4 ms·

> At best, there is negligible evidence that major non-MS AV products give a net improvement in security. I apologize for present anecdote when data is needed

by chime 10y ago

> At best, there is negligible evidence that major non-MS AV products give a net improvement in security. I apologize for present anecdote when data is needed but I manage a Windows network with 100+ users and on a daily basis, Kaspersky catches 5-10 emails from Outlook that have nasty attachments. It prevents my users from opening these innocuous looking but nasty Invoice-Jan-2017.docx files. Without a good AV there is no way to know which Invoice-Jan-2017 has a virus/worm vs. which doesn't. Relying on the Office security feature is not sufficient because actual vendor/customers send macro-enabled files to us regularly.

hueving 10y ago
Does Microsoft security essentials not scan an attachment when you download/open it?
beefhash 10y ago
Are you the target audience for this blog post, though? As far as I can tell, the post talks about one-user setups. I'd argue that the starting point in a corporate environment, where you can assume that users can be quite negligent, is fundamentally different from a one-user setup, especially since I agree that you can't "fix" the user in corporate. You want the e-mails gone, not just a warning about it, but a warning is perfectly fine if you're one person and have an idea what you're doing.
- Angostura 10y ago
  I don't see any caveats in the article about the kind of user that the advice is intended for.
  - frozenport 10y ago
    In your case, the av can run on the Linux mail server.
shultays 10y ago
> Invoice-Jan-2017.docx uh, docx files can hack my PC now? Is this a bug of MS Word or docx format really has ability to become a virus?
- spinsser 10y ago
  It is a feature [0]. Microsoft office products allow for "macros" which are Visual Basic code embedded within a document or a worksheet that can be used by developers to add extra functionalities to their MS files (e.g. validate all data in a work sheet after a user clicks a specific button in the worksheet). Just like any programming language, it could be used maliciously, and there is no easy way to distinguish which macro-enabled file is safe and which isn't (without going through the code yourself prior to enabling the functionality) [0] https://support.office.com/en-us/article/Enable-or-disable-macros-in-Office-files-12b036fd-d140-4e74-b45e-16fed1a7e5c6 https://support.office.com/en-us/article/Enable-or-disable-m...
  - emodendroket 10y ago
    For this exact reason docx macros are disabled by default and you have to do some enabling. Presumably there are also more sophisticated exploits that don't rely on the user dismissing multiple security warnings.
    - chime 10y ago
      These viruses show a blank docx file in macro-disabled mode with only one image, which says "Enable macros to view secure invoice" and shows a picture guide on how to enable macros. Some of them have better instructions than the user guides I write for my users.
      - emodendroket 10y ago
        Still, some user intervention is required. Assuming you found a vulnerability in Office, it'd be preferable to have a vector where the user just had to open the file.
detaro 10y ago
Do you scan on the endpoints or centralized on the mail server?
roca 10y ago
Email attachments should be scanned by the mail server.
- gtirloni 10y ago
  https://en.wikipedia.org/wiki/Defense_in_depth_(computing) https://en.wikipedia.org/wiki/Defense_in_depth_(computing)
  - roca 10y ago
    does not mean that the answer to "should I install this 'security' product?" is always "yes".
    - lmm 10y ago
      It does mean that "the server should stop x anyway" is not a reason for the client not to prevent x.
mynameisvlad 10y ago
Have you actually tired Defender and tested it out against Kaspersky? Nobody is telling you to rely on just Office's security features; Defender is a full fledged AV product built into Windows. I believe it and System Center Endpoint Protection are essentially the same product, and in fact, in Windows 10 Defender just applies SCEP policies instead of installing a new program.
madshiva 10y ago
You should setup and remove the virus at the source, from the mail server. End users should never receive these mail. Also this is a bad habit to receive invoice from mail (who do that in that way?? in a word docx?
hannob 10y ago
For managed networks you should configure Application Whitelisting. Users simply shouldn't be able to click on something and execute it.
lorenzhs 10y ago
Does anyone on your network have a valid reason to execute Office macros? If not, disable them via group policy. Solves so many problems. See what @SwiftOnSecurity has to say on the topic, they manage thousands of users and it seems to work excellently.
- sp332 10y ago
  This is the site she runs, with configuration guides. https://decentsecurity.com/ https://decentsecurity.com/
emodendroket 10y ago
Wouldn't it be preferable to catch those on the e-mail server?

