Re: Handling new vulnerabilities like WebDav

From: Darren Van Booven <darren(at)fni-stl.com>
Date: Thu Mar 20 2003 - 12:07:37 EST

For me, the most time is spent determining whether or not the vulnerability is really a risk or not out of the hundreds of other security alerts issued each week. Once that process is done, those who already have a good handle on their system inventory should be in the position to know their exposure right away. My approach is to know what you have and where you have it ahead of time so you won't need to manually check your systems. While initially a lot of work, it pays off in the long-run. Of course, maintaining such as inventory is also difficult if you don't have the right policies and procedures in place. Regular scanning for non-inventoried systems helps identify rogue boxes.

Darren Van Booven
Director, Information Security

---

CONFIDENTIALITY NOTICE: This email message and any attachments hereto are confidential and may also be privileged. If you are not the named recipient, please notify the sender immediately by reply email and delete the contents of this email and any attachments without disclosing the contents to anyone, using the contents for any purpose, or storing or copying the contents in any medium.

---

• Original Message ----- From: <Robert_Huber@bankone.com> To: <focus-ih@securityfocus.com> Sent: Thursday, March 20, 2003 9:49 AM Subject: Handling new vulnerabilities like WebDav

> I am curious as to how people in large organizations are handling new
vulnerabilities like the WebDAV recently released. Specifically, I'm trying to gauge how people are determining their exposure, or risk level. Upon learning of a new vulnerability are folks scanning their entire environment to look for the vulnerability? Or are folks going through their inventory to look for IIS web servers and having folks manually check them?
>
> Just looking for input. Please reply directly to me and I will sum up and
post.
>
> Thanks,
>
> Bob
>
>
> **********************************************************************
and/or exempt from disclosure under applicable law. If you are not the intended recipient, you are hereby notified that any disclosure, copying, distribution, or use of the information contained herein (including any reliance thereon) is STRICTLY PROHIBITED. If you received this transmission in error, please immediately contact the sender and destroy the material in its entirety, whether in electronic or hard copy format. Thank you
> **********************************************************************
>
>
Received on Thu Mar 20 12:25:47 2003