Slashdot Mirror
Microsoft Security Whitepaper
An anonymous reader writes "Microsoft last week published a document on its Web site that describes how the company manages security on its own 300,000 node corporate network. The document is basically a dry discussion of IT risk management strategy, with lots of references to 'asset classes' and 'stakeholders,' and about five, nearly identical 'cycle of life' type diagrams showing how one risk management strategy leads to the next and so on, in a never-ending process. However, the document does open a window on how the biggest, richest software company in the world does security: from the deployment of 65,000 smart cards (let's see, at $50 a piece, that comes to....?), to MS's admission that 'there is a medium to high probability that within the next year, a successful attack will occur that could compromise the High Value and/or Highest Value data class.' According to the document, that includes things such as source code or human resources data."
cause the oxymoronic nature of using MS and Security in the same vicinity... one would think it's just an all white blank sheet of paper.
wordtrip.com
they recently published the bug list too
It is encouraging to see a big security industry leader such as Microsoft make such a public display of its unwavering belief that security through obscurity is not security at all - by publishing an open document on its security infrastructure. Perhaps other large players could take a cue from this (IBM, Sun)?
-- HG Pennypacker, wealthy industrialist and philanthropist
However, the document does open a window on how...
;)
Sounds like somone needs to switch to Mozilla to avoid these annoying pop-ups!
Where does the $50 figure come from? I have two of them in my wallet (AE and Fleet Fusion) and two readers (useless on a mac) that retail for $29.99 a pop that I got for free being that I was an "early adopter". So where does that $50 really come from? And yes, I read the story, I just want to have a better handle on why someone supposedly "in the know" would trow out a figure like that for a quantity purchase of 65,000.
Who are you? The new #2 Who is #1? You are #617565. I am not a number, I am a free man! Muhahaha.
What about World Domination plans? Are those Highest Value data class? Or Really Highest Value?
I have a friend who now works for Apple, and they had training on the various classifications of stuff - I forget what any of the acronyms were, but they were pretty oddly named. I fully expected a bunch of troopers dressed in titanium and perfectly polished clear plastic(hopefully Ti in the, uh, right places) to come storming through the door to erase my brain after being told of such things.
Oh crap- maybe they DID!
Please help metamoderate.
Poor Microsoft, still stuck in the old paradigm of closed-source software. Oh sure, it's been a profitable paradigm for them, but those days will gradually erode as the trend toward Free and Open Source continues over the years ahead. Meanwhile Microsoft is stuck spending mega-bucks and lots of time trying to protect themselves from having anyone actually...gasp...see the source code. Horrors!
ROFL!
Microsoft hit the nail on the head this time! It's security is as strong as white paper.
And why did you staple the trout to the RAM?
[A] successful attack will occur that could compromise the High Value and/or Highest Value data class.
Hey, even without all the security holes this would happen! Let me re-define some terms to my liking.
A successful attack: Linux on more machines.
High Value data class: Microsoft's stock price.
Highest Value data class: Bill's bank account.
See, if you twist a quote out of context, it can mean whatever you want!
Long live Schrodinger's cat...
Perhaps you forgot about the compromise of kernel development servers and the Debian website?
Microsoft's concerns regarding source code are likely less about preventing someone from SEEING it (you can pay them money to look at code) and more about modifiying it.
Open Source is a wonderful thing -- but it isn't a silver bullet. Sophisticated programmers with access to any source repository, open or closed can create all sorts of havoc.
Conformity is the jailer of freedom and enemy of growth. -JFK
Of course, that's a risk to Microsoft's customers, so that may not be considered as critical.
To make a long story short, this document is an "Emperor's New Clothes"-style piece of PHB-speak/business-speak/market-speak/PR-speak that nobody really understands, but every business IT strategist that reads it will pretend that its meaning is very profound, like the emperor pretends to see his nonexistant clothes, to avoid appearing stupid to colleagues.
Microsoft. Where do you want to go today?
Have you considered that the masses should actually be protected from Microsoft's source code ? You wouldn't want your neighbours to become stark raving lunatics after having been confronted with the lovecraftian abomination that is Hungarian Notation, would you ?
