Re: On the subject of security...
Sorry for the delay - many balls in the air... On Thu, Apr 18, 2013 at 5:11 AM, Ben Scott mailvor...@gmail.com wrote: On Thu, Apr 18, 2013 at 12:53 AM, Kurt Buff kurt.b...@gmail.com wrote: Not that they're equivalent in power, but that each kind of account can do and has access is different and equally valuable. For the typical home user, which is what that comic is focused on[1], not so much. Root/Administrator is valuable because it can subvert the protections on, or directly access, the data that end-user accounts have, and end-user accounts because that's the actual money/IP resides. And for a home PC *THERE IS ONLY ONE USER*. [1] Note what's in the bubbles around the edges. Yes, I noted the bubbles. But a), even for home users, while there might be only one user, there should be *at least* n+1 users, where n is the number of individuals who actually use the machine, plus an administrator account ... You're still steadfastly refusing to go near the point. But, the multi-user at home question is a valid one, and involves a previously unstated assumption on both your part and mine. I've been assuming dedicated personal hardware, because I know Randall has no children, is unmarried, and referred to his laptop, which is a dedicated personal machine. So, my assumption is n=1. With that in mind: Your statement about how an admin account can access the data of other user accounts goes directly to the heart of the problem Munroe is describing: The only other user account is Randall's. The only data is the data in Randall's user account. This doesn't make the admin account worthless, because breaking into the admin account would enable breaking into Randall's user account. But it does mean breaking into the one is roughly equivalent to breaking into the other, in either direction. A lot of people/security design treats the admin account a uniquely high-value asset, even in this scenario, which is a fallacy. And this scenario may well be the most common scenario, although I lack the data to make that determination. No, I don't agree here. Breaking into one account is definitely not the rough equivalent of breaking into the other, or at least it shouldn't be. Each must be protected (in many, but not all of, the same ways), and each should be used only in ways that are germane to its function. The user account shouldn't be used for anything but user-type activities, not admin-type activities, and vice versa. ... given all of those bubbles, the end user is in a threat-rich environment, so must exercise the vigilance techniques I and others have described/prescribed, if they care about their data, privacy and finances. True but unremarkable. Specifically: Not anything have to do with the comic. You keep launching into this list of unrelated techniques like it has anything to do with the discussion. I could talk about DoD personnel security requirements, but it wouldn't be particularly pertinent. I think it has everything to do with the comic, or at least my understanding of the comic. What I'm reading from it is that he's using poor web browsing techniques, and not protecting his personal data via the mechanisms I've outlined, including different IDs and passwords (and even different browsers) for different web sites, etc. Perhaps you have a different understanding of the meaning of that comic - if so, please provide me with illumination. Kurt ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/ ~ --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to listmana...@lyris.sunbeltsoftware.com with the body: unsubscribe ntsysadmin
Re: On the subject of security...
On Wed, Apr 17, 2013 at 7:52 PM, Ken Schaefer k...@adopenstatic.com wrote: -Original Message- From: Kurt Buff [mailto:kurt.b...@gmail.com] Subject: Re: On the subject of security... No running executables from untrusted sources, turn off scripting in my browsers, view all email as plain text, no remembering/caching of passwords in browsers, using a unique password per web site and per other accounts, regular clearing of cookies, no linking of accounts between web sites, running current AV, no browsing with elevated accounts, laptops have full disk encryption, etc., etc., etc. Without an evaluation of risks, this would be a complete waste of time for most people IMHO. Sure - if you don't browse the Internet, share USB sticks, etc., you probably don't need to do those things. But I do browse the internet, and I do share USB sticks. Yet I don't do most of what you list above. Everything is about /management/ of risk, not 99.99% avoidance of risk. You manage risk by taking countermeasures, I believe, not by ignoring them. To me, your approach sounds like ignoring, not managing. But, as you point out, it's a matter of what makes you comfortable. Just as people don’t live in impenetrable fortresses, and keep their money in Fort Knox, it's not actually necessary (or even desirable IMHO) to do some of things you do to have an acceptable level of risk. The marginal benefit from each additional step you are taking vs. the cost to usability and time taken isn't worth it (again, IMHO) Well, yes, of course. My firearms are in a safe, and so are my most valuable, irreplaceable papers - which are just about none. I run as an admin on my personal machine. I don't bother reading all mail in plain text, and I don’t full disk encrypt all my machines, and I don't clear my cookies. I've got better things to do with my time, and if I focus on protecting my identity and data instead, I'm probably just as likely as you to be safe. So, care to share how you protect your identity and data without any technologies or processes? Let's be clear - I'm not saying I have no technology, and my strategy is to rely on magic. I start by worrying about what my family needs/wants to be able to do, and then what apps and data we need to do it, and then work out what the threats/risks are. You can draw a parallel to business - info - technology architecture from TOGAF or similar framework if you want. Malware and hackers getting into my home network is probably about half-way down the list at the moment. Additionally, instead of inconveniencing end users with restrictions on either user experience, I want technology to work in the background to protect us (if possible). So, we use 802.1x for our wireless since we're all on an AD domain, and SOHO APs all support it now (there's a guest wireless network for visitors), and I use centralised malware scanning on the Exchange server. I'm researching some options for outsourcing the malware/junk scanning for incoming (it's a pity that Postini doesn't seem to be available anymore) But things I worry about more are hardware failure, lightning strikes (had two of those in two different homes), being burgled, having a fire or something else similar that destroys things. The information I worry about protecting isn't just what's electronic/digital, but also paper records, passports, birth certificates and so on. So, it's starting from a different starting point. It's not starting from you should encrypt your disk, delete your cookies, run as a non-admin. It's starting from what types of critical/important/throw-away data do I have in order to live/work/interact with friends, and then what are the risks to that data, and what can I do about it. And weigh all that against usability So, I'm not particularly worried about someone getting access to the password for the media centre PC's default user account. I'm more worried about that account somehow getting logged out, and whoever is using our media centre not being able to log back in again. I mitigate the risk of people knowing the password doing something bad by restricting what that account is allowed to do. Likewise I want to be able to share things with my family overseas, bank online and do various other things - at the same time without impacting my user experience significantly, so I take other measures to help reduce risk: I get notifications for purchases on my CCs over a certain amount. Most of my banks require (or at least offer) 2FA for authentication now. Etc. While I agree that the account(s) on your media server aren't a big deal, that's only to the extent that they don't have the same passwords as accounts on other machines, or have access to valuable data elsewhere. 2FA is good for your financial accounts, and also good backups and physical protection - all of which I strive for as well. I've had my
RE: On the subject of security...
