Slashdot Mirror
Is Whitelisting the Answer To the Rise In Data Breaches?
MojoKid writes "It doesn't take a rocket scientist to figure out that cyber criminals are quickly getting more sophisticated than current security, intrusion detection and prevention technology can defend against. And you have to wonder if the computer security industry as a whole is willing to take the disruptive measures required to address the issue head-on. One way to tackle the surging data breach epidemic is with a technology called "whitelisting." It's not going to sound too sexy to the average end user and frankly, even CIOs may find it unfashionable but in short, whitelisting is a method of locking-down a machine such that only trusted executables, DLLs and other necessary system and application components are allowed to run – everything else is denied. A few start-up security companies are beginning to appear in this space. The idea is to start with a known, clean system installation and then lock it down in that state so absolutely nothing can be changed. If you follow system security, regardless of your opinion on the concept of whitelisting, it's pretty clear the traditional conventions of AV, anti-malware, intrusion detection and prevention are no longer working."
Yes, yes, tell me more about this novel concept, I have never heard of the term before
... next we'll make it impossible to emulate a trusted DLL ... oh, wait.
What is someone breaks in, gets command line access and uses trusted commands to send the data elsewhere. The hacker used trusted programs to do the breach so white list would not stop it.
Why aren't OSes in ROM? Why do they have to be in read-write memory? If it's so expensive to suffer breaches, why trust any rewritable core? (I guess because OSes are never released as finished products, without built in security holes.)
Vulnerabilities are discovered in all OSes, open source or not. If you have that in ROM you will never be able to patch it and have a permanently vulnerable system.
It's too expensive. If you operate in a Windows environment then you have to use Windows Enterprise to access the functionality (which is expensive) and since code-signing certs are expensive not many devs (including driver devs) use them, meaning, you have to go back to file hashes for individual versions for files that aren't signed. We use these mechanism at my work for high risk workstations and the workload of maintaining them is quite tedious. We just aren't there yet as an industry.
Why the flying fuck does anybody think Slashdot readers need to have "whitelisting" defined for them, let alone think they can pass it off as a "new technology"? Did Dice start putting those retarded SlashBI articles in main Slashdot now?
Newer versions of Linux can already do this. Using the integrity measurement architecture, module signing, and Secure Boot it's possible to have a system where almost any change is detected. I'm currently trying to get it all working on my machine right now, but it's slow going. Here's hoping that distros start shipping with this set up by default. http://lwn.net/Articles/488906...
A shorter term security measure that more users/Distributions should take is making the root partition read only. I know Android already does this, but it really does help. Something that I would really like to see is an easy to use per application firewall. Cgroups mean that I don't even have to worry about it just spawning a child process. Yes, I want to play this game in wine. No, I don't want it to access the internet. No, wine refuses to run it as a different user, much less one with lower privileges.
So lets pretend that we've just completed writing this code, as opposed to having just completed sabotaging it -Altera
http://netbsd.org/docs/guide/en/chap-veriexec.html
Veriexec is NetBSD's file integrity subsystem. It's kernel based, hence can provide some protection even in the case of a root compromise.Veriexec works by loading a specification file, also called the signatures file, to the kernel. This file contains information about files Veriexec should monitor, as well as their digital fingerprint (along with the hashing algorithm used to produce this fingerprint).
What company directs 25% of its users to a partially-working, not-ready-for-production website? Please realize that Beta will not have the features that we want, because it goes against Dice's plans for Slashdot. To their advertisers, Dice presents Slashdot as a "Social Media for B2B Technology" platform. B2B - that's the reason Beta looks like a generic wordpress-based news site. A large precentage of the current userbase might be in IT, but /. is most certainly not a B2B site.
Nevertheless, Dice is desperate to make money off of Slashdot, since it has not lived up to their financial expectations, a fact that they have revealed in a press release detailing their performance in 2013:
Slashdot Media was acquired to provide content and services that are important to technology professionals in their everyday work lives and to leverage that reach into the global technology community benefiting user engagement on the Dice.com site. The expected benefits have started to be realized at Dice.com. However, advertising revenue has declined over the past year and there is no improvement expected in the future financial performance of Slashdot Media's underlying advertising business. Therefore, $7.2 million of intangible assets and $6.3 million of goodwill related to Slashdot Media were reduced to zero.