Trust me my friend, there exist Code Man Was Not Mean to Read. Microsoft is dutifully protecting reality as we know it. We should be thankful.
How can they afford the all the Licenses?
This is the same company that said, under oath, that reveling the windows source code would harm the National Security of the United States, then they gave the source code to China.
Isn't that perjury?
I do believe the issue isn't just code compromise (i.e. putting back doors in...), but in the case of the closed source, finding exploits and backdoors. I need only point to the rationale that MS gave for not disclosing pieces of their source code- it would endanger National Security. Now, either that was a dodge, in which case, Allchin should be doing time in at least Club Fed for lying to a Judge, or it's the God's truth. If it's the God's truth, being in the open is going to reveal most of those things and get them zoomed right off the bat- if it's closed, only the people working on it know about the code (well, and anyone that manages to see it without them looking...) so you don't have as many people looking over the code in question so you end up with things like MS Blaster which caused a packet storm from Hell on the Internet.
I am not merely a "consumer" or a "taxpayer". I am a Citizen of the State of Texas
Did any of the idiots commenting on this story with sophmoric (hehe, M$ security sUx045!) even start to read the Whitepaper?
If they did, they would probaly notice that the paper describes a methodology of security management, including dealing with operating system & application security issues.
Information security is more reliant on process than using x product or y product. If you have established methods to classify what needs protection, identify vulnerabilities & intrusions and rectify the situation, you have a secure IT shop.
Conformity is the jailer of freedom and enemy of growth. -JFK
.....and about five, nearly identical 'cycle of life' type diagrams showing how one risk management strategy leads to the next and so on, in a never-ending process.
:-)
Hrmmmm. Kinda like their upgrade cycles.
Visit Jonesblog and say hello.
Ok without putting in some microsoft bashing statement I have to say Im horrified at the idea that Microsoft admits in their own white-paper that they might be compromised on the highest level. Screw source code, what about automatic "updates" (They have been in the past few months especially promoting their automatic-update software, and it is expected within the next few years to be a binding part of their EULA, but even now I know for a fact most users will chose to let windows download selected updates automatically)? The same company millions are trusting to push updates unknown to them to their computer is admitting they will probably be compormised within the next year??? Does this not shock anyone? It would take next to nothing with access to their automatic update ability to wreck havoc on millions of users, imagine delete IE, and then their update system (after uploading the update itself) and 99.99% of all the users would be toast! this is serious stuff, we're talking millions of users potential take over at the hands of a script kiddie....and its glossed over in some security white paper? You have to be kidding me, where is the whole Homeland Security Department? NSA? DoD? who always seem to want to stick their noses in everything else done in the IT world? A company convicted of monopolizing the OS business now without skipping a beat making statements in a security white paper such as "There is a medium to high probability that within the next year, a successful attack will occur that could compromise the High Value and/or Highest Value data class." and "robability: High. Even with current controls, attacks have occurred and will likely happen again."
What's another word for Thesaurus?
-Steve Wright
I know when the BeOS source was leaked, every smart programmer stayed away from it - else be blamed for stealing 'IP'.
Consipiracy Theory #234,345,234: MS deliberately leaks the source to some EOLed code such as Win 95 or NT, and sues anyone who is making inroads with alternate OSes or applications, such as Linux, Mozilla, Open Office etc.
What fun! No doubt, there will be no need to show their code for National Security reasons. We'll just need to trust them.
It's easy for them to afford 65,000 licences.
The sell them to themselves as a loss. Therefore using them as a tax deduction twice - once for the loss and once for the cost......and if the loss is great enough they might even make a profit!
"Microsoft last week published a document on its Web site that describes how the company manages security on its own 300,000 node corporate network." Does this include the policy, "Do NOT patch MySQL servers, so we can get infected by the Blaster Worm again."
It amazes me that most of you really can't be constructive at all any time 'security' and 'microsoft' are uttered together.
What's more, the moderators encourage this lack of constructive talk by modding up things purely because they decry microsoft. How many days in a row are we going to hear the same old tired MS jokes?
Just because you run linux/bsd doesn't mean you're safe. Hell, by being connected to the internet at all you're at risk. Anyone with enough time, education and willingness to exploit you is going to eventually find a way in.
