[lkml]   [2008]   [Aug]   [6]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
    SubjectRe: [malware-list] [RFC 0/5] [TALPA] Intro to a linuxinterfaceforon access scanning
    On Wed, Aug 06, 2008 at 08:10:53AM -0400, Press, Jonathan wrote:
    > I think if it as being like the Sieve of Eratosthenes. The further down
    > you go, the more numbers drop out. In AV scanning, each step of the way
    > removes some percentage of the harmful files, and closes the window of
    > time that they have to operate or migrate. Or maybe it's like spraying
    > insecticide when there is an outbreak of some deadly mosquito-borne
    > illness. Without getting into the political issues about spraying,
    > because this is JUST AN EXAMPLE -- would you not spray because 5% of the
    > bugs would still be left behind? Wouldn't you then spray again, because
    > you wipe out another 95%?

    The problem with your example is that it ignores the cost; the cost in
    code maintenance; the cost in performance, etc. That's the problem an
    absolutist view towards security. Going back to the your sparying
    analogy, if the illness is considered *so* utterly deadly that you
    don't consider the costs of beneficial insects dieing, children
    getting exposed so badly that they get cancer five years later,
    etc. --- then the argument would be heck, let's spray every day!
    Let's spray every hour! Let's have a insectside misters going 24
    hours a day in the parks and in the schools!!!

    In the TSA example, let's force every single traveller to strip naked
    publically and be submitted to body cavity searches! Since
    **obviously** stopping terrorist bombs is so important that no other
    considerations need to be taken into account. Oh, and we should
    obviously also give all of our financial information to the security
    agencies so they can do futher screens to look for terrorists; who
    cares about the risks that laptops with all of that unencrypted data
    will be stolen out of a locked office in the San Francisco airport?

    Similarly there are costs to doing all of this extra scanning. You're
    getting carried away here way you say that it never hurts to do extra
    scanning, and that we don't need to decide whether or not it makes
    sense to do it all. That's just stupid. The whole defense in depth,
    taken to extremes, leads to completely nonsensical thinking. Security
    is *defintiely* a cost/benefit tradeoff, and to do something
    meaningful here we need to think rationally about the threat
    environment --- and part of that threat environment is the existing
    security systems in Linux, which are definitely far more powerful than
    what DOS/Windows have.

    - Ted

     \ /
      Last update: 2008-08-06 17:11    [W:0.036 / U:13.520 seconds]
    ©2003-2017 Jasper Spaans. hosted at Digital OceanAdvertise on this site