Security Webcast Week

It seems like every Monday starts off some new national (fill in the blank here) week. Maybe national teachers’, reading or world hunger week. At Microsoft, Dec.1-5 is (international) TechNet Security Webcast Week. Full details are available here.

The first Webcast, focusing on how Microsoft secures its own assets, commences at 2:30 p.m. ET (-5 GMT), today. The other days, Microsoft will hold three Webcasts a day, covering such topics as mobile devices, patch management and hacker techniques, among others.

All 13 Webcasts (Will that be a lucky number for Microsoft?) cover important security topics. But, I would recommend the first for just about everybody. I’ve long said Microsoft should help customers by revealing some of its own security policies and procedures. After all, while the news media points out every suspected flaw in Microsoft software, Microsoft the company doesn’t seem to have too many security problems. Consider that Microsoft carries a big hackers’ bulls-eye and that the company runs all its own software. That mix is a combination for some heaping big security problems if Microsoft’s software truly were so security buggy. Clearly Microsoft is doing something right.

Certainly, there are legitimate issues about the number of patches and customers’ burden of patch management. But, if Microsoft has found a way to deal with that and keep its big honking bulls-eye company secure, maybe some of those security policies and techniques would be good for customers, too.

I wouldn’t expect Microsoft to reveal too many details of its secret security recipe. Some basics might surprise some customers. For example, I know that Microsoft employees accessing the corporate network remotely go through a fairly convoluted access process that includes checking to make sure virus signatures are up to date. That’s smart security policy. Rather than looking at authentication, Microsoft checks for other possible areas of vulnerability. A computer without up-to-date signatures is more likely to be infected with a virus capable of spreading to the corporate network.

By the way, late last month, Microsoft published the technical white paper "Security at Microsoft," available here, which explains some of the mechanisms the company uses to secure its network. I recommend that every company deploying Microsoft software make the white paper mandatory reading for all security professionals.

Posted by Joe Wilcox at December 01, 2003 10:11 AM