Three Minutes With Sun's Security Guru
497156
Privacy laws could hurt the little guy, warns cryptographer Whitfield Diffie.
423419
He discusses the dearth of developers, scaling problems and his public blog war with Sun's Jonathan Schwartz.
531489
Critical flaw grants root privileges Solaris users who enable telnet are about as secure as a fortress with a screen door, according to reports that claim cyber crooks can use the protocol to easily gain root access.â¦
405148
Passwords are out and tokens are the authentication wave of the future, right? Not so fast, says Jon Espenschied. The next next thing is both stranger and more familiar.
507966
Worm turns Sun Microsystems has urged users to update and secure their Solaris 10 installations after a recently discovered zero-day vulnerability was found in the wild.â¦
674795
(InfoWorld) - Itâs not easy being Ben Fathi. As corporate vice president of Microsoftâs Security Technology Unit, Fathi took the place of longtime STU leader Mike Nash in March amid a larger management shake-up just days after Microsoft announced that the shipment date for Vista was slipping yet again. After Nashâs high-profile tenure, Fathiâs charge is more subtle: building what he calls a âtrust ecosystemâ around Vista and its new security features and promoting the companyâs secure development practices. But first he must help get Vista out the door. Fathi sat down to talk with InfoWorld Senior Editor Paul Roberts at the recent Security Standard Conference in Boston about Vistaâs progress, and the world after Vista. InfoWorld: Recently thereâs been some back and forth with Symantec about issues such as Vistaâs Kernel Patch Protection feature for 64-bit systems, as well as some public criticism of Vista code for having security holes. What should enterprise folks make of that? Ben Fathi: First, on the paper Symantec published: We thank them for their input. I think itâs unusual for a partner to go public with a paper like this on a beta product, but they did identify a few issues. To the best of my knowledge, all those were already fixed in more recent beta releases. We love to hear feedback on beta products. Thatâs why weâre in beta. Itâs a test. Weâll fix them as long as they report them to us. As for the kernel patching, we fundamentally believe that the current model of kernel patching is broken and not sustainable. We never recommended it or supported it on any version of our operating systems. As weâve been telling our vendor partners, this is the only chance we have, as 64-bit computing becomes available, to start with a clean architecture and build on top of that. We want to work with you to find ways to extend the kernel functionality by having a clean architecture, APIs, and filters. â¦ instead of patching instructions and data structures in the kernel. In the long term, what we want to do is move a lot of these functionalities to a hypervisor that sits under the kernel to make the kernel even smaller and the trusted computing base even more secure. We still have a window of opportunity here. â¦ and weâre working with two or three vendors in the space to come up with that kind of architecture. One of the other comments thatâs been made is that [Kernel Patch Protection] is anti-trust. That weâll go back in with our own products and get around it. Thatâs absolutely not true. Weâd never do that. IW: You recently patched a beta version of Vista. Is it a bad sign that youâre patching beta Vista? BF: I believe that Vista is significantly more secure than any version of XP or anything else weâve shipped in the past. Just SDL (secure development lifecycle) in general and the process of penetration testing and hardening kernel services. These all created a stronger, defense in depth strategy. What I would say is, Yeah, there will be patches and vulnerabilities as we move forward. What weâre hoping is that by creating these layers of defense, weâre giving customers, especially enterprise customers, a longer time to test and make sure things are not broken. IW: Do you see your job description and responsibilities changing after Vista? BF: There are six different areas that we call âBig Betsâ that have been identified in my division. I will mention two. The first, Application ID, is a way to identify an application that includes an executable, the library it uses, configuration files, registry settings, any patches that are applied to it. So youâll have a cryptographically signed version of the application, and youâll be able to identify that and whitelist or blacklist that. When we talk about a trust ecosystem today, the ability to trust people based on an ID and trust machines based on an ID, we canât do that with applications. If itâs called powerpoint.exe, we go and run it. So having strong IDs based on the application and [making] sure they havenât been tampered with after download is an important investment for us. The second area is isolation. Creating guest operating systems that sit on top of hypervisors allow us to create better isolation mechanisms so that even if malware comes in, it only affects one subset of the machine and not everything else. Weâve done some great work on server hypervisors and server virtualization. We need to extend that to the client. Weâre seeing partners do that already, and so weâre going to invest in that space.
