Slashdot Mirror
Ask Microsoft's Security VP
There's always lots of discussion on Slashdot about Microsoft's security problems, and whether Windows is or isn't more secure than other popular operating systems. In a "Let's clear the air" move, Mike Nash, Microsoft Corporate Vice President, Security Technology Unit, has agreed to answer 12 of the highest-moderated questions you submit here. (You can skip the "Microsoft and security in the same sentence?" comments we've all heard 1000 times, and ask actual questions, since Mike is answering for himself instead of having PR do it for him.) We'll post his answers next week.
Besides the same old PR scripted answers that corporations like to give in order to obscure or downplay what is really going on. What assurance can you give us that Microsoft is more focused on security and that Vista is going to be any different from the previous incarnations of Windows? What proof can you give us? Information like "We have a new team doing X" or "our process for reviewing changes has gone to X" are helpful pieces of information to answer this question. What else have you seen in the way MS is developing Vista that is different from how you've developed previous products?
From what I've heard, even though most of Vista is being rewritten from the ground up with more scrutiny on what code goes into it, it will still have major flaws generated by the way Microsoft works internally as a company.
Are you afraid that if Microsoft Security isn't greatly improved in Vista that a chair will be thrown at you?
"A government is a body of people, usually notably ungoverned." - Shepard Book Quoting Malcolm Reynolds
Mr. Nash, what are the greatest differences and similarities between Microsoft Corp. and Data General Corp., your two most recent employers? Most importantly, how drastic were the changes you saw (not necessarily changes due to job function but changes in general)? What do you like the most and what do you hate the most?
My work here is dung.
What is the Windows / Internet Explorer design decision that MS does, from a security point of view, regret most?
Did the WMF Patch now set a standard that severly high risk problems will be patched out of the standard patch Cycle? How did Microsoft come to the conclusion that is was important enough to go against what it promised it's corporate customers?
My new title at the office is "Vice-President of Everything Else"
As a Microsoft product user, it has always made me wonder what the User:Bug ratio might be. Do we see more bugs found BECAUSE more users are using a product?
Has Microsoft tracked the "security bug" to user ratio on their products and found that products with fewer users seem to have fewer bugs? If that is the case, I wonder if it is the normal process of higher supply leading to more people spending time looking for bugs.
It is like the population:innovation ratio -- as a population goes up, the amount of innovators being born goes up, too, leading to more innovations.
Is there a general policy within Microsoft to help product teams make consistent security decisions? There are frequently issues where the decision has to be made between being more secure or more user friendly.
For example, file and printer sharing defaulting to off prevents people from unknowingly sharing their resources, but requires non-technical users who do wish to set up a small network to know more about the process than in previous versions.
Given that security is a major topic on IT manager's minds these days with security flaws and patches practically making front page news of some publications, What do you feel is going to be the main focus for security in 2006 for yourself and the industry as a whole?
Has open-source software such as Linux influenced the way you think about security in Windows, and if so, how?
12:50 - press return.
Did you honestly expect to get 12 serious questions from a group like slashdot?
Does Microsoft lean more towards rigidly enforced coding standards as a way to prevent exploitable bugs, or does the company focus more on brute-force bug detection during testing?
I know the easy answer is to say "both, of course" but a 50/50 split is unlikely. So, does testing take the backseat, or does the code?
This space for rent.
Hello, Mr. Nash.
I'm from China and I was wondering [remainder of message censored by People's Center For Internet Enhancement - Powered by Microsoft]
Certain open source projects such as OpenBSD have routine audits of the software to search and remove potential security problems. While I understand Microsoft Operating Systems are very complex Microsoft does have an enormous amount of talent and resources at its disposal. Is it possible that Microsoft will review all new operating systems in the future with the same sort of audit performed by others? Wouldn't you think this would be worth it to prevent mistakes which could be costly to end users?
Quality Hosting e3 Servers
The XP Embedded version can be created with or without IE or WMP, but I don't know how many DLLs have chunks of code designed to launch or provide IE or other MS product functionality (designed to give Netscape Users "a jarring experience" in the words of a Microsoft person). Is Microsoft ever going to sort and layer things so that there will be an isolated kernel, application layer, GUI, device drivers, (and if so, when), or is "Windows" going to continue to integrate things, e.g. "The Spreadsheet and Editor are now 'part of the operating system'"?
Rationale: Many security problems are due to everything running as Administrator, with privileges, or as part of the OS. One thing I like about GNU/Linux is that each part is separate, so Firefox runs on X which runs using services, which runs using the kernel, with only the kernel having privileges. Generally a buffer overflow problem in X, or Apache doesn't let someone format my hard drive. Also you can put something to analyze or intercept things between such layers - even things like ltrace or strace.
