<?xml version="1.0" encoding="UTF-8" ?>
<rss version="2.0" xmlns:s="http://www.techrepublic.com/search" xmlns:dc="http://purl.org/dc/elements/1.1/"  xmlns:atom="http://www.w3.org/2005/Atom">
<channel>
    <title><![CDATA[Discussion on Consultant tightened security two ways after 'Needlepoint' virus attack ]]></title>
    <link><![CDATA[http://www.techrepublic.com/forum/discussions/15-111249]]></link>
    <atom:link rel="hub" type="application/rss+xml" href="http://pubsubhubbub.appspot.com/" />
    <atom:link rel="self" type="application/rss+xml" href="http://www.techrepublic.com/forum/discussions/15-111249/rss" />

    <description><![CDATA[]]></description>
    <language>en-us</language>
    <lastBuildDate>2013-05-21T18:32:29-07:00</lastBuildDate>
             

    <item>
        <title><![CDATA[Misunderstood]]></title>
        <link><![CDATA[http://www.techrepublic.com/forum/discussions/15-111249-672321]]></link>
        <description><![CDATA[Apparently I forgot to mention that the automatic part of the anti-virus updating should not be the client (user-driven) part. By automatic updating I intended that the users should have installed for them the most recent set of anti-virus defn.s, etc. that were available as soon as they were available, and that it should not be possible to refuse or cancel such updates.On a properly managed system the need for such an update installation can be assessed and the installation itself can be performed as part of the login script.]]></description>
        <guid><![CDATA[http://www.techrepublic.com/forum/discussions/15-111249-672321]]></guid>
        <dc:creator><![CDATA[doug.cronshaw@...]]></dc:creator>
        <pubDate>Mon, 25 Nov 2002 02:09:53 -0800</pubDate>
    </item>
             

    <item>
        <title><![CDATA[Kaspersky or Sophos Antivirus?]]></title>
        <link><![CDATA[http://www.techrepublic.com/forum/discussions/15-111249-672304]]></link>
        <description><![CDATA[From this discussion it appears that only Norton AV is used.  Has anyone had any experience with Kaspersky (http://www.kaspersky.com) or Sophos (http://www.sophos.com)?  John Dvorak has recommended Kaspersky over Norton in the past.  I've also heardgood things about Sophos, who are big in Europe and Great Britain in the enterprise market and are starting to sell their product in North America.  I've heard some stories where Sophos has halted a virus that Norton failed to recognize.  I'm very curious to know of anyone's experiences with either product...]]></description>
        <guid><![CDATA[http://www.techrepublic.com/forum/discussions/15-111249-672304]]></guid>
        <dc:creator><![CDATA[Marc Erickson]]></dc:creator>
        <pubDate>Mon, 25 Nov 2002 01:37:15 -0800</pubDate>
    </item>
             

    <item>
        <title><![CDATA[Win2K and XP work fine]]></title>
        <link><![CDATA[http://www.techrepublic.com/forum/discussions/15-111249-668581]]></link>
        <description><![CDATA[The previous posts are worth expanding a bit:1. If you make local users Administrators, you are indeed asking for trouble.2. If you want to grant fairly liberal rights, then put users into the Power Users group. This lets them do most functions up to the point of installing software. In my experience, most applications will work OK for Power Users, since modify rights are granted by default.3. If you keep them as regular Users, which is a more secure approach since Users can't accidentally share and therefore expose local folders, then you may have to do some sleuthing to figure out why some applications won't run. Generally, it's because Users may have only Read/Execute privileges in the application folders. For a well-writtenapplication, that's good enough. But older apps may want to write into the application folder and Users can't do that by default. You can fix it by giving Users Modify rights to those folders. This requires touching each workstation, plus going intothe Advanced section of folder security properties.4. In our medical environment, we create local user groups for specific applications, grant the groups modify rights to the necessary application folders, then add whatever users or global groups are appropriate to those local groups. For example, only radiology techs, not the secretaries, get permissions to the diagnostic radiology apps.This takes a little extra time to figure out why applications don't run with users granted normal privileges, and more attention at installation. But sure makes us sleep better at night.]]></description>
        <guid><![CDATA[http://www.techrepublic.com/forum/discussions/15-111249-668581]]></guid>
        <dc:creator><![CDATA[RoadWarrior]]></dc:creator>
        <pubDate>Mon, 18 Nov 2002 14:51:58 -0800</pubDate>
    </item>
             

