Craig,
You like to keep on my toes, that's for sure.
Pete stated: default banners ..."wouldn't be the threat, they would be
the vulnerability if you're talking Risk"
I would not even classify them as a vulnerability. They may form a part
of an attack vector or a link in an attack tree, but not a
vulnerability.
You're right. I got sloppy and should have said "on the vulnerability
side" but didn't consider to remark on attack trees in my answer.
Knowing the structure of the web site is not in itself a risk or
vulnerability. It can comprise a branch in an attack tree, but can not
facilitate an attack in itself.
Actually, it can facilitate an attack. Information does make an attack
easier to propagate.
In response to "Risk is relative to the organization not to you." This
depends on the method used to determine risk. A "fluffy" qualitative
risk analysis (there are better or worse qualitative techniques) based
on opinion will fit this description. A detailed quantitative analysis
using Stochastically defined models and a Bayesian likelihood analysis,
maybe even integrating Bayesian linguistic techniques is fairly
definitive no matter where you are.
Nothing fluffy. Nothing qualitative either. Risk is indeed always
relative to the level of involvement and cost in taking the risk. You
can have all the models in the world but risk is still a preference
based on what one values.
Sincerely,
-pete.
------------------------------------------------------------------------------
This List Sponsored by: Cenzic
Concerned about Web Application Security?
As attacks through web applications continue to rise, you need to proactively
protect your applications from hackers. Cenzic has the most comprehensive
solutions to meet your application security penetration testing and
vulnerability management needs. You have an option to go with a managed
service (Cenzic ClickToSecure) or an enterprise software (Cenzic Hailstorm).
Download FREE whitepaper on how a managed service can help you:
http://www.cenzic.com/forms/ec.php?pubid=10025
And, now for a limited time we can do a FREE audit for you to confirm your
results from other product. Contact us at request@cenzic.com
------------------------------------------------------------------------------