-Original Message- From: Kurt Buff [mailto:kurt.b...@gmail.com] Subject: Re: On the subject of security... Everything is about /management/ of risk, not 99.99% avoidance of risk. You manage risk by taking countermeasures, I believe, not by ignoring them. Where do you get this framework from? Most risk management people I've talked to would say that all the below are legitimate responses to risks a) mitigate b) transfer c) accept d) avoid OTOH, I think you seriously underestimate the risks of web browsing to your finances, identity and reputation, and also the costs of repairing them. OK - please educate us on these risks and costs. My understanding is that most fraud and identity theft occurs offline. Secondly some of the things you do (like encrypt drives) aren't going to help with dangerous web browsing habits. So, what's the real risks of browing the web? I've never seen any real research on this. Cheers Ken ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/ ~ --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to listmana...@lyris.sunbeltsoftware.com with the body: unsubscribe ntsysadmin
RE: On the subject of security...
-Original Message- From: Kurt Buff [mailto:kurt.b...@gmail.com] Subject: Re: On the subject of security... I think it has everything to do with the comic, or at least my understanding of the comic. What I'm reading from it is that he's using poor web browsing techniques, and not protecting his personal data via the mechanisms I've outlined, including different IDs and passwords (and even different browsers) for different web sites, etc. Perhaps you have a different understanding of the meaning of that comic - if so, please provide me with illumination. The text in the comic does state if someone steals my computer whilst I am logged in...” in which case, disk encryption, multiple passwords, multiple browsers etc. would mostly be useless – the assumption being that the user is logged into these sites or apps already. I think explainxkcd.com does a good job of explaining the comic (emphasis added): http://www.explainxkcd.com/wiki/index.php?title=1200 quote Computer operating systems were initially written for the business environment. Thus they were made to be accessible to multiple employees, or users, but only fully accessible to administrators (or admins). Regular users can access and use programs on the computer, but only the admin is allowed to make changes to how the computer runs. This same split level of security continues to this day, even in privately owned, or home, computers. The joke here is that the most important things on a computer are no longer the programs that it runs, but the private personal data it accesses (usually online). Anyone who wished to do real mischief on an active computer could do considerable damage without ever caring what the admin password was. The admin password, in effect, now guards a vault no one cares about. This comic pokes fun at the authorization mechanisms surrounding most operating systems' administrator accounts. It makes the argument that the user's data is more valuable than the integrity of the system. (This is arguably true for most personal systems, although it is probably not true in a shared-server setup, where a system compromise could lead to the exposure of many users' data.) Essentially, once a user is logged in, he or she can typically access all of his or her data without any further restriction. Modifying the operating system (for example, to install drivers) requires a separate password. /quote ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/ ~ --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to listmana...@lyris.sunbeltsoftware.com with the body: unsubscribe ntsysadmin
Re: On the subject of security...
On Thu, Apr 18, 2013 at 12:53 AM, Kurt Buff kurt.b...@gmail.com wrote: Not that they're equivalent in power, but that each kind of account can do and has access is different and equally valuable. For the typical home user, which is what that comic is focused on[1], not so much. Root/Administrator is valuable because it can subvert the protections on, or directly access, the data that end-user accounts have, and end-user accounts because that's the actual money/IP resides. And for a home PC *THERE IS ONLY ONE USER*. [1] Note what's in the bubbles around the edges. Yes, I noted the bubbles. But a), even for home users, while there might be only one user, there should be *at least* n+1 users, where n is the number of individuals who actually use the machine, plus an administrator account ... You're still steadfastly refusing to go near the point. But, the multi-user at home question is a valid one, and involves a previously unstated assumption on both your part and mine. I've been assuming dedicated personal hardware, because I know Randall has no children, is unmarried, and referred to his laptop, which is a dedicated personal machine. So, my assumption is n=1. With that in mind: Your statement about how an admin account can access the data of other user accounts goes directly to the heart of the problem Munroe is describing: The only other user account is Randall's. The only data is the data in Randall's user account. This doesn't make the admin account worthless, because breaking into the admin account would enable breaking into Randall's user account. But it does mean breaking into the one is roughly equivalent to breaking into the other, in either direction. A lot of people/security design treats the admin account a uniquely high-value asset, even in this scenario, which is a fallacy. And this scenario may well be the most common scenario, although I lack the data to make that determination. ... given all of those bubbles, the end user is in a threat-rich environment, so must exercise the vigilance techniques I and others have described/prescribed, if they care about their data, privacy and finances. True but unremarkable. Specifically: Not anything have to do with the comic. You keep launching into this list of unrelated techniques like it has anything to do with the discussion. I could talk about DoD personnel security requirements, but it wouldn't be particularly pertinent. -- Ben ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/ ~ --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to listmana...@lyris.sunbeltsoftware.com with the body: unsubscribe ntsysadmin
Re: On the subject of security...
