Hello everyone.
I have just finished my first (ever) 'proper' session at Tech Ed and immediately I am thinking of how we can start to implement some of the ideas at Cobweb. My session was called "Notes from teh field: Defending web applications". I won't bore you with the detail but this stark statement stuck in my mind more than any of the others...
Attackers do not generally hack into systems now to crash or deface them, they want the data on those systems to make a profit.
This was especially interesting since these attacks get around all of the usuall security precautions and are very difficult to trace in the logs (since they look alot like normal activity). Solution: Secure development lifecycle, threat analysis _before_ the code goes live, code review and continuous monitoting.
I am now starting an Exchange 2007 deployment session - This will conclude my first day here and I am shattered but already looking forward to tomorrow. I will sleep well tonight.
Comments