dmg@lid.mitre.org (David Gursky) (09/28/89)
Recently, the National Institute of Standards and Technology (NIST, the successor to the National Bureau of Standards) published a short paper entitled: _Computer Viruses and Related Threats: A Management Guide_. I have had a chance to read through it, and here are my comments: NIST Virus study comments First and formost, the NIST paper is an excellent, broad summary of knowledge of prevention measures for "electronic threats". It does not deal with the specifics of protecting this system, or that system, but rather looks at two classes of systems (multi-user and single-user) in two different environments (stand-alone or networked) and discusses six aspects of the security issue: General Policies, Software Management, Technical Controls, Monitoring, Contingency Planning, and Network Concerns. As much as I want to say this is an excellent paper, I find two flaws that hold it back: 1 -- The paper is not always consistent in its tone and advice 2 -- Some advice presented in the paper is based on false assumptions Inconsistency -- The authors of the paper appear to have a problem accepting that any successful policy to deal with electronic threats must rely on the cooperation of the user community. At certain points, it explictly states system managers must *prevent* users from performing actions of questionable risk altogether, and later on it states that users can do the same thing under controlled circumstances. The problem of electronic threats is *everyone's* problem, and *everyone* must be part of the solution. The underlying attitude of the authors seems to be "users cannot be counted on". For better or for worse, users *must* be counted on, and when that is not possible, made accountable. Other examples of where the authors make one statement, and then back down from it elsewhere in the paper exist; this is the one that I happen to have picked up. By the same token, there are only a few instances of this type of hemming and hawing. False Assumptions -- The paper forwards the myth that programs obtained from public sources (bulletin boards; public network libraries) are inheritely tainted, and that shareware/freeware/etc. should really be avoided. Certainly applications obtained from these sources are riskier, but these risks can be minimized through careful selection of sources, (i.e. public sources with a large pool of experienced users feeding from it), by judicious testing of software obtained from these sources, and by maintaining an internal library of these applications. This last step (completely overlooked by Wack and Carnahan) of providing users access to shareware from a corporate-sanctioned libraray can go far in ensuring that applications from riskier, public sources are not brought into the corporate computing environment. By the same token, the paper forwards the myth that commercially obtained applications are inheritly untainted. The Aldus Freehand infection (among others) demonstrates that this is clearly not true. Summary -- Summarizing, I would say this paper is a very good source for technical users looking to gain information about how to go about addressing the virus problem, and a good source for corporate managers looking at the same question. The paper's inconsistency on the role users must play in a successful anti-virus strategy, and it's partial reliance on a false assumption hold it back from being excellent on both counts. Copies of the NIST paper can be obtained for $2.50 from the U.S. Government Printing Office, 202.783.3238. The document is NIST Special Publication 500-166, GPO #003-003-02955-6. The opinion expressed in this review is mine, and does not in any way reflect the official policy of the MITRE Corporation, or any of MITRE's clients. Please do not redistribute this review without my consent first. Thank you. Submitted 27 September 1989 David M. Gursky Member of the Technical Staff, W-143 Special Projects Department The MITRE Corporation
time@oxtrap.oxtrap (Tim Endres) (09/29/89)
> Discussion of the NIST virus paper...
The paper forwards the myth that programs obtained from public sources
(bulletin boards; public network libraries) are inheritely tainted,
and that shareware/freeware/etc. should really be avoided.
By the same token, the paper forwards the myth that commercially
obtained applications are inheritly untainted.
Sounds like the committee was seated with commercial software vendors!dmg@lid.mitre.org (David Gursky) (09/30/89)
In the VIRUS-L Digest V2 #207, time@oxtrap.oxtrap (Tim Endres) writes: > Sounds like the committee was seated with commercial software vendors! The NIST paper was written by two staff members there, and is not a committee report. I've received some feedback from NIST on my comments to the effect of "Good point. We did not intend the bias towards commercial software, but it is certainly there".