Slashdot Mirror
Microsoft Security Whitepaper
An anonymous reader writes "Microsoft last week published a document on its Web site that describes how the company manages security on its own 300,000 node corporate network. The document is basically a dry discussion of IT risk management strategy, with lots of references to 'asset classes' and 'stakeholders,' and about five, nearly identical 'cycle of life' type diagrams showing how one risk management strategy leads to the next and so on, in a never-ending process. However, the document does open a window on how the biggest, richest software company in the world does security: from the deployment of 65,000 smart cards (let's see, at $50 a piece, that comes to....?), to MS's admission that 'there is a medium to high probability that within the next year, a successful attack will occur that could compromise the High Value and/or Highest Value data class.' According to the document, that includes things such as source code or human resources data."
cause the oxymoronic nature of using MS and Security in the same vicinity... one would think it's just an all white blank sheet of paper.
wordtrip.com
they recently published the bug list too
It is encouraging to see a big security industry leader such as Microsoft make such a public display of its unwavering belief that security through obscurity is not security at all - by publishing an open document on its security infrastructure. Perhaps other large players could take a cue from this (IBM, Sun)?
-- HG Pennypacker, wealthy industrialist and philanthropist
However, the document does open a window on how...
;)
Sounds like somone needs to switch to Mozilla to avoid these annoying pop-ups!
My goodness, you would have never thought that the maker of such *cough* secure operating systems such as the rock-solid Windows 95, the one the kiddies love, Windows ME("Mommy it's made just for ME!"), and the interface that only a 3 year old Teletubbies addict could navigate through, Microsoft Windows XP!.
Seriously, though. If Microsoft was a car, every time you went over a speed bump the radiator would dislodge.
hit me with a rimshot scottie!
*Bah-dum swish!*
Where does the $50 figure come from? I have two of them in my wallet (AE and Fleet Fusion) and two readers (useless on a mac) that retail for $29.99 a pop that I got for free being that I was an "early adopter". So where does that $50 really come from? And yes, I read the story, I just want to have a better handle on why someone supposedly "in the know" would trow out a figure like that for a quantity purchase of 65,000.
Who are you? The new #2 Who is #1? You are #617565. I am not a number, I am a free man! Muhahaha.
What about World Domination plans? Are those Highest Value data class? Or Really Highest Value?
I have a friend who now works for Apple, and they had training on the various classifications of stuff - I forget what any of the acronyms were, but they were pretty oddly named. I fully expected a bunch of troopers dressed in titanium and perfectly polished clear plastic(hopefully Ti in the, uh, right places) to come storming through the door to erase my brain after being told of such things.
Oh crap- maybe they DID!
Please help metamoderate.
During the original Code Red incident, for a short time, the Windows Update webpage was showing "Hacked by Chinese Worm".
(There was concrete evidence of this but unfortunately I don't have it.)
Where does that fit into MS's security schedule?
Poor Microsoft, still stuck in the old paradigm of closed-source software. Oh sure, it's been a profitable paradigm for them, but those days will gradually erode as the trend toward Free and Open Source continues over the years ahead. Meanwhile Microsoft is stuck spending mega-bucks and lots of time trying to protect themselves from having anyone actually...gasp...see the source code. Horrors!
ROFL!
Microsoft hit the nail on the head this time! It's security is as strong as white paper.
And why did you staple the trout to the RAM?
[A] successful attack will occur that could compromise the High Value and/or Highest Value data class.
Hey, even without all the security holes this would happen! Let me re-define some terms to my liking.
A successful attack: Linux on more machines.
High Value data class: Microsoft's stock price.
Highest Value data class: Bill's bank account.
See, if you twist a quote out of context, it can mean whatever you want!
Long live Schrodinger's cat...
>MS's admission that 'there is a medium to high probability that within the next year,
>a successful attack will occur that could compromise the High Value and/or Highest Value data class.'
>According to the document, that includes things such as source code or human resources data."
Microsoft's source code has "highest value"?
Hmm, if somebody did hack in and gain access to the window's source code, I hope they make it public, So I can look at it and learn how not to program.
Alternatively once it was on the internet it'd be a global game of keep away, plus imagine all of the new vulnerabilities that would be discovered, there'd be a code red every 2 days! Then maybe people might start taking security seriously.
I would like to congratulate Microsoft for rare insight into management of truly large organizations, probably one of the largest, if not the largest, in the world.
I'm glad Slashdot is running a story about enterprise management once and again, it's something many of us can apply.
Microsoft's security methodology.
Didn't those Russian hackers get ahold of some of their "highest" value data, namely the entire source tree for one of their operating system versions?
I am not merely a "consumer" or a "taxpayer". I am a Citizen of the State of Texas
Given Microsoft's track record of implementing security through secrecy, you can bet that either ...
1) They're not doing at all what's in the white paper, and therefore you should not use/implement security, or try to break Microsoft's based on what's in it (read: the document is useless)
2) They've described the 25% least important security measures they've taken, leaving out the juicy bits, in which case the document is also useless.
"A door is what a dog is perpetually on the wrong side of" - Ogden Nash
They still missed the mark...
It's security is as strong as white tissue paper.