Beta is not a cosmetic change. It is a new design that deliberately ruins the one thing that makes /. what it is today -- the commenting system. There is nothing wrong with Slashdot, from the users' perspective, that demands breaking its foundations. As others have commented, this is an attempt to monetize /. at any any cost, and its users be damned. Dice views its users, the ones who create the site, as a passive audience. As such, it is interchangeable with its intended B2B crowd. We, the current users of Slashdot, are an obstacle in Dice's way.
That is why they ignore the detailed feedback they have received in the months since they first revealed Beta. That is also why they now disregard our grievances. Their claims of hearing us are a deliberate snow job. It is only pretense, since at the same time they openly admit that Classic will be cancelled soon:
"Most importantly, we want you to know that Classic Slashdot isn't going away until we're confident that the new site is ready.
Don't hold your breath waiting for Dice to fix Beta. Their vision of Slashdot is a crippled shadow of the site as it is today. Don't let them pull the wool over your eyes. Dice doesn't need us, and it wants us out.
Slashdice delenda est!
Windows can be made to boot of DVD or read only media.
Now to also make %TEMP% with no execute allowed.
Liberty freedom are no1, not dicks in suits.
Sadly, the worst problem for system security is humans. If you required the flipping of a physical switch then malware would simply tell the user to flip the switch to see your choice of free porn, music, movies, games, etc. and the human will flip the switch (or any other method that requires human action). Humans are stupid... sad but, true.
"Be particularly skeptical when presented with evidence confirming what you already believe." -
Why not just take computers away from people? I mean if you're going to put such heavy restrictions in place why not just give someone pen and paper, it would be equally as efficient for the end user than having to call up IT every 5 minutes because you're not allowed to use the computer you're given.
I would like to see the filesystem of an OS partitioned into several levels: read-only disk drives where stuff never changes unless an update occurs (kernel, device drivers, configuration files), read-write disks where log files are update by the minute, hour or day, and local/user partition which is updated by the user.
Our university managed to do something similar by just having a ISO image that they overwrite the OS partition with, every time the PC was rebooted.
Vintage computer adverts: http://www.vintageadbrowser.com/computers-and-software-ads
The idea is one of the oldest in IT security.
And it works really, really well.
And it is a PITA to administrate if you have a system that changes, as lots of systems do. For your regular service server, much less a desktop system, where new releases require new libraries, system updates are regular and new application required every now and then, it is almost impossible to actually do it.
On a locked-down system that needs to do one thing, but do that thing reliably and securely, it's a fantastic security measure that will eliminate about half of your security headaches right there.
It's the same idea as SELinux, just on a different level, and it shares many of the disadvantages, namely that it makes policy management into a full-time job.
Assorted stuff I do sometimes: Lemuria.org
Which is why a good security model for a company will not give users the ability to flip that switch.
Which also means that if you don't want the IT department to spend 90% of their time fielding "I need to do X, can you enable it for me?" calls, you need to spend considerable time, effort, expert knowledge, user interviews and other things that equate to money, on creating a good policy.
And since most companies shun security expenses and would rather knowingly risk a $1 mio. break-in then spend $10k to prevent it, well, here we are.
Assorted stuff I do sometimes: Lemuria.org
I would like to see the filesystem of an OS partitioned into several levels: read-only disk drives where stuff never changes unless an update occurs (kernel, device drivers, configuration files), read-write disks where log files are update by the minute, hour or day, and local/user partition which is updated by the user.
You mean the way that almost every installation guide for every Unix system ever recommends you do it, and almost nobody ever does?
Assorted stuff I do sometimes: Lemuria.org
While I admit that as a programmer I will inevitably have a skewed point of view, I view it as ill-advised.
