Broadband Tech > Security > Security > A Letter to DSLR Security Enthusiasts

A Letter to DSLR Security Enthusiasts

•Know Thy System
•Least Priviledge
•Defense in Depth
•Prevention is Ideal, But Detection is a Must

• Learn your OS


• Branch out into other OSs if you've only used Windows


• Learn the command line in every OS you use


• Install and get friendly with VMware


• Read major security news feeds, such as Astalavista, HackInTheBox, etc.


• Follow the main security experts. See what they're talking about.


• In Windows, install one AV, one firewall, and one anti-adware/spyware tool. Don't get silly about it.


• Realize that being unsafe in a wealthy suburb is far more safe than being "secure" in a Baghdad hotspot. In other words, you're not going to be safe clicking on random crap regardless of what off the shelf security tool you're running.


• Remember that advanced malware writers have every security tool you do. Don't you think they tested to make sure it wasn't detectable before they started sending it out? Your best bet is to not interact with it in the first place.

Excellent advice!

I'd add my favorite old saw, first observed by Bruce Schneier back in May 2000;

Security is a process, not a product.
Ref »www.schneier.com/crypto-gram-0005.html

Create the process, stick to it and evaluate it periodically. Make changes to meet new needs, threats or risks.
--
BBR's Shooting for a Cause!

reply to Daniel

reply to Daniel
Outstanding advice. Not enough can be said for detection. A number of months ago, I installed Ubuntu on one of my machines, and within 5 minutes I knew something was wrong. The freshly loaded machine was trying to make outbound connections to addresses that were not on my list of update addresses, and my network instantly warned me. I wiped that machine, and installed Debian instead. At the time I thought that I had been "man-in-the-middled" on my download. Several months later it came out that the Ubuntu servers had been cracked for six months. I don't know if that's what caused my problem, but I sure felt better knowing that I didn't have that software in my systems for months.

Know your machine, know where your updates come from, decide and know which processes can make outbound connections for updates. If something you haven't specifically authorized attempts any outbound connections, find out what it is, and determine if it should be allowed. That is how you learn your OS and your applications. If you can't figure it out, ask here, this is an outstanding resource at your fingertips.

reply to Daniel
I read stuff like this with a jaded, skeptical eye. I run as admin and will never do otherwise. I CHOOSE to do so. I also will never give up ProcessGuard or a similar application just because I understand how Windows works! In fact, the more I understand the more I know I need ProcessGuard and other tools. To suggest that I not use the Proxomitron with Sidki's filters is the height of absurdity. Same goes for suggestions that I should not use my other Security applications.

I do agree though with one thing you said: use VMWare which I have been doing for several years. It is great for beta testing, running malware to test your AV, etc.

As for learning other operating systems than Windows...well, Apple computers are too expensive and judging from Safari for Windows they are too unsophisticated also to be learning. As for Linux, I probably will install Ubuntu and dual boot but I will never be a big enthusiast for many reasons.

What do I need to read those security feeds you mentioned for? In the first place, I hate any kind of feed and never, ever look at feeds. Aside from that, I believe strongly that I get enough security information here, Wilders Security, Castlecops (which I and others here helped the owner build years ago) and GRC NGs.

No one will ever convince me that I should not run the security programs that I use. I am not a stupid newbie. I've been here for over six years and was reading GRC NGs before I came here. I've been a Wilders Security member for six years and the same for Castlecops. I get tired of posts like yours....so supercilious.
--
"The same ferocity that our founders devoted to protect the freedom and independence of the press is now appropriate for our defense of the freedom of the internet. The stakes are the same: the survival of our Republic". Al Gore, The Assault on Reason

reply to Daniel
I run as admin in my desktop and even on the Vista Laptop. "Paranoia will will destroy ya..." and less is more... I only use the following and this is fine for me.

1. AVG Pro or Avast Home
2. Windows Firewall
3. Secured Netgear Router at Home
4. Windows Defender
5. Firefox with ONLY adblock plus and updater.

That's all...

No crazy "extras" that take more time to run them and tell you nothing anyway.
--
I'm proud to be a troublemaker! America was founded by "troublemakers"!

reply to Daniel
Excellent post. Security is a process, not a product.

reply to Daniel
Only a couple replies and already validating Daniel's point ....there will be more I am sure.

reply to Daniel

quote:

---

Learn your OS, harden your applications, take notice of where you browse and what you open, THEN add a few basic defense tools on top of that. That's layering for a home environment.

---

reply to Mele20

Re: A Letter to DSLR Security Enthusiasts

said by Mele20 's signature :

grep understanding < knowledge > /dev/null

reply to Cabal

reply to Steve
I saw under your Avatar you are a consultant, what do consult about?

reply to Mele20
Have to admit, at first I found ProcessGuard annoying... but now it hardly ever bothers me, and I find when it does pop up that it's useful information. I really like ProcessGuard, and consider it a strong layer of defense.

reply to Mele20

reply to Daniel
In reading your nicely written article and the responses, I see there are two different levels of security enthusiasts we're dealing with.

One level is the home PC/small network owner who installs, patches and does technical upkeep on their own system or that of friends or neighbors. They deal with the practical everyday level of security, and tools are what they know best since those are the most visible components of their security implementations.

Another level is the IT/IS/IMS professional who deals with business and enterprise level issues that involve not only hardware, OS and utility installation and maintenance, but in the design, testing, management and architectural and conceptual framework of information and business systems. People at this level put their reputations and careers on the line whenever they make recommendations to clients or others with substantial investment, exposure and liability. As such, they need to have a broader view than the essential nuts and bolts technical folks who keep things running on a daily basis.

Folks in the technical level don't have to deal with or may not be familiar with the larger issues faced by those in the architectural and business risk management level, so are more likely to disagree with or misinterpret your recommendations.

I doubt if you'll see any substantial difference of opinion from those security enthusiasts or security and compliance consultants who work at the enterprise or IMS level.

Interpreting "least privilege" as "running as limited user" rather than as an architecture or practice of limiting access or function to what program, users or systems are needed to meet operational requirements is IMO based on an erroneous interpretation of a common architectural principle. Some at the technical level may also interpret your exhortation to move beyond tools to the broader picture that includes database and application design as a call to eliminate the use of utilities and applications. In reading, I saw no indication that you advocate removal or replacement of any specific utility or the elimination of tools as a part of a security implementation.

So, bottom line - I think your article is thought provoking, well written, respectfully composed and deserving of more than accusations of arrogance or contempt on your part.

Thanks,

EG
--
BBR's Shooting for a Cause!

reply to The Rabbit