4 ms·

Most companies don't, for actual executables (PE files) and scripts. So for example: 1. Attackers use documents, because it isn't realistic to disallow documen

Most companies don't, for actual executables (PE files) and scripts. So for example: 1. Attackers use documents, because it isn't realistic to disallow documents over email as a matter of policy. 2. Attackers use download links (Box, OneDrive, etc.), because it isn't realistic to disallow URLs in email as a matter of policy. 3. Attackers put the naughty bits in password-protected archives, which aren't realistic for most companies to disallow over email as a matter of policy. Some will, though. On and on. Policy is great and you should use it as much as possible, but at some point usability always wins out. Obviously there's a business opportunity there, and companies like Proofpoint and Mimecast have stepped in to fill the gap.

tinus_hn 7y ago
Pretty easy to defeat: downloaded and extracted executables are quarantined. And documents can’t ‘drop and run scripts’, they are documents. And by the way, try sending a password protected archive in the mail once. Most services just throw them away.
- FreakLegion 7y ago
  > downloaded and extracted executables are quarantined The vast majority of companies won't implement a security policy that strict, even if they can distinguish email attachment downloads from other sources, which they generally can't (ADS doesn't capture it directly). > And documents can’t ‘drop and run scripts’, they are documents Yes they can, and do, without needing exploits, for both legitimate and illegitimate reasons. The legitimate reasons are why, again, the vast majority of companies won't implement blanket security policies here. > And by the way, try sending a password protected archive in the mail once. Most services just throw them away. Incorrect. You can do whatever you want with your personal email, but we're talking about enterprise security. Few companies (but more than the above two cases) will block password-protected anything as a matter of policy. In practice, none of what you're saying will be done because of the downstream problems it creates for IT and security teams.
  - codedokode 7y ago
    > The vast majority of companies won't implement a security policy that strict Maybe such policy should be the default; by default the employee should be able to run only applications installed (or approved) by their sysadmin, and applications are sandboxed like Android's ones. In 80s when DOS was developed, there were no easy access to the Internet, no phishing letters and viruses, so there were no risk in running different executables. But today this outdated security model simply doesn't work. You allow employees to download and run executables and they open "yearly-report.doc.exe". Maybe desktop system developers should look at iPhones and Androids. It is difficult to dowload and run a virus on an iPhone; and it doesn't require the user to deal with configuration settings - it works out of the box. Something similar could be done for desktop systems: a pre-approved catalog of known "good" software and a simple UI (that doesn't require special skills) to whitelist any other software. Also, I think that applications and documents should look different; today you can assign an icon of Word document to an executable; running an executable is indistinguishable from opening a document; that's wrong. Maybe applications should be located only in special application directory and run from there.
  - tinus_hn 7y ago
    > The vast majority of companies won't implement a security policy that strict That’s what Windows does. You can’t not implement it.

tinus_hn 7y ago

Pretty easy to defeat: downloaded and extracted executables are quarantined. And documents can’t ‘drop and run scripts’, they are documents. And by the way, try sending a password protected archive in the mail once. Most services just throw them away.

FreakLegion 7y ago
> downloaded and extracted executables are quarantined The vast majority of companies won't implement a security policy that strict, even if they can distinguish email attachment downloads from other sources, which they generally can't (ADS doesn't capture it directly). > And documents can’t ‘drop and run scripts’, they are documents Yes they can, and do, without needing exploits, for both legitimate and illegitimate reasons. The legitimate reasons are why, again, the vast majority of companies won't implement blanket security policies here. > And by the way, try sending a password protected archive in the mail once. Most services just throw them away. Incorrect. You can do whatever you want with your personal email, but we're talking about enterprise security. Few companies (but more than the above two cases) will block password-protected anything as a matter of policy. In practice, none of what you're saying will be done because of the downstream problems it creates for IT and security teams.
- codedokode 7y ago
  > The vast majority of companies won't implement a security policy that strict Maybe such policy should be the default; by default the employee should be able to run only applications installed (or approved) by their sysadmin, and applications are sandboxed like Android's ones. In 80s when DOS was developed, there were no easy access to the Internet, no phishing letters and viruses, so there were no risk in running different executables. But today this outdated security model simply doesn't work. You allow employees to download and run executables and they open "yearly-report.doc.exe". Maybe desktop system developers should look at iPhones and Androids. It is difficult to dowload and run a virus on an iPhone; and it doesn't require the user to deal with configuration settings - it works out of the box. Something similar could be done for desktop systems: a pre-approved catalog of known "good" software and a simple UI (that doesn't require special skills) to whitelist any other software. Also, I think that applications and documents should look different; today you can assign an icon of Word document to an executable; running an executable is indistinguishable from opening a document; that's wrong. Maybe applications should be located only in special application directory and run from there.
- tinus_hn 7y ago
  > The vast majority of companies won't implement a security policy that strict That’s what Windows does. You can’t not implement it.