A computer is useful primarily because it is NOT a special purpose tool, but a general purpose one.
Whitelisting cripples your computer. If you can't run software without it being on a whitelist, you can't even write a shell script, or a VBA macro. Your computer stops being useful as a general purpose tool - only the software that has been approved remains useful.
Yes, I get that most users are numpties and probably do need to be kept from hurting themselves. But this kind of policy cuts down the tall poppies - the ones who actually can make their computer work for them, instead of just working at their computer, and removes the possibility that any more will arise - no-one will voluntarily seek the rights they need to approve of their own software, because they'll be singled out as potential hackers and troublemakers, and any data breaches that do occur will be attributed to them.
As applied within our organization, it's also soul-crushingly annoying to programmers. We'll have the rights to approve of any software we want to run, but we have to click through an approval dialog for each... new..... file... which of course, means that every time we rebuild our code we face a clickfest just to debug it, or run unit tests on it, etc.... most of us have shied away from being "upgraded" to Windows 7 because of this. Several of us just wish we could change to Linux, being Java programmers.
Indeed, many of our internal teams are also getting the self-approval rights, which just trains them to click "Approve" and you're all the way back to UAC again, no extra security, just extra hassle, reduced performance of the computer (which is now hashing every file you access on the drive to see if it's on the whitelist), and more money diverted into the coffers of the kind of company that sponsored this story in the first place.
Have the change require a hardware dongle. Lock the hardware dongle away where only the sysadmins have the (physical) keys. Problem solved.
Unless the sysadmin wants to see the porn, of course. ;-)
The Tao of math: The numbers you can count are not the real numbers.
Whenever someone tells you that x solves all problems, it typically doesn't.
Whitelisting is currently practised on many mobile platforms. The only thing it does is force people to turn it off so they can actually use their devices, since the white list was done by people with differing opinions.
The more sensible solution is to do it like Debian does it. Have repositories making it easy to download software which matches certain criteria. Make it moderately hard to install new repositories and make it hard to just "download a binary and run it". That way the layperson will just use decent software from the main repositories while the expert can still do anything they want to do.
Whatever happened to boycotting comments until Dice announces it will not move to Beta? Fellow slashdotters, don't give up.
Because man is fallible? There has never been an OS that is bug free and by placing the OS in ROM not only do you insure that no bugs will EVER be patched but that any improvements that would help make things run better/faster/smoother will likewise never happen.
Oh and even if you had the OS boot from a ROM its gonna have to have core files placed in memory sooner or later so an attacker could simply patch in RAM and still take control.
ACs don't waste your time replying, your posts are never seen by me.
Reddit has a text-based, list-oritented design the way we want it. It suffers from a lack of article summaries though.
How to cuztomize reddit to replace slashdot:
Step 1: Singup on reddit.
Step 2: Visit these subreddits and click the "subscribe" button in each one of them:
http://www.reddit.com/r/games
http://www.reddit.com/r/gaming
http://www.reddit.com/r/pcgami...
http://www.reddit.com/r/privac...
http://www.reddit.com/r/politi...
http://www.reddit.com/r/openso...
http://www.reddit.com/r/techno...
http://www.reddit.com/r/law
http://www.reddit.com/r/space
http://www.reddit.com/r/scienc...
http://www.reddit.com/r/govern...
http://www.reddit.com/r/securi...
http://www.reddit.com/r/biotec...
http://www.reddit.com/r/censor...
Step 3: Go to your user profile and look for your personalized RSS feed, (should be in https://ssl.reddit.com/prefs/f...) it will give you a digest of the best stories accross all your subscriptions.
But... the future refused to change.
It's not that those methods do not work, it is that the managers, executives, and directors are insulated from the damage. Make the CIO, CFO, and CEO cough up a few million per breach and they will be stopped. Close companies that are breached repeatedly, and make the directors reimburse the other stockholders out of their own pockets. I once worked at a company where the CEO mandated that he should be able to access confidential information at any location in the company, including offshore locations. I've worked other places where the product programmers had admin privileges on the financial systems.
