The rethinking of computer security

TalkBack 18 of 20:

Next »

« Previous

• Thread View
• Flat View

Yes, MS at lost got it ...

At first, if MS is 'finally' getting it wrt security is questionable. This is simply due to the fact that even after 3 whole years of public proclamations of the war against insecurity, its systems can STILL get compromised almost equally easily. Although the etternal and frequently cycles of repatching, cleaning, reinstallimg, AV s/w, etc. their basic products (eg., IE and Outlook) are still buggy and flimsy in this respect.

At second, the presentation by MR. Gates was a blatant attempt to SELL more s/w with the promise of better security. It is NOT CLEAR AT ALL that MS is working seriously in eradicating the INHERENT security and other malformations in the kernel. Signs that MS wants to minimize its efforts in addressing the root of the problem include its recent announcement (and reversion) of stopping support for its (recent) next-best OSs. It is clear that the effort to RETROFIT security is an exercise in hopeleness with high cost.

Third, this article exhumes the usual 'I understand your pain people: MS did stupid things in the past but now has corrected its ways and it wants to redress the wrongs'. This can only be CONCLUDED AFTER tangible results are visible. I don't think that straight thinking people can just take MS's proclamations, or those of its friends, at face value.

Although PERFECT security maybe an evasive goal for ANY system, MS could have just done the COMMON SENSE thing that others did in the 80's and 90's: define the WEAK parts of the system (eg., network packet) and allow RESOURCE ACCESS ONLY AFTER authentication at a certain satisfactory level has been acquired.

There were so many simple things and common sense precautiosn that could have been built in the kernel and in the interaction of the user with the system. MS didn't start working on those until very recently.

But now we see again some big head ideas on securing the TCP/IP stack and all these things to facilitate 'the downloading of the .... patches'. So if we believe MS's words, we will go from a childishly flimsy system to one that EVERYTHING is protected.

This is TOO big of a semantic gap for MS to leapfrog, and even if this is their true intentions, their usual (lack) of good sense development and slopiness will most likely defeat the purpose.

In short, MS is struggling to APPEAR that is working dilligently on the matter and it has already started announcing big and glamorous solutions.

I don't believe them. Do you?

-m

Posted by: michael-t   Posted on: 03/12/04 You are currently: a Guest | Members login | Terms of Use

Alert moderator to an offensive message

Subscribe to this discussion via Email or RSS

SponsoredWhite Papers, Webcasts, and Downloads

• Driving Business Agility through SOA Connectivity & Integration Whitepaper from IBM IBM In this whitepaper, you will learn how to work smarter so you can solve ... Download Now
• Advanced Java Memory Analysis with JProbe Quest Software Memory issues in Java applications can cripple performance and cost your ... Download Now
• SpotLight on Active Directory ScriptLogic Spotlight on Active Directory Pack is a real-time diagnostic tool for ... Download Now