Comments on: Are We Less Secure Now Than Before?

By: Operating Systems Security: Year 2007 Vulnerability Report | Computer Security

Thu, 10 Apr 2008 00:50:50 +0000

[...] Derek Schatz says it best when it may be possible to think about a relative security nirvana by patching your Operating System diligently, locking down the configuration and being careful with where you surf and what you trust on the Internet. For the average user, it is hard to make an OS secure but at the same time preserving usability, doesn’t matter whether the Operating System is Windows or Linux or Mac OS. None is measurably better than the other and they only differ in how many security researchers/ malicious hackers are paying attention to it. Sure, there are some really secure Operating Systems such as OpenBSD or Trusted Solaris, but how many of your applications would run on them, those required for desktop usage. [...]

By: Derek

Derek — Thu, 03 Apr 2008 17:53:11 +0000

@Martin:
Of course, the fundamental problem in security (indeed, in the military and counter-terrorism realms even more so) is that an attacker need only be successful once, while we the defenders need to be successful ALL THE TIME. My point is that the threats are getting really nasty, so even if your defenses are 99.99% effective the stuff that does get through can be devastating. Take spam, for example. Five years ago, spam was fairly benign. Annoying by it’s volume, but still benign. Now, phishing and malware threats are being carried in spam messages, so a user opening just one message by accident can cause a rootkit infection, and perhaps even a broader network outbreak.

By: Martin

Martin — Thu, 27 Mar 2008 14:35:30 +0000

Security will never get perfect. Maybe security will never even be better and we have to fight to just keep it at the same level.

Maybe you have cherrypicked one the weakest links in our current ICT world so it looks we are getting worse in “all” aspects. One could cherrypick the things we are getting (almost) right and prove otherwise?

The spam thing… the network is definitely getting more and more of it… but how many of them reach the destination mailboxes? More of it or less? Personally, I’m getting less spam than I was some 3-5 years ago… So, is the problem worse or is better?

I am in ITsec for 8 years and I must admit that I don’t feel safer today than I was years ago (so I may agree with the original column after all). The question is if it isn’t just a POV of a security specialist – you are getting better, your world is getting bigger, you are naturaly interested in “bad” things and so – you are seeing more of them!

By: Scott Hicks

Scott Hicks — Tue, 18 Mar 2008 19:10:46 +0000

I think this is a great post, anything that raises the awareness out there of the dangers on the internet, and the face that they are only getting bigger is valuable in my opinion.

That being said, I do think more credit should be given with regards to spam, and spoofing preventative measures that different companies have been developing. DKIM and Sender IP to name are helping to increase the effectiveness of spam filters. Companies that focus on authentication measures, basically the BBB or Verisign of email are helping to build trusted white lists of corporate contacts.

From a technical standpoint, efforts are being made, and companies are taking more responsiblity on their side to protect and authenticate communications between themselves and their consumers.

It is the individuals that value convenience over security that are the prime targets at the moment, and until they are willing to take those extra few seconds to really look at what is in their inbox, then no technology solution is going to be a panacea to the spam problem.

Just my humble thoughts.