Re: Virus author profiling

From: Harlan Carvey <keydet89(at)yahoo.com>
Date: Wed Mar 19 2003 - 08:02:48 EST

Stewart,

I think you've helped me make my point...

> The inherent problem with this profile (and with so

Regardless of the views of many respondants, I haven't even attempted to disparage Dr. Hruska's credibility or abilities. In fact, I'm fully cognizant of the fact that this is a generalization being made, based on "averages". However, it is that generalization itself that is dangerous. Developing a mindset like that can easily make us complacent, in an already far too complacent world. Don't believe me? I have one word for you..."Slammer".  

In the current state of information security, I have to wonder where "profiling" plays a useful role. When an administrator is setting up a system to be connected to the Internet, how useful is it for her to know the type of person who will be attacking it? Any profiles may very well assist law enforcement, true...but what good are they to the administrator?

Some will say that by understanding a "profile", they can better guage how far and wide they have to search following a compromise. I'd say in response that such things are simply laziness...using a proper methodology is always the best practice, rather than making subjective judgements about how much or what to look for based on mood, etc.

Regarding Dr. Hruska's comments...again, we need to take them w/ a grain of NaCl. After all, they were presented by a journalist, so we have no way of guaging their completeness, nor knowing the context in which the questions were asked. But knowing the age, gender, and motivations of a virus author doesn't really do much to help someone who's cleaning up after one.

---

---

Harlan Carvey
Computer Security Administrator
AIM: carvdawg
Yahoo: keydet89

---

---

Do you Yahoo!?
Yahoo! Platinum - Watch CBS' NCAA March Madness, live on your desktop! http://platinum.yahoo.com Received on Wed Mar 19 16:12:21 2003