Comments on: 10 things to know about info security in '07

Jon Oltsik offers his take on the top trends destined to affect the information security business this year.

[Solaris_User]

We have laws they just ignore them.

With the recent claims that the feds do not need a warrant to read e-mail because its not "in our possession" Congress needs not write aditional data privacy laws to protect our data. Also primaraly they must protect it from themselves, IE government.

The 4th Amendment (not that they pay any attention to it but..) it states we are to be secure in our "persons, houses, papers, and effects" against "unreasonable searches and seizures".

Just as government needs a warrant to search your rented gym locker so must they have a warrant to search your Yahoo inbox folder.

We need to tell George Bush he does not have a right to search without a warrant and it doesn't matter what type of terrorist activity they are investigating. The reason never trumps your right to be secure in your effects. They need a warrant always EVERY single time.

If they want to write specific laws reinforcing that, its ok by me but I just wish they would respect the laws they have.. and stop trying to find "ways around" the constitution.. it means what it says.

[Penguinisto]

"Microsoft Gains Security Respect"?

Dunno - that part remains to be seen, and it assumes a lot of things:

1) ...that Vista will have few to no exploitable holes. Not likely given its size and complexity.

2) ...that MSFT is actually proactive on patching and stays as such.

3) ...that things like DRM and other user-directed restrictions don't force users to compromise their own security (via disabling, underground patches and the like) just to run their stuff (be it custom apps, media, what-have-you).

4) ...that #3 doesn't begin to happen at the corporate level, for the same reasons.

Kudos to them for actually doing something, but IMHO the things they do will have to be effective before they lose the security risk stigma that they have rightfully earned over the years.

/P

[wbenton]

Some heat is an UNDER Statement

>>>I know I'll take some heat for this one but by 2008, many security professionals will stop their incessant bad-mouthing of Microsoft.<<<

(* ROFLOL *)

Personally I wouldn't stake anybody's reputation on that... well... except Microsoft's... (* ROFLOL *)

They have TOO MUCH to do and TOO LITTLE time to do it in. 2008 is only a year away, but it's going to take them at least 5-10 years before they can clean up the title they've earned over the past 20 years.

Walt

[Ryo Hazuki]

Agree 100%

The reason you (and many others, I bet) wouldn't stake anybody's reputation on that except Microsoft's (hahaha, how amusing you are, ever considered a career in stand-up comedy?) is because you know you wouldn't give them that respect even if they deserved it.
Actually the "much" they had to do is done already (it's called "Microsoft Windows Vista") and with an OS share of more than 90%, browser share of more than 85% and office suits share of more than 75% they actually have plenty of time to do whatever needs to be done.
To short-minded biased people like you I even say it would take eternity to Microsoft to clean up the (in several ways unfair) title they've earned over the past 20 years, but you're forgetting that (fortunately) not everyone in this world has problems giving credit where it is due, even if that means giving credit and respect to Microsoft for their efforts and improvements in their products.

[alek_nedic]

TOO MUCH to do

http://www.analogstereo.com/volvo_owners_manual.htm

[the_integrator]

Microsoft and security respect

I'm not a Microsoft basher, I work with their products all there time and I have seen vast improvments, however whilst they insist on embedding their browser into the operating system, they can not been seen to be taking security as seriously as they should. This disasterous design flaw along with the addition of ActiveX ensures their browser is significanlty less secure than other browsers. As for Symantec's credentials, these have suffered a serious blow by their insistance on the user installing wscript in order to install and configure their products. The security industry really needs to get it's act together over stupid blunders like these.
Let's see some Ronseal security!

[Ryo Hazuki]

Browser and operating systems

The act of bundling a specific software with an OS can never be considered a design flaw or anything like that by itself.
As long as the software is well designed and programmed no disasterous security flaws exploits will happen for the simple reason the software was bundled with the OS.
MacOS comes with Safari and nobody seems worried with that, even with all the recent bugs found in Mac OS.
Regarding Symantec, I still trust my AV protection to them.

[Ryo Hazuki]

Microsoft Gains Security Respect

The question whether Microsoft will get security respect by 2008 is not a question if that respect will be deserved by Microsoft (IMHO it is already to some extent with products like Windows Vista, Internet Epxlorer 7 and Windows Defender), but if people in general (and that includes many short-minded, ignorant, biased people towards Microsoft) will give that respect where it is due, even (even) if that means giving respect to evil Microsoft (something I seriously doubt will ever happen, at least regarding some people).

[Ryo Hazuki]

Because...

...it's a very tuff job to open the eyes of Microsoft haters...