Generally, I agree with your point. Risk management is a holistic endeavor, and when we forget that, we get hung up on technicalities that don't help us achieve the end goal. Protecting root access in a system does have some value when it comes to persistence of malware. Malware that is confined to userland is easier to detect and uproot than malware that makes it to a deeper level. Your key point about the safety of data in userland cannot be denied, however. But, it's not like there aren't tools for that -- it's just that people are as annoyed about using them as they are with UAC, etc. Example: Too many people share passwords across multiple systems/services. These same people tend not to use password managers. The use of the latter would go a long way to curtailing the mistake of doing the former. Similarly, very few people who could benefit from it actually bother to use encryption. I think that the bigger problem is that most people don't realize the importance and criticality of their data until it is lost... *ASB **http://XeeMe.com/AndrewBaker* http://xeeme.com/AndrewBaker* **Providing Virtual CIO Services (IT Operations Information Security) for the SMB market…*** On Wed, Apr 17, 2013 at 3:27 PM, Ben Scott mailvor...@gmail.com wrote: On Wed, Apr 17, 2013 at 2:43 PM, Michael B. Smith mich...@smithcons.com wrote: IOW: Security is for the MANAGEMENT of risk and MITIGATION of same. For real world systems, and usage of them, there is no such thing as perfect security. That's true, too, but the point Munroe is trying to make is that a lot of people lose track of the forest for the trees. They get so caught up in protecting the computer that they forget why they're protecting it. On my home PC, most of the the software I use is free and unremarkable. I could rebuild the software configuration from scratch in a matter of hours. Why do I care about protecting *that*? I don't. I want to protect my photos, files, bank account, Facebook account, etc., etc. All of which are tied into my user account and who-knows-how-many third-party web sites. They don't much care about my admin account. But a lot of computer security people focus on protecting the system privileged account. For example, I've gotten into strong arguments with *nix weenies about how protecting the root account is the most important thing on a system, and that's the fundamental flaw in Microsoft Windows, or some such thing. They don't get that the data in my user account is a lot more valuable than the software install. They don't get that a worm can propagate from my user account just as easily. And as I'm the only user of my home PC, I'm not even protecting other users from me. Yah, I protect the root account, but only as a means to helping protect the stuff I care about. I've had the exact same discussion about Windows and UAC. On this forum, in fact. If UAC works perfectly, it successfully protects an admin account on a throw-away home PC with one user. Meanwhile, the malware is quite content to delete/steal all the user's data from userland, and then propagate to other PCs, again from userland. It's mildly useful in helping prevent a reinstall of a bunch of software, but that's not the high value asset. (Protecting system access is rather more relevant in business, where you've got more than one level of privilege.) -- Ben ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/ ~ --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to listmana...@lyris.sunbeltsoftware.com with the body: unsubscribe ntsysadmin ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/ ~ --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to listmana...@lyris.sunbeltsoftware.com with the body: unsubscribe ntsysadmin
Re: On the subject of security...
Ah, but Ken, you've done a risk assessment. :) Without one, there is no way to know what your status is, and what steps should be taken (or avoided) to make it better. This is just as true for consumers as for corporations, and often just as ignored. *ASB **http://XeeMe.com/AndrewBaker* http://xeeme.com/AndrewBaker* **Providing Virtual CIO Services (IT Operations Information Security) for the SMB market…*** On Wed, Apr 17, 2013 at 7:29 PM, Ken Schaefer k...@adopenstatic.com wrote: -Original Message- From: Kurt Buff [mailto:kurt.b...@gmail.com] Sent: Thursday, 18 April 2013 6:08 AM To: NT System Admin Issues Subject: Re: On the subject of security... If that's the case, then he didn't make his point at all clear. ... True again - and again unremarkable. My point is that you have to use the same methods to protect unprivileged accounts as you do root/administrator. ... That's the import of my remarks about screensavers, FDE, not caching passwords for web sites in browsers, etc. - it's all about protecting the data; that which resides on the machine, and that which resides on teh intarwebs. If anyone's being unclear here, I think it's you. My reading of your comments is that a lot of your suggestions are geared towards preventing access to the system. All your suggestions about encrypting disks, having screen savers etc. are overkill if all my data is burnt to CDs. I'm better off investing in a safe to house them. Additionally, if my only PC is the one sitting in my living room, then when someone has got access to that machine (by breaking into my house), then a lack of password protected screensaver, or the fact that the password to the machine is on the bottom of the keyboard, is probably the least of my problems. Security is about managing risk: identify what the threats are, and the mitigate, transfer, accept etc. Security is not a checklist of technologies and processes. I protect all of my accounts, privileged or not, in the same ways, and have been doing so for so long that it's completely natural to me. It just feels unnatural not to do so. No running executables from untrusted sources, turn off scripting in my browsers, view all email as plain text, no remembering/caching of passwords in browsers, using a unique password per web site and per other accounts, regular clearing of cookies, no linking of accounts between web sites, running current AV, no browsing with elevated accounts, laptops have full disk encryption, etc., etc., etc. Without an evaluation of risks, this would be a complete waste of time for most people IMHO. I run as an admin on my personal machine. I don't bother reading all mail in plain text, and I don’t full disk encrypt all my machines, and I don't clear my cookies. I've got better things to do with my time, and if I focus on protecting my identity and data instead, I'm probably just as likely as you to be safe. Cheers Ken ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/ ~ --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to listmana...@lyris.sunbeltsoftware.com with the body: unsubscribe ntsysadmin ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/ ~ --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to listmana...@lyris.sunbeltsoftware.com with the body: unsubscribe ntsysadmin
Re: On the subject of security...
On Thu, Apr 18, 2013 at 11:16 AM, Andrew S. Baker asbz...@gmail.com wrote: Protecting root access in a system does have some value when it comes to persistence of malware. Malware that is confined to userland is easier to detect and uproot than malware that makes it to a deeper level. There is certainly some value to the admin account, even on a single-user dedicated device. I certainly don't advocate ignoring that. :-) I think that the bigger problem is that most people don't realize the importance and criticality of their data until it is lost... No argument there. For that matter: s/their data/anything/ -- Ben ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/ ~ --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to listmana...@lyris.sunbeltsoftware.com with the body: unsubscribe ntsysadmin
Re: On the subject of security...
