Ten laws of computer security

[PrntRhd]

(from MS Technet blog, link no longer valid)

Ten laws of Computer Security:

Law #1: If a bad guy can persuade you to run his program on your computer, its not your computer anymore.
Law #2: If a bad guy can alter the operating system on your computer, its not your computer anymore.
Law #3: If a bad guy has unrestricted physical access to your computer, its not your computer anymore.
Law #4: If you allow a bad guy to upload programs to your web site, its not your web site anymore.
Law #5: Weak passwords trump strong security.
Law #6: A machine is only as secure as the administrator is trustworthy.
Law #7: Encrypted data is only as secure as the decryption key.
Law #8: An out of date virus scanner is only marginally better than no virus scanner at all.
Law #9: Absolute anonymity isn't practical, in real life or on the web.
Law #10: Technology is not a panacea.

[froggy_newb]

i'm not running any anti virus software.

[mjc]

i'm not running any anti virus software.

And you are proud of that fact?

Not running an antivirus is pretty much like dipping a mug full of water from the Hudson to make your morning coffee...

[froggy_newb]

And you are proud of that fact?

Not running an antivirus is pretty much like dipping a mug full of water from the Hudson to make your morning coffee...

no, i'm not proud.

i figured my old mcafee was no longer good, and only causing annoying problems. so i just removed it. so as of now, i'm only running virus removal

[Whyzman]

I suppose somebody's gotta be the "beta geek" willing to sacrifice their security to test the removal product's effectiveness...

[SufferWell1396]

At the moment my XP installation's version of AVG is corrupt... so it doesnt technically have a virus scanner... but the firewall keeps most of the baddies out..

[malcore]

The problem of allowing rapid, convenient communication while restricting its use to good, and not evil intents is congruent to other intractable problems such as allowing free speech while disallowing a call of "Fire!" in a crowded theater. -Rusty Russell on LinuxGuruz

[kiosk]

i'm not running any anti virus software.

Me neither. Last time had a real virus back in 1995. Maybe this is because I learnt early on NOT to trust anything Microsoft claims is secure, technologically advanced and incredibly awesome in ways my stupid little brain couldn't possibly comprehend without catching on fire.

Active desktop and VRML: behold the future of the Internets! :p


Just for the record, I accidentally launched a trojan on my PC some three weeks ago. It was entirely my fault - I decompressed an archive which contained a program file with a standard icon of a directory, which I double clicked believing it was, well, a directory. I should have known better, but those seven beers I had before persuaded me otherwise. Anyway, the virus just copied itself into another directory and crapped out in an avalanche of error messages - I guess the virus didn't like the fact that it was running on 98lite without IE or ActiveX junk.

Staying away from the cutting edge is just... so damn fine. I might look into XP in some three to four years from now, when everybody and their grandma will be running Vista and suffering from Vista-specific problems and viruses. Till then, goold old 98 soldiers on, at least, in my computer. :p

[mjc]

Anyway, the virus just copied itself into another directory and crapped out in an avalanche of error messages - I guess the virus didn't like the fact that it was running on 98lite without IE or ActiveX junk.

Died of malnutrition?

[Budfred]

Those of you who think it is okay to go without an antivirus and/or other basic protection like a firewall -- You computer may be infected and stealing your information without your knowledge... You may simply wake up one day to find that your bank account is cleared out, your credit card is maxed out and you need to begin the extended task of reclaiming your identity...

Even if you don't care about that, please keep in mind that the rest of us suffer when your PC gets turned into a server for SPAM and DDoS attacks... I have worked with too many who proudly proclaim they don't use protection software and then come in asking for help to clean out their computers to have any faith in your ability to keep your computers clean without it....

[George Hallam]

i have loads of virus and firewalls but my best advise is you cant trust your details on the web the only way to stop people from stealing your data is PULL OUT THE CABLE problem solved. Just by things over the phone or even better go two the shop hakers will allways find ways round firewalls and virius software no one is safe conected to the internet your an open book

[malcore]

True, no one is entirely protected, however there are levels of protection. Using no protection at all is in my mind a bit cavalier and not well thought out. Infections, as Budfred pointed out, can affect all of us.

For anyone interested in exploring the idea of proactive protection on their XP Pro/2000 computer using what is available from the OS itself, rather than using third party software, here are a few links.

IPSEC Firewall/IP Filtering (http://homepages.wmich.edu/%7Emchugha/w2kfirewall.htm)

Using a Limited Account/Software Restriction Policy (http://www.mechbgon.com/srp/)

Software Restriction Policy Microsoft (http://www.microsoft.com/technet/prodtechnol/winxppro/maintain/rstrplcy.mspx)