The Six Dumbest Ideas in Computer Security

at the end of the day, no one is talking about the would be decompiler who uses techniques that are already in use (port scanning, decompiling, spoofing...) At the end of the day it won't work and will just cost a lot of money.

I agree with your ms comment incidentally.

and given any sort of choice will continue to do so.
I can understand providing .net, they've done their version of C++ for a while and C# even seems a reasonable commercial venture. Why they re-wrote the IDE in C++ , I haven't a clue, my suspicion is someone in charge had a lobotomy. Equally the decision to maintain all the development environments through one IDE, shows a total lack of brains, that was the decision of a complete moron. We have foind a few twiidles here and there but the damn thing takes nearly two minutes to load, I took the lid off my PC to make sure someone hadn't took the memory out of it.
On top of that been doing a little work at home and just lost the last forty minutes work in patches over eight code files. So now I'm chatting away and partaking of a malt or three. **** work.

you lost work because of the danged thing?

send 'em a bill for faulty app. ;)

Pretty well all systems are dumb. A hack-proof system is by its own label/definition hack-proof. You can not convert an imperfect system into a hack-proof system by hacking it; you can only eliminate the bug of the day. That is one of the points of this article.

This article describes incredible data breaches in so-called secure networks, which demonstrates an incomplete understanding of what security is really supposed to be:

So You Think Your Data Is Secure?

http://www.computerworld.com/securitytopics/security/story/0,10801,103869,00.html

I have, unfortunately, had mixed results with educating users. Some years ago, we worked with everyone in the company to try to make them concerned with password security. A few weeks after the last of the classes, we ran a test. We sent out an e-mail purporting to come from a new system administrator. In essence, it said

Hi, I've just started as a computer administrator here at . In order for me to keep the records up-to-date, please give me the following:
ID:

Mainframe system(s):

Mainframe password:

Unix systems(s):

Unix password:

E-mail password:

In our company, each user has a unique ID which is the same for mainframe, Unix, or e-mail. (Or the NT LAN, but the password for that is the same as the e-mail password.) Thus, Joe Bloggs would be "jbloggs" no matter where he logged in. BTW, Unix administration, mainframe administration, and e-mail administration are handled by three completely different groups.

Out of 2400 users, sixteen sent in their passwords, one department head not only e-mailed his password, but also clicked on "Reply to all", so every user in the company got his message, and 627 people called either the help desk or the security group to complain that someone was trying to get their passwords.

..and the solution that worked for many with your problem is to simply get a really fast machine with plenty of RAM (1 or 2 GB) for development. Also, ensure that the you are working on a 'clean' machine, ie. without much un-necessary software installed.

Cheers,
Steve

I almost need a manual to decypher some newer TV remote controls. Computers and software are extremly complex and that complexity requires knowledge and understanding to use. I don't think computers could ever have been as easy to use as the older TV or telephone systems were because computers are simply 1,000 times more complex.

Bill Dewey

How do you determine which programs are "Good"? How easy would it be to add a program to this list? There are a number of viruses that hide themselves from antivirus programs (without the proper patch), so I don't see a virus having a problem adding it's self to a good list. Then there are the viruses that overwrite DLL's of valid programs. What about Word and excel exploits? Those types of programs are going to be apart of every accept list.

Bill Dewey

Native code == everyone has to have the code beforehand. How would Microsoft, or any other software distributor know ahead of time that you might want to watch Elf bowling? Wether you accept it or not, email is a very flexible way of distributing programs.

Server side execution == enlarged IT infrastructure and less meaningful access to your own system (i.e. the exact same file level access you are trying to avoid).

Now, I am not arguing that a completely flexible approach provides any security. On the contrary, I believe it occupies the opposite end of the spectrum. An engineer's problem is to balance and maximize security and flexibility to the level appropriate for the system.

Microsoft's or any other distributor's failure to balance, or maximize security and flexibility may constitute bad design, but it does not change the underlying dynamic I am discussing.

Allowing for things like watching elf bowling is fine. Allowing for things like remote execution of elf bowling code is not so fine. Allowing for things like accessing privileged system internals by way of remote execution of elf bowling code is even less fine.

I've yet to see anything ActiveX can do that you can't do without it (or something like it), excepting the manner in which it allows you to completely bypass almost all security controls without trying.

We already have all of that information, so you don't need to do anything but watch out your window.

I can't believe you wore THAT to work today.....

that is why I stated "limits" instead of "stops".

It is a start and of course anyone that surfs regularly with ActiveX/java/scripting in full swing DESERVES to have to format their system a few times a year.

It blows my mind that cable companies haven't started selling or leasing a cable router to protect the home users! Makes their system work better for the user AND adds another "service" they can soak people for!

I think my reason for pointing the article out was missed.

I firmly believe we should here NEW ideas all the time, not just the ones that agree with what we already think.

Remember the old "no stupid questions" rule? That is why in Brain Storming sessions NOTHING is evaluated or discounted until after the collection time is done. Sure, some ideas are not very good, but a "bad" idea will get someone else think of why the idea is bad and how to make it a GREAT idea. None would have happened if the first "Bad" idea wasn't thrown into the discussion in the first place.

Not to mention, many inventions are done by MISTAKE.

If more people start to question the "chase your tail" mentality we are all stuck in, someone WILL come up with that solution.

And for the same reason Windows is so easy to be compromised, a vanilla config is just BEGGING for trouble.

We need to expect MORE from software vendors.

...are the authors.

Well, his concept of focusing on only allowing permitted apps to run is well put, but is not the total answer to security.

The reality is that no network is hacker proof...period. There are too many flaws in the apps, in the os, and in the CPU instruction sets.

Real elite hackers don't pay much attention to vulnerability notices...they already know about them. Elite hackers don't publish their exploits...only script kiddy n00bs go for that lame stuff.

How do you patch for a invalid CPU instruction that when passed through a CPU causes it to crash? The faulty code is in the silicon. No cpu as of yet has error code handling implemented. The cpu has a finite number of instructions in its set, and all other permutations are invalid and can cause the cpu to do some weird stuff.

There are hundreds of 'cool' or 'fun' apps that a family WILL install in a given year, AND that they will update / patch / and 'enhance' w/ dozens of add-ons. This is over a 1000. And since newer versions of these come out annually, we well over several tens of thousands of "good" apps, too. Effort wise, it is better for a family to pay $30 USD for up to date virus definitions...

A business may have less than a 1000 processes to keep track of; but that is not true of average families.

I?m a consultant working with Palo Alto Networks; they have an excellent whitepaper on the subject of blocking social networking apps that you may have to worry about, ?To Block or Not. Is that the question?? here: http://bit.ly/d2NZRp. It has lots of insightful and useful information about identifying and controlling Enterprise 2.0 apps (Facebook, Twitter, Skype, etc.) Let me know what you think.
kelly@briefworld.com