    <item>
        <title><![CDATA[Win 2K is NOT any help]]></title>
        <link><![CDATA[http://www.techrepublic.com/forum/discussions/15-111249-668421]]></link>
        <description><![CDATA[After deploying 200 W2K Prof desktops Microsoft recommended giving all users local admin privs to make Office 2000 work properly.  Maybe MS should be split up to avoid this type of schizophrenic behavior.]]></description>
        <guid><![CDATA[http://www.techrepublic.com/forum/discussions/15-111249-668421]]></guid>
        <dc:creator><![CDATA[jmalbrecht@...]]></dc:creator>
        <pubDate>Mon, 18 Nov 2002 07:16:20 -0800</pubDate>
    </item>
             

    <item>
        <title><![CDATA[Norton does it all]]></title>
        <link><![CDATA[http://www.techrepublic.com/forum/discussions/15-111249-668312]]></link>
        <description><![CDATA[You said it all with &quot;hadn't been updated.&quot;  That flu shot we got 6 years ago for weasel flu isn't worth anything against the current bugs.  People have GOT to keep their signature files up to date.]]></description>
        <guid><![CDATA[http://www.techrepublic.com/forum/discussions/15-111249-668312]]></guid>
        <dc:creator><![CDATA[Greybeard770]]></dc:creator>
        <pubDate>Mon, 18 Nov 2002 04:29:54 -0800</pubDate>
    </item>
             

    <item>
        <title><![CDATA[Down with Outlook]]></title>
        <link><![CDATA[http://www.techrepublic.com/forum/discussions/15-111249-668308]]></link>
        <description><![CDATA[I got hit with the bride virus its second day out, before the av had a chance to update me on its particular signatures.  I was only partially infected, since bride is a descendent of funlove, luckily I didn't infect anyone else.  And HOW did I get it?  Someone enabled the preview panel in OUTLOOK, and it was from a new spam address I hadn't yet filtered.  And why was I using outlook?  because at home I have a slow connection and downloading anything is a pain...   I'm going to work where they have a T1, and download Eudora for &quot;personal&quot; use now...  even though strictly speaking it's against their security policy.]]></description>
        <guid><![CDATA[http://www.techrepublic.com/forum/discussions/15-111249-668308]]></guid>
        <dc:creator><![CDATA[marathoner]]></dc:creator>
        <pubDate>Mon, 18 Nov 2002 04:27:04 -0800</pubDate>
    </item>
             

    <item>
        <title><![CDATA[There is, but you can't use it]]></title>
        <link><![CDATA[http://www.techrepublic.com/forum/discussions/15-111249-668271]]></link>
        <description><![CDATA[Unfortunately too much software, include some from microsoft, won't run on a win2k box without admin priveliges.  I find this to be a flaw that completely undermines the security benefits built into win2k prof.]]></description>
        <guid><![CDATA[http://www.techrepublic.com/forum/discussions/15-111249-668271]]></guid>
        <dc:creator><![CDATA[john@...]]></dc:creator>
        <pubDate>Mon, 18 Nov 2002 03:40:44 -0800</pubDate>
    </item>
             

    <item>
        <title><![CDATA[Which AV program are YOU using.]]></title>
        <link><![CDATA[http://www.techrepublic.com/forum/discussions/15-111249-668168]]></link>
        <description><![CDATA[Norton Antivirus does exactly what you expect. When you install it, it immediately invokes Live Update to get both the latest version of the code and the latest signature file.  The &quot;Corporate&quot; version even does automatic updates on a schedule that you can set.  The individual versions need you to click on something before they will do a scheduled update.You get what you pay for!]]></description>
        <guid><![CDATA[http://www.techrepublic.com/forum/discussions/15-111249-668168]]></guid>
        <dc:creator><![CDATA[draco vulgaris]]></dc:creator>
        <pubDate>Mon, 18 Nov 2002 01:30:58 -0800</pubDate>
    </item>
             

    <item>
        <title><![CDATA[Missed the most important thing.]]></title>
        <link><![CDATA[http://www.techrepublic.com/forum/discussions/15-111249-668141]]></link>
        <description><![CDATA[Forget about auto updates.  If you assume that the software is updating itself, you can be sure it is NOT.Auditing your PC base - either manually or automatically (still with manual spotchecks) - is the only way to ensure security.  Of course, that presumes that security is considered &quot;Budgetworthy&quot;.]]></description>
        <guid><![CDATA[http://www.techrepublic.com/forum/discussions/15-111249-668141]]></guid>
        <dc:creator><![CDATA[ramelectronics@...]]></dc:creator>
        <pubDate>Mon, 18 Nov 2002 00:56:28 -0800</pubDate>
    </item>
             

