Interview With Microsoft's Chief of Security

Paul Coe Clark III writes: "I interviewed Howard Schmidt, Microsoft's head of security, questioning him about, among other things, cyberterrorism and Redmond's responsibility for insecure features in the wake of many virus attacks. /. readers might find it interesting. They can find it here."

Comments

Contrary to popular belief

[Zen Mastuh]

Microsoft does focus a lot of effort towards securing their products. Unfortunately the effort is more reactive than proactive. It's a basic flaw in the capitalist model that allows the Marketing and Accounting people to determine release dates--instead of the Developers. The attitude can be paraphrased like this: "As long as the app fires up, it can be released. We'll let the customers be beta testers."

If they were in the car business insted of the O/S business, a lot of people would be dead or mangled.

Re:Contrary to popular belief

[Bonker]

If they were in the car business insted of the O/S business, a lot of people would be dead or mangled.


That's ultimately the only thing that can change the corporate machine... Death. Either the death of members of the machine or members of the public.

Look at the recent Ford/Firestone screwover: Sure, there have been reports about how unsafe SUV's were for years, but Ford was able to rationalize those deaths away as just part of the 'acceptable highway fatality level' that Americans seem to be comfortable with.

It wasn't until people were able to say with proof positive that Ford SUV's and/or Firestone tire were directly responsible for human deaths that Ford was forced to change its practices.

Microsoft is in the same boat. It won't be until the Blue Screen of Death is really, provably responsible for human fatalities (Think saftey control at a power plant, or a crash aboard a military vehicle of some kind) that Microsoft will start being more responsible about their security and program design.

Re:Contrary to popular belief

[kellin]

Having worked in that corporate QA environment on and off for the last 6 years, and watching what I thought was real quality QA testing deteriorate into mindless clicking and "following directions" mainly due to a change in corporate environment, I must agree with you.

There's a huge difference, though, between games and operating systems. Letting the end users "beta test" an OS is by far, the most insane excuse for laziness I've ever heard, and its actually one of my biggest complaints against microsoft.

You can pay people to test an OS, but I can guarantee you that's even LESS exciting than testing a game. An idea comes to mind, though.. get a bunch of young *hackers* together and *PAY* them well, to build programs that test the vulnerabilities of the OS.. or heck, get some seasoned hackers that are trustworthy for such a thing and pay them even better... I dunno.. just an idea...

Re:Contrary to popular belief

[Martin Blank]

Knowing someone in the gaming QA arena (supervisor at a major company), I can honestly testify that gaming QA is not nearly as fun as most people think. At crunch time, when you're playing the game for 12 hours a day every day for six days a week for a month, it gets REALLY, REALLY boring. I've learned to not discuss games of any kind during said crunch periods. The initial few days, perhaps through to a full week are fun, but after that the mindless tedium of replicating bugs and testing every possible combination of commands really grates on a person. I can't imagine what testing the latest version of a major application is like.

I Loved this bit...

[schon]

(When asked about full disclosure, and publishing of exploits)

In some cases, it's tantamount to screaming "fire!" in a crowded movie theater.

Yeah, except there really IS a fire.

So when there is a fire in a movie theatre, he's suggesting the person who notice it just quietly go and tell the management (who will wait to see if it's really a big fire, and then assign some staff to attempt to put it out), instead of telling the people whose lives are in danger?

Yeah, GREAT analogy.

Screaming "fire!" in a crowded movie theater

[dica]

> What we're relating to is responsible reporting, and there's a difference. In some cases, it' tantamount to screaming "fire!" in a crowded movie theater.

But there is a fire. Its only irresponsible to shout "fire!" in a crowded movie theater if there isn't on, just like it would be irresponsible to post non-existent exploits to bugtraq.

Mr. Schmidt is suggesting:

• If you see a fire start in a movie theater, the responsible thing to do is:
  1. don't inform anyone at risk.
  2. get up quietly.
  3. report the fire to the movie theater's manager.
• If the fire is due to negligence of of it is irresponsible to tell people how the fire really started.
• You have no moral authority to call the fire department, even if the manager refuses to evacuate the theater.

• 
  Geez... They must have cut their spin budget recently.

Standards, "Innovation", Best Practices

[Relic of the Future]

Standards don't drive [development efforts], because what happens, you wind [up] in a situation where standards may turn around and inhibit the ability to innovate...

Classic Microsoft... standards bad, embrace and extend good... we do it for security reasons, not because we're trying to leverage our monopoly power into yet-another market. I can almost understand the "don't tell anyone about the exploit until we have a chance to fix it" stance, but this makes me sick to my stomache.

I would be in favor of government standards of security. And not just because it would force more open standards, but because it's a good idea. Yes, it will probably not be easy to implement, and it might force MS to ship a product or two late, but at least it will enforce some needed checks from a company who's concept of security is identifying problems after product release.

Re:They're trying

[LoRider]

I will have to disagree with your statement, "Apparently MS realizes they made a wrong decision in their approach to security (trusting the sysadmin's dilligence), and they are making strong strides to change this now, and in the future."

Microsoft's approach to security has/had nothing to do with trusting sysadmins and everything to do with gaining market share. The marketing department drives development plain and simple. You really should open your eyes when you are working on them NT servers, do they look like servers?

