Slashdot Mirror
Microsoft Releases Super-Secure XP to US Air Force
Wired is reporting that Microsoft is releasing the most secure version of Windows XP ever created, but only if you are the US Air Force. "The Air Force persuaded Microsoft CEO Steve Ballmer to provide it with a secure Windows configuration that saved the service about $100 million in contract costs and countless hours of maintenance. At a congressional hearing this week on cybersecurity, Alan Paller, research director of the Sans Institute, shared the story as an template for how the government could use its massive purchasing power to get companies to produce more secure products. And those could eventually be available to the rest of us. Security experts have been arguing for this "trickle-down" model for years. But rather than wield its buying power for the greater good, the government has long wimped out and taken whatever vendors served them. If the Air Force case is a good judge, however, things might be changing."
Now i see why they disabled autorun. :D
Patents Drive Free Software as Hurricanes Drive Construction Industry
When the navy puts windows on their ships.
...what they did to make it secure. Is the default wallpaper black with a big picture of a lock on it?
It is by my will alone my thoughts acquire motion; it is by the juice of the coffee bean that the thoughts acquire speed
But what good is XP without drivers for keyboard, CD/DVD drives, USB ports, or NICs?
Why, without your clothes, you're naked, Miss Dudley!
Next most secure ever release for US army will be Windows 95, then Windows 3.11 and at the top of security development ever will be release of MS DOS 1.0.
If they can make it more secure, why don't they offer everyone the secure version?
-- these are only opinions and they might not be mine.
'The Air Force, on the verge of renegotiating its desktop-software contract with Microsoft, met with Ballmer and asked the company to deliver a secure configuration of Windows XP out of the box. That way, Air Force administrators wouldnâ(TM)t have to spend time re-configuring, and the department would have uniform software across the board, making it easier to control and maintain patches.'
So if you'd like to do it yourself, you can secure your XP too.
http://nvd.nist.gov/fdcc/fdcc_faq.cfm
I'm not sure super secure is the right word for this version of XP though, given that there are a lot of security features it is missing that Vista, Windows 7 and some other OSes have.
http://lkml.org/lkml/2005/8/20/95
So I have this on good authority from someone who works there... A few years back the VA decided to start migrating from IIS to apache. At the same time they wanted to migrate file servers as well. When MS caught wind of this, they told the powers that be at the VA, "You drop us, and we'll audit you." Part of the contract MS holds with the VA is they're allowed to perform a license audit any time they want. The VA did its own internal investigation and figured out pretty quickly that MS had them, "Over the barrel" so to speak... I don't think the Air Force really wants to use MS stuff, but if they're in a similar situation as the VA, this doesn't bode well for them. I hope the Obama administration catches wind of this and puts a stop to this practice. It isn't right that my tax dollars are being forced into MS's pockets. I think in these rough economic times our government needs to really start exploring more OSS/free solutions out there.
so the Air force paid MS to "lock down windows" probably to the STIG.. Instead of doing what DODIIS does and create a Install disk to be installed and tested against, so if you do have to rebuild its there... I thought that MS came up with an affordable PL3 or PL4 System, we have been working with MS for a PL3 system, but it would cost almost a million more than a comparable Trusted Solaris or SELinux solution. and be hell to administer
While this was an interesting article, the XP and the Vista versions used by the USAF are the same ones used by the general public. The only differences are the security setting, the firewall configuration, and the user configuration. No one is an admin unless they need to be, and no normal day-to-day work is done in admin mode (same thing you do in Linux, no doubt).
I didn't know this article was going to be published, but when I found it, I was not surprised by the comments. I've been working on this program for more than 2 years. Users hate it. Developers loathe it. Network security staff loves it.
Nothing can make Windows (or any other OS) completely secure if it's connected to a network. This is as close as the federal government as ever come.
The airforce and the military in general would do well not to create a monoculture; especially not one based on an arguably insecure operating system that is nearing its end of life. Despite the existence of *nix alternatives that are of comparable ease of use and generally superior security and customization, the military continues to insist that using an old operating system full of flaws and actively exploited by the vast majority of malware is suitable for government use. There is something very wrong here.
Sigs are too short to say anything truly profound so read the above post instead.
"Having the most secure Windows ever" does not equate to having secure Windows.
Rich And Stupid is not so bad as Working For Rich And Stupid.
It is probably a case they have a lot of Windows Apps that need to be ran, and it is cheaper to get Microsoft to secure windows then to report their products to an other OS (Who really isn't that much more secure anyways) try to get resources to secure the Open Source OS to an acceptable levels, (Or find out how to configure OpenBSD to do what you want) then pay to report all your apps and retest and security check them all again.
What the air force is doing is Replacing the Doors/Windows and Locks from the house. Vs. Rebuilding a new one just to get the New Doors/Windows and Locks.
If something is so important that you feel the need to post it on the internet... It probably isn't that important.
It's called running XP in VMware under Linux.
( Also, is it just me or does the "XP" after "Super-Secure" look like a smiley representing someone laughing their guts out? )
jdb2
let's see, Windows on hospital equipment recently got Conficker because Microsoft no longer provided security patches for Windows 2000 and NT. I'm now wondering how long the British Navy thinks these subs will last and how they'll deal with unpatched Microsoft operating systems running the show when Microsoft stops feeding them patches?
