Slashdot Mirror
Microsoft To Teach Undergrads About Secure Computing
Update: 03/24 18:00 GMT by J : Another report worth reading is Writing Software Right, which requires a free but annoying registration at Technology Review. This regards automated methods of finding software errors (not security specifically). Sun's "Jackpot" is discussed, a lint that also "identifies general instances of good or bad programming."
And Microsoft's efforts in this field are explained as well -- the company "paid more than $60 million in 1999 to acquire Intrinsa, maker of a bug-finding tool called Prefix. The program, which sifts through huge swaths of code searching for patterns that match a defined list of common semantic errors, helped find thousands of mistakes in Windows and other Microsoft products." As a Microsoft QA person says, "Our challenge is to get our software to the point that people expect it to work instead of expecting it to fail."
MSPress actually has a really good book available called "Writing Secure Code". All it takes is a few bad devs to create a reputation for the whole company.
The book talks a great deal about how having secure code is more than just the writing, especially in a corporate environment where you need to enforce standards on multiple programmers and have to deal with the pressures from marketing, etc. I think that, more than incompotent programmers, is what leads to the issues we see at MS.
Microsoft has a huge push going on in education. Campus reps, steep tool discounts, and curriculum suggestions to get Microsoft technology into undergrad and grad school course materials. Ask any CS professor what kind of contact they've had with Microsoft reps.
.Net runtime.
Java and Linux have become very large forces in education. Java has very nearly become the de facto teaching language, and Linux has become a popular instruction platform. Microsoft is trying very hard to counter this motion with C# and the
In situations like these, the actual facts play only a modest role in shaping public opinion,
True, but public opinion has relatively little to do with whether your computers are secure or not. If it did, then nobody would bother with engineering approaches to security; they'd just set aside a large PR budget to create the public perception of security, and that would make their software secure.
The main irony here is the old observation by many security people: If you want computer security, you never, ever allow any software to be run unless you have all the source and you've compiled it yourself. Otherwise, you have no idea what may have been hidden inside that binary by the people who sold it to you.
It would be interesting to see whether Microsoft's teachers bring out this rule. Will they even mention the topic? If so, will they teach the course the second time?
Granted, this isn't nearly the whole story. You must not just have the source. You must also have competent, trustworthy people on your staff who have the time to thoroughly take the software apart and understand it all. And even then, Ken Thompson's famous paper shows how subtle the problems can be.
Still, as a baseline argument, any such course on computer security should start with the observation that if you allow binary software to be installed, you are utterly defenseless against the people who compiled and packaged it for you. This is really the main thing that needs to be said about security and Microsoft.
Those who do study history are doomed to stand helplessly by while everyone else repeats it.
dare we suggest that microsoft start this initiative with its employees first?
This has already happened. Remember when Windows development was halted for a month to find and fix security issues last February? At the same time, all technical people at Microsoft had to go through a special security training. It was based on Writing Secure Code by some MS insiders, a real good book in fact.
I would think the particular course mentioned in the article would also feature this book.
When men used to be men