On Wed, Apr 17, 2013 at 1:59 AM, James Rankin kz2...@googlemail.com wrote: ...today's XKCD sums it up nicely http://xkcd.com/1200/ So, yeah, that's true if you don't use full disk encryption, or a password on your computer/domain account and a locked screensaver with a reasonable timeout, and if you have your browser save your password for all of your web sites, or have them in a text file on your desktop, or similar ridiculous practices. Oh, yeah - you should also turn off your 1394 port in BIOS. Kurt ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/ ~ --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to listmana...@lyris.sunbeltsoftware.com with the body: unsubscribe ntsysadmin
Re: On the subject of security...
On Wed, Apr 17, 2013 at 2:29 PM, Kurt Buff kurt.b...@gmail.com wrote: On Wed, Apr 17, 2013 at 1:59 AM, James Rankin kz2...@googlemail.com wrote: ...today's XKCD sums it up nicely http://xkcd.com/1200/ So, yeah, that's true if you don't use full disk encryption, or a password on your computer/domain account ... You're missing the point. A lot of devs and admins fall into the trap of protecting the system and forgetting that there's a reason why we have the system in the first place. I ultimately don't care about my root account. Protecting it is just a means to an end -- protecting my data, most of which lives in my user account. -- Ben ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/ ~ --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to listmana...@lyris.sunbeltsoftware.com with the body: unsubscribe ntsysadmin
Re: On the subject of security...
On Wed, Apr 17, 2013 at 11:36 AM, Ben Scott mailvor...@gmail.com wrote: On Wed, Apr 17, 2013 at 2:29 PM, Kurt Buff kurt.b...@gmail.com wrote: On Wed, Apr 17, 2013 at 1:59 AM, James Rankin kz2...@googlemail.com wrote: ...today's XKCD sums it up nicely http://xkcd.com/1200/ So, yeah, that's true if you don't use full disk encryption, or a password on your computer/domain account ... You're missing the point. A lot of devs and admins fall into the trap of protecting the system and forgetting that there's a reason why we have the system in the first place. I ultimately don't care about my root account. Protecting it is just a means to an end -- protecting my data, most of which lives in my user account. No, I'm not missing the point. Protecting the end-user account and its data is what those techniques are for - and they also need to be applied to the root/administrator account. Kurt ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/ ~ --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to listmana...@lyris.sunbeltsoftware.com with the body: unsubscribe ntsysadmin
RE: On the subject of security...
IOW: Security is for the MANAGEMENT of risk and MITIGATION of same. For real world systems, and usage of them, there is no such thing as perfect security. -Original Message- From: Ben Scott [mailto:mailvor...@gmail.com] Sent: Wednesday, April 17, 2013 2:36 PM To: NT System Admin Issues Subject: Re: On the subject of security... On Wed, Apr 17, 2013 at 2:29 PM, Kurt Buff kurt.b...@gmail.com wrote: On Wed, Apr 17, 2013 at 1:59 AM, James Rankin kz2...@googlemail.com wrote: ...today's XKCD sums it up nicely http://xkcd.com/1200/ So, yeah, that's true if you don't use full disk encryption, or a password on your computer/domain account ... You're missing the point. A lot of devs and admins fall into the trap of protecting the system and forgetting that there's a reason why we have the system in the first place. I ultimately don't care about my root account. Protecting it is just a means to an end -- protecting my data, most of which lives in my user account. -- Ben ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/ ~ --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to listmana...@lyris.sunbeltsoftware.com with the body: unsubscribe ntsysadmin
Re: On the subject of security...
On Wed, Apr 17, 2013 at 2:42 PM, Kurt Buff kurt.b...@gmail.com wrote: http://xkcd.com/1200/ So, yeah, that's true if you don't use full disk encryption, or a You're missing the point. No, I'm not missing the point. Well, then, you're apparently choosing not to discuss it, then. For an email conversation, they're equivalent. -- Ben ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/ ~ --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to listmana...@lyris.sunbeltsoftware.com with the body: unsubscribe ntsysadmin
Re: On the subject of security...
On Wed, Apr 17, 2013 at 2:43 PM, Michael B. Smith mich...@smithcons.com wrote: IOW: Security is for the MANAGEMENT of risk and MITIGATION of same. For real world systems, and usage of them, there is no such thing as perfect security. That's true, too, but the point Munroe is trying to make is that a lot of people lose track of the forest for the trees. They get so caught up in protecting the computer that they forget why they're protecting it. On my home PC, most of the the software I use is free and unremarkable. I could rebuild the software configuration from scratch in a matter of hours. Why do I care about protecting *that*? I don't. I want to protect my photos, files, bank account, Facebook account, etc., etc. All of which are tied into my user account and who-knows-how-many third-party web sites. They don't much care about my admin account. But a lot of computer security people focus on protecting the system privileged account. For example, I've gotten into strong arguments with *nix weenies about how protecting the root account is the most important thing on a system, and that's the fundamental flaw in Microsoft Windows, or some such thing. They don't get that the data in my user account is a lot more valuable than the software install. They don't get that a worm can propagate from my user account just as easily. And as I'm the only user of my home PC, I'm not even protecting other users from me. Yah, I protect the root account, but only as a means to helping protect the stuff I care about. I've had the exact same discussion about Windows and UAC. On this forum, in fact. If UAC works perfectly, it successfully protects an admin account on a throw-away home PC with one user. Meanwhile, the malware is quite content to delete/steal all the user's data from userland, and then propagate to other PCs, again from userland. It's mildly useful in helping prevent a reinstall of a bunch of software, but that's not the high value asset. (Protecting system access is rather more relevant in business, where you've got more than one level of privilege.) -- Ben ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/ ~ --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to listmana...@lyris.sunbeltsoftware.com with the body: unsubscribe ntsysadmin
Re: On the subject of security...
On Wed, Apr 17, 2013 at 12:06 PM, Ben Scott mailvor...@gmail.com wrote: On Wed, Apr 17, 2013 at 2:42 PM, Kurt Buff kurt.b...@gmail.com wrote: http://xkcd.com/1200/ So, yeah, that's true if you don't use full disk encryption, or a You're missing the point. No, I'm not missing the point. Well, then, you're apparently choosing not to discuss it, then. For an email conversation, they're equivalent. -- Ben As you wish, Buttercup. ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/ ~ --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to listmana...@lyris.sunbeltsoftware.com with the body: unsubscribe ntsysadmin
Re: On the subject of security...
