Are the Days of Individual Security Over? 125
angry tapir writes "People solely relying on patching and upgrades are lulling themselves into a false sense of security, and individual protection is no longer sufficient in the age of multi-vector attacks, according to the president of the Australian Internet Industry Association. According to AIIA's Peter Coroneos, vendors need to intervene at the network level and provide security tools at multiple levels to help secure people from the variety of threats that are emerging."
*yawn* (Score:1)
Film at 11!
Re: (Score:3, Insightful)
the solution?
A monoculture of course!
and telling everyone that *someone else* is handling security for them.
Re: (Score:2)
No. Once we move everything into the cloud, all of this will be moot. The cloud uses SSL, for chrissake!
Re: (Score:3)
I'm convinced this article is simply FUD meant to push the insane content filters so desired by Australia's political class. You'll notice the site's name in cio.com.au. As pointed out down thread, the article basically proposes using "industry standards" as an end run around the legal hurdles Australian's leaders have encountered while trying to copy China's "Great Firewall".
We had another recent article explaining how the NSA decided that preventing intruders was impossible, instead concluding that secu
Re: (Score:2)
I agree that the article cited is of questionable value and use. However, I'm not sure EMV is the best example for demonstrating improved security through a modified end-user experience.
EMV may improve security some, but more importantly for the purveyors, it shifts liability... from Wikipedia "The supposed increased protection from fraud has allowed banks and credit card issuers to push through a 'liability shift' such that merchants are now liable (as from 1 January 2005 in the EU region) for any fraud
Re: (Score:2)
Interesting. Imho, any merchant not employing reasonably up to date fraud prevention system should be liable for more fraud. It's obviously evil to shift the liability onto the card holder though since liability was the only benefit they brought to the table to justify their transaction fees. If they really shifted off all their liability, we should all be switching to systems that exclude them, like bitcoin [bitcoin.org] or even ripple [wikipedia.org].
Re: (Score:2)
But I hope you do not imply that "Chip & PIN" are secure. It's better than the old system, granted, but this "better" is like the "better" you reply to the question how you're feeling after you've been at death's door.
Re: (Score:2)
In fact, another commenter pointed out that "Chip & PIN" is not universally better than the previous system because banks used it to push through liability for merchants who didn't use it. It's true however that the user experience of credit crds made any secure framework impossible.
Re: (Score:2)
Actually the bar was raised for the attacker. It's not trivially easy anymore, it's just easy.
Who mods this crud up? (Score:2)
The original statement is from the AIIA (Australian Internet Industry Association) which is made up by Australian ISP's (private companies) not the government.
Secondly, the AIIA have been instrumental in blocking some of the pants on head retarded legislation, including the aforementioned content filters.
Thirdly, the Australian ISP market is highly competitive, despite all the a
Oh and by the way..... (Score:4, Interesting)
"After you secure your network Mr. ISP, remember to filter out these websites." (hands over blacklist including playboy.com, domai.com, etc)
Re:Oh and by the way..... (Score:4, Insightful)
Oh yeah, and don't forget www.somefringepoliticalview.com, and while we're at it, www.theopposingpoliticalparty.com, and hey, I've heard that religious teachings are bad for kids, so how about www.christianity.com and www.jewish.com....
"They who can give up essential liberty to obtain a little temporary safety, deserve neither liberty nor safety." - one of the best quotes ever, from Benjamin Franklin, 1775.
Re: (Score:1)
Yeah, because major religions are soooo fucking endangered with the current ruling classes of the world.
Man, you really need to pull your head out of wherever you're keeping it.
Re: (Score:2)
Re: (Score:2)
This just screams out for a Godwin-like response.
Re: (Score:2)
"...and remember, kids -- Cthulhu fhtagn!"
Just for the record, I wholeheartedly support indiscriminate oppression of all religions.
and by the by (Score:2)
and one heeded less and less. Soon both police states and helicopter parents fretting over precious snowflakes may ban the quote altogether as blatant pre-9/11 thought crime.
