Working in the Microsoft Security Response Centre (MSRC) has been voted number six out of the ten worst jobs in science in 2007, however Microsoft staffers reckon there is nowhere else they can find an opportunity like the ones they meet every day.

Analysts also believe the hard work done in the MSRC is starting to pay off, and agree that the ranking is a hangover of past product vulnerabilities.

Only in the MSRC do you come to work knowing that what you did today can help protect hundreds of millions of people around the world from malicious attackers

Mark Griesi — security program manager, MSRC

This month, US-based Popular Science magazine listed its annual top ten "Worst Jobs in Science" awards, with work in the MSRC pipping professions such as whale-faeces researcher, forensic entomologist, Olympic drug tester, gravity research subject for the middle-of-the-road ranking.

The top five professions as nominated by Popular Science magazine were coursework carcass preparer, the humble garbologist, an elephant vasectomist, oceanographer and finally hazmat diver.

The article said working as a Microsoft Security Grunt was "like wearing a big sign that reads 'Hack Me'" and called the work manning the secure@microsoft.com as tedious.

But work at the MSRC, however "tedious" it may already be, could be making practical advances in Microsoft's operating system security.

According to the recent Microsoft Security Intelligence Report, new vulnerability disclosures increased 41 percent in 2006.

In a blog post dated June 15, 2007, published on IDG's US CSO online Web site, Microsoft's Trustworthy Computing Group Security Strategy Director, Jeff Jones, perfomed an anlaysis on Windows Vista vulnerabilities since the six-month launch of the operating system, saying "it does seem like there are more researchers, better trained and with better tools and techniques than ever before ... creating an ecosystem better able to find and disclose security vulnerabilities".

A link to the blog and vulnerability report is available here

Jones added that during the first six months Windows Vista was available, Microsoft released four security bulletins and relevant updates addressing a total of 12 vulnerabilities affecting Windows Vista.

In the first six months of Windows XP's availability, according to Jones, Microsoft fixed a total of 36 vulnerabilities in the first six months (including three vulnerabilities in Internet Explorer disclosed and fixed three weeks prior).

23 of the Windows XP vulnerabilities were rated high by the US National Institute of Standards (NIST) in the National Vulnerability Database (NVD).

The study also compared vulnerabilities released in Red Hat Enterprise Linux 4 Workstation, Ubunutu 6.06 and Novell SUSE Linux Enterprise Desktop.