by chime 10y ago

hueving 10y ago

Does Microsoft security essentials not scan an attachment when you download/open it?

beefhash 10y ago

Are you the target audience for this blog post, though? As far as I can tell, the post talks about one-user setups. I'd argue that the starting point in a corporate environment, where you can assume that users can be quite negligent, is fundamentally different from a one-user setup, especially since I agree that you can't "fix" the user in corporate. You want the e-mails gone, not just a warning about it, but a warning is perfectly fine if you're one person and have an idea what you're doing.

Angostura 10y ago
I don't see any caveats in the article about the kind of user that the advice is intended for.
- frozenport 10y ago
  In your case, the av can run on the Linux mail server.

shultays 10y ago

> Invoice-Jan-2017.docx uh, docx files can hack my PC now? Is this a bug of MS Word or docx format really has ability to become a virus?

spinsser 10y ago
It is a feature [0]. Microsoft office products allow for "macros" which are Visual Basic code embedded within a document or a worksheet that can be used by developers to add extra functionalities to their MS files (e.g. validate all data in a work sheet after a user clicks a specific button in the worksheet). Just like any programming language, it could be used maliciously, and there is no easy way to distinguish which macro-enabled file is safe and which isn't (without going through the code yourself prior to enabling the functionality) [0] https://support.office.com/en-us/article/Enable-or-disable-macros-in-Office-files-12b036fd-d140-4e74-b45e-16fed1a7e5c6 https://support.office.com/en-us/article/Enable-or-disable-m...
- emodendroket 10y ago
  For this exact reason docx macros are disabled by default and you have to do some enabling. Presumably there are also more sophisticated exploits that don't rely on the user dismissing multiple security warnings.
  - chime 10y ago
    These viruses show a blank docx file in macro-disabled mode with only one image, which says "Enable macros to view secure invoice" and shows a picture guide on how to enable macros. Some of them have better instructions than the user guides I write for my users.
    - emodendroket 10y ago
      Still, some user intervention is required. Assuming you found a vulnerability in Office, it'd be preferable to have a vector where the user just had to open the file.

detaro 10y ago

Do you scan on the endpoints or centralized on the mail server?

roca 10y ago

Email attachments should be scanned by the mail server.

gtirloni 10y ago
https://en.wikipedia.org/wiki/Defense_in_depth_(computing) https://en.wikipedia.org/wiki/Defense_in_depth_(computing)
- roca 10y ago
  does not mean that the answer to "should I install this 'security' product?" is always "yes".
  - lmm 10y ago
    It does mean that "the server should stop x anyway" is not a reason for the client not to prevent x.

mynameisvlad 10y ago

Have you actually tired Defender and tested it out against Kaspersky? Nobody is telling you to rely on just Office's security features; Defender is a full fledged AV product built into Windows. I believe it and System Center Endpoint Protection are essentially the same product, and in fact, in Windows 10 Defender just applies SCEP policies instead of installing a new program.

madshiva 10y ago

You should setup and remove the virus at the source, from the mail server. End users should never receive these mail. Also this is a bad habit to receive invoice from mail (who do that in that way?? in a word docx?

hannob 10y ago

For managed networks you should configure Application Whitelisting. Users simply shouldn't be able to click on something and execute it.

lorenzhs 10y ago

Does anyone on your network have a valid reason to execute Office macros? If not, disable them via group policy. Solves so many problems. See what @SwiftOnSecurity has to say on the topic, they manage thousands of users and it seems to work excellently.

sp332 10y ago
This is the site she runs, with configuration guides. https://decentsecurity.com/ https://decentsecurity.com/

emodendroket 10y ago

Wouldn't it be preferable to catch those on the e-mail server?