Re: (Score:1)
Amen brother!
Re: (Score:2)
and?
i always thought it odd that the southern baptists denounce alcohol but their savior turned water into wine for a party.
Re: (Score:1)
Re: (Score:2)
Wine does not necessarily equal alcohol in the Bible. ;) It was not possible to get drunk on normal Jewish wine. What we consider wine today was called "strong drink."
Re: (Score:2)
Re:Oh and by the way..... (Score:4, Informative)
That's completely untrue despite being a common lie to justify modern alcohol taboos.
Wines were cut when served. The strength of the uncut wine was extremely dependent on the degree of delusion at the time of serving. The uncut wine was stronger than common table wines today. The cut wine was commonly stronger than your typical modern beer. Realistically, wine served then commonly had the alcohol content somewhere between modern beer and modern table wines.
Furthermore, as you can read in my post below, its believed one of the reasons Jesus was asked to create more wine is because they were not properly cutting the wine for the guests, making it extra potent.
Furthermore, it is well understood, the more drinks one had, traditionally, the less cut and therefore more potent the drink. This is because wines then had strong flavors of tar and pitch and cutting made it less offensive. But once had had become joyful, the need to cut the drink became substantially reduced. Such things don't happen, if as you suggest, intoxication is all but impossible.
There is what is commonly taught and widely believed from churches, and then there is the truth...
Re: (Score:2)
So, what you say is, essentially, that Jesus just watered down the too strong wine?
I didn't know our restaurant owners here are miracle workers!
Re: (Score:2)
>>>It was not possible to get drunk on normal Jewish wine
Abraham got drunk.
He slept with his daughters.
So I guess it IS possible to be inebriated on Biblical jewish wine.
Re: (Score:3)
Re: (Score:2)
Yup. Abraham got drunk and naked and shamed himself in front of his sons, or something.
Lots of boozing in the bible. _
Re: (Score:2)
i always thought it odd that the southern baptists denounce alcohol but their savior turned water into wine for a party.
That's because, like most established religions, they fabricate "facts" to support their political and societal ambitions. If you look, you'll find southern baptists were created when alcohol consumption in polite society was an issue as were concerns over slavery and tobacco production.
Furthermore, other denominations condemn alcohol on the basis that modern booze is far stronger and therefore not traditional. But that ignores that traditional wines were in fact, extremely potent, typically stronger than c
Re: (Score:2)
What's wrong with playboy.com or domai.com, from a security perspective?
should the ISP intervene? (Score:2, Insightful)
"vendors need to intervene at the network level"
Doesn't this seem like just another excuse to let networks censor material by just labeling it insecure?
Re: (Score:2)
Nice - looks like the early gestalt is agreeing this is weasel wording.
However, it's a race to see which is worse, censorship, hypertracking misdemeanors, selling higher grade user info, obfuscated blackmail, and more.
Re: (Score:2)
Depends on how "intervene" is defined within the document.
For example, ISPs with intrusion detection systems, up-to-date firewall and router patches, secure DNS (and if necessary DHCP) servers, minimum password standards for any webmail they provide, a policy of always digitally signing their e-mails to customers, protection against router table poisoning, and security on the BGP upstream routing links, etc, are unquestionably interfering at the network level.
I'd also consider them doing an adequate job.
The
Re: (Score:1)
More weasel words? (Score:5, Insightful)
Rule for the modern world.
1. Assume malice. Once you determine there's no malice, you can go back to your normal discussion.
"need to intervene at the network level and provide security tools at multiple levels to help secure people from the variety of threats that are emerging". That's one of the better ones lately. Ask yourself: what are these security tools capable of doing *besides* stopping viruses?
Re:More weasel words? (Score:4, Interesting)
Ask yourself: what are these security tools capable of doing *besides* stopping viruses?
Exactly. And yet they can give a user a false sense of security, so I dare say "security provided by ISPs" could even be part of the problem.
