Secretmaker - "all-in-one" security solution?

I just stumbled upon SecretMaker. The idea is excellent: a zero-configuration all-in-one security solution. Some features are a little questionnable (a "Worm Hunter" that does nothing more than preventing your e-mail client from mass-mailing isn't exactly hunting-material...), but it does seem - on first sight - like a pretty decent (although basic) solution. The main problems I see are a confusing interface (which would be OK if it's really a zero-configuration solution...), options that don't really tell you anything about the functions behind them (what, for example, does "Windows cleaner" do? I don't know...), and weird hot-key combinations to override settings.... I've had it installed for a day or so and haven't really looked at it... I haven't seen it do anything yet (maybe it works in the background...) other than leading me to a SecretMaker search thing (effectively hijacking Google!) when I'm too lazy to fully type in a URL in Firefox's address bar...

It does look (again, on first sight, and based more on the website's claims than on personal experience) like something that can be added to the free anti-virus/free firewall/free anti-spyware list...

In any case: the idea is great. Basic computer security (for the basic user) should be nothing more than installing one single application and not having to worry about it.

I'm a bit leery of all-in-one solutions, whether it's printers or security suites. :(

Let us know how it "drives" if you test it. Thanks for the heads up.

Quote:

---

Security Watchdog - Protects you from computer hijacking attempts
Intruder Blocker - Blocks out spyware, trackware and other harmful executables
Worm Hunter - Protects your computer from spreading email viruses

---

Of the nine features I see offered, the three I listed seem to be the only ones that regard security.. the rest pertain to other things (Note - They don't advertise an all in one solution... so this is discussing "all in one" solutions)

So, of the three above -

I think the only real "do it all" tool would be a simpler version of MBSA?
http://www.microsoft.com/technet/sec.../mbsahome.mspx

Zero configuration with a confusing interface?? That's funny haha.

Personally I stay away from all in one's as well. Especially one with zero configuration. Negative, you'll do us all a favor if you leave it installed and see if it's any good. I wouldn't keep my hopes up though, but we'll see...

Greeting's

Although nothing to do with the product directly but the site isn't completely developed too. Most of the link's show up under construction. Not a good sign to me. Anyway I'll take the software to a friends machine and test it out tomorrow or maybe later then that. Anyway thanks for the information.

Check out the forums and note the most heavily-used:

http://forum.secretmaker.com/

Quote:

---

Anyway I'll take the software to a friends machine and test it out tomorrow ...

---

Loved that line! ;)

Quote:

---

Originally posted here by Soda_Popinsky
Of the nine features I see offered, the three I listed seem to be the only ones that regard security.. the rest pertain to other things (Note - They don't advertise an all in one solution... so this is discussing "all in one" solutions)

So, of the three above -

I think the only real "do it all" tool would be a simpler version of MBSA?
http://www.microsoft.com/technet/sec.../mbsahome.mspx

---

Maybe I've missed something, but I'm curious about how the only real "do it all" tool would be a simpler version of MBSA.

I don't think that MBSA could be simplified much as far as it's purpose goes... it's a pretty good program and I'm not really sure I'd consider it a "do it all" tool.. It tells you what patches you're missing and some basic policy stuff....

I'm not arguing... yet... just looking for clarification.

Peace,
HT

Last time I checked, it doesn't actually do anything... It checks for good policies, but doesn't fix anything. The knowledge gap comes from the info it returns, and the ability to make changes.

So, I guess something similar to bastille linux with differences to allow basic usability would be good.

The MSBA finds problems, doesn't change them... Bastille Linux finds them and changes them. Something like this would be better than trying to secure an administrative account with applications running w/ the similar privledges

Soda: Your right MBSA, doesnt make any changes, but it does properly scan for "know issues" and it does (pretty clearly) explain how to correct the problem. I am not totally sure i would want a program making policy changes FOR me.

I always felt the information it returned was pretty straight forward on how to correct the issues it found.....

HTRegz: it isn't not even CLOSE to a all in one tool. If I am reading this right, SecretMaker is a real time utility while MBSA is not, nor is MBSA scanning for anything more the known issues and port scanning. Looking for exposure to exploits, verses the exploits themselves. Or at least thats my take on it...

Security comes from the OS (and the user to a lesser extent), always has, always will.

If you look at the popular "security" programs that really take proactive measures... they do nothing more than adjust the manual settings that may be hard for the average user to find.

