lkml.org 
[lkml]   [2008]   [Aug]   [18]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: [malware-list] TALPA - a threat model? well sorta.
Hi!

> > > a model other than restrictive can make sense with content security
> > > scanning.
> >
> > I'm not sure I understand why "interest in content" means not blocking,
> > and vice versa. However, I think this is a good idea if made more
> > explicit, i.e.:
>
> Small misunderstanding because both would block. If you go back to Ted's
> original post I was replying to, he was worried about how would
> anti-malware scanning interact with HSM since both may end up using the
> same interface. HSM, as far as I understand it, needs to block on open and
> "plant" the right file in place, while anti-malware also needs to block
> and examine the right content. That is why ordering matters, anti-malware
> needs to run after the content is put in place. And that is what my idea
> solves (slight overstatement since I spent only seconds on it) by
> separating them in two groups of clients. First which has no interest in
> content and second which does.

I don't see why HSMs are mixed into this discussion -- they appear
very different. For one, you probably have just one filesystem with
tape storage, so it makes sense to implement HSM at filesystem level;
probably with something like FUSE+unionfs.
Pavel
--
(english) http://www.livejournal.com/~pavelmachek
(cesky, pictures) http://atrey.karlin.mff.cuni.cz/~pavel/picture/horses/blog.html


\
 
 \ /
  Last update: 2008-08-18 13:03    [W:0.175 / U:0.748 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site