I am not merely a "consumer" or a "taxpayer". I am a Citizen of the State of Texas
yes.
Given that their entire business model relies on their source being closed, I'd say it's pretty damned important that they keep it that way.
--
the strongest word is still the word "free"
I went a similar direction just a moment ago in reply to someone, but this is sooo much better.
I am not merely a "consumer" or a "taxpayer". I am a Citizen of the State of Texas
Perhaps you forgot about the compromise of kernel development servers and the Debian website?
Microsoft's concerns regarding source code are likely less about preventing someone from SEEING it (you can pay them money to look at code) and more about modifiying it.
Open Source is a wonderful thing -- but it isn't a silver bullet. Sophisticated programmers with access to any source repository, open or closed can create all sorts of havoc.
Conformity is the jailer of freedom and enemy of growth. -JFK
Of course, that's a risk to Microsoft's customers, so that may not be considered as critical.
occur that could compromise the High Value
and/or Highest Value data class.
since when did we think microsoft was secure any
ways? is it news that people can get into
microsoft's systems?
all i say is:
a computer without a microsoft operating system
is like a dog without bricks tied to its
head.
To make a long story short, this document is an "Emperor's New Clothes"-style piece of PHB-speak/business-speak/market-speak/PR-speak that nobody really understands, but every business IT strategist that reads it will pretend that its meaning is very profound, like the emperor pretends to see his nonexistant clothes, to avoid appearing stupid to colleagues.
Microsoft. Where do you want to go today?
Have you considered that the masses should actually be protected from Microsoft's source code ? You wouldn't want your neighbours to become stark raving lunatics after having been confronted with the lovecraftian abomination that is Hungarian Notation, would you ?
Trust me my friend, there exist Code Man Was Not Mean to Read. Microsoft is dutifully protecting reality as we know it. We should be thankful.
How can they afford the all the Licenses?
This is the same company that said, under oath, that reveling the windows source code would harm the National Security of the United States, then they gave the source code to China.
Isn't that perjury?
I do believe the issue isn't just code compromise (i.e. putting back doors in...), but in the case of the closed source, finding exploits and backdoors. I need only point to the rationale that MS gave for not disclosing pieces of their source code- it would endanger National Security. Now, either that was a dodge, in which case, Allchin should be doing time in at least Club Fed for lying to a Judge, or it's the God's truth. If it's the God's truth, being in the open is going to reveal most of those things and get them zoomed right off the bat- if it's closed, only the people working on it know about the code (well, and anyone that manages to see it without them looking...) so you don't have as many people looking over the code in question so you end up with things like MS Blaster which caused a packet storm from Hell on the Internet.
I am not merely a "consumer" or a "taxpayer". I am a Citizen of the State of Texas
What Russian hackers? Was there an article I missed?
Now the black hatters are going to have to call off their plans for the year so they can prove Microsoft's "high probability" wrong.
That, or switch to trying to take over their Mr. Coffee instead of their source code.
If I have been able to see further than others, it is because I bought a pair of binoculars.
Boy, is there any Microsoft-related posting on /. where the comments aren't only modded as "funny"? And you call some of these off-repeated insults funny?
I think the whole world would take the Linux vs. Windows religion more seriously (and less religiously) if there was some real debate, not the obstandard trolling-bordering-on-mildly-funny.
Obtroll: You would think the world's biggest DOJ-sanctioned illegal monopoly would have the money to better secure their own network. Maybe Oracle or Sun or IBM would like to describe how their networks are far-better protected, given that they're secured by industry-leading, open-source Linux that has never had a security bug of any kind, and simply can't be hacked. That would be a far better source of information than this "crap" put out by Bill Gates' mindless minions in Redmond.
Did any of the idiots commenting on this story with sophmoric (hehe, M$ security sUx045!) even start to read the Whitepaper?
If they did, they would probaly notice that the paper describes a methodology of security management, including dealing with operating system & application security issues.
Information security is more reliant on process than using x product or y product. If you have established methods to classify what needs protection, identify vulnerabilities & intrusions and rectify the situation, you have a secure IT shop.
Conformity is the jailer of freedom and enemy of growth. -JFK
.....and about five, nearly identical 'cycle of life' type diagrams showing how one risk management strategy leads to the next and so on, in a never-ending process.
:-)
Hrmmmm. Kinda like their upgrade cycles.
Visit Jonesblog and say hello.
Ok without putting in some microsoft bashing statement I have to say Im horrified at the idea that Microsoft admits in their own white-paper that they might be compromised on the highest level. Screw source code, what about automatic "updates" (They have been in the past few months especially promoting their automatic-update software, and it is expected within the next few years to be a binding part of their EULA, but even now I know for a fact most users will chose to let windows download selected updates automatically)? The same company millions are trusting to push updates unknown to them to their computer is admitting they will probably be compormised within the next year??? Does this not shock anyone? It would take next to nothing with access to their automatic update ability to wreck havoc on millions of users, imagine delete IE, and then their update system (after uploading the update itself) and 99.99% of all the users would be toast! this is serious stuff, we're talking millions of users potential take over at the hands of a script kiddie....and its glossed over in some security white paper? You have to be kidding me, where is the whole Homeland Security Department? NSA? DoD? who always seem to want to stick their noses in everything else done in the IT world? A company convicted of monopolizing the OS business now without skipping a beat making statements in a security white paper such as "There is a medium to high probability that within the next year, a successful attack will occur that could compromise the High Value and/or Highest Value data class." and "robability: High. Even with current controls, attacks have occurred and will likely happen again."
