Wardens of the Web
TalkBack
E-mail
del.icio.us
Digg thisMicrosoft's lessons from the desktop
Editors' note: This is part three of a four-day series examining the state and future of Web security.
Pete Boden wants people at Microsoft to think like criminals. That's why the company held its first "Blue Hat" meeting in 2005, which invited hackers onto the corporate campus for lectures and meetings intended to expose security employees to the mentality of digital intruders.
Although it has become a popular biannual event, Blue Hat can still be an unnerving experience at times as guest hackers occasionally break Microsoft products in front of the people who built them. But studying such simulated attacks--a process known as "threat modeling"--provides invaluable lessons in teaching developers how an application can be attacked and what the security controls should be.
"Often times, we find that developers are thinking like a developer or like a user," said Boden, senior director for MSN and Windows Live security at Microsoft.
That's the challenge facing Microsoft. Many company developers and executives believe that securing Web applications is no different from protecting PC desktop software, something the company has learned over the course of three decades. At the same time, Microsoft must acknowledge the crucial differences in pace and scale that are presenting some of the most difficult security challenges ever encountered in digital technology.
For all its successes, Microsoft has in the past reacted slowly to industry change or has underestimated its impact. Case in point: back in the mid-1990s the company misjudged the significance of the Internet and Web-based computing. What followed has become equal parts lesson and legend, a call to arms from Bill Gates that ultimately sank arch rival Netscape Communications and set the course of Internet history. More recently, Gates and CEO Steve Ballmer have admitted to miscalculating the value of Web search and digital music, long after Google and Apple stole the show.
It is understandable, therefore, why Microsoft is determined not to fall behind in Web security. The key, according to many within the company and beyond, is not treating it like just another set of desktop bugs.
"The same rules apply. It is not a new science, it is a different environment to apply the same science," Boden said. However, he stresses, "We have to be very careful not to get complacent about saying we understand the problem, because it is going to change right in front of our eyes."
The 18-year company veteran understands why many at Microsoft cling to the notion that Web and desktop security are essentially the same. Although the types of threats change, Boden says desktop and server security lessons are equally valid when applied to online applications.
"There are pieces that are different," he said. "But the discipline of understanding what could break, how it could break, the impact of it breaking, how we protect it, how we respond to any event, those are fundamentally the same."
The main differences--and they are crucial--are speed and size. As Boden says, securing Web applications is all about scaling; if security doesn't scale, data could be at risk.
A year ago, Microsoft had about 30,000 servers in its data centers to support its online services. This year that's up to 80,000, and more growth is planned.
"The business stakes are enormous in this area," Boden said. "If we or anybody in this business violates the users' trust, then we're essentially out of the business."
Learning the hard way
If Microsoft veterans sometimes sound as if they've seen it all before, there's good reason: they've learned the hard way.
Five years ago, Microsoft's customers were getting hammered. That's when Gates launched his Trustworthy Computing initiative to make security a priority. Industry analysts have praised the effort, even though there are still plenty of vulnerabilities found in Microsoft software and attacks still occur.
Inside the MSN and Windows Live security offices, banners still work to remind employees of the importance of security, and a "Security Scorecard" keeps track of performance and ties into individual reviews.
The regimented approach hasn't always been welcomed by the rank and file. Like human resources and IT staffs, the security department of any company is sometimes viewed like the internal affairs division within the police force--they're paid to keep an eye on you. The 55 members of the MSN and Windows Live security team set policies, assess risks and respond to security incidents.
Not surprisingly, initial efforts to reach out to other departments and employees were met with trepidation.
"We had a robotic image on a lot of our awareness campaign materials last year, and it portrayed a very stern, standoffish approach to the team," Boden said. "We went away from that, specifically because we want to build better relationships with the development teams."
Things are better now. Boden's department is engaged in an ongoing marketing campaign within the company, which includes hosting regular happy hours with local brews and chips and salsa.
"Redhook, Mac and Jack's, we're not short on beer here in the Northwest," Boden said.
Next page: With growth comes more risk
Stories
Day 1: Inventing the wheel
Leading the charge in Web security at Google, vice president of engineering stands at the forefront of a critical period.
Day 2: It pays to be paranoid
All Yahoo employees are encouraged to be at least a little paranoid. Meet the man who was the first to put it in a job title.
Day 3: Lessons from the desktop
While similar rules apply to Web security, the differences are crucial and the stakes are high, says Microsoft senior security director.
Day 4: Web security challenge
Unprecedented amounts of data will need to be secured in new, untested ways. What's the best course in such uncharted territory?