On Wed, Apr 17, 2013 at 12:27 PM, Ben Scott mailvor...@gmail.com wrote: On Wed, Apr 17, 2013 at 2:43 PM, Michael B. Smith mich...@smithcons.com wrote: IOW: Security is for the MANAGEMENT of risk and MITIGATION of same. For real world systems, and usage of them, there is no such thing as perfect security. That's true, too, but the point Munroe is trying to make is that a lot of people lose track of the forest for the trees. They get so caught up in protecting the computer that they forget why they're protecting it. If that's the case, then he didn't make his point at all clear. On my home PC, most of the the software I use is free and unremarkable. I could rebuild the software configuration from scratch in a matter of hours. Why do I care about protecting *that*? I don't. I want to protect my photos, files, bank account, Facebook account, etc., etc. All of which are tied into my user account and who-knows-how-many third-party web sites. They don't much care about my admin account. True, and unremarkable. But a lot of computer security people focus on protecting the system privileged account. For example, I've gotten into strong arguments with *nix weenies about how protecting the root account is the most important thing on a system, and that's the fundamental flaw in Microsoft Windows, or some such thing. They don't get that the data in my user account is a lot more valuable than the software install. They don't get that a worm can propagate from my user account just as easily. And as I'm the only user of my home PC, I'm not even protecting other users from me. Yah, I protect the root account, but only as a means to helping protect the stuff I care about. True again - and again unremarkable. My point is that you have to use the same methods to protect unprivileged accounts as you do root/administrator. Not that they're equivalent in power, but that each kind of account can do and has access is different and equally valuable. Root/Administrator is valuable because it can subvert the protections on, or directly access, the data that end-user accounts have, and end-user accounts because that's the actual money/IP resides. That's the import of my remarks about screensavers, FDE, not caching passwords for web sites in browsers, etc. - it's all about protecting the data; that which resides on the machine, and that which resides on teh intarwebs. Kurt ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/ ~ --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to listmana...@lyris.sunbeltsoftware.com with the body: unsubscribe ntsysadmin
Re: On the subject of security...
On Wed, Apr 17, 2013 at 4:07 PM, Kurt Buff kurt.b...@gmail.com wrote: On Wed, Apr 17, 2013 at 12:27 PM, Ben Scott mailvor...@gmail.com wrote: On Wed, Apr 17, 2013 at 2:43 PM, Michael B. Smith mich...@smithcons.com wrote: IOW: Security is for the MANAGEMENT of risk and MITIGATION of same. For real world systems, and usage of them, there is no such thing as perfect security. That's true, too, but the point Munroe is trying to make is that a lot of people lose track of the forest for the trees. They get so caught up in protecting the computer that they forget why they're protecting it. If that's the case, then he didn't make his point at all clear. It was pretty clear to me, and coincidentally (or not!) his image looks like a tree. Nevermind the fact that most professionals are saying don't run as admin. OK, so they're not. Does that mean they are protected? Protected from what? Not getting a more pervasive infection, sure. But malware writers are dropping the .exe's in userland and doing stuff with the data they access. How do you protect that data, when the person who's been infected, is the person who needs access to the data? Thought it was pretty clear, to be honest. ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/ ~ --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to listmana...@lyris.sunbeltsoftware.com with the body: unsubscribe ntsysadmin
Re: On the subject of security...
On Wed, Apr 17, 2013 at 1:19 PM, Jonathan Link jonathan.l...@gmail.com wrote: On Wed, Apr 17, 2013 at 4:07 PM, Kurt Buff kurt.b...@gmail.com wrote: On Wed, Apr 17, 2013 at 12:27 PM, Ben Scott mailvor...@gmail.com wrote: On Wed, Apr 17, 2013 at 2:43 PM, Michael B. Smith mich...@smithcons.com wrote: IOW: Security is for the MANAGEMENT of risk and MITIGATION of same. For real world systems, and usage of them, there is no such thing as perfect security. That's true, too, but the point Munroe is trying to make is that a lot of people lose track of the forest for the trees. They get so caught up in protecting the computer that they forget why they're protecting it. If that's the case, then he didn't make his point at all clear. It was pretty clear to me, and coincidentally (or not!) his image looks like a tree. Nevermind the fact that most professionals are saying don't run as admin. OK, so they're not. Does that mean they are protected? Protected from what? Not getting a more pervasive infection, sure. But malware writers are dropping the .exe's in userland and doing stuff with the data they access. How do you protect that data, when the person who's been infected, is the person who needs access to the data? Thought it was pretty clear, to be honest. Apparently I'm dense, then. I protect all of my accounts, privileged or not, in the same ways, and have been doing so for so long that it's completely natural to me. It just feels unnatural not to do so. No running executables from untrusted sources, turn off scripting in my browsers, view all email as plain text, no remembering/caching of passwords in browsers, using a unique password per web site and per other accounts, regular clearing of cookies, no linking of accounts between web sites, running current AV, no browsing with elevated accounts, laptops have full disk encryption, etc., etc., etc. Kurt ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/ ~ --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to listmana...@lyris.sunbeltsoftware.com with the body: unsubscribe ntsysadmin
RE: On the subject of security...
