Manage updates with the Download App
August 11, 2006 5:37 AM PDT
Perspective: Microsoft security--no more second chances?
See all Perspectives
- Related Stories
-
Microsoft eyes acquisitions to build security
August 2, 2006 -
Microsoft harpoons Whale for security
July 26, 2006 -
Chills at Microsoft's security huddle
July 24, 2006 -
Microsoft irons out security patch
July 19, 2006 -
Microsoft shakes up security fray
June 7, 2006 -
Microsoft security service to ship in June
February 7, 2006 -
Microsoft's security product hits home stretch
February 6, 2006 -
Microsoft to provide security strategy update
October 4, 2005 -
Microsoft security guru: Jot down your passwords
May 23, 2005 -
Security gripes? Microsoft feels your pain
May 12, 2005
Not only has he had to deal with Katrina and Osama. Now he's also got to whip Steve Ballmer and the crew at Microsoft into shape. If past is prologue, that last task may be the most daunting of all.
In a remarkable declaration earlier this week, the Department of Homeland Security--a bureaucracy set up to deal with stuff that generally falls under the category of national emergency--called on all users of Windows software to install a new security patch issued by Microsoft.
This wasn't your garden variety flaw. The fear in Washington was a repeat of something like the chaos caused by the MSBlast worm in 2003.
By now, Chertoff's people must be thoroughly frustrated that Microsoft still turns out poorly designed products. What with terror plots being uncovered overseas and threats of airline bombings, cybersecurity obviously is not the top headline this week.
But the threat of a network meltdown has not disappeared--especially when flaws so regularly turn up in Windows, the computer operating system most people in this country use.
The Microsoft monoculture is a fact of life in government and corporate circles. And that comes at a price in the coin of vulnerable computer security.
Microsoft contends that the situation is improving and that it's doing the maximum to make sure that Windows and the other software products it sells go out the door with as few problems as possible.
Each month, the company issues a security update in which it patches problems. And every Microsoft spokesman within earshot can be counted on to solemnly pledge the company's maximum effort.
It's a familiar refrain.
Ever since Bill Gates announced Microsoft's Trustworthy Computing initiative four and a half years ago, the company says it has reshuffled its development priorities. Cool new features were to take a backseat to improved security and privacy.
Yet the problem lingers. In the last three years, Microsoft has issued an increasing number of yearly security bulletins, in which several patches get put online to fix problems in existing applications. The company sees this as evidence that it's on top of things, not an indictment of managerial incompetence.
If you want to find someone to blame, Gates says, point a finger at the "malicious people" out there looking to "take advantage of whatever things there are."
What did you expect him to say? That it's Microsoft's fault? That would be too hot to handle. Gates and the rest of the brass stick closely to the script but clearly know that Microsoft can't keep turning out finished products that are as porous as Swiss cheese.
Defenders will argue that it's unfair to demand perfection from Microsoft; that software is an imperfect art. And besides, they add, is the Mac operating system or Linux bulletproof? Clearly, the
Here's something to consider: If bridge builders or airplane designers applied the same standards to their labors, do you believe that the public would so easily forgive the regularity with which bridges would collapse and airliners fall out of the sky?
Biography
Charles Cooper is CNET News.com's executive editor of commentary.
See more CNET content tagged:
Bill Gates, patch management, security, Microsoft Corp., operating system
102 comments
Join the conversation! Add your commentRSS Feeds
Add headlines from CNET News to your homepage or feedreader.
RSS
Subscribemy Yahoo
Add this FeedGoogle
Add this FeedMSN
Add this Feed
Airplanes are not networked to the wider community. I am sure they would be just as vulnerable if any one of a billion individuals could remotely access a planes systems during flight.
Airplanes are not networked to the wider community. I am sure they would be just as vulnerable if any one of a billion individuals could remotely access a planes systems during flight.