For gov't breaches, jail those responsible as traiters.
You should always set-up your file-systems in such a way that the OS part is completely separate from user data such that it should be a simple matter to recover or even install and update just the system file-systems. Unix and now Linux has always recommenced this type of layout although you can even do something like this for Microsoft Windows.
/home or archive data.
/var which contain logs and update information that is required to be read/write. Even / (/ and /usr) needs read/write on occasion. The same is true for a Microsoft OS. The best you can do is have a tested disaster recovery plan and surprisingly it need not be that elaborate but you do need to cover most what if's.
I have Fedora 20 running on my PC's and I make sure I document my system layout, application requirements, customisations and of course my security files which I save. If on the off my system gets compromised I can easily 1) Do a system recovery or 2) Do a fresh install and update without compromising my
The fresh install takes me approximately 1 hour then 15 minutes for customisations then about 1 hour for the update although during this time I can fully use the machine. It must be noted that a recovery from backup would most likely take me about 20 minutes for 10 GB to be recovered (over 2000 packages), however if you have been compromised it is usually safer to do a fresh install.
It is possible to have a read-only system file-system for a Unix/Linux but this would be a stupid idea since you have
There ain't no such thing as proprietary standards only proprietary formats. Standards are by definition open.
As usual with this type of headline, this is not a solution. In fact, it is not a solution at all. Just think of the most common way to compromise an executable: Buffer overflow. In that case, code is put somewhere in the memory area of the running process and then the process is coerced to execute it. This means the attack code runs in the context of the already running process afterwards and white-listing has zero impact. The only effect it has is that it gets harder for the attacker to start additional processes.
As for code-injection attacks, these are usually done with interpreted code, and white-listing does not even apply to that.
This is another technology that at best makes it harder for script-kiddies to break into a system, but has basically no impact on competent attackers.
Incidentally, techniques like SELinux allow far more than a simplistic "white-listing", and have done so for quite a while.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
What is someone breaks in, gets command line access and uses trusted commands to send the data elsewhere. The hacker used trusted programs to do the breach so white list would not stop it.
Well your machine is now compromised. You now have to ask the question "What can I do". Normally in a case like this you should do a fresh OS install from a trusted source (eg. bootable CD/DVD, USB key) followed by appropriate customisations then updates from a trusted source. You could do a recovery from your OS backup but if you have been compromised I would not trust this.
Obviously you may need to recover your user data if that has also been compromised but if are looking at an enterprise system or even just a home PC, initially you may not need to do this until all interested parties (eg. DB administrators) have checked for issues since you cannot be sure if your backups have not been compromised as well. This is why an appropriate documented disaster recovery plan needs to be in place whether the system is a multi million dollar Enterprise system system or a home computer.
There ain't no such thing as proprietary standards only proprietary formats. Standards are by definition open.
Have the change require a hardware dongle. Lock the hardware dongle away where only the sysadmins have the (physical) keys. Problem solved.
Unless the sysadmin is in a different office, city, country or continent... Yes it is a real scenario. We do that in our company.
Or unless the sysadmin is responsible for a few thousand servers in a datacenter.
One problem solved, another unsolvable problem created.
The powers that be had the great idea of launching a policy of locking down PCs where I work. Which is ridiculous considering that we're a large research university and that, believe it or not, bureaucrats can't predict what researcher X in lab Y will want to put on their computer. Because users were unable to do anything on their own, the IT people were spending a lot of time going from one office to the other installing the software that people needed. It lasted for maybe a week, at which point some "helpful" IT person decided that it was much easier to just give "trusted" users the admin password! However, that was the XP era and people soon realized that they could not easily install .msi packages for instance because you could not just right-click, "run as admin" them. But if you were logged in as admin, you could install everything easily.
So, eventually, lots of people started using the admin account FULL TIME and leaving the password in plain sight on post-it notes. So, to "improve security", we went from people using regular user accounts, with a small risk of their machine being infected/compromised, to people logging in as admin with full rights on the machine. What a great improvement!