What's another word for Thesaurus?
-Steve Wright
$50 is WAY off.
Smart cards don't cost over $10. If you bought 65,000 like MS' they'd probably be about $1.
I have a friend who works for MS. There is nothing special about these cares. No RF at all.
Look, I don't know where you get your info, but note that DirectTV uses smart cards. GSM phones use smart cards. Many credit cards are smart cards. My badge at an embedded system's conference was a smart card. The reason that these are all smart cards is because smart cards are very cheap.
I know when the BeOS source was leaked, every smart programmer stayed away from it - else be blamed for stealing 'IP'.
Consipiracy Theory #234,345,234: MS deliberately leaks the source to some EOLed code such as Win 95 or NT, and sues anyone who is making inroads with alternate OSes or applications, such as Linux, Mozilla, Open Office etc.
What fun! No doubt, there will be no need to show their code for National Security reasons. We'll just need to trust them.
>I am not merely a "consumer" or a "taxpayer". I am >a Citizen of the United States of America
you're my hero.
It's easy for them to afford 65,000 licences.
The sell them to themselves as a loss. Therefore using them as a tax deduction twice - once for the loss and once for the cost......and if the loss is great enough they might even make a profit!
"Microsoft last week published a document on its Web site that describes how the company manages security on its own 300,000 node corporate network." Does this include the policy, "Do NOT patch MySQL servers, so we can get infected by the Blaster Worm again."
It amazes me that most of you really can't be constructive at all any time 'security' and 'microsoft' are uttered together.
What's more, the moderators encourage this lack of constructive talk by modding up things purely because they decry microsoft. How many days in a row are we going to hear the same old tired MS jokes?
Just because you run linux/bsd doesn't mean you're safe. Hell, by being connected to the internet at all you're at risk. Anyone with enough time, education and willingness to exploit you is going to eventually find a way in.
Anyone running any operating system can be attacked and comprimized. Security is only as good as the people who maintain the machines. You people sometimes seem to forget that despite MS's faults, they do employ some of the best and brightest in the world. I imagine some of you may not believe that, but I do.
Personally, I think that if linux were a home desktop platform that had enough popularity to be a significant enough player in that market you'd be seeing a whole lot more hackers focusing specificly on linux. Realisticly, what is the point of trying to exploit linux? Why exploit the little guy when you can go after the big fish? Especially when the majority of people running the big fish's stuff couldn't secure _any_ box to begin with, regardless of what it was running.
Same thing with the mac. I love it when macos users say "I never get viruses/worms!" well, who would write a virus/worm for such a miniscule percentage of computer users? The whole point of a virus/worm is to propigate, and if you don't have the userbase for it to propigate well, what's the point?
I apologise if I've offended people here, but I really felt this needed to be said. This persistant catscrap between linux and windows users doesn't help anything, or anyone.
Linux/BSD ARE good operating system
MacOS/OSX ARE good operating systems
Windows IS a good operating system
and they ALL have faults.
BeauHD. Worst editor since kdawson.
Your education is not.
A quick Google search ("russian hackers microsoft") comes up with:
0 52.txt
http://www.newsmax.com/articles/?a=2000/10/27/180
There's tons of others. It made a big splash on the tech news circles- and then was apparently promptly forgotten for some unknown reason. Strictly speaking, MS has already had one of their critical breaches they talk about and they couldn't have instituted a scheme like they're talking about in the timeframe from when this was discovered to now (i.e. It pretty much had to be in place or largely so because of the scope and scale of the effort in question...).
I am not merely a "consumer" or a "taxpayer". I am a Citizen of the State of Texas
you want maximum security on your windows box?
go to download the software and uninstall outlook express and internet explorer.
my blog
The quote from the article (There is a medium to high probability that within the next year, a successful attack will occur that could compromise the High Value and/or Highest Value data class) is being taken out of context. The white paper was giving an example of how an assessment is made to justifiy the "IPsec project." It seems pretty clear to me that if MS published this article saying they were vulnerable in this area that the project was approved and completed, thus eliminating the threat risk in this area. RTF White Paper.
Remember... ZG9uJ3QgZm9yZ2V0IHRvIGRyaW5rIHlvdXIgb3ZhbHRpbmU=
from the deployment of 65,000 smart cards (let's see, at $50 a piece, that comes to....?)
Smart cards are much cheaper than $50 each. For development work I get them (for this device) for under $10 each in quantities of 10 and that's expensive. In large quantities they are available for a few dollars each. I'm sure MS buys them in quantities to ensure some sort of discount is applied.
Not to sound old fashioned, but I wonder if using several large systems and dumb terminals would help lower costs and problems?
This was the standard motto in the early 80's when pc's were considered toys.
But 300k nodes sounds like an administrative nightmare.