Have the days of individual security ever begun by the way? People "solely relying on patching and upgrades" were always lulling themselves etc., just not for the reasons suggested by Mr Moroneos: and not necessarily for Windows only (one word: rootkits), although it heroically stands as the most exploited target. Some of the worst threats are still represented by bad password policies -- or no password policies at all -- and vulnerability to social engineering. 15 years ago it was not called that, but there were examples in the wild back then. (What I recall on the fly is ILoveYou, but I'm sure somebody less lazy than me can come out with other examples from 1995-ish.) Some people will click the wrong link, open the wrong messages, etc.: ISPs cannot correct people's behaviour, unless in the horrific ways we can all imagine (see several of the comments here.)
Or is there something in TFA I didn't get? I confess the word "cloud" repeated every other line gave me a hard time understanding what the hell he was talking about.
Re:More weasel words? (Score:4)
Re: (Score:3)
Individual security isn't rocket science either. Last virus that I had end up running uncontrolled was the WDEF virus on the Mac, pre System 7. One can do some fairly simple measures so their individual security is up to par:
1: First and foremost backups. Not RAID. True backups with media rotated out. This way, if malware nails the drives and the backup media, restoring is still possible. Backups mean what would be at best a day long install-fest (finding the OS media, installing the OS, applications
Re: (Score:2)
Individual security isn't rocket science either.
Says the rocket scientist. For my mom it is a complete mystery.
Re: (Score:2)
Or is there something in TFA I didn't get? I confess the word "cloud" repeated every other line gave me a hard time understanding what the hell he was talking about.
I thought I was understanding him, until my brain bashed into this sentence:
"One credit union customer has been running end-point security for three years and has already experienced authentication token security.”
Whaaaaat???
Re: (Score:2)
I remember that incident. Their computer processor got thrown into an Nth complexity binary loop. It was horrible!
Re: (Score:2)
Nah. I say the best protection is not having anything worth stealing that's not in my head.
Re: (Score:2)
Quite hard. You have bandwidth and processing power, both worth stealing.
Re: (Score:2)
Yeah, you're right. But all I have to do is convince them that I've got nothing worth stealing.
Re: (Score:2)
As long as I can see a computer connected to the internet, there is something I want. For bandwidth, and an IP address that isn't mine.
Re: (Score:2)
You don't have to "reduce the value of your identity to zero", you only have to convince the bad guys that the value of your identity is zero.
Re: (Score:2)
Sorry, I disagree.
Hanlon's Razor belongs to an earlier age. Once the bigwigs discovered how much fun abusive super tracking is, the heuristic hit end of life.
The fact that you posted AC is telling.
Meanwhile viruses are not tigers. Whether Joe's comp is vulnerable has nothing to do with the security status of my machine.
No they don't! (Score:1)
I run a popular rolling release linux distro, by the time you clowns have identified a threat I'll be patched. I don't run flash or any proprietry software so you're not going to be helping there either.
In summary: This is not a valid excuse to sidestep privacy protections and intercept communications data with DPI kit.
In short: Fuck You!
Re: (Score:2)
Re: (Score:2)
Your network security is good, but physical security might need some work. It can't hurt to encrypt the backup disk (perhaps a TrueCrypt file is the most foolproof), and use some form of encryption for Ubuntu.
Of course, other types of security (Remington, Ruger, Smith & Wesson, Calico) can't hurt either.
Re: (Score:2)
Ok, this is coming from Australia (Score:3, Insightful)
So stop taking it seriously. They don't seem to have much respect for the individual in anything anymore:
http://en.wikipedia.org/wiki/Censorship_in_Australia [wikipedia.org]
This just looks like another power grab.
Re: (Score:1)
Lol! Australian Internet Industry Association? Who? Big time! Personally I'm not going to reconsider my views until I heard what the Scots have to say about this.
