Table Of Content

The Myths of Security What the Computer Security Industry Doesn’t Want You to Know The Myths of Security What the Computer Security Industry Doesn’t Want You to Know John Viega Beijing • Cambridge • Farnham • Köln • Sebastopol • Taipei • Tokyo The Myths of Security: What the Computer Security Industry Doesn’t Want You to Know by John Viega Copyright © 2009 John Viega. All rights reserved. Printed in the United States of America. Published by O’Reilly Media, Inc., 1005 Gravenstein Highway North, Sebastopol, CA 95472. O’Reillybooksmaybepurchasedforeducational,business,orsalespromotional use.Onlineeditionsarealsoavailableformosttitles(my.safaribooksonline.com). For more information, contact our corporate/institutional sales department: (800) 998-9938 [email protected]. Editor: Mike Loukides Indexer: Angela Howard Production Editor: Cover Designer: Mark Paglietti Rachel Monaghan Interior Designer: Ron Bilodeau Copyeditor: Amy Thomson Illustrator: Robert Romano Proofreader: Rachel Monaghan Printing History: June 2009: First Edition. Nutshell Handbook, the Nutshell Handbook logo, and the O’Reilly logo are registeredtrademarksofO’ReillyMedia,Inc.TheMythsofSecurity,thecover image, and related trade dress are trademarks of O’Reilly Media, Inc. Manyofthedesignationsusedbymanufacturersandsellerstodistinguishtheir products are claimed as trademarks. Where those designations appear in this book, and O’Reilly Media, Inc. was aware of a trademark claim, the designations have been printed in caps or initial caps. While every precaution has been taken in the preparation of this book, the publisher and author assume no responsibility for errors or omissions, or for damages resulting from the use of the information contained herein. ISBN: 978-0-596-52302-2 [M] Contents Foreword . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ix Preface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xiii Chapter1 The Security Industry Is Broken . . . . . . . . . . . . . . . . . . . . . . . . 1 Chapter2 Security: Nobody Cares! . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5 Chapter3 It’s Easier to Get “0wned” Than You Think. . . . . . . . . . . . . . 9 Chapter4 It’s Good to Be Bad . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19 Chapter5 Test of a Good Security Product: Would I Use It? . . . . . .25 Chapter6 Why Microsoft’s Free AV Won’t Matter . . . . . . . . . . . . . . . .29 Chapter7 Google Is Evil . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .33 Chapter8 Why Most AV Doesn’t Work (Well) . . . . . . . . . . . . . . . . . . . . . 41 Chapter9 Why AV Is Often Slow . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 49 Chapter10 Four Minutes to Infection? . . . . . . . . . . . . . . . . . . . . . . . . . . . . .55 Chapter11 Personal Firewall Problems . . . . . . . . . . . . . . . . . . . . . . . . . . . .59 Chapter12 Call It “Antivirus” . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .65 Chapter13 Why Most People Shouldn’t Run Intrusion Prevention Systems. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 71 Chapter14 Problems with Host Intrusion Prevention . . . . . . . . . . . . . . 75 vi Contents Chapter15 Plenty of Phish in the Sea . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 79 Chapter16 The Cult of Schneier . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 87 Chapter17 Helping Others Stay Safe on the Internet . . . . . . . . . . . . . .91 Chapter18 Snake Oil: Legitimate Vendors Sell It, Too . . . . . . . . . . . . 95 Chapter19 Living in Fear? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 99 Chapter20 Is Apple Really More Secure? . . . . . . . . . . . . . . . . . . . . . . . . 105 Chapter21 OK, Your Mobile Phone Is Insecure; Should You Care? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 109 Chapter22 Do AV Vendors Write Their Own Viruses? . . . . . . . . . . . . . 113 Chapter23 One Simple Fix for the AV Industry. . . . . . . . . . . . . . . . . . . . 115 Chapter24 Open Source Security: A Red Herring . . . . . . . . . . . . . . . . .119 Chapter25 Why SiteAdvisor Was Such a Good Idea. . . . . . . . . . . . . . .127 Chapter26 Is There Anything We Can Do About Identity Theft? . 129 Chapter27 Virtualization: Host Security’s Silver Bullet? . . . . . . . . . 135 Chapter28 When Will We Get Rid of All the Security Vulnerabilities? . . . . . . . . . . . . . . . . . . . . . . . 139 Chapter29 Application Security on a Budget . . . . . . . . . . . . . . . . . . . . 145 Chapter30 “Responsible Disclosure” Isn’t Responsible . . . . . . . . . . 153 Chapter31 Are Man-in-the-Middle Attacks a Myth? . . . . . . . . . . . . . . 163 Chapter32 An Attack on PKI . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 167 Contents vii Chapter33 HTTPS Sucks; Let’s Kill It! . . . . . . . . . . . . . . . . . . . . . . . . . . . . 171 Chapter34 CrAP-TCHA and the Usability/Security Tradeoff . . . . . 175 Chapter35 No Death for the Password . . . . . . . . . . . . . . . . . . . . . . . . . . . 181 Chapter36 Spam Is Dead . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 187 Chapter37 Improving Authentication. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 191 Chapter38 Cloud Insecurity? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .197 Chapter39 What AV Companies Should Be Doing (AV 2.0) . . . . . . 203 Chapter40 VPNs Usually Decrease Security . . . . . . . . . . . . . . . . . . . . . .213 Chapter41 Usability and Security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .215 Chapter42 Privacy. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 217 Chapter43 Anonymity . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .219 Chapter44 Improving Patch Management . . . . . . . . . . . . . . . . . . . . . . . .221 Chapter45 An Open Security Industry . . . . . . . . . . . . . . . . . . . . . . . . . . . 223 Chapter46 Academics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 225 Chapter47 Locksmithing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 227 Chapter48 Critical Infrastructure. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 229 Epilogue . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .231 Index. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 233