If any terrorist targeted one individual bridge, I am sure they could bring it down if they really cared. In fact if all bridges were build to the same spec, you can be even more sure they would be a target of attack.
The comparisons your make in this last sentance are just silly, and we expect better from you Charles.
network consisting of miles of wires, a multitude of parts and
devices. I can see the relation to an operating system, such as
Windows. The fact is, Windows is a flawed and poorly designed OS
that is somehow become the "standard" for many businesses. I can
only hope that a large organization, such as branches of the US
Government, start switching to OS X and Apple for their computing
needs. Our security is dependent on it.
users. However from an engineering (and quality) point of view
they are similar in complexity and systems/subsytems. One
could also argue that both have life and death implications.
Now the point: IT IS POSSIBLE TO CREATE AN OS THAT IS
SECURE! Just look as OS X, it has been done, and this leaves no
excuse for MS. And before someone sprouts about lack of
market shares as the reason for ZERO wild viruses for OS X, I will
quickly point out that no one was able to crack the system via
the internet when given a challenge. And I don't doubt for one
second that thousands of hackers are drooling at getting the
fame of being the first to succeed at cracking X!
Nuf said!
can to keep it safe and will fix it when there is a problem, often
before there is a major failure. Contrast that ideal about aircraft
design, with that of Microsoft who want to claim that building
software is a tough business and they cant cover everything
...spare me the tears Bill...youve got billions of $$$ ripped off
from users who Dont understand the inner working of a PC so
they let you tell them its as good as it can be. While every day a
new failure,hack gets into a PC, or Windows comes down with
the Flu, people just say "Ah, I dont understand it, so who am I to
judge?"
Boeing builds jets with 4 million parts made by many
manufacturers, yet in spite of pilot error, or terrorists, they
manage to make a safer, more reliable product than Microsoft
does, and most people dont know how a plane is built but you
can bet your sweet bippy they wont get on a rickety old rattle
trap to fly if they are told its got problems, yet they will use a PC
that has the same sense of junk.
there is a disconnect because a PC doesnt often end up in a
smoking twisted heap, unless you teach it a lesson with a
hammer, so people are reluctant to judge that Windows is
broken, and they should move to a safer design...but marketing
and human herd mentality stops them from finding a Mac is the
safer, better way to go.
Until PC bigots wake up, or are willing to ADMIT they bought
junk, this lack of safety, and weakness that we have from
Windows insecurity will plague the world for generations to
come.
Linux would get hacked if it was more fun - blah.
The historical problem with Windows is the scripting systems
and internal message authentication.
Since Windows was stupidly designed as a networked OS and not
provided with enough security, it was easy for a hacker to send
you an email, automatically launch a script as if someone were
typing at the keyboard as Admin, let it raid your Outlook
address book, install an application, turn you into a mail server,
populate itself to all your other Windows user friends, record
everyone's actions, send back any 16 digit numbers you type
in... on and on.
Digging out from 140,000 exploits is tough stuff. So far, most
Windows patches plug the signature of the exploit and do
nothing to fix the underlying problem - the fact that the OS has
no idea if the scripting host or the Admin is running the
machine. All the hackers had to do was change the name of the
virus and off they go again.
It's getting better but there's SO much to fix without destroying
all compatibility first. Vista may beat people to death demanding
passwords all the time and you'll be able to decipher the
password by which keycaps are worn away. Windows RELIES on
the ability of applications to talk to each other freely and make
system calls without restriction. Hackers are just using those
abilities for themselves.
Those paths largely don't exist in Linux or OS X. Sure, there are
patches to fix problems all the time - it's electronic warfare,
after all - but LInux and OS X have a HUGE jump on Windows.
Unlike Windows which runs as root (Admin) and will happily run
whatever you tell it, the majority of exploits the common Linux
or Mac user will encounter would require someone to be at the
keyboard with the Admin password to install it first.
You want security? Encrypt the important stuff on your computer
and be done with it.