Re: (Score:2)
Hang on, folks... So we are supposed to care what Threni thinks about the AIIA? Who? Personally I'm not going to reconsider my views until I heard what pedo666 has to say about this.
Seriously, just because you haven't heard of an organization does not mean that you should simply discount their views. It only takes one person in the world to have an insightful thought, and it is most likely that you have never heard of that person before.
Re: (Score:2)
> It only takes one person in the world to have an insightful thought,
The last time that happened, the Vogons showed up.
no really, WTF Austrailia?! (Score:2)
In summary, grow a pair .
Great Firewall v2 (Score:4, Insightful)
GP had no clue. (Score:2)
Seems like another argument to take responsibility away from individual users. I'm sure it involves filtering domains that "may be virus vectors and may contain illegal content that the user is being protected from". Little "Great Firewalls" for each ISP? Considering that this is coming from Australia, it might be a part of yet another attempt to push for the creation of a Great Firewall at the ISP level, using "industry standards" to enforce it instead of a law that has to be approved and might be struck down.
Odd considering this man's stance [iia.net.au] on filtering (pretty similar to the stance of the entire ISP industry and most Aussies)
Q: Why do you oppose it?
For a number of reasons, the first is that we think that in terms of the way that the model is constructed, that it is not going to pick up the kind of content that people really do have issues with online. The volume of content that it is likely to pick up by virtue of the design of the filtering systems is really a drop in the ocean compared to the unsuitable content that is on the internet. And so the fear is that we will be creating a system where people believe that they are safer online, whereas in fact it will only be that content that people complain to the regulator about that is classified, combined perhaps with international input onto lists - but only a few thousand sites at best.
In other words the best you could say about the filter is that it will prevent inadvertent, accidental, access to a very limited number of sites, in the absence of any evidence whether anecdotal or empirical the people are accidentally coming across child pornography, bestiality, rape sites - the kind of sites that the government is seeking to dramatise here. Not in our experience, people are routinely bumping into.
A lot of the content that families really are concerned about for their children - things like violent material, racial hatred material, material which promotes race hate, maybe even just adult content that you wouldn't want your children to see, none of that will be picked up by this filtering solution.
Time to admit you dont know what you're on about.
Let's get the astroturfing out of the way (Score:4, Funny)
It's early in the thread, so I'll get the astroturfing over with post-haste.
The only corporation that has any clue as to what constitutes effective security is Microsoft. Everything Microsoft does is great. The iPad isn't anywhere near as great as the yet-to-be-released tablet that Microsoft is planning.
Have I mentioned, yet, how great Microsoft is? Google is actually evil, despite what they say.
If Microsoft wasn't great, they would have 0% market share.
And even though I have a 7 year old cellphone, which I use sparingly (prepaid ftw), if I were to bother with a smartphone, it would definitely be something with Microsoft Windows Phone 7.
OK, MIcrosoft: where's my moola?
cheers,
ps - afaict, there are no ms-related products in my life, and there *probably* never will be. Slackware 13.37 RC 3.14159265358979323846264338327950288419716 ftw!
pss - I still want my money.
They never were sufficient (Score:2)
Seriously, whatever made him think that consumer machines, particularly Windows machines, were even close to being secure? Remember that you're dealing with Aunt Tillie who may still be running Windows ME here.
Now, one thing ISPs could do that might make sense is to have an automated system that contacts a user if they see something suspicious (e.g. several hundred thousand emails at 3 AM) from their connection. That of course assumes that the ISP deletes the data in question within a reasonable time frame.
Re: (Score:2)
Re: (Score:1)
>>>suspicious behavior (...sudden, prolonged increase in amount of traffic)
Like downloading youtube videos?
Running Utorrent to grab missed episodes of Supernatural?
And you think the ISP should suspend the user if there's no answer???
Judas Priest - stop giving them ideas!
Re: (Score:2)
Re: (Score:1)
"Oh yes, I was doing something at that time which would explain that spike in emails/usage."
- "What were you doing sir?"
- "None of your business."
