News

Microsoft's new focus on security is paying off, but the company still has a long way to regain its customers' trust, according to the company's security program manager, Jesper Johansson.

Johansson — a Ph.D who left academia in search of more hands-on tasks — discovered security holes in Windows and warned Microsoft, and eventually got offered a job in Redmond.

He is the author of several documents with practical tips on how to avoid security gaffes and tips on hardening Windows installations.

Some of the work he is involved in at Microsoft includes building security into the design lifecycle of applications.

“We train developers to write better code and build threat models that show how an attack could happen,” he said.

A fan of OpenBSD, the open source operating system that emphasised security over everything, Johansson said Microsoft also vetted its code for holes.

“Automated tools check code for known security issues, and we have an internal penetration testing team plus use third-party consultants for this,” he said.

Although Johansson has said that system could not ever be completely secure — at least not if you were planning on using it and that the best security tool was a wire-cutter (for snipping the network connection to the system), he maintained that despite this, it was possible to achieve a workable level of security.

“Security is a process that changes constantly” he said, when asked to explain his statements.

The conflict lies in usability — the best-working IT solution is the one that is transparent to users — which hurts security as it increases the attack surface, according to Johansson.

Usability and security could marry, but it wasn't cheap due to the greater amount of effort required, he said. Does management understand this?

“Not quite,” Johansson said. "They are beginning to understand, but we are still seeing the ‘stare so hard at a tree that you don’t see the whole forest’ syndrome with customers.”

He admitted that Microsoft had "lost a lot of trust” due to the way it traded off security for usability and features in the past, and said it would be a gradual change before users discover that our products were safe.

He held up the small number of security advisories for Windows Server 2003 as an example of the emphasis on safe computing is working and what customers should consider.

“We have halved the number of security advisories for Windows Server 2003 compared to Windows 2000,” Johansson said. However, he said there was room for improvement because Microsft was not proud that there had been 25 advisories for Windows Server 2003.

The real success security success story was the latest version of Microsoft's web server, IIS 6, he said.

There has only been one security advisory for IIS 6, and that was for an obscure hole that would be difficult to exploit, according to Johansson.