Rewind: Secure Computing

Today, Microsoft revealed a new security initiative that will unfold over the next six to 12 months. The changes are a commendable improvement over Microsoft’s current approach to securing Windows-based systems, but I do think they miss some important issues that I will address later. The changes correspond to a three-prong attempt to improve security. (Microsoft’s brief explanation for IT professionals can be found here.)

For starters, Microsoft is tackling the sticky issue of patch management. The company plans to move to a monthly patch release schedule, except when a critical security vulnerability warrants an intermediary patch. Apparently, Microsoft reasons that a single monthly update will be easier for network administrators to test and roll out.

The company also plans to release, during first half of 2004, Software Update Services 2.0. The current version is mainly designed for platform software, such as Windows. The successor would allow patch scanning and updates for Exchange Server, Office, SQL Server,Visio and Windows.

In what I consider an extremely smart move, Microsoft is extending security support for Windows NT 4 Workstation with Service Pack 6a and Windows 2000 with Service Pack 2 through June 2004. The move rightly recognizes that a large number of companies still run NT 4 Workstation or Windows 2000 with the older service packs (The most current is Service Pack 4).

Education is Microsoft’s next strategy for improving security, and, again, the company should be commended. That’s because Microsoft will be paying the bill, so to speak, for educating businesses about software security. Later this Fall, Microsoft will start offering free TechNet security seminars. Additionally, starting in November, Microsoft will hold monthly security Webcasts.

Microsoft’s Oct. 26-30 developer conference will offer several security sessions, including those for better coding software, as today's announcement notes. I have to ding Microsoft for relegating the major security events to the last day of the conference, when the least number of attendees are likely to be there. Lest I’m mistaken, Microsoft’s mandate is to put security ahead of product features. So why relegate the showcase security events to the end of the show?

The third security change will affect Windows XP and Windows Server 2003. Microsoft plans several, as yet amorphous, safety technologies focusing on e-mail and port-based attacks, buffer overruns and malicious Web content. Microsoft considers these four areas to account for the largest percentage of vulnerabilities. These safety technologies would debut with release of Windows XP Service Pack 2 and Windows Server 2003 Service Pack 1, both of which are scheduled to release in the first half of 2004.

My biggest problem with the security changes: I hear a lot of talk, but I would like to see more action. Most of these security changes won’t come until sometime next year--and some could be eight months or more away. I make a big deal out of this because Bill Gates’ mandate that Microsoft put security before all else came in January 2001. I’m trying to grapple with why Microsoft has taken so long to seriously deal with problems like patch management.

Even that effort falls short, because nowhere in Microsoft’s announcement is any indication the company plans to ease consumer patch management. One of the lessons learned from August’s Blaster outbreak: Too few consumers patch their computers. Why should they think to do so, when no other major consumer product--CD players, televisions, DVD players and the like--needs regular maintenance or security updates?

In today’s WiredNews story (here), "Cloaking Device Made for Spammers," reporter Brian McWilliams reveals that a Polish company is effectively hiding spammer sites using a network of 450,000 computers. The PCs, the majority in homes, have been infected with a Trojan horse that spoofs IP addresses. I find that number of compromised computers--presumably mostly running Windows because of Microsoft’s huge desktop presence--co-opted by one company to be a staggering amount and a sure sign of the vulnerability that exists among home-based PCs and their threat to the larger Internetworked community of users.

My other problem is Microsoft’s ongoing tendency of putting out fires rather than trying to prevent them. Certainly, today’s security changes are welcome steps forward. But they come in the wake of several nasty summer security vulnerabilities rather than Microsoft demonstrating true leadership by following a methodical process of improving security.

I know that Microsoft the individual company takes security very seriously. In fact, the company has put in some not-so-user friendly steps to ensure that only authorized, remote users get into its network and that their computers have up-to-date antivirus definitions and other security measures before the log-in process completes. Microsoft likes to tout the "dogfooding" of its products, meaning real employees exhaustively test software before shipping to customers. Hopefully, Microsoft can pass some of that dogfooding of security onto its customers through the education process and by incorporating into popular products like Windows some of the policies and technologies in use at Microsoft.

Posted by Joe Wilcox at October 09, 2003 04:00 PM