Photo galleries
Day 1: Google team at work
Everything from dogs to Darth Vader keeps things lively at the office. June 25, 2007
Day 2: A peek at Yahoo 'Paranoids'
"Paranoids" come in the uppercase and lowercase variety. And then there are the superheroes. June 26, 2007
Day 3: Leading Microsoft's crew
Senior security director heads up a 55-member team that's working on marketing itself inside Microsoft. June 27, 2007
Podcast
Podcast: The state of Web security
Is Web security where it should be? Where is it headed? CNET News.com talks to some experts.June 25, 2007
Related stories
Wired but not Web 2.0? That's normal, study says
Wrangling Web 2.0 at S.F. expo
Bug hunters face online apps dilemma
Insecurity complex on the Internet
Google deal highlights Web 2.0 boom
News from around the Web
Divide between Net, desktop disappearing
Web 2.0 threats and risks for financial services
Security remains a challenge for browser developers
Is Really Simple Syndication really secure?
Study: Security cues on banking sites ignored
Botnet battlers call for Net driver's license
Credits
Editors: Anne Dujmovic, Mike Ricciuti, Mike Yamamoto
Design: Andrew Ballagh
Production: Jessica Kashiwabara
until they were left with nothing.
How can a consumer accept a car that is unstable, crashes, is a
magnet to viruses and allows break-ins from a poorly built
machine?
The only way is for Microsoft to start over and create a whole
new OS. Until then, the dark ages of computers continues for
most.
Many are already in the renaissance with their Macs.
There are 4 simple rules to follow for computer security: 1: No unauthorized access to memory. 2: No unauthorized access to Storage. 3: No unauthorized processes. 4: Administrator sets all authorizations requiring at least one physical access to the system/console.
Security comes before anything else. M$ likes to through anything out there they think they can sell, saying look what this could do for you...without ever thinking that the very nature of what they introduce is a complete violation of security. As an longtime Internet user (long before the WWW) it may appear a novel idea to be able to automatically execute and process arbitrary code on a remote machine simply by sending an E-Mail to it, but all you have to do is think once about how such a thing can be abused, and decide its not worth the risk. But noooooo, we have this thing called outlook express preinstalled on thousands of computers with no protection against such malware configured. I can fall back on my Mac roots (thankfully), but many can't. Quite honestly, I don't think M$ has the expertice to create a really new system, they have been regurgitating the same old crud code that Mr. Bill bought (not developed) many years ago, yes it has evolved, and been built upon, but they still use the same old mindset. If they were a car company they would have asked the government for a bailout, if they got sued to insolvency, unfortunately the gov won't hold them accountable for anything, so we must all pay.....
Wait, I know! WE are all stupid, and YOU are the only smart person around (not...).
Oh my... Another day, another MS bashing thread...
Yahoo: Completely weird trying to put humor into security with drug-like tactics with cartoons and paranoia
Microsoft: They decided to have their own photographer and in the last photo <a class="jive-link-external" href="http://news.com.com/2300-1002_3-6192282-3.html?tag=ne.gall.pg" target="_newWindow">http://news.com.com/2300-1002_3-6192282-3.html?tag=ne.gall.pg</a> drink was seen within the Microsoft office
Who wins on a Cnet report level? Google.
In security and public relations, behind the scenes and ideals don't matter, this was a media and public relations face off, and out of that only Google came out best. The public don't care about cartoons, paranoia and other behind the scenes stuff, they want to hear stuff that is going to make them feel better as a consumer, but how you're better serving your employees.
Consumers wanted to hear about things that effect consumers, and the Google report and photographs done that, Yahoo and Microsoft failed to do that.
Funnily, Google are winning over consumers, something you've failed to beat in your cnet public relations, yet again Google stand out as #1, not only as the number one search company, the number one company online but the crown in public relations and giving the public what they want to hear in terms of cutting edge journalism.
Kudos to Joris Evers for the three reports.
Popular Science's "Worst Jobs in Science 2007". It was right
between Coursework Carcass Preparer and Gravity Research
Subject. "Like wearing a big sign that reads 'Hack Me'".
<a class="jive-link-external" href="http://***********/2v9la9" target="_newWindow">http://***********/2v9la9</a>
I have to disagree with PopSci's analysis on one point --
Microsoft's products are not hacked for the challenge. They are
hacked to create bot nets that send spam, launch attacks, etc.
Zombie PCs are money makers for virus and worm writers.
Just like Plug and Play. . . only Microsoft could invent
Trustworthy Computing.
However, just stating that they're aware and actually implementing it are two totally different things.
It's too late for them to implement such in Vista because it's just a bake-off of XP with extras.
To really implement what they're claiming properly, it must be done from the Ground Up meaning at least the next operating system after Vista at the earliest!
But can they really pull it off correctly remains to be seen?!?!
Walt