Security threats Toolkit
Story: Microsoft study finds Trojans are biggest threat
Endpoint security software designed against trojans.
It is true that antivirus software plays an important part on organizations network security.
It is also true that in many cases it’s not, for example industrial networks (clients not connected to internet) virus signatures are not updated quickly enough leaving the systems with a false sense of protection. (+ the resources consumption)
The truth is that if you are only blocking endpoint data extractions and not usage (read-execution) your network is vulnerable to be infected by the simple use of a CD or USB removable drive at any endpoint.
So, if you have in place antivirus software (signatures not up to date) or your network is unlucky enough to be a virus debutant (get it before its known) and you have endpoint security that allows usage of CDs for example. Your real protection value against trojans is 0. (+ the resources consumption)
Therefore the importance of endpoint security software in preventing virus or Trojans entrance without the luck factor.
Endpoint security software solutions should not provide one way security (meaning block only extractions) pseudo read-only because execution is also allowed.
The truth is that to be able to allow usage of removable storage devices the only method that makes sense is to authorize specific storage device to operate at a specific client for a specific duration, and monitor file extractions. Or completely disallow usage when not required.
To provide options that diminish the protection value of the software regarding Trojans or virus entrance to minus 0 does not make sense. (And is misleading by nature)
Regarding removable storage devices, effective network endpoint protection should only provide the following options to be straightforward:
a) Block (protected)
b) Authorize specific a device and monitored (block all other devices of the kind except the approved device)
c) No action taken. (Unprotected)
One could argue that as long as one way “protection” is provided as an option its fine. (You don’t have to use it)
Have you wonder how unnecessary options affect the protection value of your solution. The truth is that options always bring compromise at development.
If you need to protect your organizations assets implement endpoint security that is straightforward to your real needs and not resources consuming ,blotted, weakened by options solutions.
Full Talkback thread
