Bad Security Habits
|
When people who know better don't act responsibly, who do you trust? |
Over the New Year's holiday, we visited some friends. The husband is a small-organization IT manager--the equivalent of a CIO at a much larger operation.
His wife keeps a blog and reads others but knew nothing about RSS feeds. In the process of helping her set up a feed reader, I observed that the Windows XP Security Center icon flashed red and warned that anti-virus software wasn't detected.
Later on, I warned my friend that there might be some problem with the anti-virus software on his wife's computer. "Oh, it doesn't have any," he replied. "My God," I thought. "This is a network administrator for 50 people!"
When asked why his wife's computer had no security software, he shrugged and said that it was too much trouble. "Why bother?" he asked.
I understand that some people don't like to bring their work home and that maybe administering the home network might seem too much like the day job. But, c'mon, he of all people should know better.
In this day of increasing Internet dangers, what's good enough for work absolutely is good enough for home. My friend's attitude is appalling, and I hope we'll still be friends after he reads this post.
Companies like Microsoft have security policies for their own operations, which often extend to mobile employees using remote equipment. But why not further extend those policies to the employees and provide the means to comply? I'm convinced that one way to diminish the botnet threat is for corporations to provide free security software for their employees' home computers.
I know that at least McAfee offers this kind of option. There is opportunity under some site licenses for businesses to provide security software to their employees for home use. But few customers take advantage of the opportunity.
A further step--and one that would mean a short-term public relations blow--would be for Microsoft to mandate security software for some of its products. No security software, no installation. Such action would lead to strong blog and news media reaction, if not some customers.
If Microsoft feels strongly enough about forcing consumers to validate that Windows is genuine--and take some hefty negativity in the process--surely the company can do something to ensure customers are better-protected. The wrong response, by the way, would be Microsoft requiring its own security products, such as Windows Live OneCare, for installation but not competing products (Microsoft released Windows Live OneCare 1.5 to manufacturing yesterday, by the way).
Microsoft owns the software, not the buyers. Microsoft sells the software with a perpetual license, while retaining ownership. I've argued before that this makes Microsoft a landlord, who should take more responsibility for protecting its property--and the renters within--from Internet marauders.
Good policies can help overcome people's bad habits.
One worrisome bad habit: unprotected Macs. I don't know a single Mac user--and it's a long list--that uses security software beyond anti-virus, and I can count on two hands the users with AV. More worrisome: I've seen a goodly number of Macs in corporate environments without security software. The IT managers load up Windows with security software, but like my friend, some take a "why bother" attitude about Macs.
The Month of Apple Bugs should be a real test of Mac OS X's security resilience. Even for exploits for which Macs may seem immune, they can still be carriers that infect other operating systems or their applications.
That said, the presumption that Macs are immune to malware is another bad security habit. Every IT manager that lived through the "I Love You" virus should think again about "why bother." A successful malware attack can quickly sweep across unprotected computer populations. With I Love You, bad habits about file attachment handling led to the virus' fast propogation.
When the hammer falls, it will hit Apple hard. Microsoft will always take more of the blame, though, in part because so many more people use its products. Some of Microsoft's bad reputation is undeserved because people have bad security habits. I keep wondering: How often does my friend patch his businesses' desktops and servers?
"Why bother" would be the wrong answer.
Comments (14)
Joe,
I've been in the software industry for the last 15 years and would consider myself an expert in all things software. However, I really don't understand what your beef is.
To give you an example, my parents have had a computer for the last 4 years. Until recently, the haven't had a Virus Scanner on their (Windows)PC and I only installed it for them recently because they've asked me to.
They've been using their PC to surf the Net and send/read email, they've installed software on it (based on my recommendation) and they manage their photos with it. They really aren't very computer savvy, however, I've given them a set of basic rules that they follow, in order to avoid running into any malware.
After installing the VS, I did a quick scan just for the heck of it. As expected, it came up finding nothing. Call me lucky but I've seen the same result with my own (private) computers over the years.
My point is that scanners only kick in when it's too late anyway. Education, however, will (successfully) prevent you from running into problems in the first place. Maybe that's what your friend's tinking ...
Heiko.
Posted by Heiko | January 4, 2007 1:29 PM
Heiko is right, i know plenty of IT managers that dont use anti-virus. They dont open email attachments or use P2P networks, and never have a problem. Most of the time a virus scanner is really helpful at telling you that you have a virus, but pretty weak when it comes to removing it.
