An Alternative to Patching Security Holes?
Saw this over at SNN
No, not really, but in his always interesting Crypto-Gram Bruce Schneier bemoans the current state of affairs – frequent cases of attackers compromising systems using old, well-known, and already-patched security holes – and suggests that system monitoring may be a viable solution for filling in the gaps. He writes, "If you are monitoring your network carefully enough, you'll catch a hacker regardless of what vulnerability he exploited to gain access. Monitoring makes a network less dependent on keeping patches up to date; it's a process that provides security even in the face of ever-present vulnerabilities, uninstalled patches, and imperfect products." While obviously he's not recommending that the latest security patches be ignored, he is suggesting that they should not be relied on as the only means of securing your systems. Good advice, of course. The reactive nature of monitoring can give attackers time to do some serious damage, even if they are caught, but in combination with other security measures monitoring can be an important component for reducing risk.
