Charlie,

Without knowing the exact details of your setup allow me to express this opinion;

The problem with your and Walters approach is one of extended trust. By not using a particular defence because you believe you and your users are sufficiently competent ignores the fact that the computers and computer users you interact with may not be trustworthy or sufficiently competent.

You can get infected with a variety of malware without opening an attachment or installing a program. One of the biggest threats is the person(s) you have chosen to trust. You accept attachments, and perhaps even programs, from people you think are competent (in information security). If they are not protected and they send you an infected attachment then you become infected because you have not implemented sufficient protection yourself. And once you are infected you run the risk of spreading that malware to other computers because you are not running the tools that could prevent it.

To not run one of the basic IA protections in today's day and age seems a bit unusual to say the least. NIST, CERT, and DoD amongst many others, recommend the use of AV in conjunction with other protections. It is considered a best practice.


>I'm with Walter on this one. I'm always behind a firewall. I always use Windows update. My home network, with four PCs and my wife and 16 year old daugther on it have had no problems. None. But they know and I know not to install anything without some thought.
>