Weekly Edition
Return to the Press pageSponsored link
Vyatta –
Linux & Open Source
Alternative to Cisco –
Advanced Routing,
Firewall, VPN, QoS..
Free Download ->
| |||||||||||
|
| |||||||||||
Strong reactions to CCIA security report give it added credibility (NewsForge)
A report
(PDF format) titled CyberInsecurity: The Cost of Monopoly is
currently available. NewsForge reports that
Dan Geer, recently CTO of @Stake, has been fired in reaction to this
report. "When you hire a security consultant for your factory or
warehouse, you expect that consultant to tell you if your security fence
needs reinforcement, not to defend the fence manufacturer. And if seven
respected consultants tell you a particular make of fence is too weak for
your purposes, and "industry associations" and "think tanks" supported
heavily by that fence manufacturer lash out at the consultants and claim
they being paid off by rival manufacturers even though they aren't, it's
the manufacturer of the weak fences that looks bad in the end."
(Log in to post comments)
Strong reactions to CCIA security report give it added credibility (NewsForge) Posted Sep 26, 2003 20:03 UTC (Fri) by dkite (guest, #4577) [Link] Anyone have any idea how much this security stuff is costing Microsoft in sales? From theirreactions, it must be hurting very badly. Either that or the high priced help is getting tired of being screamed at by their biggest customers, and taking the frustration out on, well, anybody. Security is so hard to do right, and when done right, invisible. A sales nightmare. This industry is prone to seismic shifts, and Microsoft is on the wrong side of this one. What are they going to do? Derek
Strong reactions to CCIA security report give it added credibility (NewsForge) Posted Sep 26, 2003 20:15 UTC (Fri) by namaseit (guest, #13940) [Link] I dont think it is hurting Microsoft too much. I think of microsoft as a corporateChina. Blocking all outside news, and spreading your own propaganda. Not admitting anythings wrong and lulling people with PR press releases that contradict facts.
Strong reactions to CCIA security report give it added credibility (NewsForge) Posted Sep 26, 2003 21:57 UTC (Fri) by JoeBuck (subscriber, #2330) [Link] I think that it's not costing them much in the US yet, but national governments (other than the US government) are increasingly considering Microsoft not to be trustworthy on security matters and are trying to move away from it. At some point these efforts will reach critical mass and the number of Linux desktop users worldwide will shoot past the number of Mac users, which will then tip the hardware manufacturers into providing decent support (because otherwise they'll lose sales). Microsoft will no doubt respond by offering governments steep discounts (even 90%, since they still make money) and lots of do-gooder projects from the Gates Foundation (we'll give all your kids immunizations, just keep buying our software and stay away from that communist GNU and Linux stuff).
Strong reactions to CCIA security report give it added credibility (NewsForge) Posted Sep 28, 2003 17:42 UTC (Sun) by MathFox (subscriber, #6104) [Link] You ask the question:Anyone have any idea how much this security stuff is costing Microsoft in sales?I do think that a more relevant question is: How much did Microsoft's security flaws allready cost their customers? (And how much will it cost them in the future?)You can just count the number of lost productive hours, multiply them with an average wage and get an impression of total cost.
Strong reactions to CCIA security report give it added credibility (NewsForge) Posted Sep 29, 2003 5:12 UTC (Mon) by leknor (guest, #15538) [Link] Q: How much did Microsoft's security flaws allready cost their customers?A: According to a survey we were given, they cost us about two million dealing with sobig, msblast, and nachi/welchia. Compared to what I've read about what other universities went though, I think we had it easy.
must we defend everything Microsoft attacks? Posted Sep 26, 2003 22:19 UTC (Fri) by stevenj (guest, #421) [Link] To be honest, the CCIA report was not the most convincing piece of writing I've ever seen. Lots of truisms ("monoculture is bad", "integration is bad"), some speculation about future behaviors, and very little in the way of hard data. (Nor are there a wealth of citations to back them up; only eight references for a 20-page paper is on the slim side by academic standards.)
must we defend everything Microsoft attacks? Posted Sep 26, 2003 23:59 UTC (Fri) by dang (subscriber, #310) [Link] I agree. And without straying from commonplaces, they might have offered some commonplaces on amelioration ( that apply even in heterogenous data centers) including very simple things such as the following: regular, principled vulnerability assessment; relentless patching; hostbased firewalls with strict ingress and egress rules; honest security policies; internal and external audits; a general awareness that after having done your best you may still be open.
must we defend everything Microsoft attacks? Posted Sep 27, 2003 1:02 UTC (Sat) by stock (subscriber, #5849) [Link] people getting fired because they write, or try to write, an indepedant and honest report, just because the upper connected Corporation is presented as the company who's products to avoid, is what even the consultants kids could predict to happen, in todays corporate world.Should a consultant then write a false report, supporting the lacking products of the upper connected Corporation? Of course not. The Consultant might get away with this once, twice or maybe three times, but the next time around his credibility, honesty and not the least his reputation on knowhow and expertise will be down the drain. But relax, your not the only one fired because of just doing your job the proper way. Think of Richard Clarke, Director CyberSecurity, White House who resigned in february 2003, after demanding : "Microsoft should seriously fix their bug prone software to prevent cyberwar attacks". Richard Clarke's department in feb 2003 was removed from the whitehouse to Homeland Security. Clarke resigned.
http://www.pbs.org/wgbh/pages/frontline/shows/knew/interviews/clarke.html Robert
the firing was still reprehensible Posted Sep 27, 2003 1:22 UTC (Sat) by stevenj (guest, #421) [Link] and should be condemned; don't get me wrong. I just think that the attention should be on the strongarm tactics of the report's opponents, while the report itself should be judged on its own merits and not on a partisan basis.
must we defend everything Microsoft attacks? Posted Sep 27, 2003 2:51 UTC (Sat) by sandy_pond (guest, #9734) [Link] "only eight references for a 20-page paper is on the slim side by academic standards"I'm really tired of "academic standards". I thought it hit home on several truly valid global issues we are faced with. These issues are well understood in other industries and have been addressed. This is an area that IT seems to be behind other industries that have been faced with cascade failures. I don't know how much convincing you need but if you want to put your head in the sand that's up to you. I think the the one thing the report missed was the problem with MS abandoning support for older OSes, like Win 98.