71190
Hal Stern holds the titles at Sun Microsystems of vice president, Distinguished Engineer, and CTO for Sun Services. He also has co-authored technical books on networking and high-availability techniques and, prior to joining Sun, developed molecular modeling software. InfoWorld Editor at Large Paul Krill met with Stern to discuss Sunâs âNext Generation Data Centerâ concept and to talk about subjects such as security, utility computing, and how the company stacks up its services efforts against IBM Global Services.
596781
Mike Elgan details what we learned from an employee training book leak and Steve Jobs' Worldwide Developers Conference keynote speech.
137967
In a new post to his blog today, Paul Jones mentions his podcast for the Zend Developer Zone (a Solar Overview) and provides the script that he worked from to record the show.   In this episode, I'm going to give a brief overview of Solar project and how it helps with the mundane aspects of building applications. Solar is an open-source library and framework for PHP 5; you can read more about it at solarphp.com...   The rest of the show notes includes links to things like Yawp, Solar's built-in localization and it's exception handling code.    Check out more about Solar at Solarphp.com and check out the PHP Abstract podcast episode Paul recorded on the Zend Developer Zone site.
645943
With Sun Microsystems set to detail its plans for Solaris 10 on Monday, Sun President and COO Jonathan Schwartz spoke with Computerworld about what the company has up its open-source sleeve.
546373
Thursday's alpha 8 release exposes several new security features to the public for the first time.
327848
InfoWorld - Is your software vendor doing everything it can to secure its products? As Sun Microsystems&#160;learned this week, there is always room for improvement.
440203
Open source split Speculation is growing that one of Sun Microsystems' most influential figures has quit following the decision to open source Java.â¦
40481
(InfoWorld) - Whitfield Diffie has been credited with making privacy possible in the digital age. As a co-inventor of public key cryptography, he is one of the most respected contributors to the field of computer security and is in constant demand as a speaker. In his day job as Sun Microsystems' Chief Security Officer, he works out of a corner office in the Sun Labs. He's just down the hall from where scientists are working on Java-based sensors and Sun's next-generation Proximity Communication processors, which seek to do away with wire connections. Though he describes his job as a "marketing" position, Diffie doesn't sound anything like a corporate pitch man. He met with IDG News Service at his Menlo Park, California, office recently to share his thoughts on Microsoft, security, and privacy. Following is an edited transcript of that conversation. IDGNS: When the PC went on the network, there were security implications that nobody thought about. Microsoft has spent the last five years fixing all of the security problems that maybe could have been foreseen ... Diffie: Wait a minute. I think there are two issues. I think you'll find that lots of them were foreseen. I think the critical thing [is] that Microsoft showed that it's judgment was correct. If it had paid less attention to security, maybe it would have had less market share. It had no real motivation, I think, until the last few years to try to fix these things. The interesting thing to me is why it's been so hard for them to do so, because they must have half the smart people I know about in the industry, and in security, working for them. And I think it has to do with the problems of legacy code, and the legacy interface expectations of their customers. IDGNS: Nowadays we don't hear about widespread security outbreaks, but there's a sense that many of the things we do on the Internet are not trustworthy. People going to Web pages do not have confidence that they are where they think they are. Diffie: I think that's a well-placed mis-confidence. IDGNS: So, are things getting better? Diffie: Phishing is the security problem, at that level, that I hear the most about right now. But I certainly don't worry about the security arrangements of going to Americanexpress.com, where I probably make the single largest most routine money transfer that I initiate. I'm not the least bit worried about that, partly because of the law, and partly because the essential point of SSL [Secure Sockets Layer -- a standard used in secure Web connections] is not about the quality of the cryptography -- about which there's often some doubt - but about the fact that the certificate costs enough money that the thieves aren't putting up a front. It's hard for me to believe that [the Internet] is getting relatively more secure. The growth of communications has steadily outrun the protection of communications over the whole history of human communication. Now I conjecture that the expansion of networked communications and of society's dependence on network communications is outrunning the security of that network and will continue to do so for quite some time. So the consequence of believing that is [believing] we're becoming more vulnerable, although to what events, it is hard to say. IDGNS: I think that ties into an interesting point you made earlier: This lack of security is a fair price to pay for growth. Diffie: Look at the biggest claim of theft against Microsoft that's been made in the last 10 years. It has 99 percent penetration in the Chinese market and 1 percent payment in the Chinese market. The business asset to them of being able to claim that they were ripped off at the same time that they gained this market of 1 billion people is fantastic. Security is always political. That is to say, it always advantages somebody and disadvantages somebody else. IDGNS: What are your current thoughts on privacy? Diffie: I believe in privacy, but privacy is just one of a number of considerations. Privacy of political conversation is essential for a democratic society. Is the privacy of information about yourself necessary for it? That's not very clear. It's a very squishy concept. In small communities you have very little privacy, but you have accountability, because you know who the members of the community are. What bothers me is that information about people is so readily available in a way not auditable to them, to organizations like ChoicePoint, who broker it around and enable other people, who are not legally constrained in what they do with it, to make decisions based on it. I am, on balance, more pleased with the fact that I can learn lots of information about people in minutes by using the Web than I am concerned about the fact that people can learn lots of information about me that way. And I would not like to see laws that restrict people's ability to go investigate things. Here's my scenario: For all its current faults, it won't be 10 years before facial recognition gets incredibly good. And it will be a PC thing, not a big money thing. So everybody's camera will be saying 'Hi" to the people who go by. Putting a camera right where you sign your signature with your credit card enables any store to build up a database of its customers. So if they see you coming down the street they can change the display in the window. But then that's going to produce all these databases of information about people. Very small operations will be able to collect information. Would I like to see that outlawed? I doubt it. I think what outlawing it would be saying [is] that certain classes of big boys -- the Fortune 1,000, the secret police -- would be allowed to have access to such information, but you little irresponsible children won't be. So I have a cowboy viewpoint on this.