I suppose that white-listing may solve the problem if it's really impossible to do anything. But it's 2014 and you can't predict what people will want to use.
I'm SO sick of this 'Fuck Beta' crap.
YOU the /. community are one of most technically-able groups of users on the internet. Therefore, instead of whining about a FREE service that you no longer enjoy, why not group together and build something better? If it's better than /. (not hard...) then your user base will come. A handful of you could throw up a simple blogging system in a few hours, whilst you work on something permanent...
So instead of bitching about it to corporate owners who do not care, get off your arses and build something better.
http://altslashdot.org/ seems to be offline at the time of writing - a good effort but when I did look at it yesterday it seems to be 90% ideas, and sod all development. The best sites on the net, didn't spring into life fully formed, they evolved. The important thing is to just get something up and working as fast as possible.
(Why am I not joining the effort? I'm a Windows guy, my linux foo is simply not good enough else I would.)
-Jar
Together, We Can Make Slashdot Better. I Do NOT Mod ACs. - Check Me Out
Game consoles with their OS in ROM are commonly hacked.
No. Getting your mom to show you how to use the washing machine is the answer to dirty britches.
Confucius say, "Find worm in apple - bad. Find half a worm - worse."
Sadly, the worst problem for system security is humans. If you required the flipping of a physical switch then malware would simply tell the user to flip the switch to see your choice of free porn, music, movies, games, etc.
Maybe so, but in an Enterprise environment, the "Toggle Switch" would be replaced with a KeySwitch, and the end user would not have the key to operate it.
I've seen Star Trek, and thus I know that in an Enterprise environment, keys are always spoken aloud, for everyone to hear. ;-)
The Tao of math: The numbers you can count are not the real numbers.
The more flexible idea is to have the complete system you'd normally image simply be read only under normal circumstances and only writable permanently under special circumstances.
Somebody posted a link to "Deep Freeze" which does this, but there are probably a lot of ways to do this on a desktop PC or through virtual desktops.
A buffer overflow should not provide the keys to the city.
We need security orthogonal to the executing application surface.
Here's an idea, don't know if it will catch on but how about
encrypting the data in it, whitelisting the users / apps that can use it, thereby
reducing the
surface vulnerable to attack. It would require a sophisticated public key
infrastructure integrated
with all processes. Data objects could organize their fields into multiple segments that can be origressively unlocked.
2007 is calling and wants their whitelist/blacklist technology back ..
`There is very good resource here comparing various host prevent/block whitelist/blacklist agents.'
UEFI SecureBoot isn't designed to secure the computer, but to prevent dual booting Linux. There are any number of ways to get unauthorized code to run on fully UEFI secure Windows PCs ..
I am sure the white list contains the hash of the all the items.
Unfortunately, though it's relatively rare, vulnerabilities allowing software to "escape the virtual machine" are not unheard of. For the kind of security model we're talking about here, you ought to be running isolated segments on completely separate physical systems that can communicate only via controlled channels with suitable safeguards like firewalls and DMZs in place, if they even need to communicate at all. Basically, each segment in your network should regard traffic from any other segment as potentially hostile, in the same way you don't just trust traffic from the Internet and you limit access from non-audited systems if you allow BYOD.
None of this is a new idea, of course. Security and compliance people in fields like finance and healthcare have been advocating these kinds of measures since forever. It's just that every time a major breach happens because someone didn't do it, the subject gets brought up again, and hopefully a few more people (including the executives who need to sign the cheques) get the message.
If you disagree, post your argument. (-1, Overrated) isn't your personal censorship tool for views you don't like.
Unfortunately, among the worst offenders for lax security practices you will often find company executives. The kind of person who makes it into such positions tends to have a certain arrogance, sociopathic tendencies, and a presumption that anything they screw up can be fixed by someone else later if necessary. If someone like that runs into an access control barrier on their computer, they call IT and say remove it. And if it doesn't get removed, they call the IT guy's supervisor and say remove it, and then they fire the first IT guy.