I wonder if we would all be using network computers and thin clients now if MS never existed. They put all sorts of fud and raised the price of client licenses of terminal servers to make it look like a pc, in every desk was cheaper then a windows terminal.
http://saveie6.com/
they can sue ms for hacking tv, 60,000 card readers times $3500 is quite a bit of money!! -lol
And don't you forget that. Microsoft DOES have people with considerable technical skill and knowledge. I'm guessing that the probability of a security breach was calculated by the people who know what they're doing.
The problem is that you don't get to be the biggest software company in the world without selling products. (And Microsoft is arguably the most important software company - although I think overall Linux is more important in it's potential as an equalizer - there is no one single Linux company).
Selling products implies marketing. This is where it goes wrong. The second that product development is driven by marketing telling customers what features they want - things explode. I mean, really - half the crap in Windows and Office was never wanted by customers in the first place.
I'd still prefer to be using BeOS (I loved 5.0, but lack of support for new hardware meant I had to move on), so Windows 2000 is a pretty good compromise for my needs.
Except that you forgot to mention that the "compromise" of the kernel never happened and the Debian compromise was a password issue and again nothing serious happened.
The difference between open source and closed source is that due to open source being so open the developers on it tend to trust no one. Closed source projects tend to be a little more lax because the closed nature of the project makes it easy to get sloppy.
Nobody uses Microsoft technology like Microsoft. Unfortuately, nobody uses Microsoft technology like Microsoft.
The reason? Only Microsoft has the source code and "really understands" Windows. Everybody elses corporate networks running Windows are dogshit -- but Microsoft really does just use the crap the way they tell you to use it, and it works wonderfully. Unfortunately, they are the *only* example of such a user on the planet!
damn, 300,000 desktops, 4200 servers. holy crap, they hvae to pay a ton in license fees. i wonder if they have looked to open source alternatives. well, maybe they bought software assurance.
My problem? I was perfectly gruntled, until some numbnuts came by and dissed me.
I think that you need to read a little bit more about the bullying. One quick quote from the book Pride before the fall The Netscape marketing chief said "They [Microsoft] basically gave us a shit sandwich. They said that we could put some ketchup or some mustard on it if we like, but either way we were going to eat it." This is bullying, this testimony got them broken up. The DOJ doesn't accost just any corporation for antitrust.
As far as having a big job, don't make it out to be like they service 95% of the computing market... because they don't. They have a couple of products that they have to work on. The reason that they are slow at fixing bugs, is that it isn't a priority, oops profitable. Think about it, when did Microsoft ever send out fixes for the bugs that weren't security related? They have the most money, the best people, they have no excuse.
During the original Code Red incident, for a short time, the Windows Update webpage was showing "Hacked by Chinese Worm".
(There was concrete evidence of this but unfortunately I don't have it.)
Here it is.
My stormtroopers will be stopping by to see you real soon!
Love,
John Ashcroft
...of a High Value attack being reality instead of taking the pompous approach that your software is hack-proof. I can find 10 ignorant Linux users who think their system impregnable for every Microsoft user who thinks the same. At least Microsoft is willing to admit that yes, sometime in the future, shit is bound to happen.
For some reason you wrote:
"Realisticly, what is the point of trying to exploit linux? Why exploit the little guy when you can go after the big fish?"
Apache is the single most prevalent web server on the internet. Why then is it that hackers "target" IIS? Maybe because it's easier?
and decided to continue:
" they do employ some of the best and brightest in the world. I imagine some of you may not believe that, but I do."
Have you seen Balmer lately? The problem with working for MS is that, even though you may be smart your just wasting your time. Who cares that you can give a lecture on some brilliant way to link corporate data to business users if your entire architecture needs to fit into a proprietary MS 5 year plan for the enterprise?
MS has had 20 years and billions in funding and the best they can come up with is Windows XP. XP solves problems that Unix, Apple, X, NeXT, Amiga, et als. solved a decade ago. MS produces over architected under engineered gaming consoles that are'nt even compatable with themselves.
If your looking for "fair and balanced" where are you going to go? Read a frigin Windows rag if you want to "balance" Slashdot. I'm sure there are plenty of fine articles on .NET just waiting to provide you with hour of fun filled and objective learning experiences.
Kind Regards
"A few great minds are enough to endow humanity with monstrous power, but a few great hearts are not enough to make us w
I really doubt that they used Windows for Smart Cards. I think that the program was totally cancelled in 2001. However, I do not doubt that they spent that amount on the card deployment. Figure $10 per card (yes they could be a lot cheaper) and $25 per reader (again could be cheaper) and that only leaves $15 for development and installation. Yeah, it seems like the figure is low, depending on how they arrive at it. I really doubt that the cards themselves cost $50, unless they have some sort of secret 16 MB card running .NET... not likely.
Lasers Controlled Games!
The article probably gets it wrong. True Smartcards are almost useless for remote access at this point because there are few readers deployed in the field. At best, you can use them with specially equipped laptops, but even that is a hassle.
Microsoft, like most other large companies, almost certainly uses something like RSA's SecurID token or some challenge/response thing, and those things are quite a bit more expensive. The reason why companies use them is because they work with any web browser or ssh client--no reader required.
