Messages in this thread | | | Date | Fri, 15 Aug 2008 16:31:06 +0200 | From | Pavel Machek <> | Subject | Re: [malware-list] TALPA - a threat model? well sorta. |
| |
Hi!
> > > a model other than restrictive can make sense with content security > > > scanning. > > > > I'm not sure I understand why "interest in content" means not blocking, > > and vice versa. However, I think this is a good idea if made more > > explicit, i.e.: > > Small misunderstanding because both would block. If you go back to Ted's > original post I was replying to, he was worried about how would > anti-malware scanning interact with HSM since both may end up using the > same interface. HSM, as far as I understand it, needs to block on open and > "plant" the right file in place, while anti-malware also needs to block > and examine the right content. That is why ordering matters, anti-malware > needs to run after the content is put in place. And that is what my idea > solves (slight overstatement since I spent only seconds on it) by > separating them in two groups of clients. First which has no interest in > content and second which does.
I don't see why HSMs are mixed into this discussion -- they appear very different. For one, you probably have just one filesystem with tape storage, so it makes sense to implement HSM at filesystem level; probably with something like FUSE+unionfs. Pavel -- (english) http://www.livejournal.com/~pavelmachek (cesky, pictures) http://atrey.karlin.mff.cuni.cz/~pavel/picture/horses/blog.html
| |