Analysis: Microsoft Bets Big on Vista Security Robert McMillan, IDG News Service
http://news.yahoo.com/s/pcworld/20060724/tc_pcworld/126522 SAN FRANCISCO-- Microsoft's Vista developers can't catch a break these days. After years of warnings from security researchers that old code in Windows was creating security risks, the software giant decided to rewrite key parts of the operating system. The result? Last week, Symantec published a report suggesting that all of this new code will introduce new security problems. "The network stack in Windows Vista was rewritten from the ground up. In deciding to rewrite the stack, Microsoft has removed a large body of tried and tested code and replaced it," Symantec wrote, noting that it found vulnerabilities in the Windows Vista networking software. "Despite the claims of Microsoft developers, the Windows Vista network stack as it exists today is less stable than the earlier Windows XP stack," said Symantec after examining a beta release of the software. The two major hacker/security conferences of the year start next week in Las Vegas: Defcon and Black Hat USA. A No-Win Situation? After years of being blamed for countless security problems, Microsoft may be in a no-win situation. "You get beaten up if you modify the old code; you get beaten up if you write new code," says Russ Cooper, a senior information security analyst at Cybertrust. "The historic complaint against Microsoft has been that their code is bloated with all this legacy stuff. Rewrite it, and now, 'this is too new; this is untested.'" The fact that Symantec was able to discover flaws in a beta release should not raise eyebrows, Cooper says. "There's a reason products are put into beta, and it isn't because people just want to see the default colors change," he says. If customers do not ultimately see Vista as a more secure product than its predecessor, however, it will be a disaster for Microsoft--on an epic scale. Over the past few years, the company has literally reinvented the way it produces software, instituting a new set of software development practices known as the Security Development Lifecycle. It has retrained developers, built a suite of automated security testing tools, and, most remarkably, invited scores of independent researchers to have unprecedented access to early versions of Vista. "Vista is really the first release of the operating system to go through our Security Development Lifecycle from beginning to end," says Ben Fathi, corporate vice president of Microsoft's Security Technology unit. "That's fundamentally a different way of looking at building security into the platform." Security the Reason for Vista Delay? Microsoft has gone to great lengths to publicize its Security Development Lifecycle, which was used in the development of Windows XP Service Pack 2 and SQL Server 2005. Company executives say that the strict development guidelines used for XP SP2 played a big role in eliminating the widespread worm virus outbreaks that seemed so common just three years ago. The emphasis on security is perhaps best illustrated by an event that Microsoft executives have declined to discuss in detail: the recent slip in Vista's ship date. Last March, Microsoft grabbed headlines by announcing that Vista would not be available in time for the 2006 holiday shopping season, as expected. Microsoft never gave specific reasons for the miss, but it was a major setback for a product that had already been five years in the works. Microsoft immediately reorganized the Platforms & Services division responsible for the delay, putting a new executive, Steve Sinofsky, in charge of Windows development. Privately, several sources familiar with Vista's development say that concerns over Vista's security caused the widely publicized slip in the product's ship date. In fact, T-shirts reading "I caused Vista to slip" soon became a common sight at Microsoft's Building 27, home to the Secure Windows Initiative group. The group is responsible for securing Microsoft's software. "The shirt became very popular on campus," to the chagrin of management, says one source who asked not to be identified. Experts Snapped Up Fathi isn't saying how much money the company has spent on making Vista secure, but judging by the contract work available for penetration testers--hacking professionals who specialize in poking and prodding systems to unearth vulnerabilities--it hasn't come cheap. Though Microsoft will be sponsoring a Vista track at this year's Black Hat hacker conference, many of the most prominent Windows security experts are now under nondisclosure agreements, according to Jeff Moss, the show's director. "They've hired pretty much all of the bright people," he said. "So the number of speakers who can actually go out and publicly talk about Windows Vista security has rapidly dwindled." For Fathi, this is a good thing. "We believe that we have the largest group of penetration testers ever assembled," Fathi says. "It's costing me a lot of money....It's worth every penny of course." Microsoft's design choices will have a big effect on Vista's security as well. Developers have changed the way Vista runs applications, scaling back the types of things that users can do by default in order to limit the damage that malware can wreak on a system. And they have also changed the way Vista works with the computer's memory--by fencing off parts of memory and shuffling around the location of Windows functions--to make it harder for hackers to trick the PC into running malicious software. "When you put all that stuff together, you end up making it a lot harder to write exploits," says Alex Stamos, a researcher who has worked with Microsoft in the past and is a founding partner of Information Security Partners LLC. This will make life harder for hackers, but it will also present challenges to users and legitimate software developers as well, who may suddenly have problems running their Windows XP code on Vista. "They're basically breaking binary compatibility with a lot of things," Stamos says. "[This] really does mark a watershed change in thinking, from 'binary compatibility over all' to security being the most important thing." As for Symantec's paper, Microsoft downplayed its importance last week. "The issues they discovered were all addressed in Beta 2," said Stephen Toulouse, a security program manager with Microsoft's security response center. But it appears that other important parts of Windows are being rewritten. Microsoft plans to talk further about some of the changes to "legacy functionality" at the Black Hat conference, Toulouse said. Reply with a "Thank you" if you liked this post. _____________________________ MEDIANEWS mailing list [email protected] To unsubscribe send an email to: [EMAIL PROTECTED]