Dear Microsoft Security VP:
I know a person who doesn't have his copy of Windows registered. His PC got infested by spyware, so my deduction is that his computer was probably used to send SPAM, spread viruses and whatnot. When He called me for tech support, I told him to download the Microsoft Anti-spyware from Windows update, but his answer was that it required a registered copy.
My question is this: If Windows updates make the Internet SAFER from hackers, spyware and viruses, why limit them to registered copies of Windows? (IMHO this is analogous to not giving the vaccine of the bird flu to illegal aliens)
What do you plan to do about this?
On January 17, 2002, p. 1, the New York Times reported, "Stung by Security Flaws, Microsoft Makes Software Safety a Top Goal" and quoted Jim Allchin said "Every developer is going to be told not to write any new line of code until they have thought out the security implications for the product" and that "the company was trying to change the culture of its software developers, who have been putting their emphasis on adding features to the company's software to increase its value."
In your opinion, has Microsoft succeeded in changing its culture so that every developer now considers security first, features second?
"How to Do Nothing," kids activities, back in print!
As a Service Desk manager and network guru for my organization, I am responsible for ensuring that all workstation desktops are kept up-to-date and secure. Currently, Microsoft releases patches once a month, usually on the second Tuesday of the month.
With the current advances in smart viruses and malware, that release schedule seems unrealistic. OS security threats have been addressed with emergency patches, but that does not seem like a sustainable methodology.
What is Microsoft's long-range vision on OS patches to ensure that our Server and Workstation Operating Systems are secure, safe, and patched in a timely manner?
Management is doing things right; leadership is doing the right things. - Peter F. Drucker
I'm honestly not trying to troll here, but wouldn't it be easier to rewrite IE from the ground up? Have you guys considered this and ruled it out, or have you just not contemplated it. Not to vaguely bash microsoft, but a large percentage of PC and/or Windows power users would probably consider Internet Explorer 6 a write-off. Any thoughts?
I realize that Microsoft cannot control what 3rd party software does, but will Microsoft's applications and games run under a limited account, or will they still need Admin access?
Slow down, cowboy! It has been 4 hours since you last posted. You must wait another few hours.
Mr. Nash,
In regards to spyware MS has already taken some steps to try and stem the flow (asking about running exe files, the Spyware Removal Tool, etc), however as a consultant I find many of my clients are still infested with the stuff. From my perspective it appears that many users are affected still by these programs and that they are either unaware of how to prevent them in the first place, or how to get rid of them. Many times it is significantly faster and easier (and in some cases, safer) to just format the machine in question and start from a clean slate. Does MS feel that spyware is still a major problem, and if so, what new measures MS doing in order to combat it?
Regards,
Petyr Rahl
Many users still don't understand the importance of creating user accounts instead of using the default administrator account. Will Vista work "out of the box" in a manner that will encourage those who are not technically savvy to work under a user account instead of an admin account?
There are a number of industry best-practices that any system administrator will tell you are vital for proper security. I will not claim to provide a complete list, but the two that seem to have the most frequent effect on an OS's percieved security are:
Windows has been steadily improving on the first point, but the second point has long been a problem for administrators; there is no generally-used near-transparent way for a program to request higher privileges, for instance.
Worse, many third-party (and, for that matter, some Microsoft) programs will fail silently or with obtuse errors if you run them as less-privileged users because they demand the ability to, say, write to system areas - often without warning - and require heroic gymnastics by administrators to resolve (if a resolution is even possible).
Is this issue of least-privilige being difficult to acheive being addressed in future versions of Windows? What changes can we expect to come down the line soon and in the near future?
This flies in the face of science.
Why is there no way to submit easily reproducable and verifiable bugs other than by snail mail to a generic address, or worse, opening (and paying for) a support case?
And why does the phone number on this "report a bug" page:
http://support.microsoft.com/gp/contactbug
call a generic technical support & sales line, which ultimately will tell you that you must either open (and pay for) a support case, or submit your bug by snail mail to 1 Microsoft Way?
Is it Microsoft's stance that the inability of its users to report bugs makes its OS more secure?
-Tommy
"I got a half gallon of Jack, and 2 dozen Ant Traps. I'm about to get wild." -me
When Microsoft added a firewall to XP, it was a since first step; but why was the decision made to have it only work in one direction? Surely, a better solution would have been a firewall that worked for not only incoming packets, but for outgoing as well? And as a followup: why not add that functionality?
