21 Quotes by Alan Paller

There is a wave of people looking for infected machines. We are getting into the second wave of infections. We haven't figured what they are doing. But we are seeing a very big wave of scanning.

Of course it's the government. Governments will pay anything for control of other governments' computers. All governments will pay anything. It's so much better than tapping a phone.

Fundamentally, it's an organization that is behind in making security part of its regular operations. It's very dangerous for health care data.

If an early infectee had an e-mail list with reporters at all the major news services, that would start the cascade. News organizations do not have radical e-mail attachment limits (like a rule banning all picture attachments) because they get legitimate pictures.

It gives anyone on the Internet who comes in as a browsing user the ability to take control of your site. Instead of looking at Web pages, they can make your computer do whatever they want.

It is a situation where MCSEs had no idea that there is a fundamental vulnerability in IIS and ISAPI mapping and so had no way to protect their systems other than after-the-fact patching,

That could be a real wave of traffic that the Internet has not dealt with.

Most of them, ... appear to be just plain thieves.

Most large organizations have a big investment in Symantec tools and wouldn't normally consider switching. This year, however, Symantec's products have repeatedly shown up on the list of the software with critical new security vulnerabilities. Many corporate IT managers are angry and frustrated that their security vendor is as careless as the operating system vendors in writing bad code. And Microsoft has succeeded in persuading many of them that they are far ahead of other software vendors in improving the situation for new products.