February 27, 2006

nCircle blog states that they think Microsoft's security initiatives are a joke

I was surprised this morning to come across a blog post over at nCircle where they were attacking Microsoft's security initiatives. It was rather interesting to me because I was agreeing that I don't believe its right to have Windows Media Player installed on a Windows server. Quite frankly, a lot of the accessories shouldn't be needed on a main server. But what got me was that we were comparing a product that was written 4 or 5 years ago, BEFORE the security initiatives really were occuring on the Redmond campus. As a follow up, another employee at nCircle tried to balance the discussion with another post about why Microsoft has the right approach to security. In it, there were a few counterpoints, but not enough clarity to the work that Microsoft is REALLY doing behind the scenes as it relates to building a safe and secure platform for consumers and businesses alike. I decided to respond in the comments, and then decided I may as well report it here so I got a record of it, in case it disappears off of nCircle. The following was my response to the original post:

What can I say? You're right that in an optimal situation there wouldn't be a media player installed on a server. However, using your logic, why would you allow an attack vector of untrusted code from a foreign device execute either? You need to turn off the USB ports. There are always going to be tradeoffs that need to be made for function. What makes sense to your corporate security policy may not make sense in mine.

Look, security is about risk mitigation, and not risk avoidance. If you aren't applying the proper information security principles and practices to your organization, it doesn't matter if media player is installed or not. The administrator shouldn't be playing music or browsing from a server period. And that is a weakness in the human factor, not the technology.

Although you cannot easily remove things like media player, you can just as easily prevent Media Player from running with restriction policies. This is a configuration issue, not an installation one. (I will conceed that media player shouldn't be installed at all on a server, but thats only a small point to a larger issue here)

I beg to differ that Microsoft's security initiative is a joke. You are commenting on an operating system that was written over 4/5 years ago (remember that Windows Server 2003 codebase was feature completed before 2003), before Microsoft really had a chance to apply security to their software development lifecycle. I've blogged about this before (http://silverstr.ufies.org/blog/archives/000808.html), but let me list a few of the initiatives they are doing that is helping to make for a safer computing environment for us all:

  1. They have created better error-reporting software. They have found that the top 20% of their errors make up 80% of the problems. Knowing this and capitalizing allows Microsoft to significantly prioritize and reduce bugs that matter the most.
  2. They have created better developer tools to help write more secure software, with release of tools like prefix, prefast, AppVerifier and FxCop.
  3. They halted product development for a period of time and retrained their developers to code more securely. This is an ongoing initiative that helps everyone who touches the master sources.
  4. They audited as much product source code as humanly possible and now have a dedicated lead security person for each component of the Windows source code to watch over code quality as it relates to security. Previously they had a clean up crew come in after the fact and try to sanitize the master sources.
  5. Microsoft has begun to provide more secure defaults when shipping new product. As a clear example we have seen the launch of Windows Server 2003 with a lessened attack surface than previous versions of their server product.
  6. Microsoft now provides better tools such as the Microsoft Baseline Security Analyzer to analyze and audit patch management as it relates to security bugs in a proactive manner.
  7. After major security incidents (like MSBlaster and MyDoom) Microsoft has released tools to help respond and fix possible vulnerable and compromised machines. Although these are not timely enough (IMHO), it’s still good to see.
  8. Microsoft has provided a more definitive patch management cycle to address "patch hell" until their newer products get released that have a significantly lessened attack surface, and have better code quality.
  9. Microsoft provides better integrated firewalling with their Internet Connection Firewall (ICF), released with the latest service pack for XP. Ok this item isn't about secure coding... but more about "secure by default" mentality.
  10. Microsoft is being more open about the entire security process. And not just for PR purposes. More articles, documentation and transparent communication are now available through MSDN, Microsoft employee blogs, and Microsoft's Security webcasts.

Microsoft is far from perfect. But they are making significant changes to address their lax posture over the last decade as it relates to security. And the lessons they are learning are now impacting 3rd party applications which goes even further to protect us all. In the security software engineering field, a LOT of Microsoft's experiences are making headway into designing more secure software. From threat modeling to least privilege token control, Microsoft is being open and letting people understand how to write more defensive code in the Windows world.

Vista is the first real product that we will see where these initiatives have been applied. It will be only then when we can really understand if their security initiatives are a joke or not. I already see things like the UAC subsystem that makes it much easier to run with least privilege in the system. Far nicer than how sudo works or the hacked sudo Apple uses in OSX. We are seeing redirectors and virtualization to transparently deal with non-compliant software. The inclusion of Windows Defender and a proper two way firewall goes a long way to battle hostile code and control network communications effectively.

It's easy to hate Microsoft. It's far more difficult to acknowledge the great work they ARE doing because its so easy to criticize their older work. Lets take the bias and hatred out and worry about protecting our clients. You know, the ones who are mostly using Windows, if we like it or not.

Posted by SilverStr at February 27, 2006 12:25 PM | TrackBack
Comments

I'd agree with you when you say that Microsoft have done a huge amount with security over the last couple of years, including making other peoples products developed using Microsoft technologies far more secure (ASP.NET has a much improved level of security over classic ASP as I can testify from many penetration tests)

However I do think that the area that Microsoft are letting themselves down on is modularity of software.

You mention Media Player being installed and hard to remove and that is a classic example, and I must say I think that is the core issue, locking it down after the fact should be unnessecary as it shouldn't be installed by default.

However I'd go further than that. Why do many servers need an Internet Browser installed, or indeed a GUI. In terms of attack surface, quantity of code installed has to be considered, as if it's installed, it may be possible to execute it.