If you look at the "immunization" option in SpybotSD, all it really does is create system settings that prevent certain IP/hosts from being accessed, and denies all cookies from certain sites. There is no reason you can't do this on your own, it just makes it easier.

Bastille-Linux as another example. All it does is create the settings that will protect your computer, it doesn't "add" anything except a few cleanup scripts. All it does is changes the defaults to more restrictive settings. Sometimes causing unexpected side effects... but usually doing a good job.


There are a myriad of tools and preset configurations you can install, from a custom hosts file, to the NSA's Security Configuration Templates

There is not a single thing that can't be easily done by a competent user without the use of external tools.

My point is, that if you want security, you have to look at the system, not what you can download for it.

Quote:

---

Originally posted here by Synja
Security comes from the OS (and the user to a lesser extent), always has, always will.

If you look at the popular "security" programs that really take proactive measures... they do nothing more than adjust the manual settings that may be hard for the average user to find.

If you look at the "immunization" option in SpybotSD, all it really does is create system settings that prevent certain IP/hosts from being accessed, and denies all cookies from certain sites. There is no reason you can't do this on your own, it just makes it easier.

Bastille-Linux as another example. All it does is create the settings that will protect your computer, it doesn't "add" anything except a few cleanup scripts. All it does is changes the defaults to more restrictive settings. Sometimes causing unexpected side effects... but usually doing a good job.


There are a myriad of tools and preset configurations you can install, from a custom hosts file, to the NSA's Security Configuration Templates

There is not a single thing that can't be easily done by a competent user without the use of external tools.

My point is, that if you want security, you have to look at the system, not what you can download for it.

---

I agree with Synja - when I do system lockdowns, it consists of mostly making registry changes, implementing certain security policies by using either secpol, domain security policies, etc. I feel you can properly configure a system without the use of third party software in an effort to secure the box.....

Quote:

---

My point is, that if you want security, you have to look at the system, not what you can download for it.

---

And what you keep forgetting is that you cannot expect the average user to "manually" secure his or her system. I think we can all agree that a Windows-out-of-the-box system isn't exactly fit to go on the Internet (although it's getting better). It's a fact that a few simple settings can vastly improve your security (aren't you writing a tutorial on that subject?) - why not have an automated tool that changes those settings? Or are you hoping that the average user will read and implement your tutorial?

Quote:

---

It's a fact that a few simple settings can vastly improve your security (aren't you writing a tutorial on that subject?) - why not have an automated tool that changes those settings? Or are you hoping that the average user will read and implement your tutorial?

---

Yes, I am writing a tutorial on that, I have had a few delays, but it is getting done.

My issue with the one size fits all tools is that they miss quite a bit in many cases, and it doesn't *teach* the user anything. The user stays blind to the way the computer works. That is why I am writing the tutorial, and posting it on a variety of sites. (I am posting a link to it and hosting it on my server to prevent copyright and ownership issues).

Many security settings are not difficult to implement, and a user who has had even a small amount of experience should be able to manage it. THis is why I am writing the tutorial. The user doesn't have to be scared of system settings or the registry, they just need to pay attention.

Look at me... I have never had any formal training, everything I know was learned from books, forums, tutorials, and just playing around. If my drunk ass can do it, the average user sure as hell can.

Ah... but the average user does not WANT to have to do it :)
The average user does not WANT to be taught - he wants to turn on his computer and use it, and I don't blame him. I want to drive my car, and I couldn't care less about what goes on under the hood. If my car needs to have some bolts tightened after every hour or driving, it better do it automatically (I may want to push a button to do it), but getting under the hood?

Quote:

---

Ah... but the average user does not WANT to have to do it
The average user does not WANT to be taught - he wants to turn on his computer and use it, and I don't blame him. I want to drive my car, and I couldn't care less about what goes on under the hood. If my car needs to have some bolts tightened after every hour or driving, it better do it automatically (I may want to push a button to do it), but getting under the hood?

---

But, as long as you brought up the car analogy...

You change your oil every 3000 miles?

You get new tires every 50,000?

You perform all the prescribed maintenance, either through your own means or by hiring another entity to do it?

If the user does not want to do it themselves, they need to have someone actually do it for them. You wouldn't take your car to a shop that just dumped more oil in it? You'd take it somewhere that would inspect and correct.