ebook img

The Myths of Security: What the Computer Security Industry Doesn't Want You to Know PDF

262 Pages·2009·1.94 MB·English
by  John Viega
Save to my drive
Quick download
Download
Upgrade Premium
Most books are stored in the elastic cloud where traffic is expensive. For this reason, we have a limit on daily download.

Preview The Myths of Security: What the Computer Security Industry Doesn't Want You to Know

The Myths of Security What the Computer Security Industry Doesn’t Want You to Know The Myths of Security What the Computer Security Industry Doesn’t Want You to Know John Viega Beijing • Cambridge • Farnham • Köln • Sebastopol • Taipei • Tokyo The Myths of Security: What the Computer Security Industry Doesn’t Want You to Know by John Viega Copyright © 2009 John Viega. All rights reserved. Printed in the United States of America. Published by O’Reilly Media, Inc., 1005 Gravenstein Highway North, Sebastopol, CA 95472. O’Reillybooksmaybepurchasedforeducational,business,orsalespromotional use.Onlineeditionsarealsoavailableformosttitles(my.safaribooksonline.com). For more information, contact our corporate/institutional sales department: (800) 998-9938 [email protected]. Editor: Mike Loukides Indexer: Angela Howard Production Editor: Cover Designer: Mark Paglietti Rachel Monaghan Interior Designer: Ron Bilodeau Copyeditor: Amy Thomson Illustrator: Robert Romano Proofreader: Rachel Monaghan Printing History: June 2009: First Edition. Nutshell Handbook, the Nutshell Handbook logo, and the O’Reilly logo are registeredtrademarksofO’ReillyMedia,Inc.TheMythsofSecurity,thecover image, and related trade dress are trademarks of O’Reilly Media, Inc. Manyofthedesignationsusedbymanufacturersandsellerstodistinguishtheir products are claimed as trademarks. Where those designations appear in this book, and O’Reilly Media, Inc. was aware of a trademark claim, the designations have been printed in caps or initial caps. While every precaution has been taken in the preparation of this book, the publisher and author assume no responsibility for errors or omissions, or for damages resulting from the use of the information contained herein. ISBN: 978-0-596-52302-2 [M] Contents Foreword . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ix Preface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xiii Chapter1 The Security Industry Is Broken . . . . . . . . . . . . . . . . . . . . . . . . 1 Chapter2 Security: Nobody Cares! . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5 Chapter3 It’s Easier to Get “0wned” Than You Think. . . . . . . . . . . . . . 9 Chapter4 It’s Good to Be Bad . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19 Chapter5 Test of a Good Security Product: Would I Use It? . . . . . .25 Chapter6 Why Microsoft’s Free AV Won’t Matter . . . . . . . . . . . . . . . .29 Chapter7 Google Is Evil . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .33 Chapter8 Why Most AV Doesn’t Work (Well) . . . . . . . . . . . . . . . . . . . . . 41 Chapter9 Why AV Is Often Slow . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 49 Chapter10 Four Minutes to Infection? . . . . . . . . . . . . . . . . . . . . . . . . . . . . .55 Chapter11 Personal Firewall Problems . . . . . . . . . . . . . . . . . . . . . . . . . . . .59 Chapter12 Call It “Antivirus” . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .65 Chapter13 Why Most People Shouldn’t Run Intrusion Prevention Systems. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 71 Chapter14 Problems with Host Intrusion Prevention . . . . . . . . . . . . . . 