What do you consider an acceptable level of security?

"The only truly secure computer is unplugged."

Okay, fine. However, there are certain limits on what I consider acceptable vs. unacceptable security.

For instance: I can accept that against a human attacker, my system is basically toast. I don't expect a desktop OS to stand up to a deliberate, calculated attack. And I can accept that my OS cannot protect me from myself. It's not my computer's job to keep me from doing something stupid.

However, the idea that a dumb, automated program can reliably exploit a series of zero-day vulnerabilities to instantly root any system with any security setup whatsoever... And to have that happen twice in a row, as per Duqu and Stuxnet... To me, that is pushing the limits of what is acceptable, especially in a rather expensive product like Windows.

So, yes... To me, an acceptable level of security constitutes a very, very low probability of being compromised without either a) direct malicious action on someone else's part or b) direct stupid action on my part.

What are your limits?

 

Don't use Stux as an example in such a discussion, as that is in the realm of national espionage and not relevant to such a general topic. Stux was not meant to bypass any and all security on any setup. It was carefully constructed to attack a highly specialized industrial target, and one with a specific configuration. It was also introduced to the target by hand and didn't need to "break into" anything.

You already have a very low probability of an attack, no matter your setup, unless you're targeted or stupid. Acceptable security is the ability to do what you need to do, without too much (preferably none at all) interference from your security setup (at home). Unacceptable is getting in the way, being overly sensitive and causing FPs and other issues.

 

At some point you end up with two possibilities:
1) The security becomes so complex/ convoluted that it leads to insecurity (complex policy = can't understand the policy = insecure OR security measures interfere with each other)
2) It becomes impossible to deal with/ maintain

I think I have what could be considered a rather "paranoid" setup. I've compiled my own kernel and I've set up a ton of apparmor policies + completely restricted what can be done on the computer through grsecurity and I've added mitigation techniques to the kernel through PAX.

Is this "enough" security?

Depends. Just installing Ubuntu is enough for everything currently out there that I know of. I don't have Java installed so even if I were on Windows that eliminates something like 60% of the exploits I'm likely to run into. I use Chrome so nothing's getting in through that (seriously, I don't know if there's a talented enough hacker to get through Chrome on my system) and apparmor is applied to a few things by default.

Those simple measures alone make me more secure than "enough" for anything I'm likely to run into.

If a hacker does target me and they're actually legit... I could do more. My router is the weak point right now.

In terms of rooting my system I'd be very impressed but I'm sure it's possible. I don't think a hacker would have an easy time just because no matter what part of my system they exploit they're very likely stuck in an apparmor profile.

But, in terms of likely scenarios I think I'm definitely secure enough.

 

You could start with this handy reference guide

 

Thank you. That was... rather enlightening.

 

You raise an excellent question Gullible Jones.

Defending against a targeted attack isn't feasible on my system, aside from the fact that I don't have the necessary knowledge, resources, or time to properly do it. I would like to harden my system against targeted attacks mostly because I want to do infosec professionally- it's good practice and it's fun!

I guess for now my acceptable security setup is to have really good backups of all my data. I want to be able to reinstall at any given moment if I feel threatened or compromised. Very little can survive a reinstall, so it's the best I can do for now. But I can see how that would be a major pain for most people. It takes time to reinstall.

 

When I can browse wherever I want and view whatever I choose.
When I can let someone else use it without worrying about what they might find or try to install.
When every time I start or use it, the PC behaves exactly as it did before.
Then the security level is acceptable.