Author Topic: the definitive minimal amount of programs for the greatest security? (Read 36306 times)

nudone · « **on:** April 06, 2005, 05:14 PM »

just thought i would start a new thread as i'm sure everyone will have their own list of programs that they deem essential for a 'secure' system.

from my experience there appears to be a lot of overlap when installing the typical list of anti-virus, trojan guards, firewalls and spyware detectors, etc. which, to me, feels a little excessive.

how about trying to define the minimum number of programs that are required for a thoroughly secure system; trying to avoid features that overlap or are possibly redundant.

hopefully a small list of 3 to 5 programs could be discovered that provide the greatest protection. providing a true sense of security to even the most novice of users and all without the worry that there are unnecessary programs running in the background that are duplicating the tasks of other software.

mob's post on 'processguard' and 'regdefend' got me thinking as these are two things i've never used, so, i'm wondering, can i get by without them or not?

currently i use avg free edition and agnitum outpost and that's about it. i'm not fully convinced i need anything more but if there is a program (maybe processguard) that will 100% protect my system with the least amount of fuss then i guess it makes sense to use it for that rare occasion when things could go wrong.

mouser · « **Reply #1 on:** April 06, 2005, 05:24 PM »

id consider an antivirus+firewall the bare minimum. and they should be running all the time in the background, imho.

process guard sounds intriguing though, and i'm going to give it a look.

as for antitrojan and antispyware, and others, i wouldnt waste my cpu running such programs in the background, though its nice to have these for on-demand scanning.

slightly off topic but invaluable for those of us who like to test software is a virtual machine like VmWare or VirtualPc; such a program is essential, and we will be doing an award on them in very near future.

nudone · « **Reply #2 on:** April 07, 2005, 02:26 AM »

well, that describes my setup too.

i'd guess that users that know their pc systems inside and out will only have a firewall and anti-virus running as they are confident that they know what they are doing with their machines.

i was thinking more along the lines of what happens to people i know. no matter what you advise them to do to avoid nasty things getting onto their pc, they will still allow it to happen. their fault i know, but it's always left to someone else (like me) to pick up the pieces and try and get everything working again. i'd just love to know how to make their machines totally secure and idiot proof (and i'll have the moon on a stick whilst i'm at it).

the virtual pc thing is something that sounds fantastic though. the main reason i do lots of system backup images is because i tend to install software that usually needs removing so i just wipe the lot with the restored image. i'd much rather just use a virtual system to install the test software into. so i look forward to hearing about the virtual pc comparisons.

randiroo76073 · « **Reply #3 on:** April 09, 2005, 09:34 AM »

I can only offer what I run: Active=Firewall, AV, & Winpatrol[I like the dog

]. Inactive/on-demand, 3 AV's, 2 Trojanscans, 3 Spyware, a CD with lots of command line removers. I'm not paraniod, just like to be prepared as I have had to cleanup many puters for people who weren't. VMware would be nice if I could get it installed on all the puters I've fixed

nudone · « **Reply #4 on:** April 09, 2005, 09:45 AM »

not paranoid, okay, i believe you.

i think i tried winpatrol but it got kind of annoying with it asking if things were okay all the time - i know that's it's job but it seemed to have a poor memory and kept asking me things it should have already known.

from what i've done with other people's computers, it appears to me that the MS antispyware beta thing might be less annoying than winpatrol.

randiroo, your machine sounds more secure than fort knox.

mob · « **Reply #5 on:** April 09, 2005, 08:23 PM »

By the title of this thread I see you want the least amount of programs that will give you the most amount of protection.

With that in mind, here is what I suggest:

You need a Firewall. Outpost is really really good, but if you are more advanced I would suggest using Look-N-Stop as it is a little bit better. Ofcourse, I could get shot for saying this by some die hard outpost fan... but hey.. this is just my opinion. I'm actually using outpost right now but I am considering switching to look-n-stop as it uses very little resources.

You definitley need process guard. (A free alternative is a program called Anti-Hook which supposedly does the same thing as process guard. Although I would rather stick to a proven and tested program such as process guard)

The only programs I use to protect my system is Process Guard and Outpost Firewall and COMMON SENSE!! <--- this is important!

