During the keynote of the
Intel Developer Forum,
Intel’s CEO Paul Otellini explained their motivation for the acquisition of
McAfee. Basically, Intel wants to provide a possibility to shift computer
security from a known bad model to something that is a known good model.
Coming back to some of our
recentblog posts, we think that a
reliable and working approach to implement application whitelisting would
increase security in corporate environments — especially when thinking of the
latest vulnerabilities with exploit code in the wild that could not be catched
up by any AV solution. As covered by
this article,
the possibility that such an approach succeeds depends heavily on the critical
mass that would use it. The widespread
x86 architecture therefore
is the perfect plattform for accomplishing a widely used known good model.
Presuming the possibility for flexibel and secure operation, Intel’s efforts
could be the chance to shift the paradigm of corporate security from a reactive
to a preventive model.
Recently I noticed
this news
titled “New email worm on the move”. At roughly the same time I received an
email from a senior security responsible from a large customer asking for
mitigation advice as they got “hit pretty hard” (by this exact piece of
malware).
Given I’m mainly an infrastructure and architecture guy usually I’m not too
involved in malware protection stuff (besides my continuous ranting that – from
an architectural point of view – endpoint based antivirus has a bad security
benefit vs. capex/opex ratio). So I’m by no means an expert in this field. Still
I keep scratching my head when I read the associated announcements (like
this,
this
or
this)
from major “antivirus”, “malware protection” or “endpoint security” vendors – to
save typing, in the remainder of the post I call them SNAKE vendors (where
“SNAKE” stands for “Smart Nimble APT Kombat Execution”… or sth equally ingenious
of the valued reader’s choice… 😉
Interesting research from Stuart Schechter et.al.
here.
They evaluated the effect that the removal or modification of online banking
sites’ security features had on the users’ behavior (as for entering or
withholding their passwords). Maybe for some of you not too surprising it turned
out that the vast majority of users entered their passwords even if obviously
alarming clues were present on the websites.
This, again, shows how important it is to understand how users behave, what
their motives and incentives are and how to build environments that help them
acting securely. This even more applies to corporate space. At times, bringing
an industrial/organizational psychologist in might be a much better investment
than writing yet-another-ignored-piece-of-policy.
Welcome to insinuator.net, the semi-official blog of
ERNW Enno Rey Netzwerke GmbH.
You may ask: Why yet another infosec blog? Aren’t there already just too many
around? Well, possibly. But that opulence is part of blogging in general, isn’t
it? 😉
Given we are trying to contribute to “public space & opinion” in a number of
ways anyway [e.g. by our
presentations
or our newsletter] it seemed just
too logical – and we’ve been asked by various people as well – to add another
element to global blogosphere. Voilà, here we go!