Security is a process

By sjvn  5 comments

I often point out that Windows is insecure. It's so insecure, in fact, that I, in all seriousness, propose that ISPs (Internet Service Providers) should start forcing users to secure Windows-since neither users or Microsoft will do the job, Windows PCs should be banned from the Internet. That said, nothing, and I mean nothing is really secure.

People keep having this delusion that security is a product. That, if you just buy some magic box, you'll have a program or an operating system that's as secure as Fort Knox. Or, if they just use a Linux desktop or a Mac, they'll be safe. I wish!

It doesn't work that way. Security is a process, it's not a product. Some systems are more secure than others. Linux, as anyone who pays any attention to security news knows, is a lot more secure than Windows. If we were talking cars, Linux would be an Audi A4, the Mac, BMW 330 and Windows would be a mid-70s Ford "Hit here to blow up" Pinto.

But, any car can be in an accident, and any car can be hit hard enough to junk it. It's all about the odds and driving safely. Driving safely on a computer or a network means knowing, and using, their available security features. For example, any machine that's exposed on the Internet should have an enabled firewall.

Without one, it's like leaving your car keys and a bottle of rum in the front-seat of your unlocked car. You're just asking for that car to vanish.

You should also, no matter what operating system or program you're running, make sure you install all the security patches as they come on. Period. End of statement. You don't want to wait a week because these days, the second a fix is made public, the crackers are busy releasing zero-day exploits. If you wait around to install a fix, chances are good, especially if you use your PC a lot on the Internet and it's running Windows, that it's already been compromised.

So, in short, if you want to avoid wrecks on the information superhighway, you need to learn to be a safe PC driver. If you keep up-to-date with patches and security software you should be fine. If not, well, don't be surprised if you find your PC busy attacking Twitter one day and turning over your credit-card numbers to professional thieves the next.

5 comments

    Anonymous 2 years ago
    ...are such an amusing group of disillusioned elitists. same argument every time, slightly different spin. so i'll throw back the old, tired argument educated microsoft users use:any product that has the largest market share is going to be subject to people who can't stand how successful it is, and others who know how to social engineer exploits to their own gain.if linux or mac ever turn the tables and grab the market share that microsoft enjoys right now, the talented malware writers will develop crap that takes advantage of the many linux security holes that are constantly being patched.i've used machines that hadn't been patched in months, sometimes more than a year. either they hadn't been turned on, vm's that hadn't been updated, test machines, or just plain laziness. None of the machines I personally use, have ever gotten a virus or been compromised (assuming i was the only user). Basic user knowledge and wariness can prevent most users from having their computers taken over.
    Anonymous 2 years ago
    If you got a car in a similar condition to Windows it would be unsafe to drive.To make it safe you would need to locate a shop and get front and rear crumple zones added and side protection bars inserted into the doors. Then find another shop and get anti-skid, split system power brakes installed then a third shop would provide seat belts and air bags. Finally your brand new car could be used, more or less safely, on the road.But the next day before you took your car out to go to work or anywhere else you would need to visit 2 or 3 of the previous places where you had your car made safe to get the safety equipment updated. This would be necessary every day you took your car onto the road. Note that while driving down to the shops your car would still be somewhat unsafe. You would have to pay for the safety equipment which would come with updates for a limited time and when that time expired you would have to pay again.It would be possible to get a package deal with the original purchase of the car. Sometimes you might even be able to specify which brands of safety equipment was to be installed. But usually not,unless you got the car from a custom dealer. Most of the package would be free for a while. But would still need the daily trips to a shops to get the latest daily safety updates. You could keep going in for the updates until one day (soon) the tech would ask you to pay first, otherwise – no more updates. The package would also include a pile of stuff that you didn't need or want but it would come with the car and would be very difficult to get rid of in spite of much of it being of questionable quality and dubious utility. If you were a fleet owner you could get a much better deal regarding what packaged stuff came with your cars.The car maker would also come out with modifications which supposedly made your car safer; usually once every month. The design of these manufacturer's modifications would sometimes conflict with one (or more) of your existing safety packages so you would not be able to use your car without removing your seat belts or anti-skid brakes or what ever it clashed with. After a while one or the other supplier would make some modifications to what ever it was they supplied and you could have all your safety equipment working again. All of this stuff loaded down your car and made it run slowly so you got a car with a much bigger engine than you really needed and also a multi speed gearbox and traction control to offset the performance loss caused by the safety equipment. This of course separated you from more of your hard earned cash. It then used much more fuel than you could afford. Every so often the performance would deteriorate so much you would need to get it completely rebuilt to make it usable again.There would be no chance of you (or your agent) doing any real work on your car or the safety packages. There would be no useful manuals. If you tried to work on the safety packages this would void the (very questionable) warranties. If you tried to work on the car proper you would become liable to return the car to the supplier or at least junk it and could look forward to defending your freedom and/or whatever assets you possessed in a court of law.
    Anonymous 2 years ago
    And don't forget perhaps the worst of all ... running your machine as an admin when you're just surfing, checking email and running Office. Malware runs with the rights of the user logged in. If you have God rights, so does the virus.
    sjvn
    sjvn 2 years ago in reply to Anonymous
    Yes, that's another "built in by design" Windows mistake. They have backed off on that one starting in Vista, but it's still a problem since a lot of software is built to assume it's running with Admin-level privileges.Steven
    Anonymous 2 years ago
    I read a few weeks back from someone that Windows security is like trying to make a screen door waterproof. That how bad it is.

      Add a comment

      Post a comment using one of these accounts
      Or join now
      At least 6 characters

      Note: Comment will appear soon after you have activated your account.
      Obscene/spam comments will be removed and accounts suspended.
      The information you submit is subject to our Privacy Policy and Terms of Service.

      ITworld LIVE

      SecurityWhite Papers & Webcasts

      White Paper

      Overcome Top 7 Admin Challenges of Active Directory

      As Active Directory's role in the enterprise has drastically increased, so has the need to secure the data. Gain insight on creating repeatable, enforceable processes that reduces administrative overhead and enables robust, customizable reporting and auditing capabilities. Brought to you by NetIQ.

      White Paper

      Insiders Can Ruin Your Company. Take Action.

      Did you know that 80 percent of threats to an organization come from the inside? The threat from insiders is often overlooked in organizations worldwide. This white paper from NetIQ, discusses key technology solutions that help to prevent and detect insider threats.

      White Paper

      Top Solutions and Tools to Prevent Devastating Malware

      Custom malware frequently goes undetected. According to Forrester Research, the best way to reduce risk of breach is to deploy file integrity monitoring (FIM) tools that provide immediate alerts. This white paper has been brought to you by NetIQ, the leader in solving complex IT challenges.

      White Paper

      Streamline Compliance and Increase ROI

      Streamline, simplify, and automate compliance related activities; especially those that impact multiple business units. This white paper from NetIQ, outlines solutions that will help your business gain the maximum return on investment possible while aligning your compliance programs.

      White Paper

      X-Ray of the PCI Process-4 Proactive Steps

      This white paper from Forrester Research Inc., helps break PCI into understandable components. Security and risk professionals will gain knowledge and insight into creating a compliant and secure IT environment. Follow these four proactive steps now before your next audit. Brought to you by NetIQ.

      See more White Papers | Webcasts

      Answers - Powered by ITworld

      Ask a question

      Ask a Question