RE: [malware-list] TALPA - a threat model? well sorta.

["Press, Jonathan" <Jonathan.Press@ca.com>]

> -----Original Message-----
> From: malware-list-bounces@dmesg.printk.net [mailto:malware-list-
> bounces@dmesg.printk.net] On Behalf Of Peter Zijlstra
> Sent: Friday, August 15, 2008 6:37 AM
> To: Helge Hafting
> Cc: linux-kernel@vger.kernel.org; malware-list@lists.printk.net;
hch@infradead.org;
> andi@firstfloor.org; viro@ZenIV.linux.org.uk;
alan@lxorguk.ukuu.org.uk; Arjan van
> de Ven
> Subject: Re: [malware-list] TALPA - a threat model? well sorta.
> 
> On Fri, 2008-08-15 at 12:07 +0200, Helge Hafting wrote:
> > It seems to me that this "scan on file open" business is the
> > wrong way to do things - because it reduces performance.
> >
> > If you scan on file open, then your security sw is too late and
> > getting in the way.

The problem is that you have to account for the cases where the malware
made it onto the system even if you were trying to catch it ahead of
time.  For example:

- Administrator turns off or reduces AV protection for some reason for
some period of time.  It happens all the time.

- New infection makes it onto the machine before the signatures have
caught up with it.  This also happens.  There is an ongoing PR race
among AV vendors about who was faster on the draw to get out signatures
to detect some new malware.  The fact that this race exists reflects
that reality that there is some window during which new malware will
make it onto some number of machines before the scanners catch up.


> > It is better to scan in advance. Most machines has lots of idle
time.
> > Use that time to scan in advance, and mark the files as "clean".
> >
> > A "clean" file can be opened without further checking anytime -
giving
> > normal high performance.  A file that gets written to becomes
"dirty"
> > until checked again. Some mechanism for making a clean copy of a
> > clean file might help avoid excessive "dirtying".
> >
> > "Scan on open" might still be useful for cases when the system
> > haven't kept up with writing, but please don't aim to have
> > this be the _primary_ mode of scanning. A file server
> > where most of the stuff is pre-scanned will likely perform much
better
> > than  one scanning everything on open.

It isn't the primary mode.  It's the mode that catches things as they
arrive, and as they are about to be used.  Most sites will also employ
the applications' features for running regular scans of the whole system
on a scheduled basis, to catch anything that may have slipped through.


Jon Press