Previous Thread
Next Thread
Print Thread
Rate Thread
Joined: Sep 2002
Posts: 390
Shinobi Offline OP
UGN Member
OP Offline
UGN Member
Joined: Sep 2002
Posts: 390
Despite taking a beating in the press and from customers for security holes in its products, decision makers at Microsoft appear to think the company still has something to teach the world about computer security. The company this week published a technical white paper that describes its internal security practices, which Microsoft hopes will "help customers successfully secure their environments," the company said.

The paper, simply titled "Security at Microsoft," details the methods and technologies that the company's Operations and Technology Group (OTG) use to secure the company's global corporate network of more than 300,000 computers and 4,200 servers.

In the paper, Microsoft describes its risk management strategy, which involves classifying different computing resources according to their "value class" -- from servers hosting the Windows source code down to test servers. Microsoft also provides guidance on how its security group assesses the potential risks and threats to those assets and creates policies to secure the assets that are appropriate, given the value of the data they contain.

Just as interesting are the tidbits of information about Microsoft's security operation that can be gleaned from the document. For example, Microsoft discloses that the company experiences more than 100,000 intrusion attempts each month and receives more than 125,000 infected e-mail messages.

To protect corporate assets from threats introduced by remote workers, Microsoft said it has invested heavily in smart card technology, deploying more than 65,000 smart cards to remote workers that enable them to log on to the corporate network using two-factor authentication.

The company is also candid in admitting to past security failures, acknowledging that the company has been attacked in the past and that "there is a medium to high probability that within the next year, a successful attack will occur that could compromise the High Value and/or Highest Value data class," such as source code or human resources data, according to the document.

Microsoft also says that prior to reforms enacted by the OTG in recent years, the company had no formal, enterprise-wide system for managing its source code. Instead, Microsoft's source code management was characterized by "redundant infrastructure and inconsistent processes," as well as inadequate security, according to the document, Microsoft said. At one point, any computer on the company's network could access the Source Depot servers storing the company's source code, creating a situation in which "the compromise of a single computer on the corporate network could potentially lead to penetration of one or more Source Depot servers," according to the document.

Microsoft is equally candid about its struggles to enforce strong user passwords and thwart a flood of intrusion attempts on its rapidly growing network.

Perhaps not surprising, the company also takes a tough stand on software patching on its own networks. Microsoft centrally monitors the patch level of machines on its network using its own Systems Management Server 2003 product, enforces the application of security patches "without end-user intervention" and prohibits users from disabling security patch management features without "an approved exemption," according to the document.

The candid discussion of Microsoft's internal security operation is part of a company-wide effort to improve communication with its customers about security issues, according to Mike Nash, vice president of Microsoft's Security Business Unit.

In addition to publishing the white paper, Microsoft has started broadcasting monthly webcasts featuring senior security executives, who articulate the company's message on securing its products and answer questions from IT professionals about where to find software patches and technical information, Nash said in an interview on Monday.

The company has also launched a new security portal called the "IT Pro Security Zone" that brings together information on security best practices and provides access to Microsoft MVPs (Most Valuable Professionals), experts on the company's technology who are active participants in technology news groups and online discussions.

The new resources address technical questions and are intended for IT professionals more than end users, Nash said.

One prominent member of the technical community, however, said that Microsoft didn't spread the word about the IT Pro Security Zone or the new white paper.

"They're not sending any of that stuff my way," said Russ Cooper, surgeon general of TruSecure and moderator of the NTBugtraq security discussion list, which focuses on Microsoft products.

After reading the white paper, Cooper said that it probably had more public relations than technical value, especially with a reading audience made up of administrators at companies with constrained budgets.

"Hey, if I had a US$50 billion war chest, I'd do some of these things too," Cooper said.

"My god, they deployed 65,000 smart cards. I mean, it's wonderful if you can get that kind of budget, but I know people who can't get approval for an antivirus e-mail gateway," he said, noting that smart cards can cost between $50 and $100 each.

Microsoft also could make the document more useful by providing more examples of projects the company completed to secure its network, he said.

Microsoft detailed one project in the whitepaper, to separate managed and unmanaged computers on Microsoft's network, was not complete, and said that it was just beginning one core component of the project, Cooper said.


"The secret to creativity is knowing how to hide your sources."
-Albert Einstein

Tech Ninja Security
Joined: Sep 2002
Posts: 390
Shinobi Offline OP
UGN Member
OP Offline
UGN Member
Joined: Sep 2002
Posts: 390
Sorry I forgot this

The Source


"The secret to creativity is knowing how to hide your sources."
-Albert Einstein

Tech Ninja Security

Link Copied to Clipboard
Member Spotlight
Phatal
Phatal
Houston, TX
Posts: 298
Joined: April 2004
Forum Statistics
Forums41
Topics33,840
Posts68,858
Average Daily Posts1
Members2,176
Most Online3,253
Jan 13th, 2020
Latest Postings
Where and how do you torrent?
by danni75 - 03/01/24 05:58 AM
Animation,
by JohanKaariainen - 08/15/19 01:18 AM
Blackbeard.....
by Gremelin - 10/03/18 07:02 PM
my old account still exists!
by Crime - 08/10/18 02:47 PM
Okay WTF?
by HenryMiring - 09/27/17 01:45 AM
The History Thread...
by Gremelin - 08/11/17 12:11 PM
My friend NEEDS your HELP!
by Lena01 - 07/21/17 12:06 AM
I'm having fun with this guy.
by gabithompson730 - 07/20/17 01:50 AM
I want to upgrade my phone
by gabithompson730 - 07/20/17 01:49 AM
Doom 3
by Cyrez - 09/11/14 08:58 PM
Amazon Gift Card Generator/KeyGen?te
by Gecko666 - 08/22/14 09:21 AM
AIM scene 99-03
by lavos - 09/02/13 08:06 AM
Planetside 2
by Crime - 03/04/13 07:10 AM
Beta Testers Wanted
by Crime - 03/04/13 06:55 AM
Hello Everyone
by Gremelin - 02/12/12 06:01 PM
Tracfone ESN Generator
by Zanvin Green - 01/18/12 01:31 PM
Python 3 issue
by Testing - 12/17/11 09:28 PM
tracfone airtime
by Drache86 - 07/30/11 03:37 AM
Backdoors and the Infinite
by ZeroCoolStar - 07/10/11 03:52 AM
HackThisZIne #12 Releaseed!
by Pipat2 - 04/28/11 09:20 PM
gang wars? l33t-wars?
by Gremelin - 04/28/11 05:56 AM
Consolidate Forums
by diggin2deep - 04/21/11 10:02 AM
LAN Hacking Noob
by Gremelin - 03/12/11 12:42 AM
Top Posters
UGN Security 41,392
Gremelin 7,203
§intå× 3,255
SilentRage 1,273
Ice 1,146
pergesu 1,136
Infinite 1,041
jonconley 955
Girlie 908
unreal 860
Top Likes Received
Ghost 2
Cyrez 1
Girlie 1
unreal 1
Crime 1
Powered by UBB.threads™ PHP Forum Software 7.7.5