Göteborg Sweden
Göteborg Sweden
Secondly, Linux and Apple is used by maybe 5-10% people in the world. A hacker creates ways to breal affect is very less and secondly those OS'es are used by who have knowledge what they are doing. Windows is used by people who have no idea of computers.
Thirdly, your bridge analogy I dont have even words to say....If every day and nite some people are poking hammers or some other things on the bridge I dont know how long that will stand....
using Linux. ;)
Yes, fewer people use Linux. I don't know what breal means. The effect is less; true, so that is an argument against MS mono culture.
Linux users are more knowledgeable; often true, but how knowledgeable do you need to be for autoupdate.
The point is that in software testing there are infinite number of test cases even when just tested individually in a controlled environment. When combined with other software it starts to exhibit emergent behavior. Smart testers try to partition those cases such that by a process of induction it can be shown that the software behaves properly over the entire test case sample space. If you know anything about computer technology you will agree that there are far more variables here than in civil engineering (building bridges -- not that that is easy by any stretch of the imagination and you need constant maintenance, they also have weight limitations and people are not allowed to change anything on the bridge). Civil engineering is a centuries old discipline and compare that to software engineering which is at most 50 years old. Best practices have evolved and things will get better.
Meanwhile, please don't write such uninformed and misleading articles. You say that MS turns out poor quality software and I disagree with that. They have had problems but it works with thousands of devices and software titles without a hitch. They are single handedly responsible for the tech revolution. Without them I am not sure if you would have a job of an online tech news site editor.
Windoze is a poorly designed OS. Period
Amazing that so much ignorance can be stuffed into a small paragraph.
MS does put out poor software. With very, very few exceptions, I can point out a safer, more stable and downright better solution to any MS product. ANd lets not forget that the majority of the security issues can be laid directly as MS doorstep.
How is MS singlehandedly responsible for the tech revolution. That would imply leadership. MS is a follower.
Björn Lundahl
Göteborg Sweden
We, are so fixated with "Sucess" in everything that we no longer have patience for minor hiccups or a huge bump in the process. Software developments is hard, it takes the best brains and patience to come up with a product, worth selling...most of us are used to Windows so much in our daily lives...would you rather go back to DOS?? or work entirely on a UNIX system..i guess no, then let the people do their job, and try to help them, than oppose them!
This reminds me of the movie "The Holy Grail" where the knight get's his limps chopped of and he comment "ah it's just a flesh wound".
I have to use Windows for my work, but personaly I just use Linux. So i guess yes.
I wish the people at MS did do there work, so these things wouldn't happen.
My advise: Try Linux, there are a lot of distributions for non-technical users. Or move to Mac OS X, wich is essentially UNIX under the hood.
All I wish is they could reduce or eliminate the reboots. I think that will be better in Vista.
Linux code is open and more checked for errors by more people then Windows. So it's unfair to speculate that it would have as many exploits.
Your market share argueement only holds water as it applies to desktops and people being stupid opening attachments.
Ask any Linux/Unix admin with systems exposed to Internet. My box personally was twice attacked: several years ago somebody tried to exploit old apache hole (which didn't existed in my configuration) and about year ago dumb brute force attack on weak passwords against all common daemons (mysql, ssh, telnet, etc).
With Windows advancements, literally anybody can become a 1337 h4x0r - the rootkits/malware are spread all over the net. Pick rootkit, add exploit for new vuln - and you are ready.
With Linux/Unix systems, the target is harder to crack since it has magnitude more possible configurations. And overall security model of Unix is well known for several decades and is tested routinely by many companies - including Unix and Linux vendors themselves. But the Unix systems are magnitude easier to program and automate - plus many such systems sit on Internet backbones with very very speedy network access times. Cracking such system is like finding a treasure box.
