Mark Breen
marklbreen at gmail.com
Mon Sep 19 05:24:33 CDT 2011
Hello All, there was a very interesting article recently, I cannot recall if it was in MSDN magazine, Code magazine or HBR magazine. Basically they did some financial analysis on the cost in the US of implementing security, vs the cost of a loss. What was not surprising to (to me anyway) was that the cost of implementing security (at a macro level) is higher than the potential loss. I adhere to this philosophy. In my house I lock my doors at night, but a robber can still get in if he really want to. To make my house totally secure would be to make it impractical and unpleasant to live in. So I balance security with practicalities. With my IT security I try to adopt the same approach. My brother is an IT security professional, and he sometimes disagrees with me, but sometimes he also acknowledges what I suggest. Thanks Mark On 19 September 2011 10:19, Hans-Christian Andersen <ha at phulse.com> wrote: > Regarding locking down the hosts file on Windows, if I'm not mistaken, by > default it should already be set to read-only and require admin privileges. > But, even if you set it to read-only, if you have mistakenly given a > malicious attacker admin privileges (or they have found some other hole in > which to escalate their privileges), wouldn't it be rather trivial for them > to add code to remove the read-only lock from the file? In fact, since this > is the default in Windows, I would imagine attackers probably already > factoring RO into their code. > > Francisco has the right idea in the sense that a very safe environment > would > be to have a virtual machine set up to boot a live CD of your favorite > flavour of Linux (or Windows, if possible?) from a virtual drive in your > VM, > so that the environment is completely clean and that you know that anything > you have done within that instance of the VM is discarded when you shut it > down. In fact, if you are really paranoid, don't run it through a VM but > from the bare metal of a machine. Then, before surfing, install NoScript > and > run a full update of Firefox. It takes a little while to get the > environment > prepared, but it might be all worth it if you are doing online banking. > It's > what I do. > > But, regarding this specific issue with Komodo, DigiNotar (and more, it > appears), it's probably worth looking into managing what certificates you > have within your trusted root store and consider removing ones that you > don't feel comfortable having your computer trust implicitly. ( > http://technet.microsoft.com/en-us/library/cc754841.aspx ) There are far > too > many in there, which kind of wrecks havoc with the whole chain of trust, in > my opinion. > > > > Hans-Christian > >