I do use TDS-3 as my trojan scanner. I will perform a scan once a week and maybe once in a year I will detect some trojan than got passed my defenses. TDS-3 is by far the best trojan scanner available... hands down.

As far as a virus scanner... I wouldn't use one. I don't use them because they hog resources and plus I don't really see the benefit of having one. Remember, as long as you have common sense, you don't need one. But if I was ever going to get one or recommend one to another person it would definitley be NOD32. NOD32 is a superb antivirus system. If you don't want to pay for an antivirus, my choice would be Avast (which is an amazing antivirus that is FREEWARE and is better than the big names out there.)

Registry protection. I use RegDefend. Great program that uses almost no resources! If anything ever gets through your layers of protection, you can always be sure that your important registry keys will always be safe. Meaning, that a simple reboot will usually solve the problem. Of course, it's a great program but if minimal is what you are looking for then cross this one of the list.

Lastly, I would suggest installing a spyware remover. Just run a scan every week or so and you will be alright. Spybot S&D is a great freeware one and Lavasoft Ad-Aware SE is in my opinion the best one. Use both of them if you can.

So to sum it all up:

Minmal protection in my opinion:

-PROCESS GUARD (ALWAYS LOADED)
-FIREWALL (ALWAYS LOADED AND PROTECTED BY PROCESS GUARD)
-AntiVirus (If you want, get one. Make sure you protect it with Process Guard too!)
-TDS-3 (Weekly Scan)
-Spyware (Weekly Scan)
-RegDefend (Recommended as an added layer of security)

Of course, there are a ton of other programs you can use for added layers of security, but I beleive that what I posted above will give you some tough security to get through and still keeping it minimal.

Also, the most important thing you should do is keep your OS patched with the latest updates.

mouser · « **Reply #6 on:** April 09, 2005, 08:34 PM »

i think antivirus tools are def. worth installing,
BUT
they do consume cpu scanning every file, and i think a case could definitely be made for NOT installing a resident antivirus, and only using an on-demand antivirus tool, providing you are very careful about not executing programs until you scan them.

on the whole though, i definitely feel safer having a resident antivirus and unless one is playing some top of the line game, the lost cpu cycles are a fair price to pay for some increased safety.

some antivirus programs are easier than others to install in a purely ondemand mode; when we get around to our antivirus recommendations this will be one of the criteria we look at.

JeffK · « **Reply #7 on:** April 09, 2005, 08:49 PM »

Has anyone had any experience with TaskGuardian? http://www.asmdev.net

Jeff

mob · « **Reply #8 on:** April 09, 2005, 09:34 PM »

Has anyone had any experience with TaskGuardian? http://www.asmdev.net

Jeff
-JeffK (April 09, 2005, 08:49 PM)

I've never used it before, but I have used similar programs that do the same thing.

After reading the website I can see that TaskGuardian does 5 main things. I'll list them below and in parenthesis I will give you an alternative from what I've used.

1) Process Guardian (You can use ProcX its freeware - http://www.ghostsecu...index.php?page=procx )
2) Network Guardian (I recommened Port Explorer - http://www.diamondcs...com.au/portexplorer/ )
3) Startup Guardian (This is bullshit. Why would you want to know if a trojan is starting up AFTER it already started up?? Use RegDefend for REAL TIME protection against this threat plus more. Also check out this freeware app that does exactly the same thing as Startup Guardian - http://diamondcs.com...ex.php?page=asviewer )
4) Windows Guardian (Don't know much about this feature but I beleive TDS-3 has a similar type of scan involving CRC32 checking of files in your windows directory.)
5) Browser Guardian (Ad-Aware and Spybot S&D can take care of this department. Also check out http://www.javacools...re.com/products.html for two good freeware apps. SpywareGuard and SpywareBlaster)

mouser · « **Reply #9 on:** April 09, 2005, 10:38 PM »

it would be nice to hear what users who know about security think about ProcessGuard vs. the competition, since i've heard good things about ProcessGuard..

btw
even though we have the 5 daily columnists i originally planned for, if one or even two (as an alternating pair) of people here feel like they have enough to talk about to do a weekly blog column on security issues, and think it would be fun to do so, i think it would be worthwhile adding a weekend blog.

