[plug] Security, Social Engineering, Etc

[Christian]

russ wrote:
> > Yes, he does place the "threat to information" from external attackers
> > at 5-8% of the total. Mind you, he never clearly states where he gets
> > this figure from although I suspect it might be from a survey that he
> > mentions previously...  That in itself should tell you something about
> > the worth of the article -- A SURVEY!!  If these assertions came from
> > some relevant, empirical source then they might be worth something but
> > asking a bunch of people what they think on this subject is probably
> > next to meaningless (especially since we don't know who these people
> > even were!).  The paper reads like something aimed at upper management,
> > there is minimal detail and I didn't notice much original thought
> > (although I did only skim it).
> 
> To quote from your previous message in this thread:
> 
> "Anyway, I don't really have any strong evidence or argument for my
> statement but I just don't buy into the idea that most compromises are
> internal."
> 
> This is your "relevant emperical source"? :)

No, but my subsequent explanation and reasoning as to *why* I don't buy
into the idea is somewhat empirical and relevant (at least to me). 
(This should be obvious from what I've already said and I shouldn't have
to explain it yet again.)  Then again, I'm not publishing a paper on why
I think the majority of security infringements occur by external parties
-- I'm just giving an opinion on a mailing list.

Getting back to the original point which was me suggesting to Jeremy
that most of the people who were likely to compromise his security would
not be people he knows, i.e. they would be strangers off the Internet. 
I base this on a) my own experience (and thus the view that I hold,
which has now be extremely comprehensively discussed!) and b) the
indication that he gave he sees regular penetration attempts on his
network from remote sites on the Internet.  I notice that, so far, he
hasn't disagreed with me on this so I suspect that my original point is
probably still correct.

Regards,

Christian.