Posted by matt | January 4, 2007 1:43 PM
Heiko, Matt,
There was no security software on this computer of any kind. Would you react differently if I said that his wife visited sites like AllofMP3.com?
What if her computer became infected with a keylogger and he used that PC to access his corporate network?
Thanks,
Joe
Posted by Joe | January 4, 2007 2:20 PM
It just seems like a virus should not be able to run in the first place on a well-designed system. In a perfectly designed system, AV software would not need to exist even if users used p2p networks and other virus infested places. When you consider the number of viruses on windows compared to the number of viruses on mac/linux, it makes you realize how much this is true. I guess I would never pay for AV software. It just seems like I'm paying for something I shouldn't have to have anyway. I'll use free AV software though, but it annoys me.
Phil
Posted by Phil | January 4, 2007 3:29 PM
I must agree with Heiko and Matt. My own desktop has no antivirus [just Zonelab's firewall]. My wife's laptop computer came with Norton Antivirus preinstalled. She just does office stuff with it. No MP3, no warez no scene. Two months after buying it the protable started to come out of hybernation for no reason at all. Norton Antivirus could not find anything wrong with it even after downloading all updates. After some digging with sysinternals' utilities I found an keylogger that has been modified by somebody, just enough that it would not be recognized by AV software. I downloaded Panda and MCafee and neither one of the products found anything wrong with the computer. I had to remove the keylogger by hand from the recovery console.
Two days later, Norton Antivirus asked me if I wanted to renew the subscription for just $60. I answered by uninstalling.
AV software is always a step behind viruses, just because of the way it is written. Slows down your computer and that's it.
Security needs to come from the application and, as Joe said from people themselves that have to maintain good security habits; change passwords often, keep passwords separate, practice safe browsing, get a good email client that does not launch just everything (Opera is my favorite).
Security software often gives you a false sense of safety when it really does not protect you. And more often than not can be exploited to gain access to your computer, thus creating a new entry for malware.
Posted by Antonio | January 4, 2007 4:31 PM
Joe, have to disagree with you about your view on AV software. AV companies are nothing but scaremongers when it comes to educating the public about the threat of viruses. I stopped using AV software years ago because I found it to be of no use whatsoever if you ever DID get infected by a virus. Subsequent tests using different AV software and a selection of virus variants I manager to acquire enlightened me to how poor AV software is at removing the virus from an infected machine. Frankly AV software isn't worth the resources it consumes.
The best form of defence against viruses is plain common sense. Then I wouldn't browse then internet using Internet Explorer - EVER! I also ensure I perform regular backups. I also have a hardware firewall on the router and a software firewall on the systems. Finally I also install a good HOSTS file.
If people get a virus or a trojan from looking for pirated warez off a p2p site then no AV software in the world is going to save them. It might warn them, but by then its too late anyway and a reformat is all that's going to save them.
If your not visiting dodgy websites or downloading warez or opening email attachments you never requested why on Earth do you need AV software?
Horse. Stable. Gate. Bolted.
Posted by William | January 4, 2007 5:58 PM
With all due respect, the previous posters are missing the point.
Antivirus software is one part of a defense in depth strategy in today's computing environment. Along with keeping all installed software updated (patching), running as a non-admin, and practicing safe computing, antivirus is another layer of protection in that strategy. Take away one of the layers and a system is not as secure as it otherwise could be.
Is your home safer from intrusion by having the doors locked? How about the windows? How about a burglar alarm? How about fire protection (smoke alarms, etc.)? They are all part of the equation and each adds to the level of protection.
Any IT Admin worth his salt understands this. Obviously, many like this IT Manager don't have a clue.
All in all, it's about risk management and taking steps to mitigate those risks.
Posted by Tim | January 4, 2007 8:50 PM
AV software is one of several layers of protection. Educating users, and staff is another. I recall a user calling me into her office for my opinion on if she should open an email attachment out of curiosity.
I told her if she didn't know the sender, and she didn't request it, not to open any email if she didn't know the source.
This was my first realization that many people are not security savvy when it comes to computers..."ooooh, 'click'"
The other disturbing thing is the IT manager took no interest in security either. With a 150+ Netware/Windows environment there were no policies, or systems in place for applying patches/updates centrally. A user could turn on/off automatic updates, some weren't sure if they should apply the updates, and some didn't want the updagtes...and everyone had admin privileges.
I admit that I introduced a worm into the network from an unchecked laptop...wasn't thinking, ouch!
The calls came it, but it was quickly contained. The worm infected about ~10-15% of the computers, because although I was discouraged from spending extra time on 5 minute trouble tickets, I patched every system I visited.
