Does anyone in I.T. here have luck with keeping users from getting infected?

The simple answer is "no". as new defense mechanism become available the attackers just change what they are doing.

White listing is one of the better things that have come around in the last few years. It even has its flaws.

Bit9 for instance... About a year ago they were the hottest thing since sliced bread. Then attackers just stole their application hashes. Defense mechanisms in infosec are developed in a mainly reactive fashion. the attackers are always 1 step ahead of what is out there to defend.

But past that, reducing user permissions is obviously something you want to do. But it doesn't matter what the user can browse to or install when you open a malicious office document that exploits OLE, etc

(no message)

quote:

---

Where I work, every office computer is locked down to the point that users can't even update Java without an admin's assistance, or flash or a new browser.

---

Same here. I can't change anything on my work laptop. I can't even defrag the hard drive or go into device manager :/

Sucks for me, but this level of totalitarianism is probably best for the company.

We also have Websence Endpoint blocking pretty much the entire internet, so the only thing coming in would be a malicious email attachment.

We have lots of things locked down. I can't run an exe without admin approval. I think flash upgrades require an admin.

With that, we have still been hit a few times in the last couple of months.

Without 100% lockdown of the net, I don't see how it is possible to stop infections.

You just need to react fast and have the tools in place to fix the mess.

Sounds like job security to me

We have everything pretty much locked down, the only updates that don't require us are Windows updates. 8e6 firewall, Barracuda spam blocker for email, Kaspersky for the A/V.

Since switching from the steaming pile of crap that is Computer Associates a/v, our malware issues went from 20-30/month to 1 every other month (around 600 machines, some with multiple users). The most common culprits are the few outside of IT that have admin rights and/or folks with laptops (tip: IT people know what TOR is so don't be shocked when you get called into HR for downloading a copy of "Black Hookers 1998").

Even with that I still run across people that have managed to load things like Spotify.

What browser are you running on user computers? I know there is a big push away from IE (and rightly in many cases) but I have an issue with Chrome's app store being accessible and hardly any of the apps needing admin rights to install (haven't tinkered with Firefox's store).

It's been a while but when we were still using CA I would load occasionally Spybot and put the Tea Timer on to toss out scary warning messages anytime something tried to make a registry change. I had some limited success with it, but again that was years ago.

quote:

---

We most definitely didn't have intrusive fake a/v viruses as discussed above.

---

that's about the least sophisticated threat out there. it wants you to know its there. the bad ones are the stuff you never find out about

quote:

---

So the systems that can't even keep the obvious things out are more secure than the ones who can...?

---

please show me where I said this

Yes, I have had great success. There are two easy answers. Open DNS, and Eset antivirus. Since installing these two, we have only had one virus, which was on a VM machine an outside tech logged into, which didn't have ESET on it.