Odd that they would actually release something like this, aside from the marketing opportunity it represents. That said, the article is actually quite good, especially for those stuck with MS at work. Nothing groundbreaking, but some nice solid practices throughout, many of them that are easily accomplished without spending money if you already run on Windows 2000 servers. The one shocker is they actually appear to use ISA! Talk about eating your own dog food.
- pessimism rooted in previous wounds, physical or emotional, caused by the subject
- A cutting and/or ironic remark intended to wound
- An extraordinarily deep wound, as in chasm
I don't know if it was intentional or not, but I like it.I find one issue that people rarely bring up when discussing Ms vs. Open Source OS's is that if the tables turned, people would shit on Nix's as openly and wantonly as MS products. Microsoft realized they had a profitable and viable piece of coding that could become the core of their company. So in turn they didn't allow open sourcing. Now with all these great operating systems available that ARE open source Microsoft becomes the "giant that stole christmas"
Linux and OS's like it have successful security implementations because they have an unlimited amount of programmers to work on the code. There is no over head, no one to say "That's not a profitable solution" and no one to gripe when you sit down for hours on end tweaking your source. Open sourcing becomes a pet project, a hobby, and a way of life. A battle cry, held upon high by rogue programmers who sit at their consoles running a MS product at work, wishing they could do something besides regediting to add finesse to their OS. So they go home, fire up the ole' Red Hat and tweak till' they turn blue in the face. And it's a great thing to behold. BUT a problem with a lot of open sourcing is personal preference. MS products were intended for the masses of "dull" witted purely PC users. It had to be the friendly OS by design or it wouldn't have profit potential. THAT is why every person in your neighborhood has a PC, because SOMEONE took the time to gear it down to the "regular Joe" (I mean could you imagine your 57 year old mother running BSD?) However, Open Sourcing has a tendency to be modded personally, so that the OS operates to YOUR personal preference. That is the beauty of running a *Nix your can dumb it back up.
Basically my point is this, Security was not a primary concern when Windows was produced, they were worried about the little guy who could barely turn on his monitor, but you have to admit your Mom loves Bill Gates because getting email is cool!
"This is the value of a summer spent and a winter earned"
"Microsoft Security Whitepaper"
Seriously, what is a "whitepaper"? This is not a troll. I have no idea what it is. Is it an article? I know what a "paper" is; what is the significance of it being white? Are there blackpapers?
Oh Great Slashdot Oracle, I, your humble follower, bow before you, please hear my question.
What is the difference between the kind of ideas that are in a whitepaper, and the kind of ideas that are in a paper? Are the whitepaper ideas whiter? When you are having white ideas do you consciously avoid negative thoughts?
If there were a "Microsoft Security Blackpaper", what would it say? "Ohmygod, we've had years of pushing out product before the programmers are really finished with it. Now we a sitting on a mountain of sloppy code. We have no hope of finding all the vulnerabilities."
Just take into effect the blow on e-commerce a major MS security issue would have. I work for a large retail company that relies on e-commerce for at least 45% of their annual income, that turns into millions of dollars a year dependant (unfortunetly) solely on Microsoft products. That's ONE company. If I were said hacker, who exploited Microsoft to it's Highest security level, I would definetly go after any form of automatic updating and virus code definitions. Make every Microsoft user that EVER connects to the internet automatically update a virus I planted in the Microsoft system and watch the world's ECONOMY die. This whitepaper has the potential of a great work of fiction for some tech savy novelist to implement. The world could feel a tremendous tremor by MS being exploited to that level, and with the loss of a large portion of e-commerce you would lose a large portion of economical stability due to a major dependency on the internet as a viable business solution to reach long distance clients/customers
The end is nigh my friends, as goes Microsoft so goes the world. Maybe the NSA and Homeland Security Departments should aid Microsoft in it's efforts to securify their networks. We all know the NSA has some of the best technical minds in the world and it sure as hell is a National Security issue if all of our economy dies in one fell swoop.
"This is the value of a summer spent and a winter earned"
This article is a veritable cornucopia for all bad Slashdot comedians and their inevitable +5 Funnies. Come one, come all!
Here they come...
Oh, it's out there. Know where to look.
The wording here is really a bit too strange and not like a normal Microsoft attack. First of all anybody with any knowledge of history would put the "rock solid" joke on ME, not 95. And I never heard the "just for ME!" line before, in fact this is pronounce emm-e by every Microsoft hater. Though the background of XP is obvious teletubbies appearance, most Microsoft haters attack the candy-coloring bubbles which don't resemble Teletubbies scenery much at all. And "the radiator would dislodge?" How about "when you go over a bump it would stall" or otherwise do an obvious failure.
It should be obvious that Microsoft is setting this up. They want to attack OSS on security. Their plan is to put a hole or exploit into the code by compromising some system to infect the code. Possibly this has been caught three times now, but there may be a missed one already planted, so everybody check carefully! Notice that they plan to announce this "security" stuff apparently in sync with 2.6 being released.
