<html><head></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; "><br><div><div>On 22/06/2010, at 3:03 PM, Dobbins, Roland wrote:</div><br><blockquote type="cite"><div><font class="Apple-style-span" color="#006312"><font class="Apple-style-span" color="#144FAE"><br></font></font></div></blockquote><div><br></div>I'm sure that after this, there will be a wave of 'spoofers' to fool these systems into thinking they're all locked down, either installed by the owner themself or by some haxor as part of a botnet script. - It just gets better and better :)</div><div><br></div><div><blockquote type="cite"><div>One can't trust end-nodes to self-report, anyways - the miscreants will compromise them anyways, and then send back the signals the management system expects to hear. This is why 'NAC' is completely useless.<br><br>The only way to determine whether a given host is compromised/misbehaving is observe its behavior from *outside* said host - flow telemetry, DNS queries, et. al.<br><br>-----------------------------------------------------------------------<br>Roland Dobbins <<a href="mailto:rdobbins@arbor.net">rdobbins@arbor.net</a>> // <<a href="http://www.arbornetworks.com">http://www.arbornetworks.com</a>><br><br> Injustice is relatively easy to bear; what stings is justice.<br><br> -- H.L. Mencken<br><br><br><br>_______________________________________________<br>AusNOG mailing list<br><a href="mailto:AusNOG@lists.ausnog.net">AusNOG@lists.ausnog.net</a><br>http://lists.ausnog.net/mailman/listinfo/ausnog<br></div></blockquote></div><br></body></html>