The firewall couldn't stop inside attacks.
I learned a hard lesson. I'm all for layers of security which includes training staff, and users.
Posted by Darrick | January 5, 2007 7:18 AM
Just because anti-virus software isn't perfect is no reason to go without it. Those who complain of it slowing down their system should keep in mind how slow their system will be with a bunch of malware in place. They should also research the vendors, as there are several who are much less onerous and more effective than the old stalwarts.
So far as Macs go, the only widely available AV tool is Symantec, and it causes more problems than it solves (in my experience anyway). I wish some of the better AV providers (are you listening, Kaspersky and Trend?) would provide consumer level versions for OS-X.
Posted by TonyH | January 5, 2007 9:23 AM
It seems to me that having AV software tends to make people complacent. Perhaps this is the reason why the my.doom and blaster worms had not affect on me (without my AV software), yet decimated my friends systems (who did).
Besides, AV software is only as good as its virus signatures. Unless your connected to your AV company by an umbilical cord your always going to be at risk of viruses anyway. And your AV company isn't going to be the first place a Virus writer is going to send his wares.
Besides, no amount of AV software will stop social engineering.
Posted by William | January 5, 2007 2:56 PM
A good defense is a layered defense. The problem is : how much system resources are you going to use in preventing/fixing a malware attack? Most AV today suck at removing malware and are resource hogs. You don't get value.
I added a layer by putting a firewall enabled all-in-one modem/router/switch/WiFi on the system.
Then we have the ZA incompatibility issue on the system. Lets face it, vendor products do not play well together. When that happens, the end-user either spends time on the phone or chucks the software.
Make it convienient for the end-user to use ( ideally, transparent ) and the end-user will use it.
Posted by Art | January 5, 2007 5:42 PM
Joe, just because someone doesn't like bloatware doesn't necessarily mean (although it can) that they're an irresponsible user. I've been a daily online computer user for two decades and I've never in my life used anti-virus software, or a client firewall, and I run anti-malware and anti-adware software at most once a year. And yet I have *never* had one of my many dozens of computers infected with a virus, malware, trojan, or botnet client, nor do I need to "R"e-install my systems except when they're brand new. Really it all comes down to common sense.
I don't install software unless it's from a trusted source, and I avoid like the plague any software that sounds too good to be true. I don't use IE or a POP3 e-mail client, I long ago added a simple hardware firewall between my LAN and the internet, and I keep my systems current with patches. It's truly amazing how many layers of electronic bloatware protection can be replaced by a little bit of education and common sense. I'm not sure if your friend was an idiot or a savant, but it's incorrect to assume that just because someone doesn't run A/V software that they must be a fool.
Posted by coupland | January 5, 2007 11:45 PM
First, I quit using Norton AV in 2001 because it was such a resource hog. I then switched to Panda, which I keep up to date. There are two AV vendors that I do not recommend and they are Norton and McAfee because these programs are not only resource hogs but they are know for creating problems for users.
I have been impressed with Kaspersky and I am planning on trying it out on one of my computers, when my AV expires. Kaspersky includes all forms of malware (Spyware, etc.) in their AV package.
I endorse the layered approach to security, educating users and deploying best practices.
As a member of a non-profit group, I discovered with horror that our system administrator had decided that our servers didn't need either a hardware firewall or AV or any security. Both of these servers were connected to the internet's backbone and lo and behold both were infected. Our newest server had to be completely rebuilt.
For the people who say that they don't need AV or security measures because they have never been infected, I would ask them these questions.
Would you go without homeowners insurance because you have never had a fire or a break-in in your home? Same goes for health insurance and car insurance?
If these network administrators - CIOs felt that they could lose their jobs because of their security practices, I bet that some of them would clean up their act super fast. Sooner or later, these bad practices may very well cost them their jobs.
BTW, all computers (including Macs) should have security software installed and users should be educated as to security best practices.
Posted by Linda | January 7, 2007 8:09 AM
For most home systems, splitting OS, software, and data to different drives/partitions and keeping known good backups is a better (cheaper, faster, easier) solution than using AV or malware detection.
Most home systems get set up and rarely get new software added. If you are going to add new software, restore your OS/software backups, install the new software (preferably while off-line) and make new backups. With a disk-based backup system this is not even terribly time consuming.
If your system starts acting up, or you suspect a problem, restore everything.
The hard part is ensuring that data is kept separate and backed up regularly.
This would probably work well in most corporate environments also, but the logistics might be a problem.
Posted by JimFive | January 10, 2007 11:20 AM