Anyone running any operating system can be attacked and comprimized. Security is only as good as the people who maintain the machines. You people sometimes seem to forget that despite MS's faults, they do employ some of the best and brightest in the world. I imagine some of you may not believe that, but I do.
Personally, I think that if linux were a home desktop platform that had enough popularity to be a significant enough player in that market you'd be seeing a whole lot more hackers focusing specificly on linux. Realisticly, what is the point of trying to exploit linux? Why exploit the little guy when you can go after the big fish? Especially when the majority of people running the big fish's stuff couldn't secure _any_ box to begin with, regardless of what it was running.
Same thing with the mac. I love it when macos users say "I never get viruses/worms!" well, who would write a virus/worm for such a miniscule percentage of computer users? The whole point of a virus/worm is to propigate, and if you don't have the userbase for it to propigate well, what's the point?
I apologise if I've offended people here, but I really felt this needed to be said. This persistant catscrap between linux and windows users doesn't help anything, or anyone.
Linux/BSD ARE good operating system
MacOS/OSX ARE good operating systems
Windows IS a good operating system
and they ALL have faults.
BeauHD. Worst editor since kdawson.
A quick Google search ("russian hackers microsoft") comes up with:
0 52.txt
http://www.newsmax.com/articles/?a=2000/10/27/180
There's tons of others. It made a big splash on the tech news circles- and then was apparently promptly forgotten for some unknown reason. Strictly speaking, MS has already had one of their critical breaches they talk about and they couldn't have instituted a scheme like they're talking about in the timeframe from when this was discovered to now (i.e. It pretty much had to be in place or largely so because of the scope and scale of the effort in question...).
I am not merely a "consumer" or a "taxpayer". I am a Citizen of the State of Texas
The quote from the article (There is a medium to high probability that within the next year, a successful attack will occur that could compromise the High Value and/or Highest Value data class) is being taken out of context. The white paper was giving an example of how an assessment is made to justifiy the "IPsec project." It seems pretty clear to me that if MS published this article saying they were vulnerable in this area that the project was approved and completed, thus eliminating the threat risk in this area. RTF White Paper.
Remember... ZG9uJ3QgZm9yZ2V0IHRvIGRyaW5rIHlvdXIgb3ZhbHRpbmU=
Thank you! I too tire of the 'ms sucks' posts.
I work with MS once and awhile to get a bug fixed. Like ANY major software out there they have bugs just like the rest of us. Worked with a nice gentleman yesterday. He traced through their code for me. I have done if I had the code. But its their code, and I respect that. They were looking into why an API I use in my code changed after a 'security' hotfix. After an hour of tracing he found that it was wrong. I knew that, but thats ok too, he had to prove it to himself. After all that he told me 'if its a security hotfix it will not be fixed your lucky the code ever worked the way you were using it'. He was right, I knew what they had done and its a good thing.
The moral here? They are deadly serious about security. They will not back out a fix just 'cause'. They are fixing the holes that are there.
I am convinced they are enduring some of the most punishing testing on the face of the planet. To use a term from open source, 'many eyes make all bugs shallow'. They are on a much larger number of desktops then any other OS out there.
I have never found them 'arrogant', 'loud mouthed', or 'bullying'. Like I find on slashdot sometimes about open source. I have found them to bend over backwards to fix ANY bug they have. They do not pounce on it. But they DO fix it. They do not 'hack' it into the code. They test it and make sure its good. If you act like an ass to them they respond in kind. They have THOUSANDS of bugs to fix and they have prioritized them. They only have so many 'core' developers and they are trying to write new stuff and retrofit old stuff.
They have a serious challange. The code is basicly done. They now have to go through it ALL and fix things that were never a priority for them. I would cringe at someone coming up to me and saying my code has the same serious problem in every module, and every function. That is basicly the problem MS has. And making the code 'open source' would make the problem better in some ways, but much worse in others. Also would you want them to rush out a fix for something? Or test it and make sure it works? Also if you want top shelf support out of MS you need to talk in the language of the corporate world. You need money to wave at them. Otherwise get in line with the thousands of other people.