- "Sorry sir but I cannot reactivate your account until you tell me what you were doing, because we're concerned about your safety, and protecting the net from virus attacks."
- "It's personal."
- "Then I cannot..."
- "Okay fine I was bittorrenting some TV shows."
- "That is illegal under our TOS, which forbids running an uploading server or program. I'm sorry but we
Re: (Score:2)
The correct response when told what the user was doing was not:
"I was bittorrenting some TV shows."
It would be:
"I was downloading some files."
If they ask what files, the answer is, "I'm sorry that is privileged information that you have no legal basis for asking. If you still feel th
Re: (Score:2)
It also helps to use an anonymous VPN service, even one that is in the same country. This way, Comcast has no way of telling what is going over the PPTP/L2TP link.
It also strengthens the case of either they provide a legal reason that a judge would sign off on, or they provide compensation for what might be a material breach in their contract terms.
Re: (Score:1)
Re: (Score:2)
Re: (Score:2)
But what good would be alerting the common person that they are infected?
First off, it means they're less likely to put in, say, their credit card information or bank account numbers.
Secondly, the ISP could provide a referral service for a pro to come clean up the machine. It may be the Geek Squad or something, but there's a good chance it will help.
Re: (Score:2)
Problem is that with most modern malware, cleaning up is almost pointless. The only real way to get back to a known state is reformatting and restoring to a point in time that is definitely before any infected code got free reign, or formatting and installing from scratch, reloading the OS and apps, and hopefully any recovered data.
I don't mind an ISP notifying (perhaps via SMS) about viral threats, as it puts their IDS system to good use. However, I am leery of having an ISP automatically pull the plug o
Re: (Score:2)
What a world (Score:5, Interesting)
I'm pretty sure we all know the score here. We know who the bad guys are and what they are after. We know who the vendors of the platforms being exploited are and why they aren't or can't be patched. We know why end users continue to pretend they don't know or understand what is happening or what they can do to prevent it.
I just wonder what things would have to happen to overcome all of this crap? Will there have to be a cyber 9-11 attack somewhere to wake everyone up?
The other day, a person I went to some classes with called me and told me she "got a virus... or several viruses." I invited her over and she brought her laptop with her for me to examine and clean if possible. She was afraid to turn it off. But what was refreshing to me was the fact that she did everything right.
1. She went to another computer and changed all of her on-line passwords -- banking, insurance, bill paying, email, everything.
2. She ceased all work and use of her computer immediately.
3. She was using a browser that wasn't MSIE.
What I saw what just about what I expected to see. A window that was decorated to look like a Windows window "running a scan" and reporting several infections all over her computer. Problem was, since she was using something other than MSIE, the window wasn't manipulated to hide the URL this was supposed to be coming from... showed to be somewhere in eastern europe. A dialogue box was up with two buttons -- both of which lead to downloading an EXE file. And had this been MSIE, I had no doubt that the machine would have already been compromised -- seen that too many times. And oh yeah, all of this continued to work despite that she wasn't connected to the internet at all. Fascinating stuff and kinda pretty.
Still, I booted one of my machines over to Windows, updated everything and AV signatures too. I pulled her hard drive and connected it to a USB adapter and connected it to my computer to perform a scan. After a very long time, nothing showed up leaving me 98% certain that all was well and that nothing had happened to her machine.
Still, she doesn't fully understand the technologies but she at least listened to advise to not run MSIE on the WWW and to stop using her computer and to change her passwords from a different computer. How many people do you know would do that? I don't know too many... in fact, she was the first. I had another classmate who had a similar problem and she was terrified but she KEPT USING HER COMPUTER. I was like "uh.... okay... these are the risks... it's on you now."
Motivations and desires push people to do things, often stupid things, in spite of their knowledge of the risks involved. AIDS is still alive and killing for that very reason and so is drug-pushing spam. (Though lately, I have seen a LOT less of that... actually, none... either my filters are learning way good or there is simply less of it out there and what is out there is being caught.)