JeffK · « **Reply #10 on:** April 10, 2005, 12:52 AM »

Thank you, mob. That was just an excellently helpful answer to my very general query. Thanks for taking the time to reply in such detail.

Jeff

nudone · « **Reply #11 on:** April 10, 2005, 03:57 AM »

thanks mob for taking the time for your in-depth reply. you've provided exactly the right kind answers and opinions i was looking for when starting the thread.

it's clear that you've had plenty of experience with the security side of things and i can fully understand your view on not using an anti-virus barrier. my system has only sufferred a virus infection twice in about 5 years or so - and that was my own fault for installing suspicious software.

i've never heard of it but 'look-n-stop' sounds interesting and your other comments are enticing enough to make me try out the other programs you mention.

i have one question - does process guard (or the other programs you mention) bombard you with confirmation dialog boxes everytime you run a program?

(i can't remember what it was now, but i had to turn something off with agnitum outpost as it became really annoying - always asking if it was okay to run macromedia software i use, even though i had told it it was okay.)

Ann Elm · « **Reply #12 on:** April 10, 2005, 10:56 AM »

Someone tell me what I need PLEASE. I read so many different things and am so confused.
I run Avast, Conterspy,Sygate,Spyware Blaster,Spyware Doctor, And Spyware Guard all of the time! What more should I have? I also use Spysweeper once a week. I NEVER open links in emails! Also I use Firefox as my default browser. I love to download and try software but am careful. Thanks

mob · « **Reply #13 on:** April 10, 2005, 08:08 PM »

i think antivirus tools are def. worth installing,
BUT
they do consume cpu scanning every file, and i think a case could definitely be made for NOT installing a resident antivirus, and only using an on-demand antivirus tool, providing you are very careful about not executing programs until you scan them.

on the whole though, i definitely feel safer having a resident antivirus and unless one is playing some top of the line game, the lost cpu cycles are a fair price to pay for some increased safety.
-mouser (April 09, 2005, 08:34 PM)

This is a good point. I failed to mention that I myself am a gammer who is paranoid about programs taking up my valuable resources, which is primarily why I am so obsessed with programs that require little use of them.

Now don't get me wrong guys... an Antivirus is a great added layer of security to have (If you don't mind the resource hogging.)

But for me it is pretty much useless as almost 99% of the time, common sense will be your #1 virus prevention and I figure that the 1% risk is not worth the toll on the CPU that this software will take. NOD32 is very good with resource usage... just incase anyone is interested. Also, if you want the bare minimum (as this topic suggests) I say to hell with the antivirus...

my system has only sufferred a virus infection twice in about 5 years or so - and that was my own fault for installing suspicious software.
-nudone (April 10, 2005, 03:57 AM)

careful careful careful.... common sense is KEY

i have one question - does process guard (or the other programs you mention) bombard you with confirmation dialog boxes every time you run a program?
-nudone (April 10, 2005, 03:57 AM)

If you hate confirmation dialogs then PG is not for you

Nah I'm just kidding. At first, PG will be annoying with its pop ups. The first thing you will notice is that it acts like a firewall for loading programs. So basically, the only things that can load up on your computer are the things you give permission to load up. Once you teach PG what is OK, it will stop bugging you.

Not only does it protect all the files on your computer from loading, it will also notify you if the file you are loading has changed since the last time you gave it permission to load. So lets say you permanently allow your browser to load up because you don't want to see the confirmation every time you want to use it. This is OK because now PG knows it is allowed, but most importantly it records the CRC of the file, the path of the file, and the size of the file. If a virus takes over your browser or modifies something in it, PG will give you a conformation before you load it up saying that the file was changed and it is not the original that you normally allow to load.

That's great security. Also, there are leaks in firewalls that can be taken advantage of. So like, a malicious file will attempt to inject itself into your browser and since your browser has permission by the firewall to access the internet, the virus has successfully broken through your firewall and can do what it likes. But PG will protect all loaded programs from modification in real time. So it easily defeats this.

