4 ms·

I agree, the problem however is that threats are constantly evolving and getting more complicated. Even most IT people don't understand the threats properly (I

by jiggy2011 14y ago

I agree, the problem however is that threats are constantly evolving and getting more complicated. Even most IT people don't understand the threats properly (I know I struggle). It used to be that could just tell people to install a security suite on their computer and they'd be mostly OK. I don't think that's really true any longer. You could also partly lay the blame at Microsoft's door in getting users to start connecting to internet with an OS designed without any reasonable security (Windows 95). Now that we have operating systems with better security it's hard to change people's usage patterns to take advantage of that.

jessriedel 14y ago
If she has Microsoft Security Essentials installed, doesn't run unknown software, and doesn't give out her password, what more could my mother, as a layman, reasonably be expected to do? I understand there are all sorts of complicated steps she could take if she had good intuition about sniffing out bad guys, but she doesn't. Isn't the problem with the crappy software, not her?
- jiggy2011 14y ago
  The fundamental problem is that bad guys can come up with new attack methods faster than we can educate or produce reliable user friendly software to counter their methods. Even a sophisticated user is just as vulnerable in many cases. If I give personal information to a third party site that I presume to be trustworthy (say a government site) there's no way I can know if someone is going to find SQLi vulnerabilities in that site next week and exfiltrate all of that data.
  - MacsHeadroom 14y ago
    Speaking of such, I just recently accidentally happened across an SQLi vulnerability on a government site containing confidential information of tens of millions of people. That's just the way the Internet is right now.
  - peterwwillis 14y ago
    New attack methods are not the problem. If there is new technology there will always be a new attack method. Right now the existing attack methods are the problem. Specifically, that technology is being developed using the same lack of basic security standards and thus the same old attacks keep working. SQLi should not be a thing. At all. It's the most trivial fucking thing in the world to validate data before you use it in an SQL query, and people get it wrong, every single day. Security isn't hard, it's just tedious.
- sp332 14y ago
  Use a router that monitors spikes in traffic. Check the logs occasionally (weekly?). Turn the computer off when you're not using it.
  - jiggy2011 14y ago
    My traffic has lots of spikes. Some days I download HD video, some days I don't. If I look at the logs, it's all connections to CDNs with weird hostnames. How do I know which ones are legit and which ones might be part of a DDOS? Also CC numbers are 16 bytes long, would just get lost in all the noise..
    - sp332 14y ago
      Maybe I should say, spikes in outgoing traffic. The internet is not safe for banking, and I don't see any way it can be made safe.
      - leethax0r 14y ago
        It is safe for banking. Have you heard of encryption?
        danielweber 14y ago
        That is assuming your endpoint is secure. Most people's personal finance is probably safe to do on the Internet because of legal requirements on banks. Small businesses are another matter.
        sp332 14y ago
        Oh, encryption. Why didn't anyone else think of that! Have you noticed the spate of attacks against SSL lately? BEAST, CRIME, Lucky 13, RC4 in general? https://en.wikipedia.org/wiki/BEAST_%28computer_security%29#BEAST_attack https://en.wikipedia.org/wiki/BEAST_%28computer_security%29#... Not profitable for some things, maybe, but definitely worth mounting such an attack for banking info. Have you noticed that the certificate authority system is totally broken? http://www.theregister.co.uk/2011/04/11/state_of_ssl_analysis/ http://www.theregister.co.uk/2011/04/11/state_of_ssl_analysi... Heard of DigiNotar? Comodo? http://arstechnica.com/security/2011/09/comodo-hacker-i-hacked-diginotar-too-other-cas-breached/ http://arstechnica.com/security/2011/09/comodo-hacker-i-hack... These aren't hypothetical attacks! Google got MITM'd by Iran https://blog.mozilla.org/security/2011/08/29/fraudulent-google-com-certificate/ https://blog.mozilla.org/security/2011/08/29/fraudulent-goog...
- freehunter 14y ago
  Reasonably? That's pretty much good. Add what another comment said about not giving out personal information, but having a good AV like MSSE, using automated Windows Updates, use an updated browser (even if it's just the latest version of IE), don't run untrusted software, and having strong passwords (using something like LastPass to remember them all but still retain convenience) is basically all you can reasonably ask an average user to do. And for the most part, that's good enough. Sure, there's evolving threats, there's drive-bys that will slip around all of this, there's ways attackers could still get through. But as scary as it all is, anything beyond these steps gets into the territory of major inconvenience. The problem with that is, the more intrusive and inconvenient the security becomes, the less likely people are going to be to actually use and remember their security practices. If mom can't repeat it at her book club, it's not going to be effective. And to be honest, these types of attacks that bypass these restrictions are exceedingly rare when it comes to mom and grandma. The biggest threat there is phishing and malware. Corporate security has professionals enforcing a policy that meets the business's own requirements. So to answer your question, yes, that's all you can reasonably do. In most cases, you'll be pretty well protected with just that, and those steps aren't too complicated to follow or remember.