In a perfect world, Microsoft would abandon its Win32 and create a new OS based on BSD like Apple did. We would still have reasons to "hate" on Microsoft and they would still find ways to screw things up I am sure, but a better OS is definitely needed for the world and if it ain't going to come from Microsoft, I find it hard to imagine where it would come from in the near future.
Re: (Score:2)
Seriously? No. Wouldn't have wanted to... some people are best with their clothes on. (myself included)
Re: (Score:2)
Actually, no, it was a very sophisticated Javascript application that managed to keep itself running even after the web browser was closed and opened again. I didn't dissect it... wish I had now.
The fact that it wasn't running MSIE has, in my experience, prevented MSIE specific code from running which would have led to worse things.
There was no "scan now" button.
But yes, this attack is common and relies largely on gullibility and a lack of knowledge of the users who normally wouldn't be able to close the a
98% certain? (Score:2)
and 2% fearful that you got the same root kit she has?
Still, I booted one of my machines over to Windows, updated everything and AV signatures too. I pulled her hard drive and connected it to a USB adapter and connected it to my computer to perform a scan.
or Plop Linux + Avast + latest 400.vps on bootable CDR. That's how I end up fixing peop's computers (if I'm feeling charitable, i.e. if they are family). No way am I plugging a known compromised device on my LAN, let alone directly to my computer, no matter how patched I think it is. And I don't even run Windows.
Plop [www.plop.at] what a relief it is.
What he's saying (Score:3)
It's kinda hard to see what the conclusion of TFA is, since it doesn't really take a moment to summarize anywhere in the piece. But basically we have two people speaking. Peter Coroneos tries to say something that home routers should contain more/better security.
Then he says: "people need to ask if Cloud applications are secure and private". I don't see what that has to do with security but rather with privacy, but there you go.
Then there's TrustDefender co-founder and CEO, Ted Egan, who's trying to peddle his company product, which seems to be a piece of software not unlike a trojan, which detects other trojans.
OK, that was a waste of time.
Re: (Score:2)
It's kinda hard to see what the conclusion of TFA is, since it doesn't really take a moment to summarize anywhere in the piece.
[...]
OK, that was a waste of time.
Mate, before following your conscience and actually reading TFA, a quite commendable act anyway, I direct your attention to the smaller details of:
it security finally slashvertisement story
from the fight-botnets-with-socialism dept
Re: (Score:2)
Thanks for that tip! I actually never check the tags, but checking for 'slashvertisement' seems very useful.
Although, for even a slashvertisement, the piece was amazingly badly written, with no real conclusions or summarizations, and ad-hoc jumping between topics.
"Back in MY day..." (Score:2)
With the increase in population and vice, there are so many people walking around that it's hard for a single homesteader to protect their land and family all by themselves these days. It used to be that when someone walked onto your property you could see them coming from a mile away, and you could get a pretty good idea of what they was a-hankerin' to do by the way they looked and what they had with'em. These days, in Silver Gulch, with every kind of person around, and so many people walkin' about, it j
Re: (Score:2)
What? Be reasonable! I don't want some yahoo sheriff coming onto my property and enforcing some law, some arbitrary law, someone came up with no idea what's true and proper to do on my own land! I'll treat my servants however I like on my farm. If there's some problems around Silver Gulch, well, that's what we got those Anonymous vigilantes over there for, running around and hanging people they think done the world wrong. Why, everyone should be proud of those fellas. Even if they get a few innocent people
Um...hes a 3 letter so be careful... (Score:2)
First indicator that this guy may be wrong is he's a CIO. CIO's have staff that probably tell him the kind of crap that he has in this article, but let's look at what he has....a quote of his quotes:
"Coroneos said vendors need to intervene at the network level and need to provide security tools at a multiple levels to help secure people from the multiple levels of threats that are emerging."
