RE: IDS and Spywares

From: Frank Knobbe (frank_at_knobbe.us)
Date: 10/15/05

  • Next message: Jason: "Re: Cisco IDS 4250 vs Sourcefire IS3000 + RNA Sensor" 
    To: "Omar A. Herrera" <omar.herrera@oissg.org>
Date: Fri, 14 Oct 2005 21:05:34 -0500

    On Fri, 2005-10-14 at 10:03 +0100, Omar A. Herrera wrote:
    [...]
    > I do agree with you that layered security is always the best option, even if
    > there is some redundancy in some of the activities performed by different
    > kinds of products.
    [...]

    Come on, guys. How many layers are you willing to wrap around a rotten
    core? The spyware problem is twofold:

    1) User/operator behavior: Don't click on the shiny things! But even for
    those that don't it's getting harder to keep spyware out, which leads
    to...

    2) Flawed operating system: Any operating system configuration that
    allows software to be installed without the user knowledge is flawed to
    begin with.

    You will note that I don't point the finger at MS directly. Yes, other
    OSes provide native controls that assist keeping spyware from installing
    itself. Even a Microsoft OS could probably be configured/hardend to that
    point where it is spyware resistant.

    But how many admins/operators do that? Apparently operators these days
    either don't have the knowledge (for example, average home user), or
    otherwise lack the incentive to properly secure the hosts.

    What I'm trying to say is:

    Stop wasting your time wrapping more band-aids around flaws! Start
    attacking the real problem and solve that! Stop buying into the security
    buzz spun by security vendors promising the all-curing pixie dust, and
    understand and correct the core root causes of the problem yourself!

    If we don't look at the real issues anymore, then all hope is lost.

    Regards,
    Frank

  • Next message: Jason: "Re: Cisco IDS 4250 vs Sourcefire IS3000 + RNA Sensor"

    Relevant Pages

    • [Full-disclosure] Cringelys FUD-spreading leads to broken workarounds being suggested
      ... FUD, and had provided no evidence to back up his claim. ... Cringely can claim to know whether there's anything spyware or not ... particular how they relate to security reporting and disclosure. ...
      (Full-Disclosure)
    • Re: High Cpu usage at 100%
      ... update.exe is a process belonging to the Spyware Doctor Internet Security ... update.exe is a process belonging to Spyware Doctor Internet Security ... How to start Windows in Safe Mode Windows XP ... removal programs flag Update as spyware, but also because a number of users ...
      (microsoft.public.windowsxp.general)
    • RE: Smiley central Active X controls
      ... security setting was selected. ... It still will not allow me to download ... Does NOT monitor behavior on the Internet ... Why some spyware services may mistake Fun Web Products and its MyWebSearch ...
      (microsoft.public.windowsxp.help_and_support)
    • Re: Service pack 2 (XP)
      ... I have a 'theory' that SP2 has a LOT to do with firewall and new browser ... besides those security features. ... The operative word is SPYWARE. ...
      (microsoft.public.windowsupdate)
    • Re: Xnews and NZB files
      ... having spent HOURS helping friends pull spyware off their ... > that beneath all the crap that Microsoft puts in XP, ... Hardly a week goes by that you don't hear of a new security hole ... Windows XP has added a bunch of silly user interface ...
      (news.software.readers)
    • Quantcast