I know about two cracked Unixes: one Linux and FreeBSD boxes. In both cases the machine were used for - try to guess it - exploiting Windows boxes. Seemed to me like operators of botnets tried to extend their reach using /spare/ bandwidth of the servers.
Unix is targeted. Make no mistake. It's just the kind of exploitation is very different - as well as kind of crackers doing that.
The attempts might be the same... but as to whether the successes would be the same or not... it's plausable at best to assume that you're talking about things without any proof what so ever!
Without facts to prove your case... it's speculation at best.
Walt
Hopefully Apple won't give us users too much, and open more holes for script kiddies and such.
The problems with Windows arise from their near total market share. Macs never worried about viruses because hackers didn't bother with small potatoes. Windows is the money shot.
Since the OS must allow so many different types of software to interact with it the vulnerabilities are more prevelant. Old flaws cannot be removed without upsetting users who need to keep old databases or other 3rd party software packages. MS has tried to strike a balance between users who complain about "nothing works with the new OS" - see Mac's OSX for this - and their improvements in OS architecture (NT to 2000/XP).
Follow the money for a moment: the patches cost MS millions but earn them nothing. With each "flaw" their customer considers switching to a competitor rather than upgrade to the next "hunk of MS junk." They'd love to wave a magic wand, but since that fantasy stick does not exist "Patch Tuesday" is the best we've got.
Göteborg Sweden
According to the US governments own figures 45% of the vulnerabilities discovered in 2005 turned up in Unix/Linux compared with 16% in Windows - the US-CERT site shows a list of the vulnerabilities here: <a class="jive-link-external" href="http://www.us-cert.gov/cas/bulletins/SB2005.html" target="_newWindow">http://www.us-cert.gov/cas/bulletins/SB2005.html</a>
Where does the evidence for your assertion come from?
The numbers are not just for the Linux/Unix OS or kernel.
UNIX/Linux covers a WHOLE HELL OF A LOT MORE OSes than just Windows.
This doesn't even compare. Get over it, Windows is a security f**^$_@! nightmare and will continue to be so until they CHANGE THEIR ARCHITECTURE.
And that will only happen when they're lost 35% of the market shares.
First off, lets look at that plane example. Not to be crual or insensitive to 9/11, but i'm pretty sure you can say that the airplane system IS INDEED FULL OF HOLES too. So it's inaccurate to claim security in other areas when it's proven that those as well are not completely secure. It's a fact of life that not everything is 100% guaranteed.
As for the patches, our author states that Microsoft said years ago that security was the new concern and why hasn't the security improved over the last 3 years or so. THEY ARE PATCHING A PAST PRODUCT. Gates did make the statement before XP, but XP is getting a bit older, and it's not magically going to fix itself even if Microsoft came up with the miracle answer to the perfect operating system.
Working in the security field, another thing I can say is that you have to evaluate what you are using and also look at backups. I don't choose the most reliable energy source, then not get battery backup because i'm using the most reliable first source. I personally don't agree that Macs are 100% secure, but that doesn't matter because no matter what you are going to use, create a backup. These "bridges" the author claims are so strong and safe aren't approved by the construction company. A second party approves the bridge and depending on what it is, perhaps there are motion detectors and other forms of security for very important bridges like border crossings. The people deciding how to set up networks and what operating systems are partially to blame. There are many reasons to go with Windows, but you protect yourself. Disable unneeded services, protect your network at a higher level and don't give your users permissions that will allow certain security vulnerabilities to be opened up.
It's unfortunate that Microsoft has made so many security holes, but it's not an excuse. The author wants to point out how quickly Bill Gates pushes blame to somebody else, well what about computer users. Take some responsibility for your systems and know what you are doing. If I had no clue about cars and didn't put oil it in, I would say it was the automotive makers fault the engine seized, it was MY FAULT cause I didn't take care of it.
This article is just another person complaining because they don't want to have to learn details on their operating system. They just want to sit down and use it, and live in la-la land.
