Quote:
Well.. yeah, kinda new I guess, but no, what's so funny, have to fill me in on that one.. heh!?
I am arguably the biggst advocate of NT security on this site. I freely and frequently state that that NT security is superior to UN*X security. People like to take one of two aruments back:
1. Counting exploits.
2. Claiming exotic configurations and major architectual modifications in UN*X/Linux should be just considered the norm.
Do to this fact, I've stopped arguing the point for a while now... still unny that you'd think I meant UN*X to be more secure. My point was in fact that AV solutions for UN*X (excluding proxying services) essentially don't exist. Odd considering that the NT security is in fact superior to UN*X at the commercial level (**** all this lab stuff).
So why is AV not needed on UN*X? Even the argument that less viruses efect UN*X... well no AV software, wouldn't every virus that does exist effectively be a 0-day since no AV countermeasures exist?
As I stated before, in low assurance environments, AV is a good thing... but once you lock the systems down to providing exactly the rights your users require... which in my experience has NEVER included things like creating new shares by the way. ;)
Normal users in a higher assurance environment should not ever be allowed to make changes to their system without going through proper change control channels. In fact at my work, every single desktop system is set up in the exact same manner, and users are only allowed to modify their profiles.
Many of the client applications can only be launched as reduced privilege processes, permissions are tightly controlled, again with the point of only allowing users access to the applications they need as defined by their role and to the internal data as defined by that same role definition.
This is the real problem, most security teams have no clue what their users need, and how to effectively support business needs... consequently to avoid calls to to tech support they give their users way too much rope. This would be a low assurance environment, and prime for AV controls.
Now Saw, back to your questions:
Quote:
You are trying to tell me that every single box is so locked down that if a virus actually ends up on one of the boxes, it won't be able to do anything.. ?
Yup, as I said above, every single user system is configured in the same manner. Centralized configuration control, it's a good thing. And then user accounts are restricted via permissions ad user right assignments that only meet the role requirements.
Quote:
With all the tens of thousands viruses, that compromises a system in so many different ways, you are telling me that you have covered all the "holes" to 100%, so not one single virus can get through your "architecture" to cause damage or propagate? That's a pretty bold statement.
The number of viruses makes no difference, and I never said that it will prevent every single virus ever from causing harm. I said it will outright stop most and dramatically limit the damage possible by others. To the point where the costs saved by an AV are less than the cost of using one plus the new vulnerabilities introduced by the AV itself.
Security isn't about being 100% safe, it is about cost avoidance.
Quote:
It probably makes a big difference depending on what kind of company/environment you have... but at a College where I work for example, I don't see how you possibly could make it that secure without an A/V solution.
And would you consider your environment to be a low or high assurance one? ;)
cheers,
catch
