Oh geez +1 to that....

+1 or Mac for that matter

As far as AV products, there is a great online stats site that keeps current coverage statistics for most popular AV Vendors... Check it out man...

http://www.av-comparatives.org/seiten/ergebnisse_2008_05.php

This is where it gets very gray, as it has been explained to me 15 U.S.C. § 1681c-1 authorizes consumers to obtain fraud alerts, AND in emergency situations it can allow authorized representatives to obtain them on your behalf, HOWEVER, when LifeLock calls and claims 1. That they are you (which they consistently do) or 2. That their is a non-existent emergency (which they also do) ... in order for them to obtain fraud alerts they have now crossed the line into Felony Fraud... Acting on behalf of and Impersonating someone are two drastically different things...

Ok since I work in the credit reporting arena I will comment on the LifeLock lawsuit briefly. Understand that technically what LifeLock does IS VERY ILLEGAL. If you choose to put fraud alerts on your account. That is fine and dandy and any of the 3 bureau's (Experian, TransUnion, Equifax) will accomodate that. HOWEVER, let me explain what actually happens. ONLY you can put Fraud Alerts on your credit and Credit Fraud Alerts expire between 3-6 months after you call one in depending on which company you call, so what LifeLock does, is they call and SAY THEY ARE YOU!!!! and put an alert on your account again and again. THEY ARE POSING AS YOU on the phone and doing things on your behalf that you may not necessarily be okay with. THEY are committing fraud... they refuse to stop doing it, therefore the credit bureau's are forced to file suit to keep peoples information as safe as possible especially from people who would bend the law and abuse the power their customers give them....

It is not too hard to hide the trail of money these days... especially if you can move it through some particular foreign countries that make retrieving data VERY difficult. I am not going to get into detail because I don't want to give a tutorial on how to do this and get away clean but let's just say that foreign commodities are a great way to leave a dead end. Use your imagination from there...

My co-workers and I were actually called in on an investigation where this happened to an executive of a child company of ours. Lucky for us this version of ransomware used rot13 and not a 1024 bit key which would have sucked for us considering local IT had not implemented backups for their executives laptops....

-Jordan

Man what a cool show, I have never heard of it until now. Definitely going to set the DVR.

yes, that is exactly my point, you have to be able to prove that you had not singled out the employee, hence blanket coverage is the best way to go IMO.

Mmmmm, that is not completely correct, and no offense intended Efferri but just hear me out a sec. I have been dealing with legal issues like this for a major Fortune 100 Financial institution for years now and have a lot of experience in this area (preventing data leakage and prosecuting those who would sell your trade secrets).

 I have seen employees successfully sue their employers for tactics like that EVEN when their is a signed agreement acknowledging no expectation of privacy on company owned equipment. This type of tactic CAN fall into the realm of violating your employees rights even if you own the equipment and is very tricky to handle in court, because you have selected THAT employee for a level of monitoring beyond the rest of your employees it can also fall into the realm of discrimination.

Personally I would avoid this type of situation altogether and deploy a tool like Vontu as Don suggested. It is forensically sound, generally accepted as a standard in legal communities for IP (Intellectual Property) loss cases and keeps your company protected from discrimination responses from your employees.

-Jordan

personal opinon, ready, set, go:

IPv6 is a pain and from strictly a personal perspective I don't think it is necessary to learn it right now, even those who are being forced to change (my company included) are not going to change use anything except IPv4 internally. Honestly, there is no need to change our internal IP space so I don't see it happening anytime soon...

End Personal Opinion...

professional opinion, ready, set go:

Learning New things like IPv6 can do nothing but help prepare you for the future and increase your marketability to future employers, on this one, the career perspective should win out, I am not using nor will I use IPv6 at my current company, however, because I am career minded and more professional then just personal I have learned enough about IPv6 to understand and manage it if necessary. This way if a future employer ever had that requirement... check it off on the list, I am good to go....

end professional opinion:

As you can see their are 2 sides to this argument from everyone's posts you got a little taste of both sides. Take the knowledge that has been shared and do what you think is best for you man ....

Long time lurker, first time poster, thought I would take my shot at a free ticket at Blackhat, I figured if Z can win tickets to SANS WhatWorks, maybe I got a shot .....

Just a general discussion about what it took for you other pro's who have been in the industry for a while to really feel confident in your ability to do your job and feel like you were no longer "new" to the arena of pen-testing or vuln-research...

For me I guess it was a few years into my career (3 or 4 roughly) and I found my first 0-day vulnerability, that seemed for me to be a major turning point in my confidence, where I kinda said "Hey, you know what, I might actually be really good at this vulnerability research and pen-testing thing... " ... I am sure it was not the same thing for everyone that gave you that confident edge that sets the real pro's apart, maybe it was the first time you popped a shell on a Solaris box, or the first time you successfully completed a social engineering exploit (and yes it is an exploit, it is just the people that are the vulnerability).... Give us your story and how you think the confidence has helped you since...

-Jordan

I grew up as a Sys Admin on Unix (Solaris) systems mostly. I think that tends to pull me to be more biased to the *nix market. I feel more at home there. Windows is definitely the more "user friendly" environment but Linux OS's are getting close (Ubuntu is very user friendly).

As far as a professional perspective, Linux is my OS of choice for pen-testing and analysis (performance, tools, customizability), bear in mind though I have VM's of Win 2000 and XP, Server 2000 and 2003 as well. It is hard to RE Malware on a non-native platform and I do alot of that.

Security wise, I think Linux is not inherently more secure. It is however not targeted nearly as much and therefore benefits from it's lack of market dominance on the regular commercial customer base. Although Security Flaws exist and are exploited on Linux, they are not published nearly as often as Windows. Reknown is gained and botnets are grown by finding Windows Vulns, finding a linux vuln does little today for the average hacker...

Just my 2 Cents....

I have to strongly agree with ChrisG's point. Why condone the use of these "braindumps" by allowing the Q&A's to be posted here. I mean asking about concepts and seeking knowledge is one thing, but just trying to memorize answers, What does that accomplish?

The braindumps allow unqualified people to pass an exam that they cannot do the job for. They dillute our market with Paper Certified "Experts" and give everyone a bad name in the end.

You want to get your cert? Get the books, study, ACTUALLY LEARN the concepts, not just the answers and get your cert. If you are otherwise incapable or too lazy to do that, find another industry because Information Security isn't for you anyways... one of the KEY things that makes a good Security Professional is a passion for learning and the ability to learn things on your own.

I am adament about this topic as I have recently hired 2 "Paper Certified" Security Professionals who had CEH, CPTS and CISSP certifiications but unbeknowst had used braindumps to achieve their certifications and had lied on their resumes about experience. They waisted by time, my companies money and forced me to carry their load where they were not able. Once you have experienced something like that your opinion on the topic may change...