Re: [Full-Disclosure] Training & Certifications

["Curt Purdy" <purdy@xxxxxxxxxx>]

id3nt@xxxxxxxx wrote:
> Curt, you didn't define the case scenario for the first thing you do
> on a windows box.
>
> One would hate to reboot a box and lose any valuable evidence
> of an intruder
> or otherwise incriminating material.
<snip>

Of course id3nt, my bad, and it appearently caused a good deal of
misunderstanding.  I was referring to our troubleshooting Windows problems,
not security forensics.  When we are called to a site to work on a problem
with a Windows server related to networking/performance/system problems, not
security issues, the first thing we do is ask the sysadmin to reboot the
device.

We have learned this over the years, you basically can't make any change in
Windows without rebooting, and the look on the client's face when it comes
back with a bluescreen, not caused by anything you have done, is not a
pretty site. And when you then spend the rest of the night rebuilding the
system and not getting paid for it because the client "knows" the bluescreen
was caused by us, is not fun.

We have never once had this happen on a *NIX or Netware box.

Curt Purdy CISSP, GSEC, MCSE+I, CNE, CCDA
Information Security Engineer
DP Solutions

----------------------------------------

If you spend more on coffee than on IT security, you will be hacked.
What's more, you deserve to be hacked.
-- White House cybersecurity adviser Richard Clarke

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html