Re: More along the lines of malware disinfection

I should point out one factor which I think makes a large difference in the approach that one might take in encountering a security issue - the vast majority of my customers are home users who just casually use their machine. In a hypothetical situation of me being called in to analyse a security compromise of a medium-sized business's system(s), my strategy definitely would not factor in "can I fix this in under 3 hours".

Wayne S. Anderson wrote:
You know, I want to point out to folks on this list that this is NOT an
either/or situation. Much like any time we engage in computer forensics,
there are processes we can institute as security professionals that allow
for the removal of untrusted components via a clean install without complete
loss of data.

1) Recognize that a system is compromised if it is infected with anything
more than an embedded 'exploit'. (E.g. Email comes through that has HTML or
something which is temporarily copied to a local cache when the email loads
in the application. This is easy to fix. Any true "virus" which infects
the host system at deeper than an individual application level is taboo.
Toast.)

I used the term 'malware' because I believe that the threats are becoming more and more blended.

2) Jon's point about reliability here is very key to the discussion. It is
COMPLETELY irresponsible to warrant to a customer that you can certify a
system safe after it has been infected with any manner of
control-compromising code that has gone undetected/untreated for a period of
time.

Do you see this as applying in a joe average home user scenario?

As an individual consumer, I may choose to take that risk so there is
an important distinction for the environment that you are asking this
question on. On an enterprise level it is hard to imagine a small or medium
business where this risk is acceptable.

Agreed.

Realize that security is the intelligent application of principles and
experience to maintain a balance between confidentiality, integrity, and
accessibility for yourself, your customer, or your organization. Security
doesn't have to be "wipe and restart" OR "remove the malware and continue
using", there are other solutions out there. It is important to recognize
that there are multiple possible approaches and you need to examine the
risks and benefits of your (hopefully standardized) approach to regularly
determine if it can be improved.

I assume you mean, in my average scenario (eg. home casual user got their machine compromised through installing something while browsing for porn) that my advising the customer of common-sense approaches as well as possibly suggesting alternative software to help avoid similar problems in the future, for example?


--
Mike Moratz-Coppins
mike@xxxxxxxxxxxxxxxx
http://www.mikeymike.org.uk/

Relevant Pages

  • Re: My Frustrations
    ... Again, this is not an issue of communication, or geeks versus business men. ... This is not an issue of proving or demonstrating the quality of ones self or service. ... This is an issue of enabling the customer to make the right decision. ... landing the customer in a very poor security state, ...
    (Pen-Test)
  • RE: My Frustrations
    ... to communicate the value of what we do in business terms. ... That problem confuses the customer and often times ends up ... landing the customer in a very poor security state, ... presenting the same face and message as the quality provider. ...
    (Pen-Test)
  • Re: My Frustrations
    ... While I appreciate your response I only partially agree with you; and frankly I wasn't asking you for a lesson in business. ... That problem confuses the customer and often times ends up landing the customer in a very poor security state, then they wonder why they get hacked. ... At that point it is not a matter of the good provider conveying the message better its a matter of the customers learning how to tell fact from fiction, but they can't do that without being educated first. ...
    (Pen-Test)
  • Re: Encryption of printer files
    ... print jobs. ... One of my security conscious customers decided to lock their dot ... were printing out customer lists and selling them to competitors. ... Each dot would be re-positioned somewhere near the proper location. ...
    (comp.unix.sco.misc)
  • [REVS] Security Considerations for Web-based Applications
    ... Get your security news from a reliable source. ... consequences of this ranges from the erosion of customer confidence in the ... of poorly implemented host naming procedures or web-application URL ... The attacker may choose to inject ...
    (Securiteam)
Quantcast