Slashdot Mirror
Microsoft Executive Tapped For Top DHS Cyber Post
krebsatwpost writes "The Department of Homeland Security has named Microsoft's 'chief trustworthy infrastructure strategist' Phil Reitinger to be its top cyber security official. Many in the security industry praised him as a smart pick, but said he will need to confront a culture of political infighting and leadership failures at DHS. From the story: 'Reitinger comes to the position with cyber experience in both the public and private sectors. Prior to joining Microsoft in 2003, he was executive director of the Defense Department's Computer Forensics Lab. Before that, he was deputy chief of the Justice Department's Computer Crimes and Intellectual Property section, where he worked under Scott Charney, who is currently corporate vice president for trustworthy computing at Microsoft.'"
Boy oh boy. Obama seems to be turning into a big disappointment with some of these appointments.
What'll he do next? Appoint Mike Tyson as head of Department of Heath and Human Services?
Before that, he was deputy chief of the Justice Department's Computer Crimes and Intellectual Property section, where he worked under Scott Charney, who is currently corporate vice president for trustworthy computing at Microsoft
Trust... worthy... computing at Microsoft... Isn't there a law that prohibits the words trustworthy and Microsoft in the same sentence?
I foresee a lot of Microsoft Security jokes in the following threads.
Here is one
Do you allow Phil Reitinger to be the top cyber security official?
Allow | Deny
There goes any chance of the DHS switching over to an linux/unix environment in the next decade.
greed@All_Evils:~#
this guy doesn't seem a half way bad pick. of course if it was my call i'd eliminate the whole DHS nonense and just fund the FBI,NSA,CIA and police properly. if those 4 agencies can't get it done wtf is the DHS going to add?
If you mod me down, I will become more powerful than you can imagine....
Isn't that like asking the head of AIG to be the officer of "financial responsibility"???
I wonder if we will be seeing US-CERT standing up to Microsoft the way they did with this (a vector for conficker) with him in charge.
I have a sick feeling about this. This guy was surely part of the Microsoft effort to call this a feature. And what was this "political infighting" that the article alludes to? I hope it wasn't over whether to go after Microsoft for aiding in the creation of the largest botnet to date.
While anecdotes from Windows users regarding how they tried to make an inherently insecure system secure could be extremely valuable, I doubt that anecdotes about how Microsoft executives tried to make their systems secure will be equally valuable. This was a ridiculous choice, and further undermines my initial hope that Obama might indeed turn out to be a good President.
Anticipate all persons attempting to enter the U.S. to be screened for explosives, hazardous chemical agents, firearms, radioactive materials, and open source software.
I like how this guy, whom I don't know much about, is painted a smart pick, coming as he does from the largest single computer security threat on the planet. Anybody recall that up to not very long ago at all security was not on their agenda? Simply because it made them more money not to care.
Oh, and that is remebering their own words and without mentioning the usual, such as that they are convicted monopolists too, their business practices suck, their code sucks, their customer service and sales techniques reminisces that of office depot, and so on and so forth.
The bottom line is that in politics you usually don't let the guy who fucked it up try and fix it. Unless perhaps the guy has friends in high places.
Did anyone else misread this as "smart prick"?
Phil Reitinger is a supermod on /. and hand filters each one of thos posts in the firehose section.
I think choosing someone from a company that is STILL under DoJ supervision for questionable behaviour has a couple of unwanted implications, especially since this guy was at board level.
It's only good news for foreign industrial espionage and botnet herders..
The president's DHS pick has brought on board a liason from Symantec. Now everything will STILL be insecure, but run twice as slow, cost even MORE "way too much", and bitch, moan and cry about being renewed every year.
Chas - The one, the only.
THANK GOD!!!
[...] just because this guy worked for Microsoft doesn't mean he lacks intelligence.
No, but it does mean that he was part of the team fighting US-CERT for months over autorun, at least. He likely helped resist an effort by a division of the department he is to head to fix a security problem that was so bad, they felt it endangered national security.
then he would be hiring Bruce Schneier for this job. I know he is disliked by a lot of industry but he is the man with the facts and the plan.
You know, with countries like Iceland. They sure need an insight from a Microsoft exec right now...
Task Mangler
...already said it.
