Slashdot Log In
Ask Microsoft's Security VP
Posted by
Roblimo
on Wed Jan 18, 2006 12:15 PM
from the My-OS-is-better-than-yours dept.
from the My-OS-is-better-than-yours dept.
There's always lots of discussion on Slashdot about Microsoft's security problems, and whether Windows is or isn't more secure than other popular operating systems. In a "Let's clear the air" move, Mike Nash, Microsoft Corporate Vice President, Security Technology Unit, has agreed to answer 12 of the highest-moderated questions you submit here. (You can skip the "Microsoft and security in the same sentence?" comments we've all heard 1000 times, and ask actual questions, since Mike is answering for himself instead of having PR do it for him.) We'll post his answers next week.
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
What has changed? (Score:5, Interesting)
From what I've heard, even though most of Vista is being rewritten from the ground up with more scrutiny on what code goes into it, it will still have major flaws generated by the way Microsoft works internally as a company.
Re:What has changed? (Score:5, Interesting)
What is Microsoft's plan for eliminating this problem? How will Vista address the tasks that require higher levels of privileges? What restrictions does this place on normal users? How do focus group users respond to these restrictions? Has there been communication with applications vendors to ensure that they are making the necessary changes?
Parent
Re:What has changed? (Score:5, Interesting)
Most of the most glaring Windows XP security problems (being in the Admininstrators group by default, being allowed to write anywhere by default, having the firewall off [pre-SP2] by default) were there to preserve compatibility with previous versions of Windows.
Will Vista comprimise on security, or compatibility?
Parent
Re:What has changed? (Score:5, Interesting)
What are you doing to prevent buffer overflow and similar attacks in the future?
Parent
Are you afraid? (Score:5, Funny)
Re:Are you afraid? (Score:5, Funny)
Parent
Differences Between Windows & Other Employers? (Score:5, Interesting)
WIndows OneCare status? (Score:5, Informative)
Most regretted design decision (Score:5, Interesting)
Patch Release Cycle (Score:5, Interesting)
Security versus Quantity? (Score:5, Interesting)
Has Microsoft tracked the "security bug" to user ratio on their products and found that products with fewer users seem to have fewer bugs? If that is the case, I wonder if it is the normal process of higher supply leading to more people spending time looking for bugs.
It is like the population:innovation ratio -- as a population goes up, the amount of innovators being born goes up, too, leading to more innovations.
Re:Security versus Quantity? (Score:5, Interesting)
Parent
Security/user friendly tradeoff (Score:5, Interesting)
For example, file and printer sharing defaulting to off prevents people from unknowingly sharing their resources, but requires non-technical users who do wish to set up a small network to know more about the process than in previous versions.
Top priority for security in 2006 (Score:5, Interesting)
Re:Top priority for security in 2006 (Score:5, Interesting)
Parent
Outside influences on security (Score:5, Interesting)
Question (Score:5, Funny)
What is the basic approach to Microsoft security? (Score:5, Interesting)
I know the easy answer is to say "both, of course" but a 50/50 split is unlikely. So, does testing take the backseat, or does the code?
Question from China (Score:5, Funny)
I'm from China and I was wondering [remainder of message censored by People's Center For Internet Enhancement - Powered by Microsoft]
Audit of Software (Score:5, Interesting)
Home vs Pro (Score:4, Interesting)
Do you ever spend time with "average users"? (Score:5, Interesting)
How often do you (and the members of your team) spend time with average end-users-- not just in large corporate settings but in small businesses and (just as importantly) in real-world home settings? I believe that if you would spend time with Joe Average and see just how badly his computer's performance (not to mention his personal privacy and the integrity of his data) is suffering from the exploitation of certain bugs and design decisions (e.g. the fact that most end-users run with Administrator privileges) in Microsoft software, it would cause a significant shift in Microsoft's security strategy.
No matter how often $LATEST_WINDOWS_VERSION is touted as more secure than its predecessors, I still keep getting called to average homes to remove countless items of spyware which infected Windows systems via holes (and/or poor design decisions, e.g. the handling of ActiveX controls and the abilities they can have to alter files on the system) in Internet Explorer, and to this day (despite the wide use of antivirus software) most end-user systems I examine do contain at least a few viruses (which entered the system via Microsoft Outlook).
What are you doing to secure Joe Average's PC? Do you have any interaction with average end-users? And if not, why not?
Will you ever sort and modularize Windows? (Score:5, Insightful)
Rationale: Many security problems are due to everything running as Administrator, with privileges, or as part of the OS. One thing I like about GNU/Linux is that each part is separate, so Firefox runs on X which runs using services, which runs using the kernel, with only the kernel having privileges. Generally a buffer overflow problem in X, or Apache doesn't let someone format my hard drive. Also you can put something to analyze or intercept things between such layers - even things like ltrace or strace.