Microsoft's products should install out of the box as secure as possible, not with a blank SA password for SQL.

I am forced to work in an NT world and I hate it. I have worked with many other server OS's like Novell and Linux distros, and MS stuff sucks.

People who NT is easy are wrong, NT is high maintenance really high.

Speaking of high...I gotta go cough cough
The only good thing I can say about MS is that Windows 2000 works better then 95/98/ME every did, but that's it.

Re:Logic fault

[The FooMiester]

I say that Linux and Windows cannot be directly compared (IMHO)

I never compared the two. I just made a simple anology, much akin to the one posted in the interview. I just happen to think mine is more correct.

But nevertheless, in terms of functionality, Linux is not very user friendly (you have to do lots of steps) in order to reduce the faults in the system (whether security or stability.)

Strictly speaking, your average Linux OOB(out of box) experience is safer than your average Windows OOB experience. I recieve daily trojan emails, but see nothing in my ftpd logs.

Microsoft on the other hand wants every user will be able to use a PC even though it is their first time to use one. In the process of doing that, if you disable all features (because of security) then nobody will buy their OS since I believe their support call center will be full 100% of the time.

Be able to, be forced to, what's the difference, right? There has to be a certain expectation of knowledge.

Also, there's a difference between useful and secure. M$ may have done a bad thing when they allowed .doc files to contain machine level code. They're paying the price for that now. Many email services just outright BLOCK .doc files now. I bet that interferes with functionality.

It's funny you mention that nobody would buy their OS if it were secure.

Re:Damning with faint praise

[jfunk]

If the author of ProgramX doesn't fix a security hole, then debian might, or redhat might, or suse might, and as soon as one does the others can grab their fix and incorporate in their distribution.

Absolutely. I remember when a recent (not too serious) hole was found *by* SuSE's security team (I don't remember the package, sorry). One of the primary reasons I run SuSE is because of their awesome security team. They borrow a ton of stuff from OpenBSD, and that's a good thing. I also highly recommend their security mailing list no matter what distro you use, and their security scripts are deliberately distro-blind (I've installed them on critical Red Hat servers at work, and they work beautifully).

I ran YOU (YaST Online Update) manually and I looked through all of the updates. They submitted the patch to the original developers before sticking new packages on their servers. The new version of that package from the original developers (ie: they applied SuSE's patch) was released three days later.

But that's not the most important thing. Am I screwed if SuSE dies? Hell, no. My number one reason for preferring open source is that I can get *anybody* to do the work for me, including myself.

I've said it many times before: price is not the issue, control is. Sure, I can get SuSE for free all I want, but I pay for it just so their packagers and bug-fixers get to stay on board.

a non-MS bash (just this once)

[Multics]

I'll make two un-MS remarks just so there is some content down here in the least-read section of these comments.

1) As Multics taught us, security with significant hardware support is significantly easier to do than without. A result of this is that we need to be asking Intel (etal) about help (like tagged memory blocks) in hardware. It really is time that we got away from just the stale VonNeuman ideas that Mr Cray graciously gave us in the 1960s and 1970s.

2) Once the hardware exists, then we can move to implement better O/Ses that are significantly more robust. Everyone will win, even MS.

-- Multics

Closed source can never be as secure

[Pinball Wizard]

...as an open source system. There's more to it than just "lots of eyeballs".

For instance. Even with all the security patches Microsoft has provided with IIS, their FTP server is still insecure. How do I know this. Because some warez dudez managed to use my server, even though I had applied all the patches and set the FTP directory to be read only.

Now, if this ever happens to you, let me tell you, these guys play a dirty trick so you can't easily delete their directory. They name their folders with names that cannot be deleted the normal way, names like COM1 or DEL, names that are reserved somehow when you try to delete the files and folders.

The amusing thing about this is that the only way to get rid of these files is to install the posix utilities and use rm to get rid of them.

Now here's the kicker. If you use rm -r CO* to get rid of a directory called COM1 you might find out that this directory is really called "COM1\ /" The command line actually hides the last three characters. And rm gets fed the first directory, and then the "/" separately. Yeah. You do the math. Needless to say, it wiped out quite a few of my files before I killed it.

Yes, I perform backups, so I proceeded to restore the files. But insidiously, SQL Server on the same machine refused to run, because it felt the installation had been corrupted. I basically had to figure out how to trick it into running again, because(another hideous design fault) you can't just uninstall SQL server and reinstall it and hope your data directory is OK. I had no way of doing an up to date backup of my data on this machine. So I had to trick it into believing it wasn't a corrupt installation, or I would have lost data.

Now, how many things can you count that would have never happened with an open source system. You certainly wouldn't have files with the latter part hidden. You can back up data directories to completely different servers by simply copying the directory. Its very easy to drop in other FTP servers without loss of functionality. And there is certainly nothing that will stop a program from running if all its files are there and the execute permission is set.

All, in all, I had a very frustrating experience that never would have happened with a Linux system. With Microsoft, its their way or the highway, and you can't change things or fix them when the design is bad. Rather than the user dictating what the software does, Microsoft dictates to you how their software will work. Because of that, closed source is less flexible and configureable, is less managable and nimble, and therefore cannot respond nearly as well to any number of problems, including security.