On 25 Feb 2015, at 17:15, Yves Goergen wrote:
Am 25.02.2015 um 20:42 schrieb Bill Cole:
On 24 Feb 2015, at 17:06, Yves Goergen wrote:
I can't block all archives with executable files in them.
Then in all seriousness: why bother filtering email specifically for
malware?
Email is an inherently untrustworthy transport medium. Any sort of
executable received via email that is not cryptographically signed by
a
trusted sender should be considered unsafe to run. If an executable
is
signed by a trusted sender, it can just as easily be encrypted to
protect it from detection as an executable. If your users believe
that
you are providing them a valuableservice by allowing transport of
executables via email, they are mistaken. You are putting them at
unnecessary risk.
I fully understand you, but tell that end users.
I do.
Based on my employer's logs and support requests, the frequency of
actual user problems with an absolute omnidirectional ban on readily
identified executables attached to email is at least 3 orders of
magnitude smaller than the frequency of that ban excluding malware in
the past 14 months. It is quite likely that some of our users have
adopted mechanisms of evading the blockage and informed their
correspondents of those mechanisms, which is a relatively low-risk issue
-- a problem not worth trying to solve.
They're already happy if they manage to get an e-mail with an attached
file sent out. I've more than once thought about shutting down the FTP
service due to repeated issues with it, requiring that users manage
their files through SFTP. But FTP is still the most-used access
protocol and the average webmaster(!) doesn't care or know about it
all.
Yes, I understand that a solid 50% of the human race consists of people
with below-median intelligence. That's always been necessary to take
into account and it is a persuasive reason to avoid targeting a "mass"
market of users. Put another way: a customer who demands FTP instead of
SFTP for anything other than anonymous downloading is too dumb to be
worth serving.
Your objection also applies to unencrypted HTTP downloads, BTW.
Yes and no. No one is sent dozens of unsolicited malicious executables
daily via unencrypted HTTP, mixed in with a handful of legitimate and
possibly important messages that they are expected to see and respond
to. A user seeking out a piece of software and transporting it in an
insecure fashion is potentially problematic, but it is ultimately a
consensual problem that is mitigated by things like file encryption
and/or simple hash "fingerprints" to assure that receivers get the files
senders believe they are sending. Whether receivers are good judges of
sender integrity is a tougher problem, not readily solved by technical
measures.