Windows updates to unregistered machines? (Score:5, Interesting)
I know a person who doesn't have his copy of Windows registered. His PC got infested by spyware, so my deduction is that his computer was probably used to send SPAM, spread viruses and whatnot. When He called me for tech support, I told him to download the Microsoft Anti-spyware from Windows update, but his answer was that it required a registered copy.
My question is this: If Windows updates make the Internet SAFER from hackers, spyware and viruses, why limit them to registered copies of Windows? (IMHO this is analogous to not giving the vaccine of the bird flu to illegal aliens)
What do you plan to do about this?
Did MS culture change as promised in 2002? (Score:5, Interesting)
In your opinion, has Microsoft succeeded in changing its culture so that every developer now considers security first, features second?
WSUS Release Dates (Score:5, Interesting)
With the current advances in smart viruses and malware, that release schedule seems unrealistic. OS security threats have been addressed with emergency patches, but that does not seem like a sustainable methodology.
What is Microsoft's long-range vision on OS patches to ensure that our Server and Workstation Operating Systems are secure, safe, and patched in a timely manner?
Rewriting Internet Explorer (Score:5, Interesting)
Application software (Score:5, Interesting)
Beyond Bugs: User Interface? (Score:4, Interesting)
However, even when a security system doesn't have any bugs, it can still be very insecure. We can define "security" in a more general sense as "the extent to which a system is doing what the owner or user expects". The problem is not that the system is capable of malice so much as that the system is capable of malice of which the user is unaware.
How is Microsoft in the future going to design their systems so that users know what is really going on?
Spyware (Score:5, Interesting)
In regards to spyware MS has already taken some steps to try and stem the flow (asking about running exe files, the Spyware Removal Tool, etc), however as a consultant I find many of my clients are still infested with the stuff. From my perspective it appears that many users are affected still by these programs and that they are either unaware of how to prevent them in the first place, or how to get rid of them. Many times it is significantly faster and easier (and in some cases, safer) to just format the machine in question and start from a clean slate. Does MS feel that spyware is still a major problem, and if so, what new measures MS doing in order to combat it?
Regards,
Petyr Rahl
User privileges (Score:5, Interesting)
Industry best-practice out-of-the-box? (Score:5, Interesting)
There are a number of industry best-practices that any system administrator will tell you are vital for proper security. I will not claim to provide a complete list, but the two that seem to have the most frequent effect on an OS's percieved security are:
Windows has been steadily improving on the first point, but the second point has long been a problem for administrators; there is no generally-used near-transparent way for a program to request higher privileges, for instance.
Worse, many third-party (and, for that matter, some Microsoft) programs will fail silently or with obtuse errors if you run them as less-privileged users because they demand the ability to, say, write to system areas - often without warning - and require heroic gymnastics by administrators to resolve (if a resolution is even possible).
Is this issue of least-privilige being difficult to acheive being addressed in future versions of Windows? What changes can we expect to come down the line soon and in the near future?
Comparisons with open-source (Score:4, Insightful)
Bug submission policy (Score:5, Interesting)
And why does the phone number on this "report a bug" page:
http://support.microsoft.com/gp/contactbug [microsoft.com]
call a generic technical support & sales line, which ultimately will tell you that you must either open (and pay for) a support case, or submit your bug by snail mail to 1 Microsoft Way?
Is it Microsoft's stance that the inability of its users to report bugs makes its OS more secure?
-Tommy
XP's firewall (Score:5, Interesting)
VISTA users must still be administrators? (Score:5, Interesting)
OpenBSD (Score:5, Insightful)
How is it that OpenBSD is able to be so secure by design with so few resources and yet all of Microsoft's resources cannot stem the tide of security problems that impact everyone, including those of us who do not use Microsoft programs?
Shake a Legacy and move into the 1990s (Score:5, Interesting)
When will we have actual symbolic links?
When will you ship with everything possible disabled until needed or manually enabled?
When will defragging a disk or some obscure network function not lock up every task?
When will you not install by default two thousand modem or other
When will you not keep asking to insert a driver disk when the files are already in c:\windows\system32\ (and will "install" if I just point the directory there)?
When will you disable autoplay features by default, or at least make them prominent in a security area (instead of editing obscure system setting panels)?
When will you get rid of, split, or otherwise do something reasonable with the trash "heap" otherwise known as the registry?
Are you ever going to allow me to change my hardware and do autoconfiguration (Both MacOS and Linux will let me boot from a disk in another system, a CD, etc. and manage to find all the necessary and most of the exotic hardware)?
Why add DRM? Also, why not decouple IE? (Score:5, Interesting)
Also, I think you could dramatically improve security by decoupling Internet Explorer from Windows. Have it be a separate program similar to Opera, FireFox, Safari, etc... Is there really a valid reason that Windows Explorer has to be driven by Internet Explorer?