In fact they would have to work hard to turn their boxes into a security problem. All a windows user has to do is turn it on and connect to the internet.
With every new major release, Microsoft gives us that same DC-10 with a fresh paint job and inflight movie screens then tells us it's a DC-15 (or -20, -XP, -Vista).
Open Source like Linux is even more scary, where everyone in the world has access to the code. Would you rather Al Qaeda have access to "closed/managed code" or "open code"? Open code is a technology holocaust waiting to happen.
They already have smart people mucking about with computers for potential advantages in whatever OS the target is using; they can always farm the work out to China or the US crackers anyhow so the reading code doesn't change the stakes at all.
The end user working with OSS is either educated and compiling there own binaries from a trusted repository or less educated or happy working with pre-packaged OSS. Since there packages are comeing from a trusted repository they go through the authentication process to validate them before install. Huh, still no change in the stakes at all.
Your tinfoil hat seems to have slipped down over your eyes; it's not winter, you can pull that hat up so you can see clearly. I promis, I won't steal your brainwaves if you do.
In reality, Chertoff/DHS remains a study of gross incompetence.
I generally agree with you, and as a software user Im very frustrated by the number of critical flaws that continue to appear in Microsoft software. At the same time, as a software developer for the last 34 years Ill say Im not surprised. Bug Free software just doesnt exist. The problem isnt that Microsoft will need to fix something now and then, its the severity of the flaws each and every month. If Microsoft could get its software to the state where Critical fixes only appeared a couple of times per year, this issue would fade from the headlines.
In your article you contend that Linux has fewer security vulnerabilities, but the last time I went through the list of known vulnerabilities (the CVE directory) that just wasnt the case. UNIX and Linux systems had just as many, if not more (particularly when the stacks are made comparable), vulnerabilities as do Windows systems. There are environmental factors (most systems under professional system management rather than on end-user desktops, more systems locked down to dedicated functions with unnecessary features turned off, users generally running without privileges, vastly fewer systems overall, etc.) that tend to mitigate the Linux/Unix vulnerabilities compared to the Windows vulnerabilities. Vista addresses the major factor under Microsofts control, the need for normal users to run with privileges. Actually, you can run without privileges on Windows XP but many things become painful (e.g., installing new software). And some third-party products, like Intuits QuickBooks, require Power User privileges thus defeating all attempts to make ones PC secure. Having all normal users run without privileges would cause many of todays Critical fixes to be reclassified a level lower and thus change the entire discussion about Windows security.
A second point really has to do with your frustration versus the release dates of software. Windows XP is five years old and predates Microsofts security push. Yes, SP2 was done to proactively find and fix a lot of problems before they were discovered by others. But that was just a band-Aid. It could fix some things, but it couldnt alter the design of the OS. Windows Vista is the first real test of if Microsoft has its OS act together. This is also largely the case for Microsoft Office, as the new release will be the first one whose development occurred completely after Microsoft started its big security push. So while your message is right on the money, it would be a more appropriate editorial 12-18 months from now (if needed).
The third point has to do with holding Microsoft developers more responsible for the quality of their code. I dont know what current Microsoft goals are for SDEs, but I will say that it is very hard to hold people responsible for defects that arent discovered for many years after they write it. Take one of the most severe vulnerabilities in recent memory, the Windows Metafile (WMF) file SETABORTPROC GDI call flaw. This is a design flaw carried over from Windows 3.x and no doubt the people responsible for it left Microsoft a long time ago. Even if they are still at Microsoft, how do you punish them for a decision that was the correct one at the time it was made? Ok, thats an extreme example. But nearly all bugs being found in Windows today were created 6 to 10 years ago, and most of those responsible are either not at Microsoft or else far removed from that particular job. The one thing you can do is change the culture to make having the fewest bugs one of the top two most critical evaluation factors for anyone who writes code. Fewer total bugs should mean fewer security vulnerabilities. But even if you have someone who writes near bug-free code, if the one bug they introduce in a year is a Buffer Overflow you can be sure that means another critical fix on a Patch Tuesday some years in the future. And Microsoft has thousands of developers.