    <item>
        <title><![CDATA[A Privilage not a Right]]></title>
        <link><![CDATA[http://www.techrepublic.com/forum/discussions/15-111249-668059]]></link>
        <description><![CDATA[At a non-ptofit organization where I manage the LAN, We have a policy that Internet usage is a privilage and if our strict usage policy is not followed the Internet will be disconnected.  This has worked well in this 50 user organization.]]></description>
        <guid><![CDATA[http://www.techrepublic.com/forum/discussions/15-111249-668059]]></guid>
        <dc:creator><![CDATA[Jeep@...]]></dc:creator>
        <pubDate>Sun, 17 Nov 2002 23:42:09 -0800</pubDate>
    </item>
             

    <item>
        <title><![CDATA[Two favorite alternate e-mails]]></title>
        <link><![CDATA[http://www.techrepublic.com/forum/discussions/15-111249-668042]]></link>
        <description><![CDATA[If you or your firm have a Novell network, any version, you can use Novell's GroupWise full service e-mail package. Works great, and the learning curve and implementation are minimal. As for home, I've always preferred the Netscape suite of productsover the Outlook/Explorer products for the same virus protection reasons!!]]></description>
        <guid><![CDATA[http://www.techrepublic.com/forum/discussions/15-111249-668042]]></guid>
        <dc:creator><![CDATA[wendyb_09@...]]></dc:creator>
        <pubDate>Sun, 17 Nov 2002 23:27:32 -0800</pubDate>
    </item>
             

    <item>
        <title><![CDATA[Great Idea!]]></title>
        <link><![CDATA[http://www.techrepublic.com/forum/discussions/15-111249-668007]]></link>
        <description><![CDATA[Aside from the security benefits, think of the increase in employee productivity. The internet can be a great time waster for some people.MP]]></description>
        <guid><![CDATA[http://www.techrepublic.com/forum/discussions/15-111249-668007]]></guid>
        <dc:creator><![CDATA[Michel Pizaz]]></dc:creator>
        <pubDate>Sun, 17 Nov 2002 22:48:56 -0800</pubDate>
    </item>
             

    <item>
        <title><![CDATA[Basics]]></title>
        <link><![CDATA[http://www.techrepublic.com/forum/discussions/15-111249-667995]]></link>
        <description><![CDATA[For all the money that was spent on security, it sounds like some basics were overlooked.1. Most users should not have permission to install software on their workstations. They should have just enough permission to allow them to perform theirdaily tasks. For those users who require administrative access, they should be logged into such accounts only when performing administrative tasks, and have an ordinary user account for everyday tasks such as reading email and surfing the internet.2. Current antivirus software should be installed on all servers and workstations. There are a number of ways to automatically force definition updates. There are also some good antivirus packages for Exchange servers to scan email for viruses.3. Consider using content filtering software for your mail server to remove malicious scripts and attachments with unauthorized extensions.Chances are most of the above suggestions were already in place and simply misconfigured.MP]]></description>
        <guid><![CDATA[http://www.techrepublic.com/forum/discussions/15-111249-667995]]></guid>
        <dc:creator><![CDATA[Michel Pizaz]]></dc:creator>
        <pubDate>Sun, 17 Nov 2002 22:36:37 -0800</pubDate>
    </item>
             

    <item>
        <title><![CDATA[There is]]></title>
        <link><![CDATA[http://www.techrepublic.com/forum/discussions/15-111249-667959]]></link>
        <description><![CDATA[By default, if you are a standard user on a Win2K, pc you can't install or change anything.  But if you have been given elivated right, that security goes away.]]></description>
        <guid><![CDATA[http://www.techrepublic.com/forum/discussions/15-111249-667959]]></guid>
        <dc:creator><![CDATA[Talanj]]></dc:creator>
        <pubDate>Sun, 17 Nov 2002 22:00:30 -0800</pubDate>
    </item>
             

    <item>
        <title><![CDATA[Use an alternate e-mail client]]></title>
        <link><![CDATA[http://www.techrepublic.com/forum/discussions/15-111249-667925]]></link>
        <description><![CDATA[The vast majority of viruses today exploit &quot;features&quot; of Microsoft Outlook for either infection or distribution.  Even with regular (automatic) engine and virus definition updates, you can still be one of the lucky few to get the virus before the definitions are updated.The best protection against further propagation of e-mail distributed viruses is to completely remove Microsoft Outlook from all of your PCs, and use an alternate e-mail client.  Even better, get rid of Exchange Server, too,and use a different e-mail server.  All of those Outlook-enabled viruses will be stopped dead at the first infected PC, and the loss to your enterprise will be minimal.]]></description>
        <guid><![CDATA[http://www.techrepublic.com/forum/discussions/15-111249-667925]]></guid>
        <dc:creator><![CDATA[the docman]]></dc:creator>
        <pubDate>Sun, 17 Nov 2002 21:07:55 -0800</pubDate>
    </item>
             