Also do not be fooled by that linux has no 'serious' bugs. They exist, can you say 'root kit'. If you belive that linux is secure by default your living in a dream world neo.
I look at the two systems as tools for me to do things. I have both types of boxs. I use both for many things all the time.
and the interface that only a 3 year old Teletubbies addict could navigate through, Microsoft Windows XP!
:)
Oh get over it already. It doesn't take 20 scripts and ten screens of typing to make an OS powerful or functional. Some 'power users' actually like the idea of using a couple of clicks to print photos or play music with the OS UI model.
This reminds of DOS/UNIX people bashing all GUI interfaces in the 80's.
Are we really back to the days of using words like WIMP and telling everyone that GUI's are inherently bad, or are we just saying that ones that are easy to use are bad?
The open source world needs to learn a little about UI consistency and try to make things easy to use if any Open Source OS is ever going to be taken seriously on the desktop or in the home.
(And don't bring OSX into this as a champion of Open Source usability - it is not Open Source.)
PS *cough* Windows95 was NEVER designed to be a secure OS, it has NO inherent security, just like Mac System software did not as well. People forget it was a consumer OS and was designed in a time of the early internet where massive consumer connectivity via the internet was not something that was happening in the home markets.
Back then, there were things like CompuServe, AOL, and the new MSN, and at the time AOL had just recently added the ability to browse HTML, MSN was a folder based browsing service, and CompuServe was a text system with a new GUI that made it look pretty to interpret the text interface.
Most people had no clue about ISPs, especially when Win95 was being designed in 1993-1994.
If you want to talk about Microsoft's security track record, pick on something like NT, which in 1996 was far more stable and secure than even Linux of 1996. (With both being about the same age)
Oh, and by the way, have you ever heard of cars being recalled? Almost EVERY Model and Make of car has had at least one type of recall that has required dealer service. Don't believe it, go look up whatever you are driving, there will be a list for what has been a 'required' and a 'requested' recall for your car. - At least if Windows fails it doesn't kill you. (And if you are driving a Ford Truck or a Pinto, you REALLY might want to take a look at your vehicle recall list)
Not to sound old fashioned, but I wonder if using several large systems and dumb terminals would help lower costs and problems?
This was the standard motto in the early 80's when pc's were considered toys.
But 300k nodes sounds like an administrative nightmare.
I wonder if we would all be using network computers and thin clients now if MS never existed. They put all sorts of fud and raised the price of client licenses of terminal servers to make it look like a pc, in every desk was cheaper then a windows terminal.
http://saveie6.com/
And don't you forget that. Microsoft DOES have people with considerable technical skill and knowledge. I'm guessing that the probability of a security breach was calculated by the people who know what they're doing.
The problem is that you don't get to be the biggest software company in the world without selling products. (And Microsoft is arguably the most important software company - although I think overall Linux is more important in it's potential as an equalizer - there is no one single Linux company).
Selling products implies marketing. This is where it goes wrong. The second that product development is driven by marketing telling customers what features they want - things explode. I mean, really - half the crap in Windows and Office was never wanted by customers in the first place.
I'd still prefer to be using BeOS (I loved 5.0, but lack of support for new hardware meant I had to move on), so Windows 2000 is a pretty good compromise for my needs.
Except that you forgot to mention that the "compromise" of the kernel never happened and the Debian compromise was a password issue and again nothing serious happened.
The difference between open source and closed source is that due to open source being so open the developers on it tend to trust no one. Closed source projects tend to be a little more lax because the closed nature of the project makes it easy to get sloppy.
Nobody uses Microsoft technology like Microsoft. Unfortuately, nobody uses Microsoft technology like Microsoft.
The reason? Only Microsoft has the source code and "really understands" Windows. Everybody elses corporate networks running Windows are dogshit -- but Microsoft really does just use the crap the way they tell you to use it, and it works wonderfully. Unfortunately, they are the *only* example of such a user on the planet!
damn, 300,000 desktops, 4200 servers. holy crap, they hvae to pay a ton in license fees. i wonder if they have looked to open source alternatives. well, maybe they bought software assurance.
My problem? I was perfectly gruntled, until some numbnuts came by and dissed me.
