--- Michel Arboi <arboiat_private> wrote: > Some time ago, I was digging into CVE and I wondered if we > shouldn't > test very old vulnerabilities (because we do not. Not *all* of > them) > Two reasons for yes: > 1. An archeocomputer may have been lost in a corner of a network. I assessed a network within the last 1/2 year for an obscenely large corporation and came across a 6+ year old script vulnerability on a machine that should have not had such issues (my first thought was a honeypot :-). Sadly, I think disabling these scans will allow people to repeat mistakes since it is initially quicker to not scan for these old issues. At the same time, those that are learned can easily make the business decision not to scan them based on their first-hand knowledge. I feel Nessus shouldn't try to assume what first-hand knowledge people have. > 2. People never learn, and old bugs tend to pop up sooner or > later > > One reason for no: > why bother? We have enough new vulnerabilities now. > > Yes? No? __________________________________________________ Do you Yahoo!? Yahoo! Tax Center - forms, calculators, tips, more http://taxes.yahoo.com/
This archive was generated by hypermail 2b30 : Mon Mar 03 2003 - 17:04:59 PST