Posted 2004-February-09, 16:25
Hi All
I'm finally resettled in the US after and extensive vacation in Thailand/Cambodia. I'm sorry that I wasn't arround for the glory days of this discussion. I'm currently working for Symantec (manufacturers of Norton Anti-Virus) and have a middling - fair background with these issues. First things first: I don't want to get into a detailed debate regarding the virtues/defects of any of Symantec's products. This seems too far removed from the scope of this Bulletin Board. With this said and done, I will make a few comments regarding computer security:
First things first: If you are stuck using Microsoft Windows, you probably want to use some kind of specialized security software to supplement the security features built into the operating system. Up until very recently, Microsoft didn't care about the security of its operating system. Microsoft prioritzed "cutting edge" features ahead of basic functionality such as security and system stability. Microsoft's decision to embed Internet Explorer into the operating system also had a significant impact on overall system stability. Microsoft is desperately trying to clean up their act [security problems are starting to impact Microsoft's profitability], however, in the short term Windows has some big problems.
As many people on this thread have already indicated, you probably want to adopt a layered secuity model. A good anti-virus program will provide you with protection against certain types of attacks. However, AV is completely transparant to other security threats. Case in point, an AV solution like Norton Anti-Virus provides zero-portection against a "worm" like Slammer. To defend against this type of attack you need some other type of solution such as a personal firewall.
Personally, I think that security should get a LOT better in the relatively near future. I've seen a lot of good technologies that should go a long way towards solving a lot of the security problems out there. From my perspective, the "best"solutions attempt to extend real world concepts like "reputation" in the digital space. Unfortunately, the technologies require that end users assume a certain amount of responsibility for their own actions. For example, any solution based on "reputation" will ultimately require digital signatures. In turn, this requires that users might need to jump through an extra hoop or two when using their computers. Its very difficult to design a system that is both idiot proof as well as secure. Worse yet, any time that we do succeed, they just introduce and new and dumber idiot.
Alderaan delenda est