I can go on about PG all day, there is so much more that it does. Just download the trial and play around with it and you will see what I mean.

RegDefend will also give you confirmations every time a registry key is modified/added/deleted. This mostly happens when installing new software and things like that. It wont be so annoying, and it's a good layer of security.

Someone tell me what I need PLEASE. I read so many different things and am so confused.
I run Avast, Conterspy,Sygate,Spyware Blaster,Spyware Doctor, And Spyware Guard all of the time! What more should I have? I also use Spysweeper once a week. I NEVER open links in emails! Also I use Firefox as my default browser. I love to download and try software but am careful. Thanks
-Ann Elm (April 10, 2005, 10:56 AM)

OK you are running Avast, which is a great antivirus so you are fine there. Just be sure to update it as often as you can.

Get rid of Sygate. Its weak firewall and I wouldn't recommened it to anyone. There are more advanced firewalls today. Get Outpost, its easy to use and top of the line. Plus if you ever need help just go to www.outpostfirewall.com and you will see a forum full of wonderful people who are there to help you with your outpost needs.

That's another thing guys, in my opinion, in order for a security program to be good, it MUST have a support forum where average users can come together and discuss problems and help each other. The software designers will be able to read user comments and problems and keep making the programs better and better. Every single piece of security software I have mentioned throughout this thread has a forum of good, dedicated people... which is a must!

Ann Elm, I would suggest you invest in Process Guard. It is a one-time fee and you are good for life with upgrades just like all DiamondCS software.

If you download allot and run suspicious software without scanning, or open email that you don't know where it came from, I would recommend WormGuard ( http://wormguard.dia.../index.php?page=home ) This a another security layer which I've started using recently. It uses absolutely no resources. It sort of integrates into your OS and is never loaded in the memory. It will alert you only when you run something that it feels isn't safe or might be harmful. It's a good security program to have and DiamondCS is working on a new version which is supposed to be waaaaay better. Don't wait for the new version get it now (upgrades are free for life).

Just so you guys know, I have absolutely no affiliation with DiamondCS... it's just that this company produces the most secure protection for computers with the least amount of resource use. It just doesn't get any better. They are simply the best.

mouser · « **Reply #14 on:** April 10, 2005, 08:26 PM »

That's another thing guys, in my opinion, in order for a security program to be good, it MUST have a support forum where average users can come together and discuss problems and help each other. The software designers will be able to read user comments and problems and keep making the programs better and better. Every single piece of security software I have mentioned throughout this thread has a forum of good, dedicated people... which is a must!

i think that's a really important point.
for most programs having a support forum is a nice bonus but not super important. for security software its *really* important because they will provide a place where people can discuss possible security risks and weaknesses, which otherwise would go unfixed.

dom424 · « **Reply #15 on:** April 10, 2005, 09:43 PM »

"i think that's a really important point.
for most programs having a support forum is a nice bonus but not super important. for security software its *really* important because they will provide a place where people can discuss possible security risks and weaknesses, which otherwise would go unfixed"

That is why I started using Outpost. Their forum which is run by the users of Outpost and not Agnitum is superb.

Ann Elm · « **Reply #16 on:** April 10, 2005, 10:17 PM »

Thanks dom I've asked this in other forums and never got a definite reply!!

nudone · « **Reply #17 on:** April 11, 2005, 04:01 AM »

i'll definately look into process guard and the other programs you mention mob.

but i am curious as to what the differences are between things like process guard and microsoft's antispyware beta software. as microsoft's software is free (for the moment) i would favour recommending that to people i know.

for the most part i'm not entirely concerned of what to install on my own machine as i think i know what risks i'm taking (if any). my main interest is how to protect the average users machine with the minimum amount of fuss - without actually disconnecting that person from the net.

unfortunately, when posting this thread, i conveniently forgot the main problem with security issues on the pc and that is of the person sitting in front of it.

programs like process guard sound like they do a fantastic job except for one small problem: that is they require the user to understand the dialog boxes that pop up in front of them.

