> > There's no chance that my firm would ever trust our security to Microsoft.
> > For a individual end-user, their firewall and antivirus solution *may* be
[quoted text clipped - 49 lines]
>
> Ken
> Exactly, for simple end users that don't know (or care) any better, the the
> MS solution would probably work for them. With you being a single user with
> a single computer (hopefully behind a hardware firewall/router), you can
> think that MS offers sufficient security and you may be right. With me in an
> NetAdmin of a large firm, I know that isn't the case. It's all about scope.
Of course, as a NetAdmin, you need to worry about lots of people who are
complete novices (or dumbasses, like my younger brother) when it comes to
security. Thus, I fully understand where you are coming from.
> MS has made great strides in trying to make their products more secure.
> However, they do still have a ways to go, it simply takes time. That is why
[quoted text clipped - 11 lines]
> your personal data on your PC). Other professional products will alert you
> about this.
I don't know whether the old ICF started up prior to the login point (in
fairness, I think it did, but I can't remember), but I do remember that it
was not turned on by default. And neither the old ICF nor the new and
improved Windows Firewall block outbound communications. If you want the
additional feature of blocking outbound communications with your firewall,
you will need a third party firewall -- and I have no problem recommending
one for anyone who is a security novice. That's not me. My strategy, which
has worked 100% for years, is to be proactive, i.e. to use other software
(antivirus and antispyware) to block the crudware from getting on my machine
in the first place, and to stay fully informed and up to date on what I user
need to do to prevent security breaches, e.g. configuring IE and Outlook to
stop malware from installing on my machine without my knowledge or consent.
> You're arguement about bells and whistles is actually ironic. I've always
> thought of MS as a company that cared more about making something 'pretty' as
> opposed to making it work. Looks at Windows XP... They spend a lot of money
> making it dumbed down and pretty. (fading menus, mouse
> shadows, beeps and sounds everywhere, 'clippy' the paperclip', etc).
True enough. :) I always turn that stuff off whenever I can.
> Security has actually been after thought of sorts (because it wasn't a huge deal in the
> past. It's was more of a culture thing than a MS thing in my opinion). That's one of
[quoted text clipped - 5 lines]
> 009.mspx). It's just the nature of the best. One benefit of 'professional products' is
> they don't always rely on MS's potentionally buggy code base.
All this is true, but it is fair to say that at least since SP1, security is
now on everyone's radar screen, especially Microsoft's. And it is more so
with each passing week and month, it seems.
> MS knows a lot. I would never take that away from them. However, I would
> never be as careless as to say "I don't think anyone on the planet knows more
> about security issues with Windows XP than Microsoft". I would think those
> companies directly involved with viruses know more abotu viruses than MS,
> same is true about companies that are involves with firewalls day in and day
> out.
I'm still not sure that my statement is incorrect, although obviously it is
merely an opinion rather than a statement of known fact. Of course companies
that specialize in particular areas, such as viruses, are going to know more
about their specialized field than Microsoft. But Microsoft is going to know
much more about how these virus products (to continue with your example)
interact with the OS, for better or worse. More generally, Microsoft is
going to know more about how to strike the most reasonable balance between
performance requirements, stability requirements, and security requirements.
There is much more to computing than security, which is why I say again that
the goal of security should be to be secure enough. Every computer need not
be the equivalent of Fort Knox, just good enough to stop malware peddlers
from ruining computing for the rest of us. Security is like food: you need a
certain amount, but if you eat too much you get fat, start slowing down, and
start experiencing health problems.
> Again, back to my original point.. MS's Antivirus and Firewall products
> will probably be just fine for the common end user.
And in all fairness, that's me, although I consider myself more
knowledgeable than most such users.
>But from a corp prospective, there's no way we'd risk our network until after at least a
>year or two.... until the reports came back on how good it is. In the mean time,
> I strongly recommand a good firewall for it can help you gaurd against MS's
> bugs. I also recommand a good virus scanner because it can help you guard
> against yourself (running viruses without thinking).
I can't really disagree here, except that for a person like me Windows
Firewall is plenty good enough and I have used it without a hitch since SP2
came out in public beta.
Ken
CB - 18 Feb 2005 00:37 GMT
Ahh.. here's the quote I was looking for. ICF wasn't disabled until logon,
there was a time lapse at boot between when the system started accepting
network request, and when the ICF kicked in:
<quote>
# Boot time security. (On PC's running Windows XP Service pack 1, there is a
window of time between when your PC can "see" the network and when Windows
Firewall provides protection. This results in the ability for a "packet(s)"
of data to be received and delivered to a service without Windows Firewall
performing ANY filtering. This potentially exposes YOUR computer to
vulnerabilities. In Windows XP Service Pack 2, this vulnerability has been
stopped using a new "policy" that works during boot up. However, there is no
boot-time security if Windows Firewall is disabled.)
</quote>
I just found this funny in the fact that it came out just today:
http://seattlepi.nwsource.com/business/212437_rsaclarke17.html
I just happened to run across it.
Personaly, I think MS should implement a new feature to where if an end user
doesn't stay up to date with windowsupdate.com, that a big burly guy with
come to their house and smack them around a bit, heh.
> > Exactly, for simple end users that don't know (or care) any better, the the
> > MS solution would probably work for them. With you being a single user with
[quoted text clipped - 97 lines]
>
> Ken
Ken Gardner - 18 Feb 2005 02:33 GMT
> Personaly, I think MS should implement a new feature to where if an end user
> doesn't stay up to date with windowsupdate.com, that a big burly guy with
> come to their house and smack them around a bit, heh.
To within about four inches of his life. :)
Ken
chipmeister - 28 Feb 2006 17:16 GMT
Ken, CB, and everyone else,
In reading this I just couldn't help but laugh. Not just at the
conversations between Den and CB but at the topic.
We all know that Microsoft isn't in the business of data security...right!?!
And we all know that the base of this problem is (as was mentioned earlier)
that Microsoft needs to fix their code.
Now with those two statements let me say, as a security professional I would
never expect anyone to rely on the security technologies of a company who
doesn't have security as their core focus. Lets look at McAfee for example,
they sold off those technologies that didn't fit their goal of being security
focused. Magic Helpdesk and Sniffer didn't fit the security model and were
taking focus away from the core business of security. Through all the
challenges and changes made over the past few years McAfee has evolved to be
the industries only "pure play" security company.
Don't get me wrong, I am not saying to only use McAfee. I'm just saying we
need to call a spade a spade. The comparison needs to be apple to apples,
not apples to oranges.
MS is trying and will most likely have an okay or "good enough" solution in
a couple of years. Thus the promise of security in the upcoming Vista
release. But I for one will always utilize a third party firewall/IPS and AV
solution for both corporate and personal use.
> > Personaly, I think MS should implement a new feature to where if an end user
> > doesn't stay up to date with windowsupdate.com, that a big burly guy with
[quoted text clipped - 3 lines]
>
> Ken