During the original Code Red incident, for a short time, the Windows Update webpage was showing "Hacked by Chinese Worm".
(There was concrete evidence of this but unfortunately I don't have it.)
Here it is.
...of a High Value attack being reality instead of taking the pompous approach that your software is hack-proof. I can find 10 ignorant Linux users who think their system impregnable for every Microsoft user who thinks the same. At least Microsoft is willing to admit that yes, sometime in the future, shit is bound to happen.
For some reason you wrote:
"Realisticly, what is the point of trying to exploit linux? Why exploit the little guy when you can go after the big fish?"
Apache is the single most prevalent web server on the internet. Why then is it that hackers "target" IIS? Maybe because it's easier?
and decided to continue:
" they do employ some of the best and brightest in the world. I imagine some of you may not believe that, but I do."
Have you seen Balmer lately? The problem with working for MS is that, even though you may be smart your just wasting your time. Who cares that you can give a lecture on some brilliant way to link corporate data to business users if your entire architecture needs to fit into a proprietary MS 5 year plan for the enterprise?
MS has had 20 years and billions in funding and the best they can come up with is Windows XP. XP solves problems that Unix, Apple, X, NeXT, Amiga, et als. solved a decade ago. MS produces over architected under engineered gaming consoles that are'nt even compatable with themselves.
If your looking for "fair and balanced" where are you going to go? Read a frigin Windows rag if you want to "balance" Slashdot. I'm sure there are plenty of fine articles on .NET just waiting to provide you with hour of fun filled and objective learning experiences.
Kind Regards
"A few great minds are enough to endow humanity with monstrous power, but a few great hearts are not enough to make us w
"Microsoft Security Whitepaper"
Seriously, what is a "whitepaper"? This is not a troll. I have no idea what it is. Is it an article? I know what a "paper" is; what is the significance of it being white? Are there blackpapers?
Oh Great Slashdot Oracle, I, your humble follower, bow before you, please hear my question.
What is the difference between the kind of ideas that are in a whitepaper, and the kind of ideas that are in a paper? Are the whitepaper ideas whiter? When you are having white ideas do you consciously avoid negative thoughts?
If there were a "Microsoft Security Blackpaper", what would it say? "Ohmygod, we've had years of pushing out product before the programmers are really finished with it. Now we a sitting on a mountain of sloppy code. We have no hope of finding all the vulnerabilities."
The wording here is really a bit too strange and not like a normal Microsoft attack. First of all anybody with any knowledge of history would put the "rock solid" joke on ME, not 95. And I never heard the "just for ME!" line before, in fact this is pronounce emm-e by every Microsoft hater. Though the background of XP is obvious teletubbies appearance, most Microsoft haters attack the candy-coloring bubbles which don't resemble Teletubbies scenery much at all. And "the radiator would dislodge?" How about "when you go over a bump it would stall" or otherwise do an obvious failure.
It should be obvious that Microsoft is setting this up. They want to attack OSS on security. Their plan is to put a hole or exploit into the code by compromising some system to infect the code. Possibly this has been caught three times now, but there may be a missed one already planted, so everybody check carefully! Notice that they plan to announce this "security" stuff apparently in sync with 2.6 being released.
The far easier way to plant a hole in Linux would be to pay off or threaten some developer to do it. However they cannot do this because of the obvious fact that this can be done to one of their employees as well. They have to do it by "hacking" and they need to print this paper to show that they are extremely well-protected against "hacking", while open-source is "vulnerable"
The several posts like this, which seem out of character (ie treating Microsoft as childish rather than a threatening if clumsy evil), I think are planted. They want to point out that this coming failure of open-source has nothing to do with the security of the software on your desktop, but everything to do with the fact that people can work on the code.
"The open source world needs to learn a little about UI consistency and try to make things easy to use if any Open Source OS is ever going to be taken seriously on the desktop or in the home."
Here is an opportunity for Linux to bring something entirely new to the table: UI consistency. The gratuitous UI changes from one windows flavor to another are deeply frustrating. Finding a particular admin applet is like playing whack-a-mole. As I recall in NT 3.51 the hard disk management applet was easily reached. Every generation hides it deeper.
