Gustav Brock
gustav at cactus.dk
Mon Sep 19 07:29:03 CDT 2011
Hi Mark
Same here. I think some have a paranoid approach to this.
We have two major (standard) protections here: A hardware firewall and Microsoft Security Essentials.
For the last many years I've come across one (1) incident where "something" tried to install something and MSE popped a message if I really wanted that. No thanks.
All machines including servers run with NAT and port forwarding where needed.
That is complemented with timely updates of Windows and Office.
One additional thing is done, however, and I can highly recommend that: Advertising filters on browsers. These cost a little yearly fee per client but the advantage is huge as banners and adds are removed which is a relief (which you have to experience to grasp) for the users and removes the risk of clicking some nasty banner add ("Your computer is at risk! Press here" and a full-stop sign).
Our VOIP server was hacked once and some Middle East uglies consumed our credit calling Arabic numbers. That was a loss of about USD 60. Not much work can be done for this, indeed as it seems our admin password had been cracked by brute force. Our splendid VOIP supplier changed the account and in half an hour we were back on-air with a longer password.
/gustav
>>> marklbreen at gmail.com 19-09-2011 12:24 >>>
Hello All,
there was a very interesting article recently, I cannot recall if it was in
MSDN magazine, Code magazine or HBR magazine.
Basically they did some financial analysis on the cost in the US of
implementing security, vs the cost of a loss.
What was not surprising to (to me anyway) was that the cost of implementing
security (at a macro level) is higher than the potential loss.
I adhere to this philosophy. In my house I lock my doors at night, but a
robber can still get in if he really want to. To make my house totally
secure would be to make it impractical and unpleasant to live in. So I
balance security with practicalities.
With my IT security I try to adopt the same approach. My brother is an IT
security professional, and he sometimes disagrees with me, but sometimes he
also acknowledges what I suggest.
Thanks
Mark
On 19 September 2011 10:19, Hans-Christian Andersen <ha at phulse.com> wrote:
> Regarding locking down the hosts file on Windows, if I'm not mistaken, by
> default it should already be set to read-only and require admin privileges.
> But, even if you set it to read-only, if you have mistakenly given a
> malicious attacker admin privileges (or they have found some other hole in
> which to escalate their privileges), wouldn't it be rather trivial for them
> to add code to remove the read-only lock from the file? In fact, since this
> is the default in Windows, I would imagine attackers probably already
> factoring RO into their code.
>
> Francisco has the right idea in the sense that a very safe environment would
> be to have a virtual machine set up to boot a live CD of your favorite
> flavour of Linux (or Windows, if possible?) from a virtual drive in your VM,
> so that the environment is completely clean and that you know that anything
> you have done within that instance of the VM is discarded when you shut it
> down. In fact, if you are really paranoid, don't run it through a VM but
> from the bare metal of a machine. Then, before surfing, install NoScript and
> run a full update of Firefox. It takes a little while to get the environment
> prepared, but it might be all worth it if you are doing online banking. It's
> what I do.
>
> But, regarding this specific issue with Komodo, DigiNotar (and more, it
> appears), it's probably worth looking into managing what certificates you
> have within your trusted root store and consider removing ones that you
> don't feel comfortable having your computer trust implicitly. (
> http://technet.microsoft.com/en-us/library/cc754841.aspx ) There are far too
> many in there, which kind of wrecks havoc with the whole chain of trust, in
> my opinion.
>
>
>
> Hans-Christian