Thanks, Jim. This validates my opinion. It isn't that I think that encryption is wasted or unnecessary but we need to balance our time and budget according to realistic threat estimates. Now, if I were the Port of Portland and I was thinking about using 802.11 for communications between security personnel at the airport you better believe I would be into encryption -- big time. The threat and target value justify it. Disclaimer: I have no idea if the Port is considering or using wireless however I know a number of airports are so the example is still relevant. Thanks! Jere >>> "James Wilcox" <jim_wilcox@private> 04/18/02 09:16AM >>> Jere, Whatever you might think of Peter Tippett (I think he is mostly on), you might find this of interest (at the risk of copy violation, I have excerpted and provided the URL to the entire article): I would argue that the likelihood of success of sniffing somewhere between your home or office and an e-commerce Web server is incredibly low, perhaps as low as 106 (meaning the likelihood of success would be one in 100,000 sniffing attempts). ... Moore's Law tells us that processors are perhaps three times faster, and disk drives perhaps two times faster. Bandwidth has also increased; today's OC192 pipes are more than 60 times faster than OC3. Translation: As difficult as sniffing was three years ago, it's 20 to 30 times more difficult today. Of course, other factors further reduce the vulnerability, including the problem of identifying which fiber to sniff and the fragmentation of transmitted packets. Now, what about the threat rate? We read lots of news reports about this and that Web site losing thousands of credit card numbers to a database cracker, but have you ever once heard about a cracker obtaining such information by sniffing the public Internet? ...it hasn't happened. In 2000, less than half of the credit card numbers traveling across the Internet were encrypted at all. For the other half, more than 70% of browsers in North America and Western Europe only support 40-bit encryption. Most B2B sites still use private (unencrypted) lines or 56-bit DES. All of this is to demonstrate that the threat is lower than low. In fact, it appears to be zero. So, when we consider all these factors together, here's what our risk equation looks like: The risk of credit card fraud by sniffing the public Internet has a very low vulnerability multiplied by a threat rate near zero multiplied by a very small cost. When you extrapolate this out to the millions of people transmitting credit card numbers over the 'Net, the risk is darn near zero. In fact, I would argue that it's not even in the top 1,000 real risks worth worrying about. Peter Tippett http://www.infosecuritymag.com/articles/may01/columns_executive_view.shtml James R. Wilcox, CISSP Regional Manager SecureInfo Corporation 503 799-8438 503 244-8827 fax TESS Support (888) 753-8377 james.wilcox@private www.secureinfo.com
This archive was generated by hypermail 2b30 : Sun May 26 2002 - 11:41:03 PDT