[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: Your Opinion +

Mark Litchfield wrote:

Consider the Anti-Trust law suits filed against MS by AOL regarding IE and RealNetworks regarding Windows Media Player back in 2003, lets say for discussion, MS now turn around and offer up their 'Security Applications' for free. You know exactly what is going to happen.

Why do you care? Microsoft is the only OS vendor in a monopoly position, and it certainly doesn't need advice from anyone. Nor it would matter, considering that Microsoft already bundles malware removal tools, provides an interface to port blocking "firewall" functionality in Windows, and includes anti-phishing service with its web browser. Everyone else can bundle whatever he wants.

I guess my point is, whilst I appreciate the common comment, what other options are available to an OS vendor. Offer it up as a free download (not bundled within the OS) allowing the end user to make the decision, or to carry on charging for it ?

You can't make an insecure OS secure by adding "security software" to it. You do it by designing OS in a secure manner and by removing vulnerabilities. First is an essential part of the OS design, and OS design is (or at least should be -- this is why monopolies are dangerous) the reason why users want it in the first place. Second is usually provided to users for free because the alternative would be keeping systems insecure and eventually compromised -- a cause of massive embarrassment for the vendor and deterioration of the safety for all users (compromised systems are used for attacks that would otherwise be impossible).

Another common theme has been, that the OS should be secure in the first place. Again I agree with this, but as someone indicated developers schedules are being dictated by their marketing departments with shipment dates, so regardless of their intentions to code securely a vulnerability is likely slip through.

Vulnerabilities are not negated by addition of "security software", so this is a moot point.

If vulnerability is found it should be fixed, and if the vendor's development process produces too many of them, vendor has to pay (in money and developers' time that would be otherwise spend on improvements) for more fixing, additional testing and auditing. That process will eat into initial savings made by rushed development process, so maybe this will force the vendor to revise its development policy.

With regard to third party security solutions outside of the OS vendor, in reality how many new security issues does their software introduce to a fully patched OS.

"Security software" does not increase the security of any computer unless it's a replacement of an insecure vendor-provided component or product. Those things aren't even usually called "security software" -- for example, use of Mozilla-based browser makes Windows desktop more secure not because Mozilla-based browsers are designed as "security software" but because it allows the user to not use Internet Explorer, and it contains less, shorter living or easier to avoid vulnerabilities than the product it replaces.

The products that are usually called "security software" usually are in the following categories:

1. Data filters/sanitizers. All kinds of "firewalls", email filters, on-access virus scanners, etc. that add themselves into some data transport mechanism (network connections handling, filesystems/storage, OS-specific configuration repository access) and look for known-bad signatures and possibly malformed or suspiciously formatted sequences. Detection of such potentially harmful data usually results in offending data being truncated, corrupted, connection or operation canceled, etc. in hope that it will prevent an intrusion.

2. Local intrusion detection and cleanup. Software that runs on potentially compromised computers looking for signatures, altered files, inconsistent responses from system interfaces and other evidence of compromise. Results are reported to the user, and if the symptoms match some known piece of malware, software performs some "cleanup" action that hopefully removes or deactivates it.

3. Local intrusion mitigation software. Software that runs on potentially compromised computers and implements some access policy for some system interface (filesystem, network, configuration) that the system otherwise would not have. Often "policy" is reduced to asking the user to confirm operation, and returning the offending application an error if the user denied it. It is assumed that if some malware is already running on the computer, user or built-in policy may recognize some of actions as being out of the ordinary and prevent malware from causing some damage.

This is the closest thing to "making system more secure", however it is inadequate replacement for OS design that implements a secure access restrictions/policy in the first place, and usually much more difficult to implement.

4. Remote intrusion detection software. Software that runs in environment expected to be secure, and monitors activity that is happening in some other environments to detect possibly compromised ones. Though usually a network sniffer running various analysis procedures applied to the traffic produced by potentially compromised computers, now it can be also implemented as a part of virtualization environment -- one virtual machine polices the network, storage and device access performed by others running on the same physical host.

5. Backup software. Though not usually recognized as such, it is an essential part of any reasonable post-intrusion recovery procedure. Again, recently increased popularity of virtualization gave us a more convenient kind of backup, recording a full virtual machine state for instant rollback to the pre-intrusion condition.

6. Offline intrusion detection and cleanup. Same as #2, but runs is a special secure environment while accessing potentially compromised storage. Boot CDs and network boot images with virus scanners are in this category. Running a virus scanner on a filesystem/storage server may be in this category, too, however more sophisticated on-access scanner will be in category #1, a filter.

7. Penetration testing software. Imitates attacks (known or potential, or produces an attack-like traffic or pattern of access), checks the results.

8. Quick recovery to the known-good state. Restores known-good image from read-only media while discarding everything else.

None of those things can make an insecure system into a secure one. None of them work worse or better if the system it protects is secure or insecure. They merely provide a way for the user to prevent or counteract a set of compromise scenarios. Computers are still vulnerable to all possible exploits of all security bugs and deficiencies that their software has, "security software" merely decreases the probability of successful intrusion, and in the case of successful intrusion may reduce the consequences (amount of altered, erased or disclosed data, control of resources, time the system spent being compromised). Please note that in "still vulnerable" I include the situation when a filter prevents a certain common virus, worm or exploit from compromising the system, yet an altered version of it, exploiting the same vulnerability would still pass it and succeed. System is still vulnerable, merely not compromised yet.

This has nothing to do with the actual security by design that is based on lack of exploitable vulnerabilities and strictly limited scope of damage that can be possibly caused by exploits and user errors.

Except for category #3, that is an inadequate crutch for insecure system design, OS vendor shouldn't have any advantage over anyone else in developing those things. And #3 is a bad thing for the OS vendor to make anyway.