I agree, without the data you have nothing, protecting the data is what its about. Why have controls in systems if you aren't trying to protect the crown jewels which is the data in which your organization/business used to get its job/mission accomplished. Z Edward E. Ziots, CISSP, CISA, Security +, Network + Security Engineer Lifespan Organization ezi...@lifespan.org Work:401-444-9081 This electronic message and any attachments may be privileged and confidential and protected from disclosure. If you are reading this message, but are not the intended recipient, nor an employee or agent responsible for delivering this message to the intended recipient, you are hereby notified that you are strictly prohibited from copying, printing, forwarding or otherwise disseminating this communication. If you have received this communication in error, please immediately notify the sender by replying to the message. Then, delete the message from your computer. Thank you. -Original Message- From: Kurt Buff [mailto:kurt.b...@gmail.com] Sent: Wednesday, April 17, 2013 2:43 PM To: NT System Admin Issues Subject: Re: On the subject of security... On Wed, Apr 17, 2013 at 11:36 AM, Ben Scott mailvor...@gmail.com wrote: On Wed, Apr 17, 2013 at 2:29 PM, Kurt Buff kurt.b...@gmail.com wrote: On Wed, Apr 17, 2013 at 1:59 AM, James Rankin kz2...@googlemail.com wrote: ...today's XKCD sums it up nicely http://xkcd.com/1200/ So, yeah, that's true if you don't use full disk encryption, or a password on your computer/domain account ... You're missing the point. A lot of devs and admins fall into the trap of protecting the system and forgetting that there's a reason why we have the system in the first place. I ultimately don't care about my root account. Protecting it is just a means to an end -- protecting my data, most of which lives in my user account. No, I'm not missing the point. Protecting the end-user account and its data is what those techniques are for - and they also need to be applied to the root/administrator account. Kurt ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/ ~ --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to listmana...@lyris.sunbeltsoftware.com with the body: unsubscribe ntsysadmin ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/ ~ --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to listmana...@lyris.sunbeltsoftware.com with the body: unsubscribe ntsysadmin
Re: On the subject of security...
You do that. Do you enforce that down to your users? All of that? What is an untrusted source? On Wed, Apr 17, 2013 at 4:42 PM, Kurt Buff kurt.b...@gmail.com wrote: On Wed, Apr 17, 2013 at 1:19 PM, Jonathan Link jonathan.l...@gmail.com wrote: On Wed, Apr 17, 2013 at 4:07 PM, Kurt Buff kurt.b...@gmail.com wrote: On Wed, Apr 17, 2013 at 12:27 PM, Ben Scott mailvor...@gmail.com wrote: On Wed, Apr 17, 2013 at 2:43 PM, Michael B. Smith mich...@smithcons.com wrote: IOW: Security is for the MANAGEMENT of risk and MITIGATION of same. For real world systems, and usage of them, there is no such thing as perfect security. That's true, too, but the point Munroe is trying to make is that a lot of people lose track of the forest for the trees. They get so caught up in protecting the computer that they forget why they're protecting it. If that's the case, then he didn't make his point at all clear. It was pretty clear to me, and coincidentally (or not!) his image looks like a tree. Nevermind the fact that most professionals are saying don't run as admin. OK, so they're not. Does that mean they are protected? Protected from what? Not getting a more pervasive infection, sure. But malware writers are dropping the .exe's in userland and doing stuff with the data they access. How do you protect that data, when the person who's been infected, is the person who needs access to the data? Thought it was pretty clear, to be honest. Apparently I'm dense, then. I protect all of my accounts, privileged or not, in the same ways, and have been doing so for so long that it's completely natural to me. It just feels unnatural not to do so. No running executables from untrusted sources, turn off scripting in my browsers, view all email as plain text, no remembering/caching of passwords in browsers, using a unique password per web site and per other accounts, regular clearing of cookies, no linking of accounts between web sites, running current AV, no browsing with elevated accounts, laptops have full disk encryption, etc., etc., etc. Kurt ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/ ~ --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to listmana...@lyris.sunbeltsoftware.com with the body: unsubscribe ntsysadmin ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/ ~ --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to listmana...@lyris.sunbeltsoftware.com with the body: unsubscribe ntsysadmin
RE: On the subject of security...
-Original Message- From: Kurt Buff [mailto:kurt.b...@gmail.com] Sent: Thursday, 18 April 2013 6:08 AM To: NT System Admin Issues Subject: Re: On the subject of security... If that's the case, then he didn't make his point at all clear. ... True again - and again unremarkable. My point is that you have to use the same methods to protect unprivileged accounts as you do root/administrator. ... That's the import of my remarks about screensavers, FDE, not caching passwords for web sites in browsers, etc. - it's all about protecting the data; that which resides on the machine, and that which resides on teh intarwebs. If anyone's being unclear here, I think it's you. My reading of your comments is that a lot of your suggestions are geared towards preventing access to the system. All your suggestions about encrypting disks, having screen savers etc. are overkill if all my data is burnt to CDs. I'm better off investing in a safe to house them. Additionally, if my only PC is the one sitting in my living room, then when someone has got access to that machine (by breaking into my house), then a lack of password protected screensaver, or the fact that the password to the machine is on the bottom of the keyboard, is probably the least of my problems. Security is about managing risk: identify what the threats are, and the mitigate, transfer, accept etc. Security is not a checklist of technologies and processes. I protect all of my accounts, privileged or not, in the same ways, and have been doing so for so long that it's completely natural to me. It just feels unnatural not to do so. No running executables from untrusted sources, turn off scripting in my browsers, view all email as plain text, no remembering/caching of passwords in browsers, using a unique password per web site and per other accounts, regular clearing of cookies, no linking of accounts between web sites, running current AV, no browsing with elevated accounts, laptops have full disk encryption, etc., etc., etc. Without an evaluation of risks, this would be a complete waste of time for most people IMHO. I run as an admin on my personal machine. I don't bother reading all mail in plain text, and I don’t full disk encrypt all my machines, and I don't clear my cookies. I've got better things to do with my time, and if I focus on protecting my identity and data instead, I'm probably just as likely as you to be safe. Cheers Ken ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/ ~ --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to listmana...@lyris.sunbeltsoftware.com with the body: unsubscribe ntsysadmin
Re: On the subject of security...
