[ISN] What Billg's new security effort will cost

[R. A. Hettinga]

--- begin forwarded text


Status:  U
Date: Thu, 24 Jan 2002 02:12:13 -0600 (CST)
From: InfoSec News <isn at c4i.org>
To: <isn at attrition.org>
Subject: [ISN] What Billg's new security effort will cost
Sender: owner-isn at attrition.org
Reply-To: InfoSec News <isn at c4i.org>

http://www.theregister.co.uk/content/4/23791.html

By Thomas C Greene in Washington
Posted: 23/01/2002 at 11:08 GMT

If Chairman Gates actually meant what he said in his recent memo
calling for dramatically improved security in all MS products, then
there are going to be some immense changes going on in Redmond.
Changes in how software is created; changes in how features are
integrated into them; changes in product development schedules;
changes in disclosure practices. Indeed, we can determine just how
serious Microsoft is by tracking the metamorphosis which a real shift
towards security will necessitate.

We spoke recently with Counterpane Internet Security CTO Bruce
Schneier, who has a pretty clear idea what a security-serious
Microsoft would look like.

Schneier is cautiously optimistic, and for now would give MS the
benefit of the doubt. Microsoft can do this, he says. But it will be
difficult, and it will require an extraordinary shift in the Redmond
culture.

For one thing, Schneier says, MS is simply going to have to open its
protocols to evaluation and peer review. They simply won't succeed
otherwise.

"I'm not talking about making it open source, but rather public
source," he told us. "There is no way to achieve trustworthiness other
than publication."

Next, the EULA (End User License Agreement), which absolves the
company of all liability, "will simply have to go." Schneier reckons
that a lot of what motivated Gates to take on security is the looming
threat of liability litigation.

Now, Billg himself has said that product features will have to take a
back seat to security for the company to earn the trust of consumers.
But this will be exceptionally painful to MS software designers
accustomed to working into their projects every slick bell and whistle
they can think of.

"Putting security ahead of features is not easy," Schneier says.
"Microsoft is going to have to say things like, 'We're going to put
the entire .NET initiative on hold, probably for years, while we work
the security problems out.' They're going to have to stop all
development on operating system features while they go through their
existing code, line by line, fixing vulnerabilities, eliminating
insecure functionality, and adding security features."

Another mark of MS' commitment to security will be visible when the
company ceases to treat vulnerabilities as a public relations problem,
and deals with them openly and honestly.

Microsoft's most recent inclination has been to discourage
vulnerability disclosure, and persuade customers to make use of
auto-update, which patches the system behind their backs. The user
never knows what was wrong, or whether the fix being applied is
effective. This is obviously not a way to cultivate trust, and it will
have to be abandoned if MS really wants a shiny new reputation
suggestive of good security.

"When Netscape was serious about public scrutiny, they paid $1,000 for
each security bug reported to them. Microsoft can no longer threaten,
insult, or belittle independent researchers who find vulnerabilities
in their products," Schneier observed.

This all sounds like a radically different Microsoft from the one we
know and love, and that's just the point. The company quite simply
cannot achieve the goals set forth in the Billg security declaration
and remain unchanged.

It's undeniable that MS has the resources, both human and financial,
to accomplish what it sets out to do. It's also undeniable that the
company has an almost neo-Confucian tendency to substitute form for
substance.

But as Schneier points out, there will be signs that can't be faked,
and which will indicate just how serious the Beast is with its Trusted
Computing initiative. The question remains, is this a PR stunt, or is
it news?

We will see.



-
ISN is currently hosted by Attrition.org

To unsubscribe email majordomo at attrition.org with 'unsubscribe isn' in the BODY
of the mail.

--- end forwarded text


-- 
-----------------
R. A. Hettinga <mailto: rah at ibuc.com>
The Internet Bearer Underwriting Corporation <http://www.ibuc.com/>
44 Farquhar Street, Boston, MA 02131 USA
"... however it may deserve respect for its usefulness and antiquity,
[predicting the end of the world] has not been found agreeable to
experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'



---------------------------------------------------------------------
The Cryptography Mailing List
Unsubscribe by sending "unsubscribe cryptography" to majordomo at wasabisystems.com