Legacy Code (Score:4, Interesting)
-Charles
users and auditing (Score:5, Interesting)
Despite whatever SU-like features you have, on XP I still can't reliably install, or in some cases even run(!), programs under restricted user accounts, forcing me to give most of my clients admin accounts and just hoping for the best. How seriously do you treat this issue and what work is being done towards getting an OS that can be used in the real world with restricted user rights?
Auditing - finding, say, if user X has any write rights anywhere on a server, who has done what on the system in the past day, what files were modified by a program's install, etc. all these things are do-able but not easily, and not using just MS supplied tools. How about a toolset for administrators that give us (especially the part-time admins like myself who don't just live and breath security) easy access to the reporting, auditing, and security tweaking we need to do our jobs well. And no, configuring and interpreting the security logs in the event viewer doesn't count as an easy to use auditing tool.
What OS do you consider the most secure? (Score:5, Interesting)
Please name a specific answer for both questions, and please don't name something useless like DOS. Your answer must be something that a sane network administrator might choose for an internet-connected server and desktop deployment.
Separately, do you think that Mac OS X is a more secure _desktop_ operating system than Windows XP? Obviously there have been far fewer worms, trojans, and viruses for OS X than Windows. Is that really solely due to OS X's lesser popularity, or is it truly a fundamentally more secure system?
If you think Windows XP is more secure, why? What security features does it have that OS X doesn't?
Is it really a secure system? (Score:5, Insightful)
Why no AES in SSL yet? (Score:5, Interesting)
(OpenSSL - including the Mozilla browsers - and Java SSL have all had AES support for a while. Most SSH implementations have also had it for a while.)
Next big thing? (Score:5, Interesting)
MSFT employee here (Score:5, Insightful)
I have just one question for you. Why do we STILL ship products with KNOWN security issues?
I'll even tell you how it works in the trenches. Folks build the product. At the end of it all a "Security Push" gets declared. For two to three weeks people pretend they care about security by coming up with potential security issues and assigning DREAD+VR scores to them. Then management arbitrarily sets the "bar" below which we don't fix potential and real security issues. This bar is usually very high, sometimes at around 8, because hardly anyone has time in the schedule to fix all issues found. Now, DREAD score 8 means that flaw will affect a ton of customers and cost Microsoft significant litigation. Some of very severe bugs slip under the bar just because they don't affect more than 10% of customers. Now, even this exercise is a joke, because most developers don't know what DFD is and how to put one together.
This wasn't even the most ridiculous part of the exercise. The most ridiculous part is security "code reviews". It's when feature owners walk into a room with a huge stack of printouts and pretend they can be reviewed in a couple of hours they've allocated for this. You can barely glance through this much code in this much time, 90% of security issues remain unnoticed during this "code review".
After all is said and done, product is only slightly more secure (SOME of the most ridiculous things have been fixed), and management gets delusional saying that product is now Fort Knox secure.
If you ask me, that's abomination, not a proper security process. Are there any plans to change it?
If you had to store your Credit Card Number ? (Score:5, Insightful)
Re:WMF bug in Vista (Score:4, Interesting)
My biggest concerns about MS today surround this process, which is completely invisible to the world, but which we rely on for having greater confidence in MS products. Understanding how MS approaches these reviews might make us feel better (or might depress us beyond reason).
Tim
Parent
Microsoft DOES NOT have 300,000 coders. (Score:5, Informative)
Yeesh. This sort of quote reminds me of when I was a naive little proto-geek, wondering what sort of supercomputer my favorite MU* ran on.
Microsoft has only 60,000 employees [wikipedia.org] TOTAL.
Of that count, surely no more than 50% (and probably much less than that) are programmers. Remember, that count includes not only the veritable hordes of management types and marketroids, but the guys who clean the toilets and the ladies who answer the phones. (And the ladies who clean the toilets, and the guys who answer the phones. And the guys who clean the phones, and the ladies who answer the toilets...)
So you're off by at least a factor of ten.
Parent
Re:Usability and Security (Score:5, Insightful)
The revised mantra of Microsoft application security has been "Secure by default", a strategy that was applied with varying degrees of success to many of your products in recent memory. In security circles, this might seem like a no-brainer, but for consumer-level applications the strategy can be a nightmare. For a company that spends so much on usability and ease-of-use for end-users, the act of explicitly prohibiting certain operations or features seems to fly in the face of that investment. The users get what is perceived as a broken product, and the administrators get the headache of decreased security (say, after they install a patch that break "secure by default"). For various reasons, these two contradictory approaches seem to serve neither usability nor security.
In that vein, what other effective strategies have been considered? For years, the NSA has provided a unique service to the users of various products, including Microsoft Windows operating systems. They produce "hardening" guides for these products in an effort to ensure their continued security and viability in the wilds of the Internet. Has Microsoft ever considered producing guides like these, seeing as how they're the authors of their own products? In that vein, has Microsoft considered redacting the secure by default to enhance usability, yet instead produce tools or wizards that electorally enable hardening for your applications and OS'?
Parent