Microsoft's lessons from the desktop

CNET

News

(continued from previous page)

NEWS.COM SPECIAL REPORT: Wardens of the Web

TalkBack

E-mail

del.icio.us

Digg this

(continued from previous page)

Despite their unique mission, Boden's team in many ways represents a cross-section of the company. Members vary from someone who was hired straight out of high school at age 17 to veteran professionals with doctoral degrees in computer science.

Boden's background is equally diverse. Born in the United States to British citizens, he grew up in Southport, England, and attended high school in Philadelphia. It was a Tandy TRS-80 that first got him interested in computers. He worked for Deloitte Consulting before joining Microsoft, where he managed desktops and servers before falling into security as a project manager on Windows 2000.

"I found I enjoyed the challenges and pace of the security function much more than deploying software," Boden said.

He's certainly got plenty of what he asked for. As Microsoft has grown with Web technology, the threats to the empire have multiplied commensurately.

Special report
Wardens of the Web

In CNET News.com's multipart series, we peek behind the curtain at online giants Yahoo, Google and Microsoft, and the elite corps committed to securing Web applications.

Vulnerabilities on the Web include cross-site scripting bugs that could leave personal accounts vulnerable to hijacking, facilitate data-thieving phishing scams or let hackers plant malicious code on a trusted site. Another commonly discussed problem is SQL injection, where an attacker could gain control over a database behind a Web application.

And with expansion has come additional risk, including complications raised by new business relationships with other companies that host parts or all of Microsoft-branded Web sites. In 2005, for example, an MSN Korea partner fell victim to cybercriminals who created a nefarious program that recorded user credentials for an online game onto the PCs of MSN Korea customers.

That same year, Microsoft kicked off its online initiative, proclaiming the "live era" of software. It announced online complements to Office and Windows. Recently, it unveiled a revamped version of Hotmail, one of its early online applications.

The "live" push is Microsoft's bid to partake in the online applications surge. These applications are helped by new development techniques such as Ajax that stretch the abilities of what Web sites can do, making them act more like traditional desktop apps. That, in turn, has translated to new opportunities for security breaches as well.

"It puts stress on our program, but we have been successful in creating a security model that really pushes accountability back to the business teams," Boden said.

In sharing responsibility for security across the company, Microsoft is similar to its rivals. As mashups become an increasingly common form of developing, cooperation on security is essential for connecting multiple online applications.

Above all, Boden--like his counterparts at rival companies--says it is crucial to keep in mind why security is so important. As people continue to store their information online, the Web is becoming the equivalent of their personal filing cabinet.

To that end, Boden and his family are no different: they store all their personal data in Web applications.

"We're definitely all in," he said. "So if it fails, it fails for me personally and professionally."

Stories

Day 1: Inventing the wheel
Leading the charge in Web security at Google, vice president of engineering stands at the forefront of a critical period.

Day 2: It pays to be paranoid
All Yahoo employees are encouraged to be at least a little paranoid. Meet the man who was the first to put it in a job title.

Day 3: Lessons from the desktop
While similar rules apply to Web security, the differences are crucial and the stakes are high, says Microsoft senior security director.

Day 4: Web security challenge
Unprecedented amounts of data will need to be secured in new, untested ways. What's the best course in such uncharted territory?