RE: IDS and Spywares

["Omar Herrera" <oherrera () prodigy net mx>]

Hi Justin,

> -----Original Message-----
> From: Justin Shore [mailto:justin.shore () sktbcs com]
> Sent: Monday, October 17, 2005 4:55 AM
> To: Matt Jonkman; Omar A. Herrera
> Cc: focus-ids () securityfocus com; vipul kumra; dhruv_ymca () yahoo com;
> neelabhsharma1 () gmail com
> Subject: RE: IDS and Spywares
>
> There is an extremely easy solution to this problem.  Remove local
> administrative rights from users' PCs.  There is absolutely no reason
> whatsoever for a user in a corporate environment to have local admin
> rights if they aren't actually a sysadm.  In a home environment there is
> absolutely no reason for a user to be a local admin all the time.  Remove
> this capability for the residential-grade OSs and make users utilize the
> Run As feature of XP and 2000.  Better yet make this process automatic
> like in OS X.  There is no reason in this day and age for users to need
> constant local admin access, if they need local admin access, period.

I totally agree with, you, and I use privilege restrictions a lot (O.S.
based privilege restrictions it is). But usually the rights of common users
(enforced by the O.S.) are enough to create some harm. That is, we don't
just want to restrict their privileges but also make sure they don't shoot
themselves in their feet by abusing those privileges.

A common example: some users are able to navigate on the web. From a
FW/nIDS/nIPS point of view those users might just need ports TCP 80 and 443
open for outbound communication, but from an O.S. point of view you can only
put very general restrictions (i.e. if they are able or not to open sockets
from network communication).

Malware can easily work in this restricted environment, so you need
something else. A PFW that restricts outbound connections to certain
applications or hIPS that is able to stop any unauthorized software are
examples of how you can extend the security provided by O.S. privilege
restrictions. Host based IDS are also able to detect execution of
unauthorized software

Kind regards,

Omar Herrera 


------------------------------------------------------------------------
Test Your IDS

Is your IDS deployed correctly?
Find out quickly and easily by testing it 
with real-world attacks from CORE IMPACT.
Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708 
to learn more.
------------------------------------------------------------------------