659320
Jonathan Corbet talks about the development process, why Sun's ZFS won't become part of the mainline Linux kernel and other issues.
126613
(InfoWorld) - Microsoft's Ben Fathi has a new job now that Vista has shipped, but the man who led the company's Security Technology Unit is still focused on keeping the bad guys away from your PC. Fathi is now corporate vice president of development with the Windows Core Operating System Division, and is in charge of building the guts of the OS -- things like the kernel, networking, and security. IDG News Service sat down with him recently to discuss the future of Windows security. With the first Vista bugs now being reported, Fathi says it looks like Vista is on track to meet his own stated goal of having half the flaws that plagued XP during its first year. Following is an edited transcript of the interview, conductedÂ last week at theÂ RSA ConferenceÂ in San Francisco. IDGNS: What's going to be the big security story in 2007? Fathi: What we've done in previous OS releases and Vista and what our security partners are doing has treated security as a defensive measure. It's a way of stopping people from attacking you. What we want to do now is move to a world where we actually enable and simplify collaboration between different individuals, by making sure that those connections are end-to-end, that you can provide very fine grained control over the people, the applications and the resources that you give access to. IDG: So what are you doing to make that happen? Fathi: There are a number of things we are working on. For example, isolation. We look at isolation in terms of network isolation, whether it's IPsec [Internet Protocol security] or putting in firewalls, or SSL VPN [Secure Sockets Layer Virtual Private Network]. What we want to do is provide a better layer of isolation at the operating system level. We're looking at putting hypervisors underneath the operating system and building attestation and building a hardware root of trust on the machine. What that means is that today, if a rootkit makes it onto your machine, it can do a hyperjacking. It can take over the OS or it can even get underneath the OS so that any software you're running, like Kernel Patch Protection, won't even know that it's being lied to by a piece of malware underneath. What we want to do is put the hypervisor there and use things like the TPM [Trusted Platform Module] chip to make sure that the entire boot path is protected and secure and we can trust it and it hasn't been tampered with. This also gives you the ability to create isolation by creating partitions on the machine. Let's say you're running a server. If you consolidate your server workloads onto a single big machine -- you have a Web workload and a file server workload and a database workload. You want to protect that database workload because you're running your line-of-business apps on it. Just because somebody broke into your Web server doesn't mean they should be getting access to your database or your file server. IDGNS: Are you surprised by the number of Vista bugs that you've had reported since the launch? Fathi: I made a statement six or nine months ago that I would like to see half as many vulnerabilities as XP in the first year. Obviously I'd like less than that. I'd be happy with zero. But I think it's reasonable to say, given the additional complexity and given the additional size of Vista, that half as many would be a great goal. Am I surprised with the number? No, I think it's been a relatively small number of vulnerabilities in the three months we've been out. And given the fact that we proactively went out to the Black Hat conference and handed out copies of this, and that a couple of million people have been using Vista in test versions for the past year or so, that tells me that there are already hackers out there that are trying to attack it. So given that there are less than a handful of vulnerabilities discovered, I think that's good progress. IDGNS: And you're on track for that half as many? Fathi: I think so. Ask me again in six months. Â
342998
Security experts are warning of a zero-day vulnerability with Sun Microsystems Inc.'s Solaris 10 and 11 OSes.