So the message has to be that despite a Herculean effort so far Microsoft has to get better, far better, than where it is today. But it isnt yet time to say theyve failed. By the end of 2007 well know if theyve succeeded. And, if not, theyll probably find that even the most faithful are seriously looking to make a change.
Bug Free software just doesnt exist.
</end quote>
Sure it does!
<?php
echo "Hello world!";
?>
100% Bug Free!
Great comment. In between the trash talking between Microsoft, Nix and Apple zealots, it is possible to find some great diamonds in the rough.
I'd like to throw out something else for discussion: does Microsoft have that 12-18 months hberenson mentioned to prove itself? None of Microsofts competitors is standing still. And though I don't think Microsoft will go under, I do believe that like Internet Explorer vs Firefox, you'll see a decline over the next several years in Microsoft's O/S dominance. Particularly if Google bundles an Office/pdf compatible application that can be used offline with their online word processing and spreadsheet initiatives. Put enough services online, make them compatible with existing defacto standards and it won't matter what operating system you use.
(Sorry for the double-post--this was meant to be a response to the article.)
Now, it's true that Linux system ship with so much more stuff, but your argument that Linux code is so well checked by more "eyes" would seem to imply that this wouldn't matter, it would simply be perfect out of the box.
You obviously know nothing about writing software. All non-trivial programs have flaws, it is a fact of life. Linux is better because of the way it is designed. Even if a virus or hacker gains control of a default system, they can do little to no damage. They also fix problems fast. That is why you get updates alot. Compare that with MS's policy of leaving systems vulnerable to known and exploited flaws until they can be bothered to release a patch.
The kicker is that MS has released some fairly trivial programs and are loaded with flaws. Even the non-trivial apps are so poorly written that an attacker can cause so much havok with no effort or technical knowlege.
Apple and Linux account for less than 10% of the world market for computers, a mojority of that being server based (with regard to Linux). HELLO!! The standard computer user base is more likley around 2 percent. Why the hell would a hacker want to crack those operating systems? It would be a waste of their time; there would not be enough attention or glory for them to take.
Microsoft's standards has made computers accessible to the common individual. They standardized the OS and made it possible for the common individual to do things that a programmer would have been required to do in bygone days. Look at Linux for example. I've located at least fifteen different installations out there all of which work, look and act differently. There are no standards. But if Red Hat became the status quo in OS software, would you then be attacking them like this when hackers started picking apart their security? MS works to correct problems that are found and producing a perfect piece of software is impossible. No software is perfect and if you think you can do better, please, indulge us with your acumon. I'm anxiously awaiting your download. And in fact, I would pay you to build a perfect piece of OS software.
As far as the bridge analogy is concerned; I can't even tell you how stupid and wrong that is. Give someone with enough determination a hacksaw and enough time and see how much damage they can do to say the Golden Gate bridge. Or give them a jackhammer and see how much damage they can do to
the foundation of the bridge. Likewise, a chisel can eventually crack a dam if enough time and energy is involved.
And one more note on that. I live here in San Francisco and I would very much like to point out the amout of seismic retrofitting that has had to be done on the Golden Gate and Bay Bridges in the last five years. Damn engineers; how dare they build a bridge that can't stand up to an earthquake. (That's sarcasm by the way.)
Think about your words before you write them and understand what you're talking about.
Why are MS fans so stupid?
Windows gets hacked because anyone can do it with no effort. Linux and OSX don't because it is extremely difficult.
Go look up server hacks and market share and then come back here and spout your drivel.
Get your head out of you know who's A**.
Proof that watching to many windows ads and running windows leads to a self induced lobotomy.
Now comparing the bridges is just idiocy at it's greatest. Had those builders been found to provide faulty workmanship or products they would be shut down before you could say the sky is falling.
