Client Security Tweaks

Limiting Malicious Code

We combine things a little differently for clients. The most important "tweak" to do on clients is to make malicious code less likely to run. Basically, there are three objectives, in decreasing order of desirability:

• Prevent malicious code from getting onto the system.
• Prevent malicious code from running.
• Prevent malicious code from communicating.

Obviously, we would prefer to keep the malicious code off the system in the first place. However, if it gets on the system, we want to prevent it from running, and if it should happen to run, let us try to keep it from infecting anyone else. Four technologies (not necessarily tweaks) are critical here.