given month.

How would you arrive at this percentage in your risk analysis?

If you're getting scanned, keep logs, and have a decent way to tag log entries with the associated vuln, then you can start building statistical models of how exploit attempt probabilities fade as the target software gets older and lower market share. No, the 0.1% won't be exact. Yes, such data and models can be shared.

Paying $$$ for a LatestGreatest(tm) Firewall won't make you 100% secure either. And the $$$ might better be spent on an extra layer of swiss cheese, or better recovery capability.

Reply on news.ycombinator.com