Slashdot Mirror
Using Layered Defenses to Stop Internet Worms
An anonymous submitter writes "Following last week's release of security configuration guidance for Mac OS X, the National Security Agency has released a paper on Internet worms and how to stop new worms using layered defenses (pdf). A good read - your US tax dollars at work."
1) Always run antivirus software
2) Automatically filter all emails with attachments into a seperate folder
3) Only have one user/computer
4) Always virus scan software first
5) Always run a firewall
6) Always have twice as much bandwidth on the website as you need
7) Block virus/worm emails using filters
Video Game cheats, hints a
Obviously multilayered security is a solution to many problems. A worm would have to exploit problems at multiple levels before being able to do what it wants. This would make it much harder for the average script kiddie to write a worm, and would force an excellent programmer to write a much larger program. It also has the benefit of stopping worm variations by applying a security fix at any one of the security levels, since it's unlikely for that complex a worm to include multiple attacks for every level.
You have enemies? Good. That means you've stood up for something, sometime in your life. --Winston Churchill
Odviously this is aimed at the average american, as all the IT people and geeks out there already know this. But tell me, what average user is auctually going to take the time to read this?
I wish they could just come out and clearly advocate diverstity among OSes. The biggest threat IMO is the ubiquity of holes, not severity.
In my perfect world they would advocate open standards and address the flaws in the system not just individual "patients." As these plagues come and go, if we all have the same immune systems, our collective odds are not good.
I am glad they are putting good info out there. I guess I am hoping that in each case they identify the larger problem so we can all keep our eye on the ball.
Who is General Failure, and why is he reading my hard disk?
Does anyone else find it pretty cool that this battle is NSA vs script kiddies? I mean, a $2B a year cost is equvialent to a small terrorist attack, this is a big problem. I'm glad to see people from all walks of life attempting to combat the little punks.
https://www.accountkiller.com/removal-requested
... why is there a picture of a caterpillar?
There is a regular discussion (or flame war) over which operating system is more "secure": Windows, Linux, the BSDs, Mac OS X, or whatever. Anyone with a bit of understanding knows that there's no answer to that discussion, except if you ask which one is easiest to secure, and even then you have to ask who the securer is and what tasks will be performed. But that's not what I want to talk about.
Telling less experience users that a particular OS is "secure" leads them to think they don't need to be vigilant. Same thing with telling them a firewall will solve their worm problems, or that as long as they keep up with patches they're safe from attacks. All of these are important, but no single one of them is a panacea.
I didn't RTFPDF, but it's common wisdom that a multi-layered approach to security is best. No individual step fixes everything, nor usually even stops all of the attacks it's designed to stop. All we do is raise the bar, and hope attackers will go elsewhere.
So don't tell me that an OS is "secure". I know there isn't such a thing. Tell me what its soft spots are, so I can layer other defenses around them. Maybe the bad guys will pass me by for a while.
sigs, as if you care.
I really don't understand that if the government spends billions of dollars a year on IT products and billions more in house fixing the holes why they don't simply create a master RFP for Microsoft clearly articulating what the security requirements are and that if they are not met they lose pieces of the bid until it is. I mean if the DoD doesn't have the clout to bash these lazy slackers in Redmond upside the head then we're all wasting our time worrying about security.
MS annnounced yesterday that they are seriously considering ending FREE security patches in order,
now listen real carefully -
NOT to provide better or worse security, but to wield an effective blunt object against counterfeiters.
Microsoft views YOUR security as nothing more than a convenient tool to blackmail the entire known world into paying for MS's product. It doesn't matter that you or I never actually stole any of their product - we WILL be threatened with cyber terrorism for the criminalities of other people until WE ALL cough up more money to pay.
And at the end of the day MS makes zero warranty that patches that cost real money will be any better than the FREE updates we already get.
Seriously, in other countries and in other industries this why industries get nationalized by an irate fed up underserviced populace.
``They take advantage of things that no one previously thought of''
From what I can tell, holes exploited by worms are often just common vulnerabilities. Buffer overflows, format strings, cross-site scripting vulnerabilities, are all old news.
Please correct me if I got my facts wrong.
FreeBSD and OpenBSD make damn good worm-resistant webservers too.
From their own report, it doesn't look like it:
"It is unrealistic to assume that users will become cautious about running unknown files."
p. 6, last line of second paragraph
Even the NSA thinks ordinary people won't get smart about computer security.
Playing pornographics games during the day is evil! Play at night!
Considering there is a complete cycle that the worms take to propagate and persist, without user intervention, I would say that you could (not have to) consider them akin to what kinds of life you would find in biological viruses. They're pretty stupid. They generally stick to doing one thing. Once they're known and decoded, a defense can be formed.
However, reading the article, the advance of programming technology is getting pretty sneaky. Self-decrypting program code (hmm.. similar to DNA, only the parts in use are exposed), Self-modifying code (probably close here, though with VB's capacity to recompile on any windows machine...), Command and Control, built in analytical heuristics (worms using scanners and 'decision making' on how to propogate), and even getting to the point where they start to operate at less than full throttle to avoid the common detection method, interference in the host's performance.
The similarity between computer worms and viruses and biological viruses is very close, just on different platforms. While these aren't 'alive' in the common sense, they sure have the capacity to act like it on occasion.
Wonder what's next. Worms that record where it sends itself to in order to form a distributed AI Network?
My point is that you need to have that kind of situation, which is a multi-layered approach.
But to answer directly, yes, they still need to be vigilant. They're still being a client, unless the box is unplugged from the network. Do I download that RPM or MSI and install it, or do I check it out first? Do I log in as root, or do I waste time with a luser account?
The user who thinks he has a "secure" OS doesn't bother with the basics, or with a virus checker, or checking the signature on a tarball.
sigs, as if you care.
Then again, they should already know how to do this and learn for themselves, but a dollar saved is a dollar earned. Damn worms!
Berto