Schneier on Security

Davi Ottenheimer • October 5, 2005 10:40 AM

“too many lazy third-party developers are still writing bad code that unneccesarily requires admin privileges”

That’s not quite right. Microsoft and third-party companies have literally thousands of very talented and active developers that are prevented from making the right choices. Perhaps “prevent” is a strong word, but just like the discussion on an Airbus engineer, software engineers are typically forced to filter their ideas through management. The decision to produce unsafe software, riddled with bugs that cause large residual costs to the users, comes from the top.

Microsoft, in particular, has had virtually no security values held up by their management for the better part of the last two decades.

In other words, it doesn’t matter how active or committed you might be to secure and safe software as an engineer if management demands interoperability (withing the MS suite), ease of use, and functionality regardless of any other issues. OpenBSD is a good example of what happens when an engineer leaves his management behind to start a new company where security was one of the core values.

Davi Ottenheimer • October 5, 2005 1:00 PM

@ Jim

I agree with your variation. And if you go with the old adage “you have time/cost/security, now pick two” you might even expect quick turnaround and a good price, given questionable security (quality).

It never ceases to amaze me that Windows development continues to be plagued by a “most-privilege” paradigm.

Some within the Microsoft camp are starting to percolate “least-privilege” wisdom out of the company, but it will take time before the larger MS-centric development community digests this and follows suit. Here’s a good example of the new message:

“Browsing the Web and Reading E-mail Safely as an Administrator (Code Secure)”
http://msdn.microsoft.com/library/en-us/dncode/html/secure11152004.asp?frame=true&_r=1

But the legacy still bites — just about anyone developing for DOS/Win9x systems had a heck of time accomodating “least privilege” controls in 2000 and beyond because it just wasn’t well thought out or practiced by Microsoft themselves. You could count the number of true security practitioners working full-time at Microsoft with one hand a few years ago. It seems they just weren’t making any recognizable headway until the chorous of externalized discontent came knocking…

Davi Ottenheimer • October 5, 2005 3:17 PM

@ McGavin

I believe the question frequently asked is not “Does closed source cause Microsoft’s security problems” but rather “Does closed source prevent finding a solution to Microsoft’s security problems?”

Similarly, the question “Linux is open source. Do you think it is secure?” is better phrased as “Linux is open source. Can’t you see for yourself if it is secure?”

Minor differences, but important.

And finally “Maybe there is no business need for security…yet” would read better as “Maybe there is no business appetite for security…yet”. The need is clearly there, but the ability to pass off liability or postpone payments complicates the question of timing.

Davi Ottenheimer • October 5, 2005 11:39 PM

“Outoing firewalls provide a false sense of security for most users, since outgoing firewalls can only work if the logged in user is running with restricted privileges. Perhaps part of OneCare will be to enforce that users run with restricted privileges.”

Although I agree with what you are saying technically, I disagree with this line of reasoning from a strategic view. A huge objective of Microsoft’s new security initiative is to move users towards least privilege and to help developers understand that they’re now supposed to build RBAC-aware software.

In fact, you can blame the security community for one of the loudest voices demanding outgoing firewalls. When MS announced the security center at RSA a couple years ago one of the first things we discussed in the security forums was “What, no outbound filter? Every other host-based firewall worth it’s salt gives the OPTION of outbound filters.”

Frankly, if you think MS should base which/what security controls are available just based an average users’ security awareness, then you’re right back into the frying pan of Microsoft pre-2002. I think we have to give MS credit for making the big hurdle beyond that kind of self-defeating logic and taking on the burden of at least attempting to do the “right stuff”, although with a somewhat simplified control center. If it works out, this could end up being no less impressive than when they abruptly dumped NetBEUI and went full TCP/IP.

Davi Ottenheimer • October 8, 2005 8:40 AM

@ E.H.

Ha! But how long into the future? Security was what Microsoft said they had in mind in 1993 when they released NT 3.1…in fact, I remember when MS marketing said the big jump in cost to a $300 NT license was justified, versus a DOS license, because NT came with security “bundled” in (protection against viruses, a memory manager, access controls, etc.). Of course we had to upgrade to 3.5 almost instantly because of all the painfully obvious memory leaks and rediculous network vulnerabilities.

Oh well, here we are today, looking at a price tag of over $600 for Windows 2003 (not including client access fees to use the server), which promises to have protection that 2000 lacks, but only if you pay more for a subscription to the fixes on top of the license…it almost seems like MS should drop the price of their software back to the $20-$50 range. Then the subscription would add up to being about the same as the $600 that you were paying for “enhancements” (as opposed to defect resolution) in the first place, no?