The Myths of Security: What the Computer Security Industry Doesn't Want You to Know

262 Pages·2009·1.94 MB·English

by  John Viega

The Myths of Security
What the Computer Security Industry
Doesn’t Want You to Know

The Myths of Security
What the Computer Security Industry
Doesn’t Want You to Know
John Viega
Beijing • Cambridge • Farnham • Köln • Sebastopol • Taipei • Tokyo
The Myths of Security: What the Computer Security
Industry Doesn’t Want You to Know
by John Viega
Copyright © 2009 John Viega. All rights reserved.
Printed in the United States of America.
Published by O’Reilly Media, Inc., 1005 Gravenstein Highway North,
Sebastopol, CA 95472.
O’Reillybooksmaybepurchasedforeducational,business,orsalespromotional
use.Onlineeditionsarealsoavailableformosttitles(my.safaribooksonline.com).
For more information, contact our corporate/institutional sales department:
[phone] [email protected].
Editor: Mike Loukides Indexer: Angela Howard
Production Editor: Cover Designer: Mark Paglietti
Rachel Monaghan Interior Designer: Ron Bilodeau
Copyeditor: Amy Thomson Illustrator: Robert Romano
Proofreader: Rachel Monaghan
Printing History:
June 2009: First Edition.
Nutshell Handbook, the Nutshell Handbook logo, and the O’Reilly logo are
registeredtrademarksofO’ReillyMedia,Inc.TheMythsofSecurity,thecover
image, and related trade dress are trademarks of O’Reilly Media, Inc.
Manyofthedesignationsusedbymanufacturersandsellerstodistinguishtheir
products are claimed as trademarks. Where those designations appear in this
book, and O’Reilly Media, Inc. was aware of a trademark claim, the
designations have been printed in caps or initial caps.
While every precaution has been taken in the preparation of this book, the
publisher and author assume no responsibility for errors or omissions, or for
damages resulting from the use of the information contained herein.
ISBN: 978-0-596-52302-2
[M]
Contents
Foreword . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ix
Preface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xiii
Chapter1
The Security Industry Is Broken . . . . . . . . . . . . . . . . . . . . . . . . 1
Chapter2
Security: Nobody Cares! . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5
Chapter3
It’s Easier to Get “0wned” Than You Think. . . . . . . . . . . . . . 9
Chapter4
It’s Good to Be Bad . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19
Chapter5
Test of a Good Security Product: Would I Use It? . . . . . .25
Chapter6
Why Microsoft’s Free AV Won’t Matter . . . . . . . . . . . . . . . .29
Chapter7
Google Is Evil . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .33
Chapter8
Why Most AV Doesn’t Work (Well) . . . . . . . . . . . . . . . . . . . . . 41
Chapter9
Why AV Is Often Slow . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 49
Chapter10
Four Minutes to Infection? . . . . . . . . . . . . . . . . . . . . . . . . . . . . .55
Chapter11
Personal Firewall Problems . . . . . . . . . . . . . . . . . . . . . . . . . . . .59
Chapter12
Call It “Antivirus” . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .65
Chapter13
Why Most People Shouldn’t Run Intrusion Prevention
Systems. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 71
Chapter14
Problems with Host Intrusion Prevention . . . . . . . . . . . . . . 75
vi Contents
Chapter15
Plenty of Phish in the Sea . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 79
Chapter16
The Cult of Schneier . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 87
Chapter17
Helping Others Stay Safe on the Internet . . . . . . . . . . . . . .91
Chapter18
Snake Oil: Legitimate Vendors Sell It, Too . . . . . . . . . . . . 95
Chapter19
Living in Fear? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 99
Chapter20
Is Apple Really More Secure? . . . . . . . . . . . . . . . . . . . . . . . . 105
Chapter21
OK, Your Mobile Phone Is Insecure;
Should You Care? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 109
Chapter22
Do AV Vendors Write Their Own Viruses? . . . . . . . . . . . . . 113
Chapter23
One Simple Fix for the AV Industry. . . . . . . . . . . . . . . . . . . . 115
Chapter24
Open Source Security: A Red Herring . . . . . . . . . . . . . . . . .119
Chapter25
Why SiteAdvisor Was Such a Good Idea. . . . . . . . . . . . . . .127
Chapter26
Is There Anything We Can Do About Identity Theft? . 129
Chapter27
Virtualization: Host Security’s Silver Bullet? . . . . . . . . . 135
Chapter28
When Will We Get Rid of All the
Security Vulnerabilities? . . . . . . . . . . . . . . . . . . . . . . . 139
Chapter29
Application Security on a Budget . . . . . . . . . . . . . . . . . . . . 145
Chapter30
“Responsible Disclosure” Isn’t Responsible . . . . . . . . . . 153
Chapter31
Are Man-in-the-Middle Attacks a Myth? . . . . . . . . . . . . . . 163
Chapter32
An Attack on PKI . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 167
Contents vii
Chapter33
HTTPS Sucks; Let’s Kill It! . . . . . . . . . . . . . . . . . . . . . . . . . . . . 171
Chapter34
CrAP-TCHA and the Usability/Security Tradeoff . . . . . 175
Chapter35
No Death for the Password . . . . . . . . . . . . . . . . . . . . . . . . . . . 181
Chapter36
Spam Is Dead . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 187
Chapter37
Improving Authentication. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 191
Chapter38
Cloud Insecurity? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .197
Chapter39
What AV Companies Should Be Doing (AV 2.0) . . . . . . 203
Chapter40
VPNs Usually Decrease Security . . . . . . . . . . . . . . . . . . . . . .213
Chapter41
Usability and Security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .215
Chapter42
Privacy. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 217
Chapter43
Anonymity . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .219
Chapter44
Improving Patch Management . . . . . . . . . . . . . . . . . . . . . . . .221
Chapter45
An Open Security Industry . . . . . . . . . . . . . . . . . . . . . . . . . . . 223
Chapter46
Academics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 225
Chapter47
Locksmithing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 227
Chapter48
Critical Infrastructure. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 229
Epilogue . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .231
Index. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 233