I would enforce most of it if policy allowed, but in the absence of any written policy (which is my current situation), I can't. Were it in my power to actually set policy, things would be much different. At the very least, I'd love to be able to implement the top 4 controls - patch the OS, patch the applications, remove administrator access from end users and only allow whitelisted applications (of which we do a good job on the first, a mediocre job on the second, and get a flat failure on the last two - I'm in the process of improving the second by getting Adobe and Java patching up to speed). If I could have just those, life would be 10 times easier than it is now. All I can do is educate, and since I'm mostly limited to that, the effort is basically futile, because using the Internet for most folks is like leaving a three year old within sight of an active quarry with no fences - they don't have the skills or judgement to play safely in the field next to it and not be attracted to (or to navigate) the cliffs, ponds and heavy machinery in the quarry, because they lack the experience and and training that most of us on this list have acquired. For instance, on trusted source - I've learned that downloading software from CNET or other repositories is a great way to get pwned, yet staff keep downloading and installing random software onto machines because, well, the gods only know why, really - nothing they've ever said to me makes any sense as a reason for installing the multitudinous crap I've seen. Ditto for user interaction with any number of other sources of data, whether nominally executable or not, web sites most especially included. So, basically, any source is untrusted until I've personally vetted it, and feel comfortable with it. Likewise on leaving scripting on by default in browsers. Most commercial web sites use third party resources to track and advertise and provide rich experience. None of that is trusted until I've personally experienced it and and played with it for a while. In most cases, if the site uses its own CDN, I'll whitelist that CDN for that web site. Other than that, not so much. The best I can do when someone has a pwned machine is say sucks to be you - if you paid attention when I was talking it wouldn't have happened, then wipe their machines and let them start over, after asking them a few questions to see if I can figure out how it happened and tell them not to do that anymore - which they promptly ignore. The battle is lost - or at least it is until management says we can try to win it. The most I can safely say is that my accounts, and the computers on which I'm the sole operator, are far less likely to be compromised than end-user accounts and computers. Frustrating, but true... Kurt On Wed, Apr 17, 2013 at 3:48 PM, Jonathan Link jonathan.l...@gmail.com wrote: You do that. Do you enforce that down to your users? All of that? What is an untrusted source? On Wed, Apr 17, 2013 at 4:42 PM, Kurt Buff kurt.b...@gmail.com wrote: On Wed, Apr 17, 2013 at 1:19 PM, Jonathan Link jonathan.l...@gmail.com wrote: On Wed, Apr 17, 2013 at 4:07 PM, Kurt Buff kurt.b...@gmail.com wrote: On Wed, Apr 17, 2013 at 12:27 PM, Ben Scott mailvor...@gmail.com wrote: On Wed, Apr 17, 2013 at 2:43 PM, Michael B. Smith mich...@smithcons.com wrote: IOW: Security is for the MANAGEMENT of risk and MITIGATION of same. For real world systems, and usage of them, there is no such thing as perfect security. That's true, too, but the point Munroe is trying to make is that a lot of people lose track of the forest for the trees. They get so caught up in protecting the computer that they forget why they're protecting it. If that's the case, then he didn't make his point at all clear. It was pretty clear to me, and coincidentally (or not!) his image looks like a tree. Nevermind the fact that most professionals are saying don't run as admin. OK, so they're not. Does that mean they are protected? Protected from what? Not getting a more pervasive infection, sure. But malware writers are dropping the .exe's in userland and doing stuff with the data they access. How do you protect that data, when the person who's been infected, is the person who needs access to the data? Thought it was pretty clear, to be honest. Apparently I'm dense, then. I protect all of my accounts, privileged or not, in the same ways, and have been doing so for so long that it's completely natural to me. It just feels unnatural not to do so. No running executables from untrusted sources, turn off scripting in my browsers, view all email as plain text, no remembering/caching of passwords in browsers, using a unique password per web site and per other accounts, regular clearing of cookies, no linking of accounts between web sites, running current AV, no browsing with elevated accounts, laptops have full disk encryption, etc., etc.,
Re: On the subject of security...
On Wed, Apr 17, 2013 at 4:29 PM, Ken Schaefer k...@adopenstatic.com wrote: -Original Message- From: Kurt Buff [mailto:kurt.b...@gmail.com] Sent: Thursday, 18 April 2013 6:08 AM To: NT System Admin Issues Subject: Re: On the subject of security... If that's the case, then he didn't make his point at all clear. ... True again - and again unremarkable. My point is that you have to use the same methods to protect unprivileged accounts as you do root/administrator. ... That's the import of my remarks about screensavers, FDE, not caching passwords for web sites in browsers, etc. - it's all about protecting the data; that which resides on the machine, and that which resides on teh intarwebs. If anyone's being unclear here, I think it's you. My reading of your comments is that a lot of your suggestions are geared towards preventing access to the system. A lot - but not all of. All your suggestions about encrypting disks, having screen savers etc. are overkill if all my data is burnt to CDs. I'm better off investing in a safe to house them. If all of your data is burned to CD, you still have to stick that CD into your reader, and if your machine is compromised, it will still be read and exfiltrated. Additionally, if my only PC is the one sitting in my living room, then when someone has got access to that machine (by breaking into my house), then a lack of password protected screensaver, or the fact that the password to the machine is on the bottom of the keyboard, is probably the least of my problems. True. But they are pretty much required on a laptop that you actually take out of the house, not so? And, if you're going to practice that kind of security on your laptop, it's far easier to keep in the habit of doing it on all of your machines - and nearly mandatory if you have kids who have physical access, I might add Security is about managing risk: identify what the threats are, and the mitigate, transfer, accept etc. Security is not a checklist of technologies and processes. You manage your risks with those technologies and processes, though, don't you? I protect all of my accounts, privileged or not, in the same ways, and have been doing so for so long that it's completely natural to me. It just feels unnatural not to do so. No running executables from untrusted sources, turn off scripting in my browsers, view all email as plain text, no remembering/caching of passwords in browsers, using a unique password per web site and per other accounts, regular clearing of cookies, no linking of accounts between web sites, running current AV, no browsing with elevated accounts, laptops have full disk encryption, etc., etc., etc. Without an evaluation of risks, this would be a complete waste of time for most people IMHO. Sure - if you don't browse the Internet, share USB sticks, etc., you probably don't need to do those things. I run as an admin on my personal machine. I don't bother reading all mail in plain text, and I don’t full disk encrypt all my machines, and I don't clear my cookies. I've got better things to do with my time, and if I focus on protecting my identity and data instead, I'm probably just as likely as you to be safe. So, care to share how you protect your identity and data without any technologies or processes? Kurt ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/ ~ --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to listmana...@lyris.sunbeltsoftware.com with the body: unsubscribe ntsysadmin
Re: On the subject of security...
