Security For All

In part 1 we started a foray into security ideas for your mom with this (highly abbreviated) list:

Security Ideas for Mom

1. Think. Use common sense.
2. Learn how to use your hardware and software. Don’t use something you don’t understand.
3. It’s your computer. Show that machine who’s boss – who’s your mama!
4. Your friends are clueless.

In part 2 we explored the threats that mom is likely to encounter and some general ideas of how you might manage that risk.

Now in part 3 we’re back to the list.

In the post “NAC: Answering the right questions” I gave Joel Snyder a pretty hard time, but being a really classy guy (his primary issue was my use of the Dr. title, which he finds pretentious) he responded with some insightful comments. One of which is apropos to this topic:

My main reason [for discussing agent based solutions] is to make sure that people don’t labor under the misconception that  “agent-on-endpoint” is always the right answer — I’m trying to undo the marketing harm that some of the end-point security vendors have done…

“Well said”, you might be thinking but what does this have to do with mom staying safe while surfing the web with her new PC? Surely, you’re not going to suggest that mom deploy a NAC system on her laptop? No. I’m not going to suggest NAC for mom, but this is exactly the segue we need into the next idea.

5. Security software is not magic – in spite of what the vendors may claim. Anyone who has ever had the unforgettable experience of buying a used car from a used car dealer knows exactly what this is about. I had a friend who was wont to say “a software salesman differs from a used car salesman in that the used car salesman knows he’s lying”. The bottom line, as Joel points out, is that end-point security vendors have seriously over hyped their products. And yes, your mom’s new PC, or mac, or mini laptop or wifi-enabled cell phone is a network end-point. The problem is that, while the software will technically do what it claims, it certainly won’t do what it implies without a liberal application of steps 1 – 4. Take, for example, this partial list of features of a leading PC security suite (emphasis mine):
   • Connect securely to any wireless hotspot
   • Exchange documents freely using email and instant messaging
   • Surf the Web and play games online without worry
   • Bank, shop, and invest online with confidence
   • Guard against online identity theft
   • Inspect Web sites to make sure they’re not fakes
   • Safely download photos, music, and software

   Certainly the software has capabilities that can help mitigate some of the threats discussed in part 2, but the implication that all you have to do is install this amazing technology and you are completely safe and secure is balderdash. Hogwash. Crapola. Again, I’m not suggesting that end-point security software is useless, or that you don’t need it or shouldn’t use it. On the contrary. I’m saying that when you do use it – and you should – you must understand it’s limitations and what mom (the user) must do to make it actually function properly.

6. Do your research up front. Before you go to the computer store. Before you even think about spending one dime. If you can imagine yourself taking mom to a random auto dealership and telling the sales guy to “show me what we should buy”, then you should stop reading right now and either start over with part 1 or call this guy I know from Nigeria (who has a whole lot of money he needs to get out of the country…). Otherwise, try to figure out what mom really needs to accomplish what she wants by doing some research. Search the web. Read magazines. Read reviews. Listen to podcasts. Read blogs (oh yes – especially blogs). See if there are users groups with the same interest as your mom (trust me, she doesn’t want to search Google for random stuff, she has something tickling her fancy). And don’t discount open source and free platforms like Linux – I’ll bet your mom grew up in the ’60s and she might really groove on the idea of the free software movement. Viva la Penguin! And when you do get around to buying something, I’m guessing you’ll find a much better selection, better prices and a whole lot less pressure online. I’m not opposed to electronic superstores – just annoyed by them.

So there you have it. An even half dozen security ideas for your mom and not one single product plug in the lot. Lest mom neglect to remind you, always remember who’s your mama!