On Anti-X

Anti-malware software has become a mainstay of PC operation. If you don’t run Anti-x software then you are considered an irresponsible administrator or vulnerable user. This is because there has been billions of dollars pushed in to marketing and lukewarm security training in an attempt to secure the masses. I am all for security for the masses but there is an issue. The marketing and training may not provide the masses with an understanding of real vulnerabilities because it does not matter if they understand; only that they act and that action must be equally lukewarm in the form of automated processes if they, the masses, are ever expected perform. I do agree this is the best solution available, at present, and that there are real threats but it is not enough and I am not even going to start on marketing that uses fear as a tool to motivate people in to action. Thus there are two issues (1) current methods of protection are inadequate for current threats and (2) users are not being educated adequately. I do understand that it is not the end users job or purpose in life to function securely but that is the only answer if the masses are ever to be secure. All the automation in the world will not protect a system because automation fails.
To put this in to proper context I recall a conversation I had about a year and half ago with some vendors over lunch. My assistant, their sales guy and chief hardware designer were present and somehow, toward the end of our meal, the topic of conversation moved from business to pure security. The hardware designer also worked with the system administrators on their network. He and I were talking about different administrative practices when he said “I don’t run antivirus software on our network.” My reply, in a British accent, was “You have gown right out your tree my son!” He began to defend his position with technical details of how anti-x was broken and never worked in the first place. I agreed with his postulate but felt it was a frail argument for not running anti-x in the enterprise. I, then, presented my argument that the technical limitations were moot due to the credibility gained from end users by participating in this well known security practice. I explained that there have been billions of dollars in marketing and countless media reports that have engrained in the users mind that anti-x makes you secure and by performing well know security practices you are buying peace-of-mind. The users have to trust the system or it will not be used. I posed this as trade off of the administrative overhead of anti-x software being equal to its provided protection and peace-of-mind. His solution was to continually take baselines of the system and when something malicious occurred they would revert to the last known good copy.
Baseline-Reimage practice is now becoming a formalized process due to the advent of root kits and undetectable super evil malware. The formalization has occurred not because anti-x is broken but because it is inadequate for advanced threats. However, anti-x is still required and useful to defend against low hanging threats and to provide piece-of-mind to the users. A scary state will be when the hyperbola changes from “You must run anti-x!” to “Have you reimaged your computer today?”

YouTube, MySpace and Real Time Content Filtering

In my weekly reading I ran across this article by Pete Tenereillo. It's a very good article overall but I do have something else to add. He suggests that blocking YouTube and other video sites at the firewall would be a bit militaristic. I see his point but in the past I have been known to take such actions. My reasoning was two fold. (1)It was against policy and (2) it was more cost effective to block those sites then invest in a content management solution. Now days the systems/solutions are becoming more cost effective and there is one company that is doing just what he proposes. I have not investigated cost or effectiveness and I would like to see a real world false positive statistic. Either way if it's against policy it should be blocked not mitigated.

Current flight situation and robots

Being a student of security and its principles I have always found it amusing when people make odd security choices. We all have done it from time to time. I don't want to get off on a rant here but the method we are dealing with the current threat, somewhat, alarms me. I am speaking about the current flight restrictions. I do think the current measures are correct and I am glad to see that TSA is relaxing the list of banded items and I hope that it continues. However, I don't know what I would use a corkscrew or Toy Transformer Robot on a plane for. OK…maybe the robot.

There are several more qualified people in the industry that are have been writing about this same topic so I don't think I will bring anything new to the table. However the idea in security is that you make tradeoffs. Basically how much risk will you accept vs. how much inconvenience you are willing to endure. It was put best by Richard Bejtlich "Security is the process of maintaining an acceptable level of perceived risk".

The observation I have is that terrorists don't have to succeed in any act. Merely attempting an act of terror creates a reaction, that could be considered knee-jerk, to mitigate future attacks of the same type. These acts by terrorists can cause much more long-term damage and impact on our way of life. Such failed acts will case a nation state to create self imposed restrictions. So instead of the perceived intended terror we become a victim of our own laws and regulations. Tech savvy security professionals can relate it to auto-shunning on a perimeter device. As Dan Kaminsky said at DefCon13 "It's a bad IDEA to let outsiders decide your firewall rules." The point he was making is that if you spoof your IP as one of the DNS Root servers you can effectively cut the agency off the internet. It is completely possible that the planning of terror attacks are done two fold. (1)Plan to create terror and (2) if the plan fails make sure the mitigation methods will have significant impact. Don't get me wrong I do feel that the right thing is being done currently and we have made great strides in detection and awareness but there becomes a point when, as a society, we must accept the risk and move on. As many have stated "We can't secure everything all of the time."