On Fri, 16 Jan 2004 13:31:36 EST, Exibar said: > Will any of these do? Will you still think you don't need AV on Linux now? > > here's a partial list..... don't choke too hard now! > > Linux.Bliss.a Worm.Linux.Hijack Backdoor.Linux.Kbd <relatively short by Microsoft standards list elided> OK.. Sure. They exist. Now, think about the following questions, while chanting Schneier's "Security is a process": 1) How many of these achieved wide enough distribution so that you have a *serious* worry of actually seeing one? 'Lion' had a good run, and had a creditable threat to infect all vulnerable machines. Most of these don't qualify as a serious threat (although to be fair, the vast majority of the 100,000+ Windows viruses don't qualify either). 2) Are there enough samples to actually make sane templates for? Or are you looking at the same old "fight the next war with the last war's tactics" again? 3) Is an AV *really* the right solution, or is your time better spent deploying a *real* security solution? For instance, "only blessed developer toolkit programs such as /bin/ld are allowed to write to executable binaries" goes a long way to closing the door to viruses that scribble into binaries. Sandboxing it further with "and programs that talk to the net can't invoke the toolchain as well" does even more. If you disagree with that model, feel free to brainstorm your own policy that doesn't care if the attacker is a virus or some other attack vector (possibly even an actual live black hat)... So let's see - I can "secure" myself against viruses by running AV software, or I can *really* secure myself against viruses *AND* most other known attacks as well by doing things like: 1) Staying up to date on patches 2) iptables 3) Hardening the system as per Center for Internet Security and/or other recommendations 4) tripwire (yes, I know this one is after-the-fact) 5) SElinux and/or similar systems. Which of the above have worse stats for price/performance and TCO (on a *continuing* basis) than your proposed AV solution? And what's the incremental price/performance for your AV solution after deploying each of the above (singly or in combination)? In other words, is an AV solution for Linux *really* worth it, or are there half a dozen things that provide more bang-for-buck, and once you deploy those half-dozen, you're not doing very much additional good with an AV solution?
Attachment:
pgp00028.pgp
Description: PGP signature