Microsoft gets credit for tightening security
642037
(InfoWorld) - CodeRed, Nimda, and Blaster. These high-profile worms, which exploited flaws in Microsoft's Windows operating system and other applications, made Microsoft the butt of security jokes and forced the company to reexamine its approach to developing secure software. "Throughout Microsoft, we thought Windows 2000 was a very solid, reliable operating system, perfect for deployment in the enterprise," said Ian Hellen, a security program manager at Microsoft's Windows Security Engineering Team. "Those tiny pieces of code were realÂ wake-up calls, saying Windows 2000 isn't there yet. It's just not designed to cope with these kinds of threats." That was then. With the commercial release of Vista just months away, Microsoft'sÂ efforts to improve securityÂ are now showing results, though much remains to be done by the company, said security experts attending the Hack In The Box Security Conference (HITB) in Kuala Lumpur, Malaysia, this week. "Microsoft has done a left-hand turn in its business and said, 'Right, we've got to start building secure applications,'" said Mark Curphey, vice president of professional services at McAfee's Foundstone division. "They've implemented a very rigorous process across their organization and now they're starting to see the benefits of that." The progress that Microsoft has made can be seen in recent versions of software, such as Microsoft Internet Information Services (IIS) 6, which has had one high-risk vulnerability uncovered, Curphey said. "They've done a lot better," said Bruce Schneier, the chief technology officer of Counterpane Internet Security. Curphey and others credit Microsoft's Security Development Lifecycle (SDL) software-development process with reducing the number of design and coding errors that lead toÂ security vulnerabilities. "We spent a long time trying to reorganize our whole development process so that all of Microsoft's products, particularly the Windows operating system, is reoriented to have security engineering at its core," Hellen said. To some degree, Windows XP Service Pack 2 and Windows Server 2003 demonstrate how SDL has helped Microsoft improve the security of its products. "But it's really only in Windows Vista that we've been able to implement this in a comprehensive way," Hellen said, adding there is room for further improvement. One security improvement that has yet to be made to Windows Vista is a defense against Blue Pill, a prototype technology that uses hardware virtualization to install undetectable malware on a computer running the OS. Blue Pill, developed by Polish researcher Joanna Rutkowska, was first demonstrated using the second beta release of Vista. However, the latest pre-production release of Vista, called RC1, does not include defenses against Blue Pill, Rutkowska said, adding she was "surprised" by the omission. Blue Pill does not exploit any bugs in Vista, but Rutkowska recommended Microsoft disable paging of kernel memory in Vista, which would prevent Blue Pill from accessing the operating-system kernel and executing code. In response, Microsoft executives attending HITB said the company continues work on improving security in Vista, while making no specific promise that changes will be made to prevent Blue Pill attacks in the production version of Vista. Microsoft gets credit for improving the overall security of its products, but more can be done. However, users must first decide if the company's progress in this area is sufficient. "If we think it's enough, we're done. If we don't, than we have to do more," Schneier said. "They're going to fix the problem to the limit of their economic losses." One option is to make vendors like Microsoft liable for the economic risks of the security vulnerablilities that users face -- something that is unlikely to happen given the current political environment, Schneier said. "If we want more security, we have to raise the cost of not having it," he said.ADVERTISEMENTMAKE SOA REAL WITH IBM WEBSPHERE PODCASTStreamline processes and maximize efficiency within a proven service oriented architecture. Take back control of your business processes with IBM WebSphere.
513233
It's not out of the woods yet, said security researchers at this month's Hack in the Box conference, but Microsoft deserves praise for making a "left-hand turn" in its attitude toward security.
65644
The free service pack is a major overhaul aimed at defeating a wide variety of security weaknesses that hackers have exploited. Microsoft says the easiest way to obtain
22202
Microsoft Corp. released 10 security fixes for various products yesterday, including seven that fix flaws the company said pose the highest threat to users.
21361
Microsoft began rolling out SP2 last week, claiming that the software offers the latest security &#39;innovations,&#39; fixes several major security holes, and provides new protective features.
599952
Microsoft said Thursday that it is enjoying success with its campaign to increase IT security for customers of its products worldwide.
446936
Hackers take advantage of a flaw in various Microsoft programs that leaves PCs vulnerable to remote attacks. Security experts expect the threat to grow.
549959
Microsoft Corp. today released an unprecedented number of software security updates to plug flaws in its products, including seven &quot;critical&quot; defects that it said hackers could use to hijack
514988
By BRIAN BERGSTEIN NEW YORK - Microsoft Corp. took great pains to improve security in its newly released computer operating system, Windows Vista, redesigning it to reduce users' exposure to destructive programs from the Internet.
381915
Microsoft issues patches for holes that could allow remote attackers to gain control of your PC.
579063
Microsoft apparently yanks promos that peddled 'security fix' through misleading threats.
644765
Criticized for a program that only provided some of its largest customers with warnings on security problems in its products, Microsoft Corp.
176052
Microsoft has issued a patch to fix the security flaw, and urges its customers to use a new utility to locate the computer applications that are vulnerable.
492278
Microsoft Corp.  issued  six "critical" security patches on Tuesday to fix flaws in its  software products that the company warned could allow attackers  to take control of a user's computer.
572572
Microsoft is again pledging to improve the security of its software by beginning to notify customers of upcoming patches. However, the promise came just as experts warned that attack code exploiting
735918
Microsoft Corp. published six security fixes &#151; half of them rated "critical" &#151; in its regularly scheduled software update Tuesday.
79374
Microsoft Corp. today released an unprecedented number of software security updates to plug flaws in its products, including seven "critical" defects that it said hackers could use to hijack vulnerable computers running the Windows operating system.