Can You Say That An Antivirus Is Like A Bouncer?

1. Anonymous Says

   Think of the computer as a Medieval castle, with a moat around it.
   The Internet connection is the drawbridge: Down (connected) to allow traffic egress and ingress.
   The principle invitation sender is the browser.
   The firewall can be thought of as an inspection booth at the end of the drawbridge, where tradesmen (data bundles) present their ‘ticket’ (the header) to the booth to prove that they were summoned by those inside the castle. Un-invited (un-ticketed) packages are not allowed in.
   Normally, browsers are empowered to “ticket” all kinds of packages to be sent back (to be used to display a webpage and other assets). This automatic action makes no discrepancy as to who gets an invitation, unless modified by the user.
   Malware is either deliberately included in the main webpage packages, or (more commonly) it is packaged inside advertising…but still it is authorized to pass the firewall booth.
   Anti-virus acts like a guard inside the castle, and ‘inspects’ the returning packages after they cross the bridge. If they fit the description of their manifest (the signature database), then they are sent to the dungeon (“quarantined” is a common term for this action).
   Many freshly created malware items disguise their package, to trick the guards and get loose into the castle to pillage and plunder according to their instructions.
   To combat these open invitations, users must set the browser to not send out open invitations, but to be more refined and discretionary: only invite specific packages (and therefore ‘ticketed’) back.
   This is done by stopping all 3rd party assets. There are many other steps needed to constrain what gets back inside, but it’s a start.

Leave a Reply

You must be logged in to post a comment.