As a "computer guy", I am sometimes called upon by
friends and family to opine on what makes a computer or a network
secure. Many of my colleagues are in the same situation. As a
"networking guy", I get similar questions from even from experienced
"computer guys".
Users have very peculiar ideas about security. Users — and I include myself in this grouping — will become confused even in areas of the computing experience where billions of dollars have been spent trying to make the experience as easy and comprehensible as possible. So it stands to reason that users will often be confused in the area of security, by its nature the least usable and comprehensible area of computing. Attacks are arcane, and, by definition, unexpected ways that software can be manipulated. Yet, these attacks are very relevant to users, who want to understand what, exactly, they are vulnerable to and how to defend against it.
It's basically impossible to try to understand computer security this way, let alone explain it.
The important thing to remember in any security situation is this: what do you have of value, and what is the threat to it? Computer security professionals call the answer to this question the "threat model". Stephen Colbert calls it the ThreatDown. No matter what you call it, it's important to enumerate the threats that you're defending against. Any security measure that you take which is not designed to protect you from a threat which you can, at the very least, imagine and describe, is just extra cost.
In my case, people ask me about three broad classes of user:
I believe there are five major types of attacks which threaten average users on the internet today.
Attacks 4 and 5 are in a different class. They're attempting to get you to reveal information over the network, either with or without your knowledge. The resource under threat here is the information you are transmitting - in most cases, the information being sought is a token which allows you access to some resource; anything from a username and password to your facebook account (which allows for stealing your personal information or impersonating you) to a debit card number (which allows attackers access to the money in your bank account).
I have fairly simple ways to protect yourself against each of these types of attack. In a series of follow-up articles, I'll cover each of those strategies. They should cover a wide variety of attacks with a minimum of effort and cost. Of course, these defenses aren't perfect. It's possible that someone who knows much more about security than I do will correct me, but if so, that's so much the better.
More importantly, I will try to provide simple abstractions that allow you to reason about each type of attack without understanding the intricacies of the technology involved. A major reason I've decided to try to write about this is that security vendors play upon the intuitive (and wrong) understanding that most people have about computer security: equating it with physical security, making their security widget the digital "lock" for the digital "house" of your computer.
I am targeting this series at a fairly nontechnical audience. I realize that my audience here mostly rates pretty high on the nerd spectrum; my hope is that you will agree with what I say sufficiently that this will be a useful resource for you to refer your less technical friends and family. To maintain your interest, however, I'll also be embedding some details about the reasoning behind my own security practices. See you next time!
Update: I accidentally posted a draft of this rather than a final copy; some of the sentences and paragraphs were incomplete. I hope that I've now corrected this.
Users have very peculiar ideas about security. Users — and I include myself in this grouping — will become confused even in areas of the computing experience where billions of dollars have been spent trying to make the experience as easy and comprehensible as possible. So it stands to reason that users will often be confused in the area of security, by its nature the least usable and comprehensible area of computing. Attacks are arcane, and, by definition, unexpected ways that software can be manipulated. Yet, these attacks are very relevant to users, who want to understand what, exactly, they are vulnerable to and how to defend against it.
It's basically impossible to try to understand computer security this way, let alone explain it.
The important thing to remember in any security situation is this: what do you have of value, and what is the threat to it? Computer security professionals call the answer to this question the "threat model". Stephen Colbert calls it the ThreatDown. No matter what you call it, it's important to enumerate the threats that you're defending against. Any security measure that you take which is not designed to protect you from a threat which you can, at the very least, imagine and describe, is just extra cost.
In my case, people ask me about three broad classes of user:
- users who have networked computers in a home, and use them for checking email, browsing the web, online shopping, and games,
- users who have networked desktop computers in a business, and use them for email, web, and business applications, and
- users who have networked server computers that are running server applications.
I believe there are five major types of attacks which threaten average users on the internet today.
- Automated attacks that attempt to connect to your computer and
exploit a flaw in its operating system or in software that is running a
server, and install malicious software on your computer.
- E-mail attacks, which attempt to deliver a message which will
exploit a flaw in your desktop e-mail client to install malicious
software on your computer.
- Browser attacks, which attempt to get your browser (either with or
without your consent) to visit a site which will exploit a flaw in your
browser software to install malicious software on your
computer.
- Phishing attacks, which attempt to convince you to disclose
information about yourself, such as bank account numbers, passwords, or
personal details that can be used to access those other things.
- Snooping attacks, which attempt to read information in transit between you and another computer. Usually snooping attacks read passwords in an attempt to allow the attacker to impersonate you later.
Attacks 4 and 5 are in a different class. They're attempting to get you to reveal information over the network, either with or without your knowledge. The resource under threat here is the information you are transmitting - in most cases, the information being sought is a token which allows you access to some resource; anything from a username and password to your facebook account (which allows for stealing your personal information or impersonating you) to a debit card number (which allows attackers access to the money in your bank account).
I have fairly simple ways to protect yourself against each of these types of attack. In a series of follow-up articles, I'll cover each of those strategies. They should cover a wide variety of attacks with a minimum of effort and cost. Of course, these defenses aren't perfect. It's possible that someone who knows much more about security than I do will correct me, but if so, that's so much the better.
More importantly, I will try to provide simple abstractions that allow you to reason about each type of attack without understanding the intricacies of the technology involved. A major reason I've decided to try to write about this is that security vendors play upon the intuitive (and wrong) understanding that most people have about computer security: equating it with physical security, making their security widget the digital "lock" for the digital "house" of your computer.
I am targeting this series at a fairly nontechnical audience. I realize that my audience here mostly rates pretty high on the nerd spectrum; my hope is that you will agree with what I say sufficiently that this will be a useful resource for you to refer your less technical friends and family. To maintain your interest, however, I'll also be embedding some details about the reasoning behind my own security practices. See you next time!
Update: I accidentally posted a draft of this rather than a final copy; some of the sentences and paragraphs were incomplete. I hope that I've now corrected this.