75 vi Contents Chapter15 Plenty of Phish in the Sea . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 79 Chapter16 The Cult of Schneier . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 87 Chapter17 Helping Others Stay Safe on the Internet . . . . . . . . . . . . . .91 Chapter18 Snake Oil: Legitimate Vendors Sell It, Too . . . . . . . . . . . . 95 Chapter19 Living in Fear? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 99 Chapter20 Is Apple Really More Secure? . . . . . . . . . . . . . . . . . . . . . . . . 105 Chapter21 OK, Your Mobile Phone Is Insecure; Should You Care? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 109 Chapter22 Do AV Vendors Write Their Own Viruses? . . . . . . . . . . . . . 113 Chapter23 One Simple Fix for the AV Industry. . . . . . . . . . . . . . . . . . . . 115 Chapter24 Open Source Security: A Red Herring . . . . . . . . . . . . . . . . .119 Chapter25 Why SiteAdvisor Was Such a Good Idea. . . . . . . . . . . . . . .127 Chapter26 Is There Anything We Can Do About Identity Theft? . 129 Chapter27 Virtualization: Host Security’s Silver Bullet? . . . . . . . . . 135 Chapter28 When Will We Get Rid of All the Security Vulnerabilities? . . . . . . . . . . . . . . . . . . . . . . . 139 Chapter29 Application Security on a Budget . . . . . . . . . . . . . . . . . . . . 145 Chapter30 “Responsible Disclosure” Isn’t Responsible . . . . . . . . . . 153 Chapter31 Are Man-in-the-Middle Attacks a Myth? . . . . . . . . . . . . . . 163 Chapter32 An Attack on PKI . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 167 Contents vii Chapter33 HTTPS Sucks; Let’s Kill It! . . . . . . . . . . . . . . . . . . . . . . . . . . . . 171 Chapter34 CrAP-TCHA and the Usability/Security Tradeoff . . . . . 175 Chapter35 No Death for the Password . . . . . . . . . . . . . . . . . . . . . . . . . . . 181 Chapter36 Spam Is Dead . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 187 Chapter37 Improving Authentication. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 191 Chapter38 Cloud Insecurity? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .197 Chapter39 What AV Companies Should Be Doing (AV 2.0) . . . . . . 203 Chapter40 VPNs Usually Decrease Security . . . . . . . . . . . . . . . . . . . . . .213 Chapter41 Usability and Security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .215 Chapter42 Privacy. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 217 Chapter43 Anonymity . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .219 Chapter44 Improving Patch Management . . . . . . . . . . . . . . . . . . . . . . . .221 Chapter45 An Open Security Industry . . . . . . . . . . . . . . . . . . . . . . . . . . . 223 Chapter46 Academics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 225 Chapter47 Locksmithing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 227 Chapter48 Critical Infrastructure. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 229 Epilogue . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .231 Index. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 233

See more

The list of books you might like

Upgrade Premium
Most books are stored in the elastic cloud where traffic is expensive. For this reason, we have a limit on daily download.
DMCA & Copyright: Dear all, most of the website is community built, users are uploading hundred of books everyday, which makes really hard for us to identify copyrighted material, please contact us if you want any material removed.
Copyright @ PDFdrive.to, 2022 | We love our users