Strong reactions to CCIA security report give it added credibility (NewsForge) Posted Sep 27, 2003 3:13 UTC (Sat) by sandy_pond (guest, #9734) [Link] Very good read. A little heavy on the anti-MS side, even though valid. They may have gotten their point across better it they had prefaced their argument with historic examples of cascade failures in other industries. I agree with their call for government intervention.
Strong reactions to CCIA security report give it added credibility (NewsForge) Posted Sep 27, 2003 5:15 UTC (Sat) by dang (subscriber, #310) [Link] I honestly dont agree with their call for government intervention.Yes, there is a strong case to be made for heterogenous platforms. This isn't the entire story by a long shot, though. There are real costs to heterogenous shops including security costs. You have to track more potential vulnerabilities, you need a more complex monitoring, imaging, and patching infrastructure, and you need a team that really understands how to lock down everything that shows up in your cage. Sometimes this mkaes sense, sometimes not. That is a function of who is on staff and what resources you have. But dont tell me that it is necessarily a security win to mix windows, solaris, or bsd boxes into my linux cage if the skill set or infrastructure resources aren't there. And, honestly, the bottom line is this. Most ( not all but most ) of the headaches that people are seeing lately are because they don't patch and they dont firewall. And at that rate adding complexity to the cage is only going to make things that much worse. ( Now folks will have both SQL200 AND NFS or X exposed; what a win that will be! ) Again, this isn't to say that I disagree with the the monoculture argument. I just think that things are more complex, and legislating away monoculture will probably make things worse given the high level of apathy and cluelessness that we've seen lately. And on that score, the number of unpatched linux boxes floating around should be enough to chill anyone.
Strong reactions to CCIA security report give it added credibility (NewsForge) Posted Sep 27, 2003 19:21 UTC (Sat) by sandy_pond (guest, #9734) [Link] ”This isn't the entire story by a long shot”Didn't say it was. The point is that history has shown that “markets” will not fix many issues when faced with monopolies. In cases where monopolies have controlled markets, governments have had to provide regulations in order to protect public interests. I think we can agree that the security/reliability aspects of the Internet is very dependent on the MS platform and that MS's historic behavior concerning these issues has not been in the public interest. I take the paper as really a call to government to get involved with these issues in an open discussion. I'm sure MS is doing the same in a secretive and monopoly propagating sort of way (Palladium). I don't agree with a call for governments to require widespread use of heterogeneous computer environments as you suggest and I don't think this is what the paper is suggesting. The paper really only raising the security/reliability issues when faced with a computer monoculture on the Internet, particularly at the edges where security is minimal. One of the ways to provide for better Internet security/reliability is to foster a heterogeneous computer environment. But this isn't the only solution the paper discusses. However, all that said, from a security/reliability design point of view I may very well use two different software/hardware platforms to provide a redundant critical service. I don't believe this is bad design by any means, and is required in some industries.
Strong reactions to CCIA security report give it added credibility (NewsForge) Posted Sep 28, 2003 4:40 UTC (Sun) by JoeBuck (subscriber, #2330) [Link] The status quo, which is an increasingly draconian copyright police state, represents massive government intervention. However, those libertarians who elevate property rights above all other rights, and who don't see any distinction between "intellectual property" and other forms of property, don't see this. They want governments to sit back and do nothing other than enforce RIAA and SBA shakedowns until we're all paying taxes to Microsoft and aren't allowed on the net without a Microsoft-issued PassPort (TM) and a DRM-compliant operating system. But no, you say, insisting that governments only run code that they can get the source for is unacceptable government intervention, even when the government isn't telling anyone else what to run, but only deciding what software its own employees will use.
Strong reactions to CCIA security report give it added credibility (NewsForge) Posted Sep 28, 2003 5:56 UTC (Sun) by proski (subscriber, #104) [Link] But no, you say, insisting that governments only run code that they can get the source for is unacceptable government interventionSounds like a strawman argument to me.
Strong reactions to CCIA security report give it added credibility (NewsForge) Posted Sep 27, 2003 12:39 UTC (Sat) by deatrich (subscriber, #25) [Link] One of the most entertaining editorials I have read about the hullabaloo over this report and the firing of D. Geer is over at theregister; hop over there and check it out. (it's also very well written):Microsoft: a threat to global IT and job security?
Sacrificial lamb Posted Sep 27, 2003 20:19 UTC (Sat) by ls-lta (guest, #11615) [Link] Although unkind to Dan Geer, @Stake probably did more harm to Microsoft by firing him and giving the report that much more publicity, than simply by letting it slide. It also reinforces the notion that Microsoft and its lap dogs are bullies. I can't help but wonder if closed source fosters this type of closed mindedness.
|
|||||||||||