i have no doubt that people visiting this forum understand their computers well enough to know when to click 'accept' or 'deny' on a security alert dialog box but, alas, i don't believe that is the majority of users.

i repeatedly have to fix computers for people i know even though i have installed security programs for them and emphasised that they should be suspicious of everything they receive over the net. the problem does not lie so much with the software that is protecting their machine but with the way they understand how to use it.

as sad as it sounds, i think it would be fair to say that they wouldn't even know what internet explorer is let alone whether they should allow it through the firewall. maybe i know too many lazy people who just don't care what all the programs are called on their machine or maybe this is just how your typical user is. i suspect it is the latter.

they simply want to get the task done whilst they are sat at their desk and any security dialog box will be quickly dismissed without any real thought of what it said or what it means. they might take the policy to simply block everything when asked what to do by a dialog box, but then they will learn that this was incorrect as programs stop working correctly; so they will then learn to click 'accept' for everything to be allowed through the security layer and then we are back to the stage of having no barrier at all.

it would be easy to say all these people are morons and they deserve the problems they receive if they can't be bothered to learn about their system. i think that is a bit unfair and it doesn't help much. i admit, it isn't hard to learn the common day to day programs that one uses but when dialog boxes appear asking for permission for 'notavirus_honest.exe' to access the internet i suspect the people i'm talking about will interpret that as being a trustworthy and legitimate program to run. anything more obscure like a malicious piece of software named 'sxxx312.exe' will just confuse the user and then they will click whatever is required just to make the dialog box go away (i made 'sxxx312.exe' up).

i would just love to hear of some piece of security software that you could install and then forget about - knowing that it is protecting everything without any need for user intervention. being realistic, i suppose i am asking for the impossible as the user will always have the final say on what they allow onto their machine no matter what barriers are in place.

mouser · « **Reply #18 on:** April 11, 2005, 04:27 AM »

it's true, a program like Process Guard is to advanced for the average user.

maybe the best security app would be like what mob kept saying, call it: "CommonSensePro Xp"
and all it would do is watch you and if it sees you about to try to open some exe attachment in your email,
or something similarly rescue it would just pop up a giant warning message saying "OMG ARE YOU SURE YOU KNOW WHAT YOU ARE DOING?!@!#?"

a firewall, an antivirus which updates daily, and avoidance of high rish activities like opening email attachments are the 3 tools you need.

actually we havent mentioned something equally important in terms of security, which is making regular backups -
things do go wrong, whether it be security problem or hd crash, and you need to have regular backups to plan for this inevitability.
getting a virus is not so bad if you have a recent backup to go back to.

nudone · « **Reply #19 on:** April 11, 2005, 05:02 AM »

have to agree that having a backup of the system is the most important thing - i've recommended it to everyone since someone introduced me to ghost many moons ago. at the time it seemed magical being able to back up win95 (i think it was that far back) and i've been absolutely dumb founded ever since that a true backup method isn't built into windows straight out of the box - how more fundamental a thing do you want.

on the occassions that i've attempted to clean someone's pc of viruses it usually only took a few days for their machine to be infected again - answer: just wipe the operating system off and put the backup image on again. i've learnt that it's not even worth attempting to scan and clean a system most of the time.

only one thing to bare in mind with this kind of approach (and i'm sure most of us will have adopted it here) is to store valueble docs and config files on a separate partition so they don't get wiped out in the restore process.

i'm really looking forward to the 'backup' software review mouser as it's something i've never done on a folder/file basis - just whole parititions for me.

mob · « **Reply #20 on:** April 12, 2005, 04:50 PM »

Yeah... backups are definitely good.

You'd think I would learn after 3 hard drive crashes and 2 lightning surges... I guess it's either i'm lazy or I just like playing my luck

Oh well, I always say nothing is going to happen to me... then the next day it happens.

It's just an accident waiting to happen. Although now I am a little smarter and backup some of my important files onto dvds (just incase).

But yeah, I don't think I'll ever see the day when I do a full system backup.