A sad note on the autorun activity. The challenges US-CERT has are complex as they have little ability to enforce sane standards and are just as the name says a response team. Once you formulate a response, someone has to execute it, and the federal government is one of the largest enterprises out there, certainly if you include all the contractors as well. It will be interesting to see if there is a shift away from bah to career feds.
At the same time, everyone makes mistakes and Phil has always shown himself to be a person who generally "gets it" compared to others I've bumped into at GLB. The same is true for any org, fed or not.
You completely missed the point. If the UAC did not actually change the security model, then there was no real reason for its existence other than theater. You are merely confirming what others already know: it was a joke masquerading as "security". And if the security model did not really change, then the interface for it really did not need to change.
The fact is that some basic security assumptions needed to change but they did not. The UAC has little to do with that directly but it illustrates the extend that Microsoft will go to misdirect its users.
Isn't sending Microsoft to fight insecurity like fighting fire with fire?
I don't know. Even if he just did nothing to stop Microsoft's resistance it would be bad.
If guys from CERT called me and said, "Hey, could you make The Autorun and NoDriveTypeAutorun registry values actually do something? We worried about this 10 million strong botnet," I'd probably comply. The reality was even worse; Microsoft wrote instructions for users to mitigate the problem which they knew were not effective.
The last thing I would do would be to start a PR war, which they did only to save face about something that has been criticized for over a decade. It's amazing... some slight marketing concern overrode what they were told was a matter of national security.
Funny... the wikipedia page on autorun was just stealth edited to remove all mention of the problem.
I haven't danced around anything. I did not say that the UAC "might" be security theater, or any of these things you accuse me of. Here is simple logic, okay? I guess at this level I have to ask: You accept that simple logic is valid? From what you have stated I am not sure.
... well, "stupid" comes to mind but I am tempted to use another word.
*IF* the Windows security model hasn't changed, *THEN* the UAC is a joke. Okay? There is no reason for its existence OTHER THAN show.
Get it?
And the presence of such a major "feature" for nothing but show is
If the basic security model of Windows hasn't changed, then there was no reason for the security interface to change... yet it did. So, which is the truth? Better security, or an illusion? You argue for the illusion. Okay. But if so, let's not pretend it's anything else.
I did not say that the basic security model of windows has changed. Others have. What I am saying is: if the basic security model of windows hasn't changed, then YOU shut up! You have nothing to complain about when you get a common virus via your Exhange server, or a piece of malware because you visited an unfriendly site via Internet Explorer.
I'm not talking bollocks... I'm not talking anything. I'm simply pointing out where YOUR talk is somewhat misplaced.
DHS calls on Microsoft for computer security.
BWAHAHAHAHAHAHAHAHAHAHAHAH!!!!
Richard Steven Hack - This sig is TOO GODDAMN SHORT TO DO ANYTHING USEFUL WITH! MORONS!
Things that you occasionally compromise are generally called preferences.
Nerd rage is the funniest rage.
The term might not be used as often, but the concept is alive and well
"the new chips will 'block unauthorized access to the frame buffer.' ...
There is a short list of parties who will be unauthorized to access your frame buffer: You. There is a long list of parties who are authorized to access your frame buffer, and that list includes Microsoft, Apple, AMD, Intel, ATI, NVidia, Sony Pictures, Paramount, HBO, CBS, Macrovision, and all other content owners and enablers that want your machine to themselves whenever youâ(TM)re watching, listening to, reading, or shooting monsters with their products. "
http://www.infoworld.com/article/07/03/28/14OPcurve_1.html
My turnips listen for the soft cry of your love
Bet he still owns MS stock...
prepending "CYBER" to everything!! its so so wrong! *cries*
Happiness does not come from having much, but from being attached to little.
I thought it was like preaching to the converted. Why bother? They're not the ones who need to be convinced.
Yes, MS is evil. Yes, I won't work on MS systems (well, not past MSWind98) due to issues with the EULA. This isn't news, and most of Slashdot agrees, so why post about it? (Well, actually, most people on Slashdot have different major issues, but most of use have severe ones.)
I think we've pushed this "anyone can grow up to be president" thing too far.
With this guys resume, it should be 'chief "Thurstworthy infrastructure strategist'
-Oz