And the default XP screen is really infantile - inspired by Teletubbies. You can see Po and La-la on really hi-rez screens.
When I was a contractor/whore a colleague in development showed netstat connections from the PRC, where MS had no development. Not in our project, anyway.
Totally owned. MS netsec had no interest. The report impugned their competence. I have no idea if things are any better now. Maybe there was a shakeup after Code Red infected the very web servers that distribute patches for us all.
You'll be getting a letter from Direct TV's lawyers Monday morning.
"It's the height of ridiculousness to say for those 9 lines you get hundreds of millions."
They're more fundamental than that. A buffer overflow allows you to execute code in ring 0 that would otherwise not be ran. This isn't the same thing as something like MS Blaster and it's ilk. Now, those were found the same way as the buffer overflow exploits, but they could have been even more easily found via an audit of the source code. Under Open Source, the code's looked at by MANY people- it's likely to be found and corrected. In Closed Source, it's not so likely and it's more likely that a code leak will result in someone else doing an audit and finding weaknesses and exploiting them.
I am not merely a "consumer" or a "taxpayer". I am a Citizen of the State of Texas
Cheers from paris france!
,
.
To base security on secrecy is a losing game.
All secrets become public one day or another.
Supposedly god knows it all.
So all who know god have the secret.
In the corporations you have those with access to the secret
and the others those who do not have the access.
Upper and lower classes of employees,
the elite and their mass controlled by their needs,
And implementing a clever behavoir, understanding these needs.
Being successfull in business requires fulfilling these needs,
first in the entreprise and next with their clients small and large.
We must understand,
that we live no longer in the united states,
nor in france,
nor in dollar land
nor in gi joe's land,
today we live in sm\bill's ms land.
So this publishing of ms source code,
would put all the worlod an even chance.
Publishing the code source for microsoft would be
a sure way to see how much unix code is still under the hood in ms,
is ibm thinking of asking a search and compare on the kernal code source
#compare (
"unix-os-source-tree" ,
" linux-os-source-tree,
bsd-os-source-tree,
ibm-os-source-tree,
sun-os-source-tree,
mac-os-source-tree,
ms-os-source-tree"
)
> sco-trial.txt;
sorry for wasting the bandwidth!
This is a test!
Unless Microsoft has implemented MLSA, which is atmittedly tough to do, or they have implemented a physically separated network for their high-value stuff (without internet access!!), they will indeed at some point see a compromise that touches their high-value stuff. Unfortunately for the rest of the slashdot-crowd, this equally applies to them as well :)
Also, I don't see any references to a document classification level system, plus the proper controls to implement them. We know for the halloween documents that they must have something like that. (The halloween documents are labelled microsoft confidential).
Regardless of who we are talking about, they are predicting a successful attack on the largest company on the planet. And they DO know what they are talking about, they have a better idea of internal security issues then any of us here on the outside.
That's rather scary if you ask me... as that leaves all the smaller companies that cant afford to keep up wide open too..
We could see a really bad year in 04 for attacks and break-ins.. Even worse impact on our industry than the 'litigious 03'...
---- Booth was a patriot ----
Buffer overruns have been well understood for years, are easy to automate tools to search source code for and any that leak through are easily tested for
If you think buffer overruns are a Microsoft OS only problem, you have no idea what you are talking about.
I've heard (and mine) are about the damned cartoonish color scheme and the total waste of screen space in each and every window that dosn't add any functionality to the GUI itself.
And the funny thing, you can turn on/off what level of extra functionality you want in the GUI, even the Colors. In fact you can skin it to look like a MAC if that is your bag (using a simple UI patch)
As for the added functionality, have you actually ever looked at the items in the sidebar of an open folder? There are a lot of quick features available for novices and even power users that like to be able to click "Play Selected Songs 'Albums' " and just have the songs play.
And if you are real power user that needs the screen space, just turn off the side bar, these features are also available from a right click even if the side bar is off.
Maybe Microsoft is foolish in assuming that users have displays greater than 640x480 and are using the extra screen space to add functionality, but then again, maybe it is time for some people to get a new monitor. 1024x768 is becoming a minimum for desktop real estate. Even my laptop is 1600x1200 and it a year and a half old.