I do a fresh windows installation ever 2-3 months and start from scratch anyways...

About your question, nudone: I've never used Microsoft's AntiSpy but I've heard it was a good piece of software. As far as you comparing it to Process Guard... two totally different things.

And I agree with your point about a user needing to be some-what advanced in order to use the security apps. You can give a newbie the best security a computer can have and he will still get hit with the baddies. The point is... having the tool is not enough to get the job done. You need to know how to use it.

I just removed 994 trojans from my brothers PC... yeah... you read that right.... he's one of them

Scott · « **Reply #21 on:** April 16, 2005, 01:47 AM »

You definitley need process guard.

The only programs I use to protect my system is Process Guard and Outpost Firewall and COMMON SENSE!! <--- this is important!

I do use TDS-3 as my trojan scanner. I will perform a scan once a week and maybe once in a year I will detect some trojan than got passed my defenses. TDS-3 is by far the best trojan scanner available... hands down.

As far as a virus scanner... I wouldn't use one. I don't use them because they hog resources and plus I don't really see the benefit of having one. Remember, as long as you have common sense, you don't need one.
-mob (April 09, 2005, 08:23 PM)

OK, I'm confused by your position. You "definitely need process guard" because, ostensibly, you realize that you can come across malware. But you say that you don't need anti-virus software, because you use common sense. This brings to mind a few questions:

1. Why does "common sense" remove the need for anti-virus software, but not ProcessGuard?

2. Why does "common sense" remove the need for anti-virus software, but not anti-trojan software? (Keeping in mind that there really is no such thing as literal "anti-virus software" anymore)

3. How does "common sense" detect malware?

Scott · « **Reply #22 on:** April 16, 2005, 01:50 AM »

OK, I'll shed some light. There is no One True Answer for security. There is no One True Security Utility.

What you need depends on a lot of things. Who uses your computer. What you have on your computer. How knowledgable you are. How much money you have. How willing and able you are to deal with software and environment configuration. What you do with your computer. How it is connected to the internet. And so on and on and on...

Anyone giving a flat, specific, parrot-like answer to the question of "what do I need?" really doesn't understand security at all. I'm sorry, but it's true. If you don't even pause to ask some of the questions above, and more, how can you possibly provide a reasoned answer?

If someone asked, "How do I secure my building?" wouldn't you ask things like "Is it a dwelling, or a storage space?" "How is the building constructed?" "What is inside it, and how valuable is it?" "Where is the building located?" "How much can you spend on security?"

...?

mouser · « **Reply #23 on:** April 16, 2005, 01:55 AM »

well,

i agree that there is no one answer for everyone, in all fairness the spirit of this site has been trying to make these kind of generalizations about what would be a good setup, so i wouldnt be so hard on an attempt to suggest a good minimal set of recommended apps, and just say that people should take such suggestions with a grain of salt.

its interesting to see that some firewalls are adding the kind of functionality that process guard adds, and im guessing that the functionality of something like process guard is a good idea and could make it into operating systems in the future.

ie you should have some better control of what executable processes run. but for me process guard is a bit too much.

Scott · « **Reply #24 on:** April 16, 2005, 02:10 AM »

Sorry, I have to disagree to an extent. Maybe I worded it too harshly... Sorry. But a "good setup" for one person will be a terrible setup for another. For example, I might recommend Jetico Personal Firewall and NOD32 to you, because they both have significant strengths, but may involve some complex configuration--but I'd never recommend either to my mother (I'd be over the following day, doing a reformat). Instead, for her, it might be ZoneAlarm and Kaspersky Anti-Virus. But... Is her CPU up to the task? More questions.

Sure, you can sit back and say "A good anti-virus and firewall makes a good setup", but that's pretty much a non-statement these days, just as twenty years ago we could've had a long discussion on the merits of wearing your seat belt while driving, but today, it pretty much goes without saying.

The OP said "how about trying to define the minimum number of programs that are required for a thoroughly secure system"... If you want a number, I'll say, OK, how about 4? Maybe 3. No, definitely 5. But what does "thoroughly secure" mean? (To me, it means the system is unplugged.)