I think this means that vendors need to design security as a function of their software and of their networks which g
Re: (Score:2)
With "First indicator that this guy may be wrong is he's a CIO." you make that CIO sound so like "Chief Idiot Officer." :-J
But on topic now... there is only one security model that works and it is Active with Proactive Security where one monitors 24/7 for any breaches and searches for holes before they are exploited. This actually takes knowledge and time which costs real money. Useless information (most human beings data... especially now in the age of Facebook et.al.) doesn't need this overhead. In this l
Ask your local firearms dealer... (Score:2)
He'll tell you it's alive and well.
Fluff Article (Score:1)
Coroneos said vendors need to intervene at the network level and need to provide security tools at a multiple levels to help secure people from the multiple levels of threats that are emerging.
I work in IT Security and I barely understand what he is talking about. Is he suggesting that we don't have the tools to detect and counter-act these threats at the network level already? Is he saying we should implement network level solutions such as filtering? If so, why target that advice at vendors and not service-providers? The tools already exist. The suggestion is so light on details and ambiguous, it's meaningless as a direction.
Monty Python? (Score:2)
In the article, he writes,
It reminds me of a Monty Python skit where a building is being held up by trust. It’s only standing up because people are believing it will stand up[...]
Anybody know what skit he's referring to?
Windows will NEVER be secure (Score:2)
Windows will NEVER be secure.
To be secure (or secure enough to avoid viruses etc) would mean sacrificing other things that are more important to Microsoft's customer base including ease-of-use and backwards compatibility.
Re: (Score:2)
Which is funny, because OSX has been shown less secure than Win7.
Win7 on the network is quite secure, but I guess if you start running random programs from unknown providers, you may get malware. But hey, the same can be said for Linux and its on-going fight against priv elevation exploits.
Re: (Score:2)
Windows will NEVER be secure.
That may be true, but just saying so is not terribly informative. What, in particular, makes Windows 7 inherently insecure? Can you point to some features in the architecture of the OS that prove your point?
I'm not saying your assertion is wrong; I'm just saying that it would be ever so much more helpful if it were preceded by a valid argument that demonstrates its truth.
Are the Days of Individual Security Over? (Score:2)
A: most definitely yes: the individuals have all been secured! Now it is time to move forward to social security...
Errr... what? Ah,now I see why this is coming from:
the fight-botnets-with-socialism dept.
And the cat and mouse game continues (Score:2)
The only way to be 100% secure is to have no network connection at all. Preferably also turned off and locked in a safe. Virus --> anti-virus software --> anti anti-virus & polymorphic virus --> etc. DOS attack --> countermeasures --> DDOS --> more counter. Network attacks --> firewall --> ISP level network --> something new?
Yes, very simplified and not very accurate, but it shows the constant war between attackers and attackees.
We're saved. Saved! (Score:2)
the Australian Internet Industry Association. According to AIIA's Peter Coroneos, vendors need to intervene at the network level and provide security tools at multiple levels to help secure people from the variety of threats that are emerging."
[Industry] spokesman declares that life as we know it is about to end, and that only [industry] is in a position to protect us. Given the proper financial incentives, of course, and made mandatory by legislation "for our own good" if need be.
Color me shocked.
I have individual security (Score:2)
Look, there are things an ISP can do to keep itself secure. For example, they can look for suspicious activity and kill your connection if it becomes obvious you are owned.
But pretty much anything else becomes them providing LESS service, not more.
Yesss!!! (Score:2)
We should collectively rush to close the barn doors after the horses are out.
The author is (Score:2)
Re: (Score:2)
Won't change much. Sorry to come to MS's defense, but the absolute stupidity of users and software supplier's ability to provide security holes will prevail, even against the best security.
It might surprise you, but holes in MS's OSs are not the main attack vector these days. It's user stupidity and popular third party programs like flash and pdf-reader. And for neither, you can provide an OS patch.
The share of user stupidity in a system's security problems is well described by the "Dancing Pigs" [wikipedia.org] theory. In