Hey USAF! If you can't see the source code and see the patches for later versions, you can't have any hope of securing the system in the long run. You're only hope for security dooms you to tearing it all out and replacing it. And you know that is not going to happen and doesn't happen. Good luck with that "Super-Secure XP".
LoB
"Anyone who stands out in the middle of a road looks like roadkill to me." --Linus
Now lets rephrase that; 15% of the attacks were still successful after a complete lock-down configuration was applied and lots of manpower went into burning custom installation disks and procedures. Is it just me or does anyone else see a problem with this?
Next up, the Army and Navy. After that, government agencies ... finally, big businesses and the public.
Yes, so we will be able to buy XP instead of the best and most secure OS, Vista!!!!!
I think that this is the best own goal ever done by MS in its long life, on two counts. first, they are saying that XP is arguably more secure than vista. second, they are saying that while all organizations are created equals, some are more equal than others. Why is it that i cannot buy XP anymore, while the Air force can?
So, I do not think that "big business and the public" will ever be able to buy that. Never. not ever. BUT, that does not mean that this will not have repercussions.Big business will use it as a lever to delay, yet again, the adoption of Vista/win7, by browbeating MS into admitting that they will support XP longer than publicly stated ( I do not think that they will leave the Air force high and dry in four years, do you?), and demanding equal treatment. moreover, I do not think it possible that this XP will not percolate in the public domain.
One more unintended consequence: any attempt into selling Vista/win 7 by implying that Xp is less secure is meaningless now: "go tell the blue boys, then come back!"
"If a boss demands loyalty, give him integrity. But if he demands integrity, give him loyalty." (John Boyd, 1927-1997)
Users are free to configure their systems for higher security. Note that doing so may limit functionality you are used to. For example, you can configure your system so that all users run as normal users (no administrative functionality). Running users as normal users is part of all security guidance. Not all XP software will run if you do this. You can set IE to high security mode by default and disable Flash, etc. Doing so breaks much of the web but is more secure. You can get security, but it will impact your user experience.
It is easier to secure Vista and 2K8 server systems.
if you look closely at the article, this is something that the air force did between 2005-2007. so this is actually old news. 'The Air Force began the project in 2005 and finished installing the new configuration on systems in 2007. In contracts with hardware providers it demanded that vendors pre-load the special Windows XP configuration onto systems before delivering them to the Air Force.'
Where do you get that they are saying XP is more secure than Vista? Another angle to consider is the one that the Air Force has been running XP for a long time and all of their applications are coded to work with XP. Microsoft took the smart route and improved what the Air Force already had instead of forcing them into an upgrade. Vista very well may be more secure than XP, and Windows 7 might be more secure than both of them.
For as long as I've been using computers, I've hated the forced upgrade cycle that Microsoft imposes on their customers. It would be nice if they would just stick to a single OS and improve it. For a lot of people, XP is good enough. It gets the job done and there isn't any reason to upgrade. If NT weren't such an insecure piece of turd, it could serve the needs of most businesses out there (just like Linux + Samba and OpenLDAP can). Having said that, I understand that a single OS isn't exactly a viable business model, unless you force people into support contracts. Given that Microsoft and Apple both charge for OS updates, I don't think that business model is going away any time soon.
let's see, Windows on hospital equipment recently got Conficker because Microsoft no longer provided security patches for Windows 2000 and NT.
Uh, no. The MS08-067 patch that addresses conficker was released for Windows 2000 at the same time as all the other OSes, with the exception of NT. http://www.microsoft.com/technet/security/Bulletin/MS08-067.mspx
Need more useless stuff to read on teh internetz?
And the US Air Force lost this fight.
let's see, Windows on hospital equipment recently got Conficker because Microsoft no longer provided security patches for Windows 2000 and NT.
Extended support for Windows 2000 doesn't end unitl July of 2010. The patch that fixes the exploit on Win2k is here if interested.
As for NT, the long term support ended over 5 years ago.
I'm not not licking toads.
Meet GRASS HUT!
"Flyin' in just a sweet place,
Never been known to fail..."
In Windows XP Embedded, you can choose which components to install, on a significantly more fine grained scale. For example, you can leave out Windows Explorer (i.e. the icons on the desktop, task bar, and File Management tool (the my computer window, etc)). I'm not sure quite how fine grained the driver selection is, but it is still far more fine-grained than tradition XP installations. You can definitely leave out unused network stacks, etc.
But for some reason few people seem to be aware of it, or choose to use it. I mean I've seen logic analyzers running standard OEM Windows XP.
Stylish sheet to fix many problems in Slashdot's D3: https://gist.github.com/801524
"I am a security program manager at Microsoft"
;)
I wouldn't mention this on your next job application
davecb5620@gmail.com
And then I blew my morning coffee through my nose...
I will not be pushed, filed, stamped, indexed, briefed, debriefed or numbered. My life is my own.
>> the most secure version of Windows XP
Isn't that an oxymoron? Kinda like dry water?
The Air Force has yet to explain who, if anyone, authorized the bombing of a Redmond, WA software company by a squadron of B-52s.