jessriedel 14y ago

If she has Microsoft Security Essentials installed, doesn't run unknown software, and doesn't give out her password, what more could my mother, as a layman, reasonably be expected to do? I understand there are all sorts of complicated steps she could take if she had good intuition about sniffing out bad guys, but she doesn't. Isn't the problem with the crappy software, not her?

jiggy2011 14y ago
The fundamental problem is that bad guys can come up with new attack methods faster than we can educate or produce reliable user friendly software to counter their methods. Even a sophisticated user is just as vulnerable in many cases. If I give personal information to a third party site that I presume to be trustworthy (say a government site) there's no way I can know if someone is going to find SQLi vulnerabilities in that site next week and exfiltrate all of that data.
- MacsHeadroom 14y ago
  Speaking of such, I just recently accidentally happened across an SQLi vulnerability on a government site containing confidential information of tens of millions of people. That's just the way the Internet is right now.
- peterwwillis 14y ago
  New attack methods are not the problem. If there is new technology there will always be a new attack method. Right now the existing attack methods are the problem. Specifically, that technology is being developed using the same lack of basic security standards and thus the same old attacks keep working. SQLi should not be a thing. At all. It's the most trivial fucking thing in the world to validate data before you use it in an SQL query, and people get it wrong, every single day. Security isn't hard, it's just tedious.
sp332 14y ago
Use a router that monitors spikes in traffic. Check the logs occasionally (weekly?). Turn the computer off when you're not using it.
- jiggy2011 14y ago
  My traffic has lots of spikes. Some days I download HD video, some days I don't. If I look at the logs, it's all connections to CDNs with weird hostnames. How do I know which ones are legit and which ones might be part of a DDOS? Also CC numbers are 16 bytes long, would just get lost in all the noise..
  - sp332 14y ago
    Maybe I should say, spikes in outgoing traffic. The internet is not safe for banking, and I don't see any way it can be made safe.
    - leethax0r 14y ago
      It is safe for banking. Have you heard of encryption?
      - danielweber 14y ago
        That is assuming your endpoint is secure. Most people's personal finance is probably safe to do on the Internet because of legal requirements on banks. Small businesses are another matter.
      - sp332 14y ago
        Oh, encryption. Why didn't anyone else think of that! Have you noticed the spate of attacks against SSL lately? BEAST, CRIME, Lucky 13, RC4 in general? https://en.wikipedia.org/wiki/BEAST_%28computer_security%29#BEAST_attack https://en.wikipedia.org/wiki/BEAST_%28computer_security%29#... Not profitable for some things, maybe, but definitely worth mounting such an attack for banking info. Have you noticed that the certificate authority system is totally broken? http://www.theregister.co.uk/2011/04/11/state_of_ssl_analysis/ http://www.theregister.co.uk/2011/04/11/state_of_ssl_analysi... Heard of DigiNotar? Comodo? http://arstechnica.com/security/2011/09/comodo-hacker-i-hacked-diginotar-too-other-cas-breached/ http://arstechnica.com/security/2011/09/comodo-hacker-i-hack... These aren't hypothetical attacks! Google got MITM'd by Iran https://blog.mozilla.org/security/2011/08/29/fraudulent-google-com-certificate/ https://blog.mozilla.org/security/2011/08/29/fraudulent-goog...
freehunter 14y ago
Reasonably? That's pretty much good. Add what another comment said about not giving out personal information, but having a good AV like MSSE, using automated Windows Updates, use an updated browser (even if it's just the latest version of IE), don't run untrusted software, and having strong passwords (using something like LastPass to remember them all but still retain convenience) is basically all you can reasonably ask an average user to do. And for the most part, that's good enough. Sure, there's evolving threats, there's drive-bys that will slip around all of this, there's ways attackers could still get through. But as scary as it all is, anything beyond these steps gets into the territory of major inconvenience. The problem with that is, the more intrusive and inconvenient the security becomes, the less likely people are going to be to actually use and remember their security practices. If mom can't repeat it at her book club, it's not going to be effective. And to be honest, these types of attacks that bypass these restrictions are exceedingly rare when it comes to mom and grandma. The biggest threat there is phishing and malware. Corporate security has professionals enforcing a policy that meets the business's own requirements. So to answer your question, yes, that's all you can reasonably do. In most cases, you'll be pretty well protected with just that, and those steps aren't too complicated to follow or remember.