The Myths of Security

Chapter 10. Four Minutes to Infection?

In July 2008, a report went around claiming that if you connect an unpatched and unprotected Windows XP machine to the Internet and did nothing else, it would be infected in four minutes, on average. The typical recommendation for preventing this kind of problem is to run a firewall on your network and to install all the latest updates as quickly as possible.

This all sounds scary, but don’t worry, that report is total rubbish. It’s just garbage used to spread fear, a marketing tool for the organization producing these numbers (in this case, it’s SANS, a company that sells security training and certification and puts on security conferences; this kind of press might bolster its reputation and get people to buy its services).

It’s true that there are plenty of automated programs randomly scanning the Internet, looking for vulnerable systems to infect. It’s not true that you’re likely to be infected.

The primary reason why this is utter hogwash is that Windows XP (as of Service Pack 2) already has a firewall that is protecting you. If you install something older than Windows XP SP2 (which came out in late 2004), you would have to worry about whether there was something on the network protecting you. Though, in many cases, there would be, whether you knew it or not.

Your ISP (Internet service provider) might prevent unwanted Internet traffic from getting to your machine. Your wireless router or cable/DSL modem might have a firewall enabled by default. ...