The far easier way to plant a hole in Linux would be to pay off or threaten some developer to do it. However they cannot do this because of the obvious fact that this can be done to one of their employees as well. They have to do it by "hacking" and they need to print this paper to show that they are extremely well-protected against "hacking", while open-source is "vulnerable"
The several posts like this, which seem out of character (ie treating Microsoft as childish rather than a threatening if clumsy evil), I think are planted. They want to point out that this coming failure of open-source has nothing to do with the security of the software on your desktop, but everything to do with the fact that people can work on the code.
"The open source world needs to learn a little about UI consistency and try to make things easy to use if any Open Source OS is ever going to be taken seriously on the desktop or in the home."
Here is an opportunity for Linux to bring something entirely new to the table: UI consistency. The gratuitous UI changes from one windows flavor to another are deeply frustrating. Finding a particular admin applet is like playing whack-a-mole. As I recall in NT 3.51 the hard disk management applet was easily reached. Every generation hides it deeper.
And the default XP screen is really infantile - inspired by Teletubbies. You can see Po and La-la on really hi-rez screens.
Microsoft Security Wallpaper?
How is that supposed to work?
Go here to create your own Slashdot dis
When I was a contractor/whore a colleague in development showed netstat connections from the PRC, where MS had no development. Not in our project, anyway.
Totally owned. MS netsec had no interest. The report impugned their competence. I have no idea if things are any better now. Maybe there was a shakeup after Code Red infected the very web servers that distribute patches for us all.
I get calls from neighbors and at work all the time for hijacked desktops. They go to some lame, hostile website and every time they open IE, a million popups. If they have Active Desktop then every time they boot up.
It's insane. And ignored.
I tell them to use a browser that has not been hacked onto the OS like a siamese twin.
You'll be getting a letter from Direct TV's lawyers Monday morning.
"It's the height of ridiculousness to say for those 9 lines you get hundreds of millions."
From the parent comment: "Did any of the idiots commenting on this story with sophmoric [statements]
The first section of the paper is an "Executive Summary". The second section is "Introduction: OTG Mission and Priorities". Think about it for a while.
Did you notice the acronym that is not defined? Did you notice the next two paragraphs? Look:
The "Microsoft Security Whitepaper" is as comment #7540789 says, all nonsense. The paper is evidence of a social breakdown at Microsoft. Someone at Microsoft is not making sense, and no one else there notices it.
Don't think this is correct? Then what is the difference between "Proactively deliver" and "deliver"? What are "defined expectations"; how are they different from expectations?
Isn't this sentence a bit grandiose? "Microsoft Mission: Enable people and businesses throughout the world to realize their full potential." Does this mean Microsoft will begin providing free education?
Isn't it grandiose to say that the mission is "making it easy to work anywhere at any time"?
What is "partners-making"? It's a typo, that's what, and no one noticed the typo, even though it is at the beginning of the article. They mean "partners -- making..." Or maybe "partners-making" is playing cupid. No one noticed the typo because no one read the article, or even those first paragraphs of the article.
I'm not trolling. I'm serious. There is a social breakdown occurring at Microsoft, and this is just one symptom of it. I'm not saying it is the same as the social breakdown at Enron or Anderson Consulting or Tyco, but it a social breakdown nevertheless.
Why isn't OTG defined in the "whitepaper"? Because it doesn't matter. No one is depending on the article for anything, and they probably aren't reading it. OTG stands for Operations and Technology Group, or Operations & Technology Group, or Operations Technology Group. Sometimes two names for the group appear in one document.
When an organization begins producing nonsense documents like the "Microsoft Security Whitepaper", something is terribly wrong. That paper is just one small example. There are many.
They're more fundamental than that. A buffer overflow allows you to execute code in ring 0 that would otherwise not be ran. This isn't the same thing as something like MS Blaster and it's ilk. Now, those were found the same way as the buffer overflow exploits, but they could have been even more easily found via an audit of the source code. Under Open Source, the code's looked at by MANY people- it's likely to be found and corrected. In Closed Source, it's not so likely and it's more likely that a code leak will result in someone else doing an audit and finding weaknesses and exploiting them.
I am not merely a "consumer" or a "taxpayer". I am a Citizen of the State of Texas
Kramer's alias is actually "A.G. Pennypacker." A, not H.
YOU FAIL IT
cheers from paris france to be base security on secrecy is a losing game all secrets become public one day or another supposedly god knows it all so all who know god have the secret in the corporations you have those with access to the secret and the others those who do not have the access upper and lower classes of employees the elite and their mass controlled by their needs and implementing a clever behavoir, understanding these needs. being successfull in business requires fulfilling these needs first in the entreprise and next with their clients small and large we must understand, that we live no longer in the united states, nor in france, nor in dollar land , nor in gi joe's land, today we live in sm\bill's ms land. So this publishing of ms source code, would put all the worlod an even chance. Publishing the code source for microsoft would be a sure way to see how much unix code is still under the hood in ms, is ibm thinking of asking a search and compare on the kernal code source . #compare ( "unix-os-source-tree" , " linux-os-source-tree, bsd-os-source-tree, ibm-os-source-tree, sun-os-source-tree, mac-os-source-tree, ms-os-source-tree" ) > sco-trial.txt;
A network of VB based smartcards just waiting for a new worm!
