[clue-admin] CLUE server security audit

[David Anselmi]

Jed S. Baer wrote:
> Yeah. The purpose of an attack from outside is too see if other auditing,
> and/or changes, have missed anything.

I suppose you could look at it that way.

Strictly speaking, you write a security policy, configure your system to 
implement that policy, and then audit the system to make sure the 
implementation complies with the policy.

There isn't any particular reason to probe from the outside and the more 
info you provide the auditors, the more easily (and cheaply) they can 
conduct the audit.

Penetration testing is sexy at companies that take security "seriously", 
but for a specific system I think it's not very useful.  All you really 
need is to know what services you provide to the Internet and whether 
any of those servers have published vulnerabilities.  Testing code you 
wrote is a different story though.

Dave