china, disclosure, and malware

not too long ago, amrit williams wrote on his experience traveling in south-east asia and specifically his observation of their attitudes towards malware disclosure:

What I was shown was the most active and open distribution of malware, kits, and exploits I have ever witnessed. I will refrain from the details but considering the perceived insular nature of China and the openness of the US, I can tell you from the sharing of knowledge perspective we are way behind.

I asked some questions about disclosure and was met with puzzled looks and shaking heads.

though it's not completely unambiguous, i get the distinct impression (especially from wording of the statement that we're way behind) that he thinks we should be more like them... but i have to wonder what all that openness with regards to malware disclosure has actually done for china... are they better off than we are? are they better equipped to keep the malware problem in check?

i suppose perhaps if you were only looking at the technological side of the malware problem the easy availability of malware for study should theoretically be of help... but i have to wonder: when most of the population is not involved in the creation of tools to help defend against malware, and when those that are involved have fairly open access to malware even over here in the west, what advantage is china's undifferentiated openness really giving them in practice?...

if we don't just look at the technological side, however, if we include the social component as well (especially as it relates to malware creation) then that openness comes under a different light... what do we know about china and malware in broad terms? well, although finjan's figures suggest china is not the biggest host of malware, according to kaspersky they are the largest producer of malware...

sharing malware materials helps learning about malware, there's no doubt about that, but uncontrolled/undifferentiated sharing (as opposed to the more reserved 'only if i know and trust you' type of sharing) helps the creation of malware more than it does the defense against malware, and china may well be serving as an unrecognized object lesson in that fact... so the next time we look at how other cultures handle issues differently, before concluding that they're doing things better because they're adhering more closely to abstract principles that we value, lets make sure we look at the larger picture and not lose the forest amongst the trees...

trend micro and cloud watching

last thursday mike rothman wrote the following:

Is traditional signature-based AV dead? It's definitely on life-support, as Trend announces a cloud-based something or other. Will it work? Who knows, but clearly the sacred cow of AV will be served for dinner sooner rather than later. - Trend Micro release

if you're like mike and think this has anything to do with moving away from signature-based technology then you need to read that release a second time... or a third time... or an nth time - it doesn't really matter how many times you've read it before you need to read it again, especially the following passage:

By storing the majority of pattern files in an Internet cloud database and keeping them at a minimum on the endpoint, Trend Micro helps stop Web, file and email threats before they reach the end-user or the corporate network. This new approach lightens bandwidth consumption on customers’ networks and endpoints and provides faster and more comprehensive up-to-date protection.

in other words, it's still signature-based, they're just putting the signatures in the cloud rather than the endpoint now... it's not your grandmother's scanner but it's still signature-based av...

one of the benefits of letting this post stew a little is that i've gotten to see what others have said about the subject... as a not-so-accurate barometer of av innovation, amrit williams thinks it's the most innovative thing to come out of the av industry in the past decade but alan shimel rightly points out that it sounds a lot like something panda has been doing for some time now... i would add that both are conceptually reminiscent of the digital immune system developed by ibm (starting more than a decade ago) and sold to symantec (and we know what symantec does with the things it buys, or rather we don't)... it would be hard to imagine that either trend or panda came up with their 'in-the-cloud' architectures without taking a few lessons away from this progenitor and so i wonder if we can really say this innovation came about within the past decade at all...

the rumours of av's demise are greatly exaggerated

are you as sick of hearing about how 'anti-virus is dead' as i am? wow, what a worn out, tired, washed up meme... maybe now that amrit thinks stand alone av has actually finally died there will be a little less av is dead noise coming from his corner...

this isn't a freak out, though, just a reminder that what i said last year is still true - so long as people still want best-of-breed there will still be a market for stand alone av...

just because gartner changed the way they model the playing field (a necessity given the evolution, not death, of av), and just because vendors are gradually making the components of their security suites play nicer together (imagine that, they're actually managing to improve their products), doesn't mean stand alone av is going anywhere - and thinking it does probably qualifies as some sort of confirmation bias... personally, i'm going to wait for the fat lady to sing before i say it's dead... so long as i can still get an up to date and supported stand alone av app, stand alone av ain't dead...

the effectiveness of user education

amrit williams has a post up about how ineffective user education is... if you've read this blog for a while you probably know how i feel about user education already but i guess there's more to say than to just point to anecdotal evidence of it working in real life (amrit does that himself with the example of his mother)...

so which is it? technological 'solutions' or user education, nature or nurture, particle or wave, fate or chance - to paraphrase forrest gump, it's a bit of both...

amrit is right that user education isn't going to make things secure, but let's look at that again - nothing is going to make things secure, not user education, not technological controls, not even a combination of the two... security isn't a boolean property, it's a gradient, talking about making things 'secure' is pure sophistry as we should be talking about making things more secure than they are right now... don't let the great be the enemy of the good; since perfection is impossible anyways one must settle for simply making things better...

in that vein user education has a rather well defined place... security requires intelligent, context-sensitive decision making that just can't be hard-coded into the system... i understand and appreciate that people are hard to control and generally unreliable... i understand why security folks would want to ignore the user problem since they're trying to build reliable security... unfortunately, whether we like it or not, users are a part of the system and they're always going to be a part of the system - technology cannot be an island unto itself, technological controls are just tools and users need to know how to use those tools properly or the tools themselves will be ineffective (just as knowledge without good tools is also ineffective)...

neither user education nor technological controls can reach their full potential on their own, they need each other if we're to get the most out of our attempts to make things more secure - and unreliable though that might be, it's better than relying on either individually...

anti-virus is dead - not!

well, it looks like yet another (ahem) security expert (albeit one who apparently worked for an anti-virus company in some capacity a decade ago) is sounding the death knell for anti-virus software...

don't be alarmed though, the sky is not falling... people have been prognosticating the end of anti-virus software since the last millennium... it hasn't happened yet and it probably never will..

this example isn't much different than the previous hundred and one instances of av doomsayers... i've written about the supposed failure of anti-virus software in the past - does that address this situation? you betcha... the author (amrit williams) trots out 3 whole examples of worms that anti-virus software didn't stop, but seems to have forgotten the tens of thousands that it did stop... perceptual bias? sure... mike rothman previously made an elegant comment about mismatched expectations and judging by how far outside of av's scope most of mr. williams' examples of av's failures are his expectations are very mismatched...

what he really seems to be getting at is that av sucks because it's not UTM... the argument seems to be that anti-virus on it's own doesn't do as good a job at solving the business problem of security management as a security suite would and perhaps he's right about that narrowly defined part of the malware problem, but certainly not about the malware problem as a whole which neatly transcends your field of vision while you've got business blinders on...

stand alone anti-virus isn't going anywhere, not so long as the world is more than just a collection of businesses, not so long as there are home computers/networks out there, not so long as my security needs differ from your security needs, not so long as best of breed still has benefits, and not so long as we collectively still remember the saying "jack of all trades, master of none"...

stand alone av is evolving mind you, by including detection of additional forms of malware (that most people, and the av products themselves, were calling viruses anyways), but that doesn't stop it from being stand alone anti-virus...