The difference with the car is that all cars fresh from the manufacturer are safe to drive :)

I think an all-in-one-tool is an excellent idea. Rather than having to go into the registry, give the user a button to click; with an all-in-one-tool: give him one simple button to click, and all those settings you're going to describe in your tutorial are implemented. That's something the average user can do, and probably will do. But going into the registry? Or having it set up by a professional? People don't have computers serviced... they have them fixed when they break down ;)

Ok, so the average install gives you an administrative account to use. That's well known, and why mostly everyone on Windows uses the admin account for everything.

So what's so hard about creating a tool that checks for patches, (enables auto update for grandma), enables the firewall and creates a user account, then spits you into the user account when finished?

Quote:

---

The difference with the car is that all cars fresh from the manufacturer are safe to drive

---

Shall I quote the safety recalls of the last however many years? Spontaneous engine fires, faulty seatbelts, etc?

American cars aren't cars... they don't count :p

The only way the don't fix it till it's broke attitude will change, is by spreading the word and teaching people.

If we encourage people to fix things themselves, they will become more aware of what is going on inside their computer, and will stop hesitating to find out.


We cannot pander to the ignorant or lazy, that just feeds their limitations. For example, I have noticed that people who get to live life on disability get more and more disabled as time goes by (Some are legitimate disabilites), if we do not just acquiesce to their idle wants, they will become stronger, and eventually, self-sufficient.

Yes, it is difficult for some people. That doesn't mean they should have a different standard, or different traeatment. That is what casues the problems.


(And yes, I just compared average users to the mentally retarded.)

there is a problem with the car - PC analogy:

With a Car.. there is a social expectation that The driver has to have a minimal level of compitance before being allowed to drive the car.
The manufacturer has a legal requirement to meet certain levels of safety.. Bugs do creep in and the manufacturer has a legal requirement to fix the problem in a timely manor.

With a PC: It is user assumed you can do as you please..as you please
You dont need any traing to ge on and search out porn
The only legal obligations from the hardware manufacturers is that the equipment meets minimal electrical and Rf emmision specifications.. more that it is Market compatable.
With the software.. It is market Capable.. and IS NOT MONOPOLISTIC..
And there is no legal requirement in consumer software for the software manufacturer to repair in a timely manor.. in the Retail area it comes down to the retailer refunding the customer their money ..consumer law..(not so with the OS..Well I havent seen anyone try at this time)

Many users are not lazy.. just educated by the media, software manufacturers, and US that computers will do things for you, make life easy, simple to use..
terms like : User Friendly, no configuration, simple installation, ready to go, easy user interface.. Full protection, .

If pc's were not marketed in this way.. we wouldnt have the PC market we do today, pc woulldnt be as cheap, prolific Software as diverse and cheap.

Well, I have thought about this sort of issue and discussed it with all sorts of people over the past couple of years.

I do subscribe to the view that part of the problem is the way PCs and applications are marketed. My usual comment is that many people go out and buy a PC just as they would a television, a microwave or a washing machine; they honestly don't realise that there is a difference.

I also think that (please forgive the gross oversimplification here) there are three basic types of user:

1. Those who understand PCs, albeit they may be hardware or software orientated.
2. Those who are quite knowlegeable at using PCs, but haven't much idea how they work.
3. Those who have no idea at all, but want to use the technology.

The first are not really a problem, as they will buy into good ideas that are well presented. The second are something of a problem as they will accept the advice but might not fully understand the question or the answer.

As an aside comment, when did you last buy a motherboard that explained the implications of the various BIOS settings rather than just listing the options?

The last category are pretty much beyond redemption, as they wouldn't even understand what you were talking about.

The first two categories can be dealt with if they are given comprehensive documentation, and can be persuaded to read and act upon it. Unfortunately, suppliers do not provide this level of documentation these days. For financial reasons they assume that everyone who buys a computer is an expert..............because that is more profitable for them.

The last lot need to be spoon fed, and this is where automatic configuration software comes into its own IMO.

The last lot are the majority if you exclude institutional/commercial installations where the user has little or no input whatsoever.

It is foolish, reckless and arrogant to expect them to learn...................it is realistic to accept that they won't.

If I expect to have full disclosure of an exploit, why can I not expect full disclosure of the steps required to mitigate the situation?

And before anyone gets on their high horse and starts ripping me apart.............ask yourself this question: "would I like to take a modern MoBo manual and explain the meaning of all the BIOS settings?"......................and I mean EXPLAIN , not DESCRIBE :)