Blasting away security myths

Today, the biggest threat to any environment is client-side attacks, specifically attacks being launched against normal end-users via e-mail and through the browser. Attackers rarely beat up on Internet-facing hardened super servers. Instead, just send a little spam to less-protected workers and let the social engineering aspects do the rest. All it takes is one weak end-user to ruin the whole network.

What does this mean? Network administrators need to concentrate significantly more effort on preventing client-side attacks than building the next battle-hardened server. We almost have the latter issue won, yet our end-users keep opening ever-worsening spam and phish attacks.

Trying to prevent malicious e-mail attacks by blocking a small number of file types isn’t going to work, either. Most corporate e-mail file block lists I encounter cover 10 to 20 file types, including files with the following extensions: .exe, .zip, .com, .bat, and .pif. The truth is I’ve counted more than 150 file types that have been used maliciously -- you can download my list of potentially malicious file types from my blog. 

A better security defense tool is to block all file types by default and only allow a few legitimate types. If your defense tool only supports deny-by-exception, however, you can use my table to populate your defense tool with a more inclusive list.

The single best thing you can do to prevent malicious e-mail attacks is to force all incoming e-mail to be converted to plain text, removing all HTML code, embedded links, and active content. Pulling out the HTML coding easily reveals the phishing links, removes many automated attacks, and renders most malicious e-mail harmless. If the user wants to view a legitimate e-mail in its original form, many e-mail clients, including the newer versions of Outlook, allow the HTML to be added back in with a click of the mouse.

Testing and revealing computer security myths like these was the basis for my just-released fifth book on computer security, Professional Windows Desktop and Server Hardening. It examines all the conventional wisdom about how to defend a Windows system, finds the strengths and the flaws in each approach, and recommends practical advice that really works.

It also contains dozens of important information tables, like the one that shows more than 180 places where Windows malware can hide, and contains more than a hundred specific security recommendations, ranked by criticality. But you don’t have to buy my book to get the security recommendations -- you can download the table for free from my blog and put it to use right away.