April 17, 2008
Mark Russinovich and boundaries... are we missing a key aspect of existing security technology in Windows?
So today I got to sit in a session where Mark spent time reviewing the whole aspect of security boundaries in Windows.
This isn't a new talk, and is actually one I originally saw at last year's MVP Summit. But its always fun to watch his demos. Atleast, it was once AV showed up and fixed his demo machine.
But it had me thinking about boundaries that exist in Windows that we just aren't leveraging effectively. He mentioned .NET CAS. Code access security is an example of a mechanism that provides evidence, permissions and policies that can enforce boundaries, and limit access exposure. It is rarely used, and when it is, is used ineffectively.
It had me thinking though of another piece of technology introduced in Windows Server 2003 to the masses. That's the Authorization Manager, or AzMan as we normally call it in the security groups. AzMan gives the system and its applications role based security to provide constrained whitelist behaviour. A process that is AzMan aware is capable of enforcing policy to ensure that only users within a given role can be made availabe to take action and be restricted in what tasks they can do within a context. A well defined use of security boundaries in Windows.
But no one knows about it. Did you know about it before this post? Probably not. But you should... because at this years RSA conference Microsoft announced it's end-to-end trust initiative which is heavily directed towards role based security.
I think Microsoft is doing a great job in thinking ahead and providing the infrastructure so we can design and deliver more thought out secure solutions. But I wonder if they are doing enough to actually educate the world about just what they ARE doing in this space. This isn't the "Field of Dreams" where if they build it, we will come. Microsoft and its advocates are all going to need to ensure messaging about what Windows is truly capable of (good and bad) is clear, concise and to the point.
I think AzMan is a great piece of role-based goodness that should be much easier to use, deploy and explain. The Visual Studio team needs to step up and tool better to make this easier for developers. What do you think?
April 16, 2008
Microsoft, can you please cross-breed TAM and your internal TM tools
Been very busy lately. Had no chance to blog, or have any sense of order and time for myself.
Last week was RSA Conference, as well as The Microsoft Strategic Architects Summit. This week its the Microsoft MVP summit in Seattle. Then to Dallas for the SMB Summit before finally heading home.
In the midst of all this, I wanted to make sure I got this thought down for fellow developers who design secure softwrae. Currently at the MVP Summit I am seeing a TONNE of stuff inside of Microsoft that I obviously can't talk about due to NDA disclosure. But I wanted to say one thing without breaching the essence of the protection document:
For those that don't know, Microsoft does NOT use the threat modeling tool produced by their ACE team. Instead, they use their own internal tool, which I am not sure I am even allowed to mention by name. But it makes sense; the SDLC is much different than SDL-IT. A picture taken from the ACE TAM blog could help with that.
I am a fan of TAM, but hate that I cannot easily design my own data flow diagrams. There is too much focus on entering in critical components like use cases before the DFD is laid out. The MS internal tools isn't like that. I can't really go into details, but lets just say they figured out how to layout a DFD right. It's not just a simple Visio shape template like we are used to. There are rules and collection points that can be quite useful.
So Microsoft, when would you like me to babysit that abomination? I'd love to see the two tools converge. Anyone else think so too? Let Microsoft know.