Obviously not all management is that naive, but I suspect you'll find a strong correlation between management that repeatedly causes serious security problems and management that is willing to run over their sysadmins without losing any sleep over it.
If you disagree, post your argument. (-1, Overrated) isn't your personal censorship tool for views you don't like.
now. This is hardly a new concept or a new implementation.
Yeah, but they have voice recognition, so you only actually lose control of a starship capable of causing damage on a planetary scale if a homesick android turns hostile, which would never happen.
Well, that or if someone brings in a tape recorder, I guess.
If you disagree, post your argument. (-1, Overrated) isn't your personal censorship tool for views you don't like.
You still have to apply security updates to your installed software, specially with the lot of remote java vulnerabilities that had been disclosed in the last year (and that you should had been hurried to fix). And you must trust in who send you your update to whitelist it, because it could be someone playing MITM.
In the other hand, whitelisting an approved by some authority list of software means that the only software you will be able to install is the already backdoored by government ones, and perpetuating monopolies.
For routine operation of Internet-exposed systems, the / (which includes /usr and, usually, /usr/local) mounted read-only. The user-modifiable places (/home, /tmp, /var) are mounted with the noexec option.
Although a dedicated attacker might be able to succeed anyway (the same script can be run with a sh script instead of ./script), it throws sort of a "tangle-foot" over them — most of the hacks involve some compiled binaries. And, if the targeted filesystem is mounted read-only, even root can not modify it (remounting without a shutdown can be prohibited by policy).
In Soviet Washington the swamp drains you.
I couldn't agree with you more. UEFI doesn't stop Linux from booting if you don't use UEFI. Brilliant. Your assumption seems to be that the option to disable UEFI is always available and always will be (The former is already false, and if you don't think M$ is trying everything in their power to make sure you don't have the later option in the future then you are either woefully ) or delusional
Guns don't kill people; Physics kills people! - John Lithgow as Dick Solomon on Third Rock From The Sun
Pissing away points modding up a troll AC. Nice.
You can have my SIG when you pry it from my cold, dead hands.
Yeah, but they have voice recognition, so you only actually lose control of a starship capable of causing damage on a planetary scale if a homesick android turns hostile
Normally the computer can tell the difference between a human and an android or a recoring.
The android happened to be a computer genius though, and so he reprogrammed the voice recognition procedure
He could have defeated a physical switch too.
The fact is.... if your adversary is a technically sophisticated android with local access, then you are screwed.
Why not have a no cost public registration process for anybody who wants to write an trustworthy executable program. Issue a certificate for each individual developer who is added to the list of contributors for a trustworthy program. Make it voluntary. If you want to develop or run anonymous or old software - go right ahead - you've been warned so you can be careful.
*All* execution environments would need updates to support this so it won't be easy or quick. This is not a new idea, but having it popularized and in widespread use is the challenge. We all haven't really cared enough to take the time to make it happen. Its unfortunately clear that its now necessary.
As developers we could get valuable feedback from users and would have an additional motivation for quality. It could serve to protect our profession.
As people who use programs we would at least have a tool to deal with some of the f*&^ed up bull shit we are increasingly having to put up with. This would make viruses and malware a thing of the past. High security systems like heath care, payment and financial processing and civil defense and services would have a potent tool to eliminate a huge piece of the security puzzle.
Why don't we do this?
Greed is the root of all evil.
"So instead of bitching about it to corporate owners who do not care, get off your arses and build something better."
There is a cost to forking the site; namely that the existing data of comments and discussions are locked up by Dice. So it's sensible to apply some political organizing and public protest in the hope that Slashdot comes to its senses and not effectively destroy itself with Beta. If that doesn't work, then of course forking the site is a reasonable backup plan. But not optimal due to lost data.
We know where leadership by an anti-intellectual "strongman" who scapegoats minorities and likes boisterous rallies goes
So, sure, whitelisting might prevent your uses from running unapproved browsers at work, but it will not secure a computer system against actual attackers. Not to mention that a good chunk of would-be whitelisted binaries actually have embedded language environments (macros, javascript, shell/batch scripts, java, vbscript, etc.) that would also need to be added to the whitelisting framework.
