Here's what happens when security watchdogs ignore their own advice

Here's what happens when security watchdogs ignore their own advice

Summary: Germany's federal IT security agency regularly releases guidelines aimed at helping users keep their PCs safe. To show what happens when good security policies are ignored, the federal agency let two differently configured systems be attacked and documented the results.

SHARE:
TOPICS: Security, Microsoft, EU
6

The BSI (Bundesamt für Sicherheit in der Informationstechnik), the German government's office for information security, regularly publishes guidelines on the secure use of IT among businesses and consumers. According to the government agency, Windows users should keep their systems up to date, use more than one browser and avoid Java as much as possible.

It's all very sensible stuff, but the agency has this week showed what happens when it ignores its own advice – publishing a study comparing how systems that follows its advice, and those that don't, can stand up to security threats.

According to the study, the agency tested two different Windows 7-based systems. Both OSes were up to date with the latest available patches and also used Microsoft's free antivirus product, Security Essentials. One system used Google Chrome 21, Adobe Reader X, Libre Office 3.6.0.4 and a standard user account. The other one had IE9 installed alongside an older versions of Adobe Reader (version 9.4) and Libre Office (version 3.4.3). The system also had a year-old version of Java Runtime (version 6, update 26), along with an older version of Adobe Flash and an administrator account.

After the set-up, both systems were pointed to a hundred different websites, each of which tried to infect the system with a drive-by attack. According to the agency, the test system that followed the BSI guidelines did not suffer an infection, but four websites were able to download files to the system.

On the second, less secure system, a total of 49 attacks were successful. 36 websites were able to exploit security flaws and infect the Windows machine. Another ten attacks were able to exploit vulnerabilities in the system, but the MSE antivirus blocked an infection taking place. Three drive-by exploits were able to download data to the system, but unable to infect it as a result.

The government agency then compared those results to an older installation of Windows XP. There, a total of 88 attacks were able to exploit and infect the targeted computer.

When it comes to the security equivalent of eating your greens, the BSI's study shows that even with a few simple updates and modest outlay, users can dramatically cut their exposure to malware infection.

Topics: Security, Microsoft, EU

Moritz Jaeger

About Moritz Jaeger

Moritz is a Munich-based IT-journalist with more than eight years of experience as an author under his belt.

Kick off your day with ZDNet's daily email newsletter. It's the freshest tech news and opinion, served hot. Get it.

Talkback

6 comments
Log in or register to join the discussion
  • It was more than just "simple updates" for the infected Windows 7 system

    From the article:
    "even with a few simple updates and modest outlay, users can dramatically cut their exposure to malware infection.

    The Windows 7 system that was infected was run under the administrator account (the default account in Windows 7), while the Windows 7 system that was not infected was run under a standard user account. Least privilege, along with operating system, application and plug-in updates, is an important factor in securing ones system.

    It's noteworthy that Microsoft does not have a setup program which drops users into a standard user account on first use. Instead, the user is dropped into the default account (which Microsoft considers to be the administrator account for Windows Vista/7) where a user must 1) know they need to create a standard user account for day-to-day use, 2) know how to create a standard user account in Windows Vista/7, and 3) actually use the standard user account for day-to-day use.

    While both UAC and protected mode were important security enhancements for Windows Vista/7, Microsoft continued dropping users into the systems administrator account which defaults. Just curious, does Microsoft do the same in Windows 8?
    Rabid Howler Monkey
  • Here's happens when security watchdogs ignore their own advice

    The subject is what happens when you don't read through and check your work.
    cb77305
    • I must agree

      That article title doesn't accurately represent the article - a click bait.
      Tomas M.
      • Re: a click bait

        I think your comment is just comment bait.

        As far as baiters are concerned, some here are real masters.
        ldo17
  • So.....WHAT happens?????

    We ALL know that, if you don't follow rational means to protect your computer, (updates being one) that you will definitely get infected in time. So what did this article tell us that's new??? We expected to SEE some horrifying results depicted on an infected computer screen, not just more, "Be sure to use your anti-virus, anti-malware software, and do your Microsoft updates regularly," 'daddy reminder.'
    guardian1935
  • article title does not match anything that follows

    The "Summary" was an accurate article overview, but it seems the title was written by someone in Colorado smoking medical pot.
    MichaelCarr