And personally i think thats what should be done with Microsoft, Because thier products are faulty and lacking workmanship of any kind, If any other company put out crap like they do they would have the better businees beuro down thier necks.
POP thats the sound you'll hear when you pull your head out....
Lets say there is a flaw in the linux kernel. That is not counted just once, but for each distro.
Also consider that Linux fixes its flaws well before any exploits surface.
Windows has more security issues. To claim otherwise is stupidity.
In fact if you do not go on line the OS never needs updates - like wise if never take the plane out of the hanger the bridge out of the factory it will not need repair either!
I guess a airplanes never needs repair - every rivet last for ever? Why do they replace the rivets on planes? Why do they over haul plane engines?
Why did the tail fall off that airbus? Why did the concord get grounded - why did its tire blow and kill all those people! Why do you get paid to write non-sence?
Very irresponsible statement and its only sheik MS bashing!
"Here's something to consider: If bridge builders or airplane designers applied the same standards to their labors, do you believe that the public would so easily forgive the regularity with which bridges would collapse and airliners fall out of the sky?"
I am sure any operating system that gets widespread audience like Microsoft OS will show up holes.
No OS is perfect.
From what I read, Microsoft is doing a lot to improve the operating system. Unfortunately, microsoft does not get credit for the efforts.
Herd says: Mooo.
The recent list of patches included 9 critical flaws and 3 not-so-critial flaws. Under normal security related issues, 24 hours max for Critial issues and 72 hours for non-critical issues still seems to pass Microsoft by the wayside.
Microsoft has been aware of the critical issues for MUCH MORE than 24 hours... but they still shove their Critial patches into their Monthly updates... regardless of whether they're critical or not and regardless of whether the normally accepted 24-hour deadline has elapsed or not.
Microsoft's Trustworth Computing is as gullible as Osama Bin Laden's conversion to Christianity is!!!
If OSes were potential girlfriends and one was better looking
easier to get on with and virus free and the other was known to
be riddled with 140,000 viruses (and a bit unstable!) - which one
would you date?
Björn Lundahl
Göteborg Sweden
Ever since, as a "member" of the TCG, they've slow-walked trusted computing and made sure that the press, who never dig too deep, focused on Microsoft's "Trustworthy Computing."
and DEC's VMS?
What's the point?
Well - we have known for 50 years that software development and deployment are subject to error - human error - and so many years ago as a result of extensive research activity in computer science and engineering at MIT and elsewhere, the scientific/engineering result was that CPU architecture MATCHED WITH OS design had to incorporate tolerance of "bugs" and even "malware". Thus we have the memory typing and address segmentation of the Intel x86 architecture coupled with its 4-ring protection architecture.
the time is now - the time is a major need to stop and reconsider just what a modern OS has to be - e.g. allow for device drivers that do not come from the OS orginator, "trojans" that attempt to "invade" the OS kernel, etc. We solved all this many years ago BUT it means rethinking - well, the basis of OS design and the use of necessary hardware support, such as that memory segmentation and ring structure. Couple this with the need to acknowledge that a move to a form of "mandatory access control (MAC)" - yes - a form of it - is absolutely required in a globally interconnected IT world of Internet and computers where the origin of software loaded is largely unknown to the end user - and the need to retink, quickly is paramount. Can this happen in a largely acknowledged monoculture? Hmmm... Maybe, but SELinux from tne NSA has still not taken the world "by storm". MAC has to become:
* integral to new OS structures
* be re-invented in a CIO/CSO "friendly" format
* re-aligned to the interconnected world, and
* most impportant, become a topic of education and training for IT professionals.
After all, that disastrous move from a security viewpoint to "RISC" structures in the 1980s let the industry move away from fundamental security architectures at the CPU hardware level. Intel continued - but for how long - and who cared?
Is it too late?
Bill Caelli