On Monday I remarked on the BBC Click botnet investigation. I slightly regret my post because, in fact, I think they did a great job in bringing to life the potency of botnets. Legalities aside, let’s focus on the fact that it only took 60 PCs to cause a denial of service situation. That’s very disturbing and we all need to sit up and consider the consequences of that.
By submitting your personal information, you agree that TechTarget and its partners may contact you regarding relevant content, products and special offers.
I was chatting with the CISO of an investment bank earlier today. He was wondering whether or not we should have in place a legal framework that would allow “researchers” a better way to test system security without fear of being accused under the Computer Misuse Act. It’s dangerous territory but I take his point. If somebody discovered a gaping hole in my own organisations’ network security then I’d be grateful for the information. Many of the third parties I legitimately employ to do discovery work do little more than run Nessus and then post a report, so the hackers view would be invaluable. But where do you draw the line between “hacking” and “research” and what assurance can be gained from an unsolicited security report?