Once again I've spent part of a day working on a Windows PC. The general complaint is that it's slow. I've decided not to wipe it and re-install the software yet, but I probably will if it still seems slow. This time around I'm applying updates for all of the software that is installed. Yes ALL of the software.
Part of the problem is that this computer connects to the Internet via dial up. You can't update the computer with dial up. You can tell windows to download updates. It will do it in the background, but on dial this is slow. So, I brought the machine home and doing the updates from here.
First thing this morning I told it to update and first thing it installed SP3. Yes, I could have taken that with me (I had already downloaded it) but why bother. After updating SP3, it wanted to update 3 other things for Windows which took another 248MB of download. I believe that it was some .Net update.
In addition to the Windows update, I'm updating FireFox, AVG Free, Java, Spy Bot, Flash, Acrobat (you really need to update Acrobat), and OpenOffice. After that I'll run spy bot and defragment the hard drive over night. Hopefully this will help.
There are efforts being made to get some type of broad band connection into the area where this computer lives. It's a small rural farming area that has one dial up provider. Once it's installed I think that I'm going to set up the machine for dual boot and see if I can the users to run Ubuntu.
I can't do that now since the modems they buy are WinModems. There are no drivers for them under Linux. I'd have them buy more expensive modems, but they usually get one per year fried due to surges in the phone line. (Yes a surge protector helps.)
I need to do the same thing for my parents. I've put off putting linux on their computer even though do have high speed. The reason for that is that they've got some programs that only run under windows. I think that I'm going to try it anyway.
Showing posts with label windows. Show all posts
Showing posts with label windows. Show all posts
Saturday, April 04, 2009
Monday, December 01, 2008
Windows, USB drives, Military
If you hadn't heard, there is a ban on removable re-writable media in effect for the US Military. From what I'm hearing, this could be indefinite. I'm not in any position to know this for a fact, but I've heard that they're looking for a solution to this problem. If it was as easy to fix as not enabling autorun, I'm sure that it would have blown over and personnel would be getting their usb drives back.
The above really illustrates the problem of security in a Windows environment. Targeted exploits are being written that are not caught by virus scanners because they're not common enough in the wild. The virus scanners are doing pattern matching and no one has entered the new pattern. Consumer Reports pointed out just how bad the situation was in 2006.
The interesting thing about this is that this worm/virus probably propagated without the user having admin access. Most people take for granted that when running as a limited user it's harder to infect the system. It looks like this didn't stop this virus, since most of those users won't be running as an admin.
Perhaps it's time that the U.S. Military stopped depending on Windows and decided to use other operating systems. The NSA has provided a very valuable Linux kernel security addon called SELinux. It should be possible to create policies that would prevent this from happening on a linux system.
To begin, the USB drive should not be mounted with execute permission. This will prevent casual program execution. Using SELinux, it should be possible to limit the user to running only applications specified by the admin in the most restricted environment. I don't know how it's done, but it should be possible to prevent all shells and interpreted programs from running code from the USB drive.
I know what you're going to say next. There's a lot of windows applications that are needed. Run them in a virtual machine, but prevent that virtual machine from having access to USB drives. If the user needs data from a drive, the user will have to copy it to an appropriate location. This option will work well in the field. Laptops with virtualization enabled processors will be able to run VMWare or some other vm product reasonably well enough for most applications. Harden the laptop with all of the security that it needs.
In an office environment skip Citrix and provide the users with a virtual machine running on a software like Qumranet's (purchased by RedHat recently) virtual machine products. Watch the video of 1080p HD video being streamed from the virtual machine to a thin client. I hear that Wyse, makers of thin clients, is having a record year with the economy in a slump.
The above really illustrates the problem of security in a Windows environment. Targeted exploits are being written that are not caught by virus scanners because they're not common enough in the wild. The virus scanners are doing pattern matching and no one has entered the new pattern. Consumer Reports pointed out just how bad the situation was in 2006.
The interesting thing about this is that this worm/virus probably propagated without the user having admin access. Most people take for granted that when running as a limited user it's harder to infect the system. It looks like this didn't stop this virus, since most of those users won't be running as an admin.
Perhaps it's time that the U.S. Military stopped depending on Windows and decided to use other operating systems. The NSA has provided a very valuable Linux kernel security addon called SELinux. It should be possible to create policies that would prevent this from happening on a linux system.
To begin, the USB drive should not be mounted with execute permission. This will prevent casual program execution. Using SELinux, it should be possible to limit the user to running only applications specified by the admin in the most restricted environment. I don't know how it's done, but it should be possible to prevent all shells and interpreted programs from running code from the USB drive.
I know what you're going to say next. There's a lot of windows applications that are needed. Run them in a virtual machine, but prevent that virtual machine from having access to USB drives. If the user needs data from a drive, the user will have to copy it to an appropriate location. This option will work well in the field. Laptops with virtualization enabled processors will be able to run VMWare or some other vm product reasonably well enough for most applications. Harden the laptop with all of the security that it needs.
In an office environment skip Citrix and provide the users with a virtual machine running on a software like Qumranet's (purchased by RedHat recently) virtual machine products. Watch the video of 1080p HD video being streamed from the virtual machine to a thin client. I hear that Wyse, makers of thin clients, is having a record year with the economy in a slump.
Subscribe to:
Posts (Atom)