On other area that I hope that Microsoft improve on is modularity of network services, for example on a web or application server, should you need a service listening on port 445? Yes you can firewall it but that's patching after the fact.

My opinion is that if Microsoft can improve in these areas they would be addressing probably their last main area of security weakness (as you mentioned they've done a lot to address their other one, legacy code)

Posted by: Rory McCune at February 27, 2006 02:00 PM

Very valid points. Realistically, I belive MS has done more in the past 2-3 year than the rest of the industry put together (of course due to the fact that they are the majority of OS).
It is easy for companies like nCircle to have the "MS hating is my motto" approach, but realistically I haven't seen anything good come out of vendors like nCircle (they included as I recently evaluated one of their products to 'plug' the Security holes that MS created!).

Posted by: Vasu at February 28, 2006 05:37 AM

Rory,

I agree it would be nice to have Windows Server without a UI. Unfortunately, not many "Windows admins" are console people to really benefit from the removal of the shell. On top of that, it is so inter-woven into the fabric of the OS, I don't believe it would be easy to remove at all.

That leaves us with reducing the attack surface by removing executable code that doesn't need to run. Or at the very least, reducing the opportunity to run through restriction policies. Unfortunately, if an administrator really wants to run something, they would be able to make changes to the policy and make it work. This is why education is important and key to ensuring the server stays secure.

I do like what Microsoft did in Windows Server 2003 to slow down surfing. The tightened the security zones to make it more difficult to just go out and surf. In Longhorn server, LRIE (Low Rights IE) will take effect and reduce the security context of IE to equivilent of something like 'guest'. This will thwart a lot of the problems that exist now.

All in due time. Thanks for the great comments.

Posted by: Dana Epp at February 28, 2006 08:43 AM

Vasu,

Yep. It's extremely easy to target Microsoft when you work at a security company. Funny enough, many have profited highly from this. And most don't want to accept that in the future, they may have to update their products signficantly to take advantage of the offerings the newer operating systems will provide.

What good is vulnerability assessment services if the hosts attack surface is drastically reduced, the software stays patched, and free from vulnerabilities? We all become safer, but these appliances report very little. :)

I don't think its fair to beat on nCircle though. Although I haven't used their products, any company willing to stick their neck out and build tools to help find and remediate network threats is good in my books. Well, except when employees inappropriately drive FUD into the process. You know, like posting that Microsoft security initatives are a joke. :)

Posted by: Dana Epp at February 28, 2006 08:50 AM

If Microsoft hadn't "really had a chance to apply security to their software development lifecycle" until 4-5 years ago, why would I consider using such an immature product for a mission-critical server? When with a product like Solaris or another of the BSDs I have a comprehensible permissions model, comprehensive control over my ports, and the freedom to replace or remove components at will?

Posted by: David Smith at February 28, 2006 09:36 AM

I'm not sure if you are trolling or not here David. I will assume not, as most people who post here have the professional courtesy to offer objective opinions and counterpoints to allow for critical reflection.

I can't answer your question for you. Only you can determine which tools and technologies meets your needs. In our offices, we have a mixture of Linux and BSD systems driven by a Windows AD setup. Our client machines are almost exclusively Windows based and this setup works for our needs. Yours may be entirely different.

But to be clear, secure software != security software. Microft has a comprehensible permission model and control structure just as Solaris and BSD do. They are applied differently of course, but it does exists. Hence why Windows Server 2003 was able to get the same Common Criteria Standards credentials that various Unix operating systems have had.

What Microsoft hasn't done very well in the past was design secure software, in which it was more resilient to network attack. This has changed. Does it make it "immature"? Not really. Over the years there have been many vulnerabilities discovered in Solaris due to same insecure programming practices. Secure coding is not a Microsoft problem. It is a developer problem across the entire spectrum of software out there.

If anything, the Microsoft server platform is maturing. It has one benefit many other operating systems don't seem to have. It is CONSISTANTLY and CONSTANTLY being hammered on by attackers because of the nature of the availability of the platform. That is not to say Solaris doesn't have any market penetration, but lets be real. Attackers are lazy and will go where they can benefit the most. And that will be the plethora of Windows systems out there.

This may seem like a drawback to most people, but I think its an asset. The more it gets beat on and successfully attacked, the better it gets as Microsoft learns from it. Proof is in the pudding. Look at the number of vulnerabilities in Windows Server 2003 against Windows Server 2000 or even Red Hat Enterprise Edition.

Of course, if you are not comfortable with the platform, and you find that Solaris meets your business objectives, then by all means use it. I am all about using the right tool for the job.

And my needs are apparently much different than yours.

Posted by: Dana Epp at February 28, 2006 09:53 AM

Not trolling - I was just amused to see your suggestion that MS began to "apply security to their software development lifecycle" *after* their current server product was released, and wondered how that would sound to someone trying to do due diligence on a new server OS.

My comment on the comprehensibility of the MS permissions model was prompted by your January 31 reference to the Princeton paper that contrasted the 3-4 privileges (read-modify-execute and sometimes suid) x 3 objects (file/directory/device) UNIX model to the 15 privileges x 30 objects in Windows. I'm getting pretty old, and can handle 9 or 12 relationships a lot better than 450!

I don't often comment anywhere and don't mean to cause trouble, but I have to admit that it seems surreal to read complaints about not being able to remove unwanted features or close unneeded ports in a server OS.

Posted by: David Smith at February 28, 2006 01:17 PM
Post a comment









Remember personal info?