O'Reilly - Practical UNIX & Internet Sec... 7015KB

[Appendix E] Electronic Resources
E.1 Mailing Lists
There are many mailing lists that cover security-related material. We describe a few of the major ones
here. However, this is not to imply that only these lists are worthy of mention! There may well be other
lists of which we are unaware, and many of the lesser-known lists often have a higher volume of good
information.
NOTE: Never place blind faith in anything you read in a mailing list, especially if the list is
unmoderated. There are a number of self-styled experts on the net who will not hesitate to
volunteer their views, whether knowledgeable or not. Usually their advice is benign, but
sometimes it is quite dangerous. There may also be people who are providing bad advice on
purpose, as a form of vandalism. And certainly there are times where the real experts make a
mistake or two in what they recommend in an offhand note posted to the net.
There are some real experts on these lists who are (happily) willing to share their knowledge
with the community, and their contributions make the Internet a better place. However, keep
in mind that simply because you read it on the network does not mean that the information is
correct for your system or environment, does not mean that it has been carefully thought out,
does not mean that it matches your site policy, and most certainly does not mean that it will
help your security. Always evaluate carefully the information you receive before acting on it.
E.1.1 Response Teams and Vendors
Many of the incident response teams (listed in Appendix F) have mailing lists for their advisories and
alerts. If you can be classified as one of their constituents, you should contact the appropriate team(s) to
be placed on their mailing lists.
Many vendors also have mailing lists for updates and advisories concerning their products. These include
computer vendors, firewall vendors, and vendors of security software (including some freeware and
shareware products). You may wish to contact your vendors to see if they have such lists, and if so, join.
E.1.2 A Big Problem With Mailing Lists
The problem with all these lists is that you can easily overwhelm yourself. If you are on lists from two
response teams, four vendors, and another half-dozen general-purpose lists, you may find yourself
filtering several hundred messages a day whenever a new general vulnerability is discovered. At the
same time, you don't want to unsubscribe from these lists, because you might then miss the timely
announcement of a special-case fix for your own systems.
One method that we have seen others use with some success is to split the mailing lists up among a group
of administrators. Each person gets one or two lists to monitor, with particularly useful messages then
redistributed to the entire group. Be certain to arrange coverage of these lists if someone leaves or goes
on vacation, however!
Another approach is to feed these messages into Usenet newsgroups you create locally especially for this
purpose. This strategy allows you to read the messages using an advanced newsreader that will allow you
to kill message chains or trigger on keywords. It may also help provide an archiving mechanism to allow
file:///C|/Oreilly Unix etc/O'Reilly Reference Library/networking/puis/appe_01.htm (2 of 5) [2002-04-12 10:45:22]