from localhost (jalapeno [127.0.0.1])
	by jmason.org (Postfix) with ESMTP id E66B916F18
	for <jm@localhost>; Fri,  6 Sep 2002 11:35:06 +0100 (IST)
from jalapeno [127.0.0.1]
	by localhost with IMAP (fetchmail-5.9.0)
	for jm@localhost (single-drop); Fri, 06 Sep 2002 11:35:06 +0100 (IST)
from webnote.net (mail.webnote.net [193.120.211.219]) by
    dogma.slashnull.org (8.11.6/8.11.6) with ESMTP id g869rVC29298 for
    <jm@jmason.org>; Fri, 6 Sep 2002 10:53:31 +0100
from outgoing.securityfocus.com (outgoing3.securityfocus.com
    [66.38.151.27]) by webnote.net (8.9.3/8.9.3) with ESMTP id XAA18901 for
    <jm@jmason.org>; Thu, 5 Sep 2002 23:06:36 +0100
from lists.securityfocus.com (lists.securityfocus.com
    [66.38.151.19]) by outgoing.securityfocus.com (Postfix) with QMQP id
    868A2A33C1; Thu,  5 Sep 2002 14:19:21 -0600 (MDT)
(qmail 24062 invoked from network); 5 Sep 2002 19:24:13 -0000
Ben Mord <bmord@icon-nicholson.com>,
	"Webappsec Securityfocus.Com" <webappsec@securityfocus.com>,
	SECPROG Securityfocus <SECPROG@securityfocus.com>
Re: FW: use of base image / delta image for automated recovery
    from attacks
From secprog-return-492-jm=jmason.org@securityfocus.com  Fri Sep  6 11:36:01 2002

Scott MacKenzie wrote:
>There is a software package that is used (or was up through w2k)
>on MicroSloth for this purpose. Ghost, or some such. One essentially
>"takes a picture" of the machine's proper config, and then upon
>schedule or demand replaces the machine's current config with the
>proper picture. It essentially over-writes the entire disk drive.
>Especially good for student access machines at libraries, etc.
>
And it is pretty common practice in some environments with public
workstations to just wipe and re-install Windows machines on a weekly
(or even daily) basis. It's easier than trying to maintain Windows.
Crispin
--
Crispin Cowan, Ph.D.
Chief Scientist, WireX                      http://wirex.com/~crispin/
Security Hardened Linux Distribution:       http://immunix.org
Available for purchase: http://wirex.com/Products/Immunix/purchase.html