Marty
Guest
|
 |
A few notes on your 'security paper'.
« on: Mar 5th, 2002, 2:50pm » |
 Quote  Modify
 Remove
|
Hi Magnus,
Just a few notes on the paper in the subject. Please note, I mean everything with respect and no 'attack' is intended. I just want to clear a few issues up, which may help some people.
I'm quite amazed at the lack of ANY reference regarding NAT/Network Address Translation.
In todays technological world, and the ever increasing rise in popularity of Cable Modems and ADSL - more and more people are taking into account the security risks of the Internet, and are trying routers. If not for the ease of connection sharing, routers offer one VERY vital security measure, and that's network address translation. A machine behind a router will be 99.9% inpenetrable to trojans. This is because a trojan that installs itself on a machine behind a router/in a LAN and starts *listening* on a port, would only be listening on a PRIVATE address. This would be totally inaccessible from the Internet, and as such a victim would never be able to be compromised. There is of course a very very unlikely situation of a machine becoming compromised, and the router having the infected port being forwarded to the infected machine.
This would, in effect, make your product less useful and I can understand any willing lack of information.
The other real 'issue' I have with your paper is your over exaggeration of firewalls, in particular software ones.
Whilst I know nothing about your previous employment, technical expertise or any other tricks you've picked up during your time online, you seem like a man who knows a thing or two. I also consider myself to know a few things, here and there. Personally i'm disgusted with what seems to be a sometimes over-faithful trust in software firewalls.
We have to remember here that your average user base will be Windows users. This is strictly for the ease-of-use environment it has to offer. As such, the most commonly used firewall products would be either ZoneAlarm (tends to be the favourite, as it has a 'free' version) or Norton. There are others to consider, but these are the two primary candidates.
Having used both these products, I see *no* real configuration options. Which leads me onto this point, you say the following:
"As for the attacks that saturate your bandwidth, there is no final solution. If you have a firewall between your network and the Internet, you can probably configure it to start dropping packets if one single host suddenly starts sending you a large amount of data"
Now whilst I respect that from an advanced knowledge point of view, it's certainly possible to be running some form of IDS/deep stateful packet inspection on a host and for it to detect, trigger and block any extensive flooding from a source address - I challenge you to show me a product that can do this on a Windows machine.
I, personally, having used many many HOME software firewall packages (corporate ones are excluded), have found no such function available for home users.
Which leads me onto my final point.
Whilst I agree with most things your report points out, I think you really do need to make the differences clear between your 'basic' security measures and precautions available for limited platforms, ie Windows, and the more advanced such as Unix, Linux and the like.
Windows really does need a LOT more work done on it, security wise. The rate of advance is ever so much more slow, due to the lack of open source software.
This, along with the ever increasing rate of Internet growth.
With these facts in mind, I urge you to consider rewriting an article (maybe even writing it with somebody *cough*) to incorporate a few more Internet techniques such as NAT, Encryption(SSL), Proxies and the like. All these can drastically improve your own protection and some of them are *so* easy to use.
But fundamentally, I think it should be made clear what Windows can and *can't* do in terms of protection, and how you can get the maximum out of what you've got, sometimes with no extra cost.
On a side note, I'm pleased you've decided to develop software to help the lesser knowledgeable people of the Internet - more power to you!
Again, this post wasn't intended as a form of attack or plug - it was just some advice from one fanatic to another 
Take care.
|
|
 IP Logged |
|
|
|
Mischel Internet Security Forum
Reply
Notify of replies
Send Topic
Print
Author
Search
Members
Login
Register