Unless Microsoft has implemented MLSA, which is atmittedly tough to do, or they have implemented a physically separated network for their high-value stuff (without internet access!!), they will indeed at some point see a compromise that touches their high-value stuff. Unfortunately for the rest of the slashdot-crowd, this equally applies to them as well :)
Also, I don't see any references to a document classification level system, plus the proper controls to implement them. We know for the halloween documents that they must have something like that. (The halloween documents are labelled microsoft confidential).
Moscow subway (metro) use smartcards which
go at 50 RUR/piece, 1.8$/one.
I thought the idea was to steal the source code, and port the graphical elements to Linux.
Karma: It's all a bunch of tree-huggin' hippy crap!
You worked for MS, and your website is called "The Darkside" .. dude, lead me to the borg queen.
--- Stop the world! I want to get off!
The gratuitous UI changes from one windows flavor to another are deeply frustrating. Finding a particular admin applet is like playing whack-a-mole.
:-)
That can probably be argued to be a good thing. Each major release of Windows is sufficiently different from the previous ones, I think, to warrant making it a little difficult for an admin to make the transition. That way, they're forced to actually read about the new capabilities, config options, etc, rather than just going in blind and potentially missing some new gotcha or essential option.
As I recall in NT 3.51 the hard disk management applet was easily reached. Every generation hides it deeper.
I don't know about NT, but it's in the same place in both 2k and XP - right click "My Computer", choose "Manage" - it's one of the tools in the tree list on the left.
And the default XP screen is really infantile
No arguments there. It's easily changed, though; that's hardly a reason not to use an OS, just because you don't like the default theme
It's official. Most of you are morons.
I saw the title and read "Microsoft security wallpaper"
/me changes backdrop to goatse.cx to stop hackers
I though "Yeah, just like them - now lusers will associate their wallpaper with security"
We Linux users don't phear Havoc. We have Havoc on our side helping us. Havoc is great.
>> Consipiracy Theory #234,345,234
That's my account number and password!
You must be new here, cause you ain't seen nothin' yet! It gets lower trust me on this....
Regardless of who we are talking about, they are predicting a successful attack on the largest company on the planet. And they DO know what they are talking about, they have a better idea of internal security issues then any of us here on the outside.
That's rather scary if you ask me... as that leaves all the smaller companies that cant afford to keep up wide open too..
We could see a really bad year in 04 for attacks and break-ins.. Even worse impact on our industry than the 'litigious 03'...
---- Booth was a patriot ----
its amazing with all there security things still leak out. Its been talked about in hushed irc rooms that around 8gb of source code for the xbox has been leaked on the net for over a year now. source for such interesting things as the bios, dashboard, XDK, and DirectX title libraries are floating around. Amazingly very little of it has been made openly public. the biggest leak being the X2 DVD player which is the internal media player recompiled to use the controller and ignore region.
Sure, already hacked is 100% probability of being hacked. Yep, someone in Russia got their XP source. Then M$ sold the former KGB and Communist China the whole package, despite having sworn in the anti-trust suit that such a thing constituted a national security risk. I'm not sure what they think they are gaurding, but it's true that there is a high probability that their boxes will be owned, like 1::1.
What you and I might see as a misserable admision of failure, M$ would like to push as "Bussiness as Normal". "You can't stop the hackers" they will tell you with their hands in the air as if it's impossible to keep sensitive information to yourself. This is nonsense.
There are many ways to do this including decoy data made from hashing the real data and keeping sensitive data off externally connected networks. The most important thing is to make sure there are no weak links in your chain. Real security involves understanding assets, training personel and proper network architecture.
Something as easy to own an impossible to verify, like Microsoft junk, has no place in a secure environment. Even a machine used as a decoy can be owned and used against you in ways you did not expect. If Microsoft themselves can't make it work, no one can.
Friends don't help friends install M$ junk.
The misserable failure of SCO will deter them from using this flimsy and stupid idea. It's already backfired in their face so bad that they might get some jail time out of it.
Friends don't help friends install M$ junk.
This is all funny...
Microsoft had several security incidents...
The worst thing I know of:
The complete XBOX OS+XDK Source code is traded around in the higher ranks of the xbox-scene.
The mod chip makers from xecutor even repeatetly
say on the xbox-scene.com messageboard that their
modchip bios is recompiled from leaked MS source
code...
So MS security my ass....
The complete XBOX OS+XDK Source code is traded around in the higher ranks of the xbox-scene.
The mod chip makers from xecutor even repeatetly
say on the xbox-scene.com messageboard that their
modchip bios is recompiled from leaked MS source
code...
So MS security my ass....
I replied to several commets that source code
of XBOX OS+XDK is already traded in the
underground and that some modchip makers even
admit that on the messageboards.
When you know that, it is highly unlikely that
the Windows Source Code was not stolen. People
who have it simply do not speak about it.
Go ahead and apologize for microsoft, but it doesn't help all those good/great engineers, because they still have to follow stupid executives.
