Slashdot Mirror
How Microsoft Fights Off 100,000 Attacks A Month
El Lobo writes to mention a ComputerWorld article about Microsoft's battles with the Hackers of the world. The software giant fights off more than 100,000 attacks every month, protecting their data-heavy internal network from the paws of your average script kiddie. The article discusses Microsoft's 'defense in depth' strategy, and discusses just some of the layers in that barrier. From the article: "The first layer of protection for the Microsoft VPN is two-factor authentication. After an infamous incident in the fall of 2000, Microsoft installed a certificate-based Public Key Infrastructure and rolled out smart cards to all employees and contractors with remote access to the network and individuals with elevated access accounts such as domain administrators. Two-factor authentication requires that you have something physical, in this case the smart card, and also know something, in this case a password."
So, who's doing the other 99,999 then...? :)
THE HONOUR OF THE KNIGHTS - CC Licensed Sci-Fi Novel
Thanks for passing all those protection and security measures you develop to your customers! Wait a tic...
Invexi - a Phoenix, AZ based web design and web development company.
They probably just run linux...
I thought the first thing you were supposed to do to protect against attacks was to ensure you aren't using Microsoft products in any part of your infrastructure...
Honestly, my own computers fight off thousands of "attacks" a month, if you lower the bar enough. Are there worms knocking on port 137? Or are these actual hackers with stolen passwords/passcards?
I wonder how they got to the 100,000 number. If you count port scans and IP spoofs then my home network sees thousands of attacks every month.
The software giant fights off more than 100,000 attacks every month, protecting their data-heavy internal network from the paws of your average script kiddie.
If MS is using the routine fuzzy-math they tend to throw out when attempting to make the company seem more powerful and dominating than is backed up by reality, the '100,000 attacks' could be 99,999 pieces of spam email and one ping-flood.
See, this is how MS routinely tries to brainwash Joe and Jane consumer. Toss out a statistic that is impossible to verify, along with just enough verbal imagery to impress non-tech savvy spenders and you're on your way to profitsville!
'data-heavy internal network...' That is some pretty shiny bull-shit, by the way...data-heavy! As opposed to what? I can see those steel grey towering industrial strength routers, embedded into solid concrete bunkers, laced with 50 cm MIL spec reinforcing bar that is tied deep in bedrock, far below the cavernous data centers the brave MS engineers toil without end to feed, with miles and miles of 1 meter thick ethernet cables, snaking like giant blood veins, throbbing quietly as the beast that is MS R&D works around the clock for the good of mankind.
Makes me proud to be an American, I 'tell ya!
funny you mention that - all outbound internet traffic from Microsoft's internal network goes through...
wait for it..
Microsoft ISA Server.
There may be other stuff out in front of that, but I have no evidence that there is.
I happen to dislike ISA server - because all of my traffic to the outside world goes through it, and if i notice it, its because it did something i didn't like (like forgot how to resolve hostnames - that's pretty common). I used to complain about it every day.. i'd say stuff like "ISA server makes me want to quit my job" or "maybe i could buy a 28.8 modem and get reliable fast internet access while at work). But, ISA server has gotten a lot better and the # of times a week I curse my existance has gone way down. I'll complain to co-workers that "there is no excuse for this - i've run Squid before and there are never any problems", but to be honest, i've never run a squid cluster with over 100 nodes serving over 100,000 PCs, so its not precisely apples to apples. And i've never put pre-production Squid code into a production environment -- which is exactly what we do with everything we make. My inbox has been on beta exchange for months, and over half the domain controllers here in Fargo are running Longhorn server builds.
Same thing with wireless. We deployed WPA before most of the outside world had heard of it. Internally, it was the only way to get wireless at all. If your device didn't do WPA, you didn't get to connect.
There are a few well-known "MS uses linux!!!!@#$!@#$ OMGZORZ!!!" stories out there, so i'll address the ones i am familiar with
MS uses Linux to host MS.Com
False. Microsoft.Com runs on windows servers. Microsoft has contracted with akamai to do geocaching of various web properties, and akamai uses linux to a large extent. This is why when you look at some MS.Com "machines" with tools like nmap, they'll come back as Linux boxes. they aren't MS machines, they aren't in any MS datacenter, and they aren't MS managed.
Hotmail is all linux
False. Hotmail was never linux. Hotmail has a distributed architecture, and at the time of acquisition, the front end machines were FreeBSD, and the back ends were Ultra enterprise 4500s. Eventually, the FE's were moved to Windows Server. My understanding is that they tried the transision using NT4 and it was miserable, and tried again with W2k and it was much much better. Eventually, all the Fe's got moved onto one of the server products (i dont remember if it was w2k or w2k3 before it was "done") and the hotmail capacity went UP.. i.e. re-writing the hotmail stuff natively for the new windows based platform has allowed hotmail to run more efficiently on less hardware, with lower management costs. The backend machines were still enormous sun boxes last time i asked about it a few years ago.. for a few reaons. 1) the investment in those was huge 2) the filesystem was completely customized for the application. I wouldn't be surprised if the back ends have also moved off of Sun machines. The back end boxes apparently did almost nothing with CPUs.. but lots and lots of disk IO. The custom filesystem is probably the biggest reason that moving back ends didn't happen earlier.
It's important to Microsoft to run our own stuff everywhere we can, because it demonstrates to customers that the product can meet their capacity needs, and because real world use is the best test of big complex systems. There are a few things we are NOT self hosting on yet - for instance, I am in the Business Division and while we sell a variety of ERP programs (from companies we've acquired), we still use 3rd party ERP systems to run "Microsoft, the Company". Those of you with ERP experience will understnad that this is not something you transition "over nite" or "just because". It is a goal for us in the Business Division to move MS onto our ERP stuff internally - it adds additional credibility to our products when we can tell customers "it can run Microsoft, so it can probably run your stuff". And our competitors _love_ saying things like "why buy MS's version of blah, they dont even use it themselves!"
My opinions are my own, and do not necessarily represent those of my employer.
African or European?