Whitelisting works against a lot of things. It doesn't work against things that look enough like the program to sneak through or against hack systems that are outside your system probing for weaknesses.
Not only do you need a white listing system you need portions of the network that are hardcoded. Literally impossible to change because the coding is set in stone. You can have firmware in those systems but the firmware has to be READ ONLY. Possibly you could have a PHYSICAL switch that enabled read/write to the firmware or make it a removable chip that can be inserted elsewhere for editing. But when in the machine under normal operation... most of your core infrastructure must be hardcoded. Unchangable.
Beyond that, many systems should not only be hardcoded but also very simple. Simple systems that can only work one way and no other can't be hacked. You can hack something behind them often but you can't hack them directly because there is nothing you can do to them. That is a strength. You know in the event of a breach that those assets were not at fault.
I've decided to stop wasting my time responding to AC trolls/sockpuppets... so if you want a response from me... login.
I just figured out how to turn on the Administrator account on Windows 7 & knock everyone else down to Standard! O:
I would like to see the filesystem of an OS partitioned into several levels: read-only disk drives where stuff never changes unless an update occurs (kernel, device drivers, configuration files), read-write disks where log files are update by the minute, hour or day, and local/user partition which is updated by the user.
That's called every file system that exists on any computer today. If you want to see it, only log in as a user who doesn't have administrative rights.
It's probably not offline. I bet it's altslashdotted.
A simple shell script runs only resident binaries, and it can already do a lot of harm. It can even escalate using local exploits.
How can whitelisting help here?
This article appears to me to be an advertisement placement article. The technology is not new, and hence not 'start up companies', except the one they are pushing. The technology is built into Windows but has no useable interface. stupid of Microsoft to leave that to the user and say nothing while maleware and hacking goes rampid. It is however good however to see the best solution get more attention. The AV track is a loosing proposition right out of the gate if you are the target of a hacker. My company has been using Bit9 for years. It does the job fairly well. The downside to this technology is process injection and overflow attacks do not run binaries, so 'running process checksums' are likely necessary. Fixing the overflow problem with an OS level secure library, and its enforcement, is necessary.
My FreeBSD jails have read-only filesystems with specific folders (for user applications, log files and user files) mounted as individual writable nullfs (like Linux loop) mounts at the host level. It can be done, you just have to DO it.
Well, you are right, but it wasn't very convenient. I did in fact fail to mention the point you just made. SecureBoot is in fact already limiting people's choices and closing hundreds and hundreds of Linux distributions off. Thanks for making my point in yet another way!
Guns don't kill people; Physics kills people! - John Lithgow as Dick Solomon on Third Rock From The Sun
We use Bit9 Parity...inventories and monitors ALL executable content on a given system and the policies remain in effect even when offline...this app closed many audit findings for us because with tamper protection and blocking of known malicious items it's more proactive. You can even import SHA/MD5 keys manually if something is discovered in the wild and there is no real detection yet....Nothing is 100% BUT much of what infects these user systems are executable content plain and simple. I wish they made this for Home use as it would be worth it. I am just another IT person too by the way and am not endorsing this product in any way..just giving an option to AV and other reactive apps. I love this app for our front-end web servers...you put these in HIGH mode and not a d@mn thing runs except what is supposed to...i.e. if the server is compromised new executable content STILL has to be approved even as local admin. That's the best part....local admin has nothing to do with this proactive approach...check it out....there is no such thing as one protection but with app control implementations like this and security in layers it just make it that much harder for the bad guys...hope this info helps....
Yes. You are confused. That it how it is currently used. There is no guarantee against the possibility, and every reason to be concerned that, SecureBoot will become first prevalent and then ubiquitous as those of us in the know are a severe minority. Those who forget the past are doomed to repeat it. You have either never known about, or forgotten, the history of computing.
Guns don't kill people; Physics kills people! - John Lithgow as Dick Solomon on Third Rock From The Sun