If the Win2K/XP code base had been compromised fully, I'm fully sure that the code would have spread. It didn't. However the suggestion that the crackers had commit access is what is really scarey. In the case of Digital, they had to review their entire O/S source code. Remember the attempt to manipulate Bitkeeper with a change to the Linux kernel. Even though there are a lot more eyes on the code, it *could* have been a serious problem.
Q:Should I bring my umbrella on Thursday?
A:Rain could occur on any day.
Q:Which car is more reliable, a Toyota Corolla or a BMW 325?
A:Anyone driving any car can experience a mechanical breakdown.
Q:Should I drink this six month old milk in the fridge or buy some new milk?
A:Anyone drinking any milk can die of food poisoning.
Microsoft's approach to security is deeply flawed. Again and again, they made visibly wrong decisions which any experienced network programmer could see as wrong. Their permissions system sucks, for example. They thought they would be clever and leapfrog Unix - they would go from no security to fancy ACL's. Unfortunately, almost none of their customer base can figure out the fancy ACL's, and most of their ISV's are not cooperating. Unix ugo perms are already at the outer limit of what most people can understand. On a typical Unix box, the majority of files have correct permissions, and a minority have a non-disastrous error in perms. On a typical Windows box, either everything is wide open, or everything is locked down so Administrator intervention is needed for almost anything.
Both Windows and Linux contain flaws in execution. But Windows contains severe flaws in design.
If you define the top x (fraction) as "the best and brightest" and Microsoft has n employees with the same brightness distribution as the general population, it follows that they employ roughly nx of the "best and brightest." If nx > 3 I think everyone would agree that Microsoft employs some of the best and brightest. E.g. 65,000 *
Of course this assertion, like the one above, is intended to connote more than it denotes. Since you raise this alleged brightness as a defense against accusations of making bad software, you appear to argue that the software isn't really bad, since bright people can't make bad software. This seems like a curiously indirect way of evaluating products that have inflicted real-world pain on many of us.
Here is an opportunity for Linux to bring something entirely new to the table: UI consistency. The gratuitous UI changes from one windows flavor to another are deeply frustrating. Finding a particular admin applet is like playing whack-a-mole. As I recall in NT 3.51 the hard disk management applet was easily reached. Every generation hides it deeper.
I agree with the push for UI consistency completely. Open Source needs to really band to together and stop trying to 'invent' their own methods. The whole idea of Open Source is to share, and yet you see distributions and groups trying to create their own methods and NOT share them.
As for the Disk management reference, a lot of things changed in NT from then, as this was a part of the administrative consistency model added to Win2k that probably won't change for long time.
Everything you need in Win2k, WinXp, or Win 2003 is available from the MMC. From services and devices, to disk management, and effectively everything thing else that is an 'administrative' function is available in the MMC interface.
Even IIS, MS SQL, Exchange, and other 'administrative' level applications plug into the MMC. There is no longer a hunt to find any of these features.
The MMC may not be the end all of usability, but it removes the inconsistent behavior of NT4 and earlier where these features were scattered throughout the OS in different mechanisms. It also provides a standard mechanism for third parties to plug into as well, so even if the MMC interface changes, the plug ins will still work and be available.
In new OSes, you may find administrative functions moved to easier to use interfaces for novices (like the User Manager in XP), but that doesn't mean they are not still fully accessible for administrators or power users from the MMC interface.
An additional note to this is the scripting level of support that was added in Win2k for accessing all of these features. Virtually every part of the OS can be accessed via command line or GUI based scripting via the same interfaces. This is almost like a big secret somehow, everything in Windows 2k and newer is scriptable.
The concept for the MMC is superficially convincing: a consistent approach for all tasks. Unfortunately, what happens is that dissimilar functions are shoe horned into the model, rather than having a task-based approach that gives the best way to deal with a particular thing.
And the function IS still scattered. When you launch the disk thingy, it's a separate applet. It's not an MMC thing, but the only way to launch it (apart from locating the file and launching it) is through MMC. The shortcut for it is just buried in one MMC default page that is not easy to find. Sure, you can build your own consoles, but why not have that applet where it belongs?
Building pages of MMC controls doesn't strike me as a massive leap forward in usability.
I'm glad scripting has improved - that's an area I haven't explored.
I may be prejudiced; I was a contract tester for SMS 2.0 and we lost the summer's work when someone made a mid-course correction, abandoning the task-based UI for the MMC. I don't think the MMC UI was intuitive at all. Sure, it looked like other apps, but it had nothing in common with, say, Exchange. So why the same interface?
OMG ! The security groups first priority is to be "Microsoft's first and best customer", while the last is to "Run a world-class utility". Shouldn't this be the other way around? Here's an idea - why not use the best technology available? If it is not yours - look, listen and learn.
I don't make predictions, and I never will.
...that Microsoft employees have time to write up security whitepapers or anything else when all they do allday is run around cosplaying the Matrix.
Actually, it is a term from England, where the government produces rough drafts called greenpapers. In that context it, has meaning. In the U.S., it has no meaning.
And the default XP screen is really infantile - inspired by Teletubbies. You can see Po and La-la on really hi-rez screens.
You may have hit on something there.... What we need is a re-compile of clippy: M$ NooNoo to clean up the mess!