Long fuse for Microsoft's security challenge

TalkBack 13 of 17:

Next »

« Previous

• Thread View
• Flat View

It's Infect-Scan-Remove approach thats the problem

Microsoft's desktop security issues stem from its continued reliance on the Antivirus industries "Infect-Scan-Remove" approach. In comparison, right from the outset, open source desktop platforms and applications have relied almost wholly on closing the infectable vectors, the exploited vulnerabilities used by malware, as quickly as possible. Follow this Usenet thread from September 2000 that covers the argument in detail ( http://tinyurl.com/4uw5m ). David Harley and Robert Moir are two Anitvirus industry leaders. It also includes the prediction that Microsoft would eventually get into the antivirus/antimalware industry. With XP SP2, Microsoft have only just begun to adopt some of the "new" defence strategies outlined by myself in the above thread. However, in my opinion, Microsoft still has yet to secure the actual applications exploited, and five years after the release of Windows 2000, has yet to provide a safe desktop environment for business ( http://tinyurl.com/5wpyu ). To quote Dr. Blaine Burnham, the former director of the Georgia Tech Information Security Center (GTISC) and previously with the National Security Agency (NSA), "Securty is a system wide property". That requires applications, middleware, libraries and the operating system itself to be secured before the whole system can be declared secure. If you have a spare hour, listen to Dr. Blaine's USENIX 2000 keynote ( http://tinyurl.com/5zlju or http://tinyurl.com/6wejm ). The Linux, Mozilla, KDE and GNOME based projects provide a more secure desktop environment because the developers and distributions secure the applications themselves where the application's vulnerabilities can be exploited. In most cases an updated package is available within days of the discovery. After years of double digit vulnerabilities discovered in Microsoft's Internet Explorer, Microsoft has reluctantly changed its mind again and offered yet another upgrade to IE7, but only for users of XP and the mythical Longhorn. Meanwhile 21 out of 87 Secunia advisories, is marked as "Unpatched" in XP professional ( http://tinyurl.com/572c3 ). For a company with the financial resources of Microsoft, that is not even close to being a good enough passing grade. It the result of longterm neglect of the securty issues and will not be secured by any magic bullet based scan or constraint ( http://tinyurl.com/5nxxy ). Shop around and compare other vendors current security status ( http://tinyurl.com/49yc3 ).

Posted by: David Mohring   Posted on: 02/17/05 You are currently: a Guest | Members login | Terms of Use

Alert moderator to an offensive message

Subscribe to this discussion via Email or RSS

SponsoredWhite Papers, Webcasts, and Downloads

• Three Steps You Need to Know to Stop Data Loss Varonis Sensitive data exposed to misuse or loss... it is the stuff of nightmares ... Download Now
• The True Costs of Virtual Server Solutions VMware In an economic environment that is repeatedly heralding the message "do ... Download Now
• VMware Infrastructure: A Guide to Bottom-Line Benefits VMware Frustrated by the costs of maintain ever larger data centers?or building ... Download Now