    <item>
        <title><![CDATA[There aught to be a way!]]></title>
        <link><![CDATA[http://www.techrepublic.com/forum/discussions/15-111249-667922]]></link>
        <description><![CDATA[THere aught to be a way in windows 2000 to prevent software installation. Using group policy you can do lots of stuff, hide the run line, hide explorer, prevent the msi installer from running etc, but none of that prevents the user from clicking on some url that says &quot;Hey, would you like me to install some unlicensed software and potentialy put your network at risk?&quot; Why isnt there a gpo that says &quot;disallow installation of any software&quot;... or is there and I have just missed it?]]></description>
        <guid><![CDATA[http://www.techrepublic.com/forum/discussions/15-111249-667922]]></guid>
        <dc:creator><![CDATA[1ronman]]></dc:creator>
        <pubDate>Sun, 17 Nov 2002 20:56:25 -0800</pubDate>
    </item>
             

    <item>
        <title><![CDATA[Virus Protection]]></title>
        <link><![CDATA[http://www.techrepublic.com/forum/discussions/15-111249-667728]]></link>
        <description><![CDATA[In a corporate environment a Gateway to Desktop AV solution must be used. There should not need to be any discussion on this! Protecting workstations and e-mail, but not having a Gateway product in place is living in a fool's paradise.Also requiring your users to update their own AV patterns is tantamount to giving them the keys to your server room (it is locked up isn't it?). A corporate AV solutions must automatically download the latest pattern, preferably every 5 hours or so to check if anew one exists, and then force/push the update onto the workstations and all other AV devices. There is no excuse in saying &quot;My desktop pattern is out of date&quot;!The scum who write viruses are usually adept at social engineering. No matter how oftenyou tell a user not to open mail from someone they don't know, they will still open the message that tells them &quot;I love you&quot; when it comes in from one of their own friends.Antivirus protection is all about removing the responsiblilty from the end user and implimenting a totally automatic and all encompassing AV solution.]]></description>
        <guid><![CDATA[http://www.techrepublic.com/forum/discussions/15-111249-667728]]></guid>
        <dc:creator><![CDATA[Joanne Lowery]]></dc:creator>
        <pubDate>Sun, 17 Nov 2002 13:18:38 -0800</pubDate>
    </item>
             

    <item>
        <title><![CDATA[AV Instal with Outdated Signatures - Doh]]></title>
        <link><![CDATA[http://www.techrepublic.com/forum/discussions/15-111249-667726]]></link>
        <description><![CDATA[How many times have you downloaded an AV program from and checked after installation to find the signatures files are way out of date.Has me puzzled. Why would you not either include latest signatures or at minimum automatically invoke an immediate update.Seems simple from my side of the fence.]]></description>
        <guid><![CDATA[http://www.techrepublic.com/forum/discussions/15-111249-667726]]></guid>
        <dc:creator><![CDATA[Swiftos]]></dc:creator>
        <pubDate>Sun, 17 Nov 2002 13:02:01 -0800</pubDate>
    </item>
             

    <item>
        <title><![CDATA[Managed Norton Antivirus]]></title>
        <link><![CDATA[http://www.techrepublic.com/forum/discussions/15-111249-667082]]></link>
        <description><![CDATA[Was a great thing at my last position.  On an NT network we pushed new virus definitions to all clients on a constant basis.  A word of warning however... there is a difference in when Norton Live Update definitions are updated and when Intelligent updater definitions are out.  Live Update is normally updated on a weekly basis except for emergencies while Intelligent Updater has new definitions an almost daily basis.]]></description>
        <guid><![CDATA[http://www.techrepublic.com/forum/discussions/15-111249-667082]]></guid>
        <dc:creator><![CDATA[jim.pollard@...]]></dc:creator>
        <pubDate>Fri, 15 Nov 2002 05:15:45 -0800</pubDate>
    </item>
             

    <item>
        <title><![CDATA[Through]]></title>
        <link><![CDATA[http://www.techrepublic.com/forum/discussions/15-111249-667053]]></link>
        <description><![CDATA[There is sure to be more than one way to implement security.  Though I'm not about to put-down this effort.  I have no doubt, that their will be incresing levels of security.  However, this story shows that social enginering was the 'let-down' in security.We know how users become upset when their internet privledges are stoped, so I think that staff sould be warned that new security is about to be implemented, and why.Security works best, when all the users are involved.]]></description>
        <guid><![CDATA[http://www.techrepublic.com/forum/discussions/15-111249-667053]]></guid>
        <dc:creator><![CDATA[kiwimagic]]></dc:creator>
        <pubDate>Fri, 15 Nov 2002 04:43:50 -0800</pubDate>
    </item>
    </channel>
</rss>

