Quote:
Originally posted here by catch
Running no services on a server?
Yes, it's a very trivial concept which I'm sure is within your grasp.
Quote:
You cannot assume that a local firewall will help this either, there are better ways to secure the desktop.
No, there are complementary ways to secure the desktop, but an app firewall is the best way to go about packet filtering on a per-application/user basis.
Quote:
In that case it would be a server, the reason all these terms exist are so people know exactly what each other are talking about, if you wish to use the language loosely enough to pull different meanings from things, don't be surprised when a misunderstand occurs.
Actually, by your definition then, NO modern desktop operating since Windows 3.11 has been a desktop, which thereby invalidates the rest of your argument.
Quote:
For what reasons? Not knowing how to use the term "Server"?
Perhaps your unwillingness to accept the widely-accepted meaning of the term Server is the issue here.
Quote:
All the local AV and firewall do is give local code more juicy targets, as they tend to require a great number of permissions.
You've never actually set them up have you? IME, AV software requires no more permissions than say, Office. Generally, client-side firewalls would be a bit of an extravagance on a corporate network (at least IMO), however, we are discussing the home, where there are no admins to set tight security policies. I would love to hear your thoughts on how they are "more juicy targets".
Quote:
Also now you need to worry about exploits in you firewall, your AV, and you OS instead of just the OS.
Please link me a comparison with the most used corporate Anti-Virus' vulnerability list and the vulnerability list for Microsoft Windows 2000 Professional/Windows XP. I would like to know the percentages on it, since you cite it as an obvious danger, I would like to quantify the level of danger involved.
Quote:
AV systems should only be used on filtering systems same with firewalls. High assurance, isolated proxying systems the clean network traffic, they have no place on standalone systems, especialy such low assurance systems as the standanrd COTS desktop.
Actually, you are mistaken, they have perfect placement on "standalone" systems, that is what their target is. Stop being ludicrous and arguing that your point about corporate desktops is right about home PCs. It isn't.
Quote:
Cite your source for this figure please.
I don't see why I should cite my sources when you are unwilling to do the same. Kind of ironic and hypocritical of you all at the same time.
Quote:
The CISSP in particular is geared toward a general theoretical understanding of IS security, no more no less.
It fails even in that endeavour. It targets specifically server environments, and leaves the desktops to the wolves, essentially.
Quote:
The reason for this is that overall poor foundation of security in the vast majority of commercial systems.
I disagree, I believe it is the overall poor education of the people in charge, and that many technical managers are no longer given the leeway they need to make the appropriate purchases and/or hiring decisions.
Quote:
So much of modern COTS security is is just bad versions of problems fixed in the 70's believe it or not. Reinventing the wheel is all that is happening now.
Cite references then, if that's the case, I'm curious to know what 'new developments' aren't really new.
[quote]This is very true, especially from an insider (this of course isn't much of a concern with a single user home system) but I still feel that a local firewall isn't the best solution for this type of problem. Firewalls are not designed to protect boxes, they are designed to protect and control connections.[/quote[
They are not designed to protect connections whatsoever, they are designed to protect services and regulate connections and services. Firewalling itself as a feature has been implemented in numerous other places.
Quote:
Defense of the box rests on the box itself. All protections against attackers, malware, and evil users in general need to be found within the TCB, otherwise anything you slap on after the fact is only going to hurt the security of the system.
The utterly fatal flaw in your argument is that "anything you slap on after the fact" can compensate for the underlying system's incapabilities, while still not compromising the security of the system. If you don't believe this, then I ask why do so many major operating system vendors provide extra security tools? Consider MS ISA Server, or any of IBM's advanced network management and security software, or 3Com, or Cisco. Those companies obviously believe the "slap-on-after-the-fact style" OS/Firmware additions are worth the time and effort.
Quote:
Granted this may be above the average user's capabilities, but I assumed they were here to learn. Besides, 10,000 other people will tell them to install Zone Alarm, so what value does that really have?
You assumed horribly wrong. Users by and large do not want or need to know WHY something works, or how it can work better, or how in your airy fairy world of network design you think it SHOULD work, they want something that will just work. Various app. firewalls are good. I should expect you are a class A mechanic, certified electrician, architect, plumber, and cuisine expert, given your attitude towards how an end user 'should' approach things.
