Microsoft Apologist Apologizes for Microsoft

hillbilly1980 writes "Internet Week has published a counter article in response to the number of anti-monoculture security papers recently published. Unfortunately the author starts out by writing off the other papers as simply anti-Microsoft, unfortunate because his paper never gets past being more then just pro-Microsoft. One of his suggestions to secure your enterprise... turn off port 80." Probably the best thing to do to prevent disinformation from entering your company is to block articles by Rob Enderle. Update: 10/11 00:54 GMT by M : Note for the record that the original version of the article referred to blocking port 80; the article has now been edited to refer to port 135.

Comments

Just another doofus, move along...

[doodleboy]

There will always be apologists for the rich and powerful, be they journalists, politicians, or supposedly impartial "analysts" like Enderle. Such people are responsible for the endless flood of Microsoft-sponsored "studies" purporting to show that Windows is more secure, more stable, has a lower total cost of ownership, wipes your ass for you, etc. So when Enderle says

I'm not a big fan of diversity because so much the research I've done over the last decade or so indicates that by eliminating diversity you can dramatically reduce costs. Companies can minimize support costs by rolling out identical hardware and software to every desktop through big bang deployments. Going the other way in a knee jerk reaction to just one class of security threat seems poorly founded.

he seems not to have considered the cheapest possibility - a monoculture of free software, which has lower cost, better security, and higher performance. Now how is that?

Funny

[Pan T. Hose]

It may be funny, but sadly some people do really think that firewalling port 80 (or 8080, or 21, or 20, or 22, or 443 -- et cetera, ad nonsensum) is the answer indeed. Some people may be surprised (not Slashdot readers though, mind you) but there simply is no simple answer. There is no working snake oil. The buzzword of the week alone will not save you. What are my answers then? Simple. Read Security Focus. Read Crypto-Gram. Read Phrack. Read the underground IRC discussions. Read encrypted Usenet posts. Read the articles posted on Freenet. Read the books for god's sake! Read about systems. Read about networking protocols. Read about cryptography. Read about cryptanalysis. Employ honeypots in every network. Learn C. Learn Assembly (Intel as well as AT&T syntax, for different CPU architectures). Learn executable binary formats. Learn how to see polymorphic shellcodes in network packets hex dump, just looking at tcpdump output scroling on your terminal. Learn how to speak different protocols (http, smtp, pop3, etc.) with netcat, then making your own tcp packets, then your own hand-made ip packets, then ethernet, ppp and slip. Learn. Read. Then learn some more. Read. Read. Read. And learn the one most important thing: security is not easy. When everything fails, you are on your own.

Turnabout is Fair Play.

[_Sprocket_]

Slashdot is too subjective.

...meanwhile Rob Enderle is the pinicle of objectivity?

Slashdot has never claimed any kind of objective viewpoint. Its rather biased. And its become well-known, if not always popular, because of that bias.

Slashdot filled an interesting niche; a dissenting opinion when the IT press was almost entirely Windows-centric. Linux was quietly seeping in to the Enterprise. But the mainstream IT press either ignored it or was unfairly dismissive. Slashdot was a forum most noted for its pro-Linux and Open Source friendly opinions.

Times have changed.

Now, its not worthy a Slashdot news post just because a mainstream IT rag has mentioned Linux. Its not entirely unlikely to find pro-Linux / pro-Open Source articles in the mainstream. Right next to the pro-Windows articles. And the press releases being masquaraded as an article. Some things don't change, after all.

Slashdot's bias is one of those constants.

I'm kind of curious. It seems that over the years, Slashdot has gained more pro-Windows readers. Mainstream attention has either provided more people with a Windows-centric viewpoint or its attracted more astroturfers and trolls.

But for every time I see someone complain about Slashdot displaying an "unfair" bias against Microsoft, I wonder how many people like myself sit quietly in the background glad that Slashdot keeps that bias firmly in place.

Re:Slashdot

[Newcastle22]

Not completely true. In addition to being owned by Microsoft, Rob Enderle also makes little sense.

"Because the key ring was so large it was easy to find and exploit. This is not to say the approach of having a single, master key was more secure, only that the fix actually didn't mitigate the problem at all, in fact it actually made the keys easier to find."

What is he talking about? This analogy was pulled straight from the man's ass, obviously. He's comparing the virtual size of bits to the physical size of a keyring. Sure, size of files are noteworthy to crackers, but any descent sysadmin memorizes his 'keys' anyways. What a stretch this one was.

"For example, if a virus targeted Microsoft Office and an enterprise deployed Apple systems running Office, for compatibility reasons, that enterprise would probably be damaged by the attacks."

This is simpley not true. I can point to the example of internet explorer exploits that only worked on Apple versions of the software (www.w00w00.org, I believe). I'm sure folks here can come up with a hundred examples of why this is not true. Summed up, same applications work differently across different architectures. Its half of the reason why non-monoculture works well to secure networks. (The other half is having different OS's.)

"But he penetrated the site in under a day by attacking another company which had trusted links into the IBM-secured site."

I'll lay a bet this other company was running Windows servers.

"One of the biggest problems caused by diversity is that it become very difficult for the IT staff to maintain equal competence on all platforms."

Here is the only good point this guy makes, and he makes it at many different points throughout this article, but in different wording each time (I'm assuming he was having a hard time finding something constructive to say). There is an easy solution to this: use Linux on the entire network. There's a secure AND cheap solution for small, medium, and big businesses! In addition, having servers run Linux, and Windows on the client side (assuming your clients aren't smart enough to learn Linux) isn't an entirely infeasable solution.

Seriously though, Rob is making non-monoculture sound more difficult than it may be. As far as cost goes, since no one has done enough research to balance cost against security in multiplatform networks, he can't assume that the costs will outway the benefits any more than the anti-Microsoft security experts can do the opposite. This basis of his article relies on speculation at best.

Dan