FUD Watch | When Did the Sky Start Falling?

About FUD Watch: Senior Editor Bill Brenner scours the Internet in search of FUD – overhyped security threats that ultimately have little impact on a CSO’s daily routine. The goal: help security decision makers separate the hot air from genuine action items. To point us toward the industry’s most egregious FUD, send an e-mail to bbrenner@cxo.com.

It seems like the world melted into a big puddle of sweat while I was away on vacation.

As I soaked up the beauty of Campobello Island (Franklin Roosevelt’s former summer destination) and New Hampshire’s White Mountains, the DNS panic deepened at the Black Hat confab in Las Vegas, Russia and the former Soviet republic of Georgia started fighting and the security vendors started making ominous predictions about Microsoft’s August Patch Tuesday.

And so I’m taking a break from the post-vacation dig-out to look for some reason in all that has happened:

The DNS panicDNS issue was much more exploitable than previously suggested.

My colleague Robert McMillan went to Black Hat and followed up on all the hoopla over the big DNS flaw researcher Dan Kaminsky discovered months ago and announced a few weeks back. McMillan reported that, according to Kaminsky and other researchers at Black Hat, the

The DNS flaw is indeed a nasty one, as I said in the last FUD Watch column. And it was inevitable that more chilling headlines would come out of Black Hat. But I don’t think what came out of Black Hat was much worse than what we already knew.

The good news is that a patch exists, and companies will be protected if they apply it. That fact isn’t going to change.

Russia vs. Georgia

As word spread that Russia was bombing Georgia over the latter nation’s military offensive against the breakaway province of South Ossetia, rumors of a cyber attack against Georgia spread like wildfire. Indeed, the attacks were real, but it’s less certain if this is an act sponsored by the Russian government.

For a more reasoned perspective on this mess, I point you to a column from security expert Gadi Evron, who dealt with this sort of attack all the time when he worked for the Israeli government.

“Could this somehow be indirectly related to Russian military action? Yes, but there is no evidence to indicate it is the case as of yet. If anything, the opposite seems likely at this point in time,” he writes. “Running security for the Israeli government Internet operation and later founding the Israeli government CERT, I found that such attacks were routine. Seeing the panicked reaction this type of attack has generated seems quaint from my perspective.”

I can’t say it any better than that.

Patch Tuesday

Finally, in time for my return to work, there’s a big August patch release from Microsoft that’s attracting the usual assortment of alarm from security vendors. This time around, Microsoft has addressed security holes in Windows, Office, Internet Explorer (IE) Windows Messenger and other software.

“Today is a perfect storm of client-side issues,” Amol Sarwate, manger of Qualys Inc.’s vulnerabilities research lab, told Computerworld. “Most or all of Microsoft’s client-side applications are affected or patched.”

Sarwate has offered a balanced perspective when I’ve interviewed him in the past, and he’s right that most or all of Microsoft’s client-side applications are affected. But to call it a perfect storm is to inject FUD that isn’t necessarily warranted.

Vendors will always issue stern warnings on Patch Tuesday, but in the end the danger and the remedy is about the same: If you run a tight IT ship and have a layered security program, you should ignore the monthly vendor cries (you already do anyway) because you already have a system to deploy patches in a timely fashion. But if you’re not guarding your infrastructure with basic defenses such as firewalls, antivirus and patch management procedures, you should start paying more attention.

The news out there may look bad, but life goes on. Be vigilant, be aware, but for goodness sake, be calm.