How is it that OpenBSD is able to be so secure by design with so few resources and yet all of Microsoft's resources cannot stem the tide of security problems that impact everyone, including those of us who do not use Microsoft programs?
"Every decent man is ashamed of the government he lives under." - H.L. Mencken
Why are you adding in DRM controls to Vista that regular users are not going to want? It may come in handy for corporations wanting to control their documents, but I can't see how regular users would knowingly want a product that restricts their access to their documents or files.
Also, I think you could dramatically improve security by decoupling Internet Explorer from Windows. Have it be a separate program similar to Opera, FireFox, Safari, etc... Is there really a valid reason that Windows Explorer has to be driven by Internet Explorer?
As a windows desktop administrator since the bad old days of 95 and 98 I have to give you guys some credit for how far you've come; however there are two issues I'm faced with that continue to be problematic - user rights and security auditing.
Despite whatever SU-like features you have, on XP I still can't reliably install, or in some cases even run(!), programs under restricted user accounts, forcing me to give most of my clients admin accounts and just hoping for the best. How seriously do you treat this issue and what work is being done towards getting an OS that can be used in the real world with restricted user rights?
Auditing - finding, say, if user X has any write rights anywhere on a server, who has done what on the system in the past day, what files were modified by a program's install, etc. all these things are do-able but not easily, and not using just MS supplied tools. How about a toolset for administrators that give us (especially the part-time admins like myself who don't just live and breath security) easy access to the reporting, auditing, and security tweaking we need to do our jobs well. And no, configuring and interpreting the security logs in the event viewer doesn't count as an easy to use auditing tool.
closed minded is as closed minded does
What modern, in-use, server operating system do you consider the most secure one available today? I'm talking about one along the lines of Linux (name the distro), OpenBSD, Mac OS X, Windows, and so forth. How about a desktop operating system?
Please name a specific answer for both questions, and please don't name something useless like DOS. Your answer must be something that a sane network administrator might choose for an internet-connected server and desktop deployment.
Separately, do you think that Mac OS X is a more secure _desktop_ operating system than Windows XP? Obviously there have been far fewer worms, trojans, and viruses for OS X than Windows. Is that really solely due to OS X's lesser popularity, or is it truly a fundamentally more secure system?
If you think Windows XP is more secure, why? What security features does it have that OS X doesn't?
This space intentionally left blank.
Does the creation of an antispyware tool by Microsoft mean that your team has failed in their role of creating secure software?
Why hasn't Microsoft added AES to its SSL stack yet? As a Microsoft developer, it's annoying to get beaten over the head when facing competing solutions that can use the AES (128-,192- and 256-bit) encryption algorithm in their SSL implementations.
(OpenSSL - including the Mozilla browsers - and Java SSL have all had AES support for a while. Most SSH implementations have also had it for a while.)
By now, many of us have heard about Singularity, Microsoft's research OS with its ultimate goal of dependability (in which security plays a very large role). How does Singularity fit into Microsoft's long-term security and operating system goals? Will Microsoft eventually adopt Singularity and its inherent security? Will Microsoft adapt the concepts of Singularity to its current NT-based OS structure? Is there a third option coming down the pipe?
"Times have not become more violent. They have just become more televised."
-Marilyn Manson
Hi, Mike,
I have just one question for you. Why do we STILL ship products with KNOWN security issues?
I'll even tell you how it works in the trenches. Folks build the product. At the end of it all a "Security Push" gets declared. For two to three weeks people pretend they care about security by coming up with potential security issues and assigning DREAD+VR scores to them. Then management arbitrarily sets the "bar" below which we don't fix potential and real security issues. This bar is usually very high, sometimes at around 8, because hardly anyone has time in the schedule to fix all issues found. Now, DREAD score 8 means that flaw will affect a ton of customers and cost Microsoft significant litigation. Some of very severe bugs slip under the bar just because they don't affect more than 10% of customers. Now, even this exercise is a joke, because most developers don't know what DFD is and how to put one together.
This wasn't even the most ridiculous part of the exercise. The most ridiculous part is security "code reviews". It's when feature owners walk into a room with a huge stack of printouts and pretend they can be reviewed in a couple of hours they've allocated for this. You can barely glance through this much code in this much time, 90% of security issues remain unnoticed during this "code review".
After all is said and done, product is only slightly more secure (SOME of the most ridiculous things have been fixed), and management gets delusional saying that product is now Fort Knox secure.
If you ask me, that's abomination, not a proper security process. Are there any plans to change it?