Cyberwar Update: Progress Made, More Needed

No I totally agree with you everything is in place it just needs to be impamented. The security levals have to be montored by someone, Shat my suggetion is, and its just my suggestion. Just  build an application to automate the process.

one thing I would not put any stock in at all is the NY Times.

at CanSecWest hackers failed to take down Chrome -- this year - or last.  that is because Chrome properly runs the web-program in restricted mode

Remember: there is no such thing as a web "page".  what you think of as a page is a program composed of java, flash, codec, silverlight, worms, adware, virus codes, xss, sql-injection, trojans, drug dealers, moles, insurance agents, gun runners, politicians, rogue av software offers, lawyers, crisis scams, ad men, bootleggers, con men, bankers, agents of the Russian Business Network, derivitive-traders. i could go on but you get the point

I wouldn't take TOO much stock or have TOO much faith in a Google OS: http://www.nytimes.com/2010/04/20/technology/20google.html , although, it will be very interesting to see what they come up with (Chrome OS); and any competition they can bring to the ring (RINGS, get it? Ha ha) against MSFT can only be a good thing and benefit the computing customer. 

it's not so much that we need to come up with a solution; the tools already exist

the trouble in getting security is to convince the O/S builders they must put security first*

remember this paragraph?

While it was an early design goal of Windows Vista to use elevations with the secure desktop, Windows Integrity Mechanism, and UIPI to create an impermeable barrier—called a security boundary—between software running with standard user rights and administrative rights, two reasons prevented that goal from being achieved, and it was subsequently dropped: usability and application compatibility.

Read Original article in Technet

Computers should be sold in a locked and secure condition.  If the customer wants to un-lock his computer and run "Brand X" on it -- that's OK -- but that must be the customer's choice and he should be advised of the risk

there has also been some discussion of revoking his certification if he does that meaning he would no longer have network access.

~~

*there are two possibilities

• free markert competition. when the Chrome O/S hits I think we will see secure Netbooks available.  My friend Greg just went through a nasty virus issue; you would not be able to get him to look at an un-secure computer under any circumstances.
• government regulations.  I think this approach will be needed to get any attention from MSFT.  I'm not a fan of government regulations; they have trouble getting anything right.

I agree with you totally, The cost should not be a dertermining factor. It should just be done. we have come a long way and those doors that remain open for the hackers to get in should be closed by policy. Weather it be Corperate Policy of Internet Policy We know how they get in. And should shut them out Period. I am actually attending a class on internet Security.

For the sake of progression. Technogogy Progression lets come up with a plasable soluion.

one of the errors we make is in viewing the hackers as the problem

the hackers are out there, that is true. it is also true that they always will be out there and that they will always take advantage of any weakness in security. they observe only one rule: "Because I can"

the software industry acts as their enabler, refusing to lock the doors "in the interest of convenience, compatibility, and ease of use"*¹

and we all suffer the consequences of their foolishness

~~

the tools i have described in this thread:

• execute applications in the sanbox
• authenticate software updates with digital signatures
• provide software auditing tool*²

-- are all within our reach. all we need is a GSKIA.

*¹ concept should be quarantined in the XP/Emulator.

*² I think it entirely appropriate for firms now offering AV products to begin to offer these audit/repair tools.  as security improves the AV tools will no longer be needed but the software audit and repair will always be an essential part of Best Practice Security

Not only is it costly but it is frustrating for the IT prfessionals and teh end user as well. SOmeone should design a program that will address this and will end up a rich person.

when you combine key defense elements you may have a pretty good result

One element is insisting on signatures and a deliberate procedure for receiving, reviewing and applying software updates -- as described in my previous post.

The second key element is User Account Control, or UAC. Privilege escallation must not be allowed*. An application program of un-known composition (such as a web page ) must run in a "Sandbox" (as in Chrome ) or in "Problem State" (RACF) or "RING3" ( x86 chips ) .  This prevents the unknown program from updating anything without your permission (update permission was  discussed in element one).

Finally: Audit.  we need an audit program on a read-only bootable CD that can be used to inventory the software on a system and audit same to be sure that all programs that are supposed to be there are there and that their CRCs check with OEM specifications and -- nothing un-expected is found.

MALWARE AFFECTS EVERYONE

stop and think: Jart's estimates aside: how much time and money is being used preventing/cleaning up malware and the effects of malware?

it's a lot more than any direct losses.

~~

*we need that "impermeable" barrier between application programs and the system software that was described by Microsoft as an original objective for UAC in Vista.

You are absolututly correct. Malware affects everyone and corperations as a whole. When On a network you will either have to rebuild if it gets to deep in to the registry. just to have a clean image. SOme even just allow window to create a new profile. But thats just aband aid fix. There is software out here that claim to completely wipe out any Malware. But teh registry is a tricky Demon. And it runs deep. So yes using the mentioned zip formula would save a lot of time, effort and frustration.

I like your solution, Mike.  Yes, it would involve a few extra steps, but they are simple ones that would truly reduce the risk of malware.  You've sold me.

DHagar