On Wed, Apr 17, 2013 at 4:07 PM, Kurt Buff kurt.b...@gmail.com wrote: My point is that you have to use the same methods to protect unprivileged accounts as you do root/administrator. True and unremarkable. There, I did it, too. See how that fails to contribute to the discussion? Not that they're equivalent in power, but that each kind of account can do and has access is different and equally valuable. For the typical home user, which is what that comic is focused on[1], not so much. Root/Administrator is valuable because it can subvert the protections on, or directly access, the data that end-user accounts have, and end-user accounts because that's the actual money/IP resides. And for a home PC *THERE IS ONLY ONE USER*. -- Ben [1] Note what's in the bubbles around the edges. ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/ ~ --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to listmana...@lyris.sunbeltsoftware.com with the body: unsubscribe ntsysadmin
RE: On the subject of security...
-Original Message- From: Kurt Buff [mailto:kurt.b...@gmail.com] Subject: Re: On the subject of security... No running executables from untrusted sources, turn off scripting in my browsers, view all email as plain text, no remembering/caching of passwords in browsers, using a unique password per web site and per other accounts, regular clearing of cookies, no linking of accounts between web sites, running current AV, no browsing with elevated accounts, laptops have full disk encryption, etc., etc., etc. Without an evaluation of risks, this would be a complete waste of time for most people IMHO. Sure - if you don't browse the Internet, share USB sticks, etc., you probably don't need to do those things. But I do browse the internet, and I do share USB sticks. Yet I don't do most of what you list above. Everything is about /management/ of risk, not 99.99% avoidance of risk. Just as people don’t live in impenetrable fortresses, and keep their money in Fort Knox, it's not actually necessary (or even desirable IMHO) to do some of things you do to have an acceptable level of risk. The marginal benefit from each additional step you are taking vs. the cost to usability and time taken isn't worth it (again, IMHO) I run as an admin on my personal machine. I don't bother reading all mail in plain text, and I don’t full disk encrypt all my machines, and I don't clear my cookies. I've got better things to do with my time, and if I focus on protecting my identity and data instead, I'm probably just as likely as you to be safe. So, care to share how you protect your identity and data without any technologies or processes? Let's be clear - I'm not saying I have no technology, and my strategy is to rely on magic. I start by worrying about what my family needs/wants to be able to do, and then what apps and data we need to do it, and then work out what the threats/risks are. You can draw a parallel to business - info - technology architecture from TOGAF or similar framework if you want. Malware and hackers getting into my home network is probably about half-way down the list at the moment. Additionally, instead of inconveniencing end users with restrictions on either user experience, I want technology to work in the background to protect us (if possible). So, we use 802.1x for our wireless since we're all on an AD domain, and SOHO APs all support it now (there's a guest wireless network for visitors), and I use centralised malware scanning on the Exchange server. I'm researching some options for outsourcing the malware/junk scanning for incoming (it's a pity that Postini doesn't seem to be available anymore) But things I worry about more are hardware failure, lightning strikes (had two of those in two different homes), being burgled, having a fire or something else similar that destroys things. The information I worry about protecting isn't just what's electronic/digital, but also paper records, passports, birth certificates and so on. So, it's starting from a different starting point. It's not starting from you should encrypt your disk, delete your cookies, run as a non-admin. It's starting from what types of critical/important/throw-away data do I have in order to live/work/interact with friends, and then what are the risks to that data, and what can I do about it. And weigh all that against usability So, I'm not particularly worried about someone getting access to the password for the media centre PC's default user account. I'm more worried about that account somehow getting logged out, and whoever is using our media centre not being able to log back in again. I mitigate the risk of people knowing the password doing something bad by restricting what that account is allowed to do. Likewise I want to be able to share things with my family overseas, bank online and do various other things - at the same time without impacting my user experience significantly, so I take other measures to help reduce risk: I get notifications for purchases on my CCs over a certain amount. Most of my banks require (or at least offer) 2FA for authentication now. Etc. Cheers Ken ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/ ~ --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to listmana...@lyris.sunbeltsoftware.com with the body: unsubscribe ntsysadmin
Re: On the subject of security...
On Wed, Apr 17, 2013 at 7:08 PM, Ben Scott mailvor...@gmail.com wrote: On Wed, Apr 17, 2013 at 4:07 PM, Kurt Buff kurt.b...@gmail.com wrote: My point is that you have to use the same methods to protect unprivileged accounts as you do root/administrator. True and unremarkable. There, I did it, too. See how that fails to contribute to the discussion? In this case, because it's untrue, because your point below is wrongheaded... Not that they're equivalent in power, but that each kind of account can do and has access is different and equally valuable. For the typical home user, which is what that comic is focused on[1], not so much. Root/Administrator is valuable because it can subvert the protections on, or directly access, the data that end-user accounts have, and end-user accounts because that's the actual money/IP resides. And for a home PC *THERE IS ONLY ONE USER*. -- Ben [1] Note what's in the bubbles around the edges. Yes, I noted the bubbles. But a), even for home users, while there might be only one user, there should be *at least* n+1 users, where n is the number of individuals who actually use the machine, plus an administrator account, and b) given all of those bubbles, the end user is in a threat-rich environment, so must exercise the vigilance techniques I and others have described/prescribed, if they care about their data, privacy and finances. Kurt ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/ ~ --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to listmana...@lyris.sunbeltsoftware.com with the body: unsubscribe ntsysadmin
