![]() |
||
![]() |
|
|
February 17, 2005Clarke on MicrosoftWednesday at the RSA Conference, I was able to grab a few moments with Richard Clarke, the former White House cybersecurity and counterterrorism adviser, as he left the Moscone Center after appearing on a panel. See this story from today's paper for his rather pointed comment on the notion of Microsoft offering its own anti-virus and anti-spyware software. Here's what Clarke said on another topic -- his desire for Microsoft and other software companies to be held accountable to standards for secure software development: "I think every software company should say what it does, specifically, to have quality assurance in software code writing and development. Ideally that would be generally accepted best practices derived from what Oracle does, what Apple does, what Microsoft does, so they can learn from each other's best practices and there will be a generally accepted set of best practices, and then we would know if people were living up to them or not. We could get a third-party auditor to come in and check whether or not they were living up to them. Until that happens, we really don't know whether it's all rhetoric or not." During the earlier panel discussion, Clarke had explained that the concept would then let the marketplace judge the companies based on whether or not they adhered to those practices. For today's story, I asked Microsoft to respond to Clarke's comments on the subject. Here's the full statement from Amy Roberts, director of product management in the company's Security Business and Technology Unit: "Many software companies including Microsoft are serious and committed to security and are making substantial investments in improving software on multiple fronts to protect customers from malicious attacks. At Microsoft, we feel that writing secure code is so important that we have formalized our security efforts by adopting a 'Security Development Lifecycle,' published our methodologies, including books on writing secure code and threat modeling, made our tools available to independent developers and offer formal training on security. Microsoft is active in organizations such as the Secure Software Forum, working with other industry leaders, to focus on application security as a life-cycle and industry-wide issue. The market is demanding security now and that hard work is going forward already."Posted by Todd Bishop at February 17, 2005 08:57 AM Comments
Bottom line? This is what I told them they would have to do way back in 1997-1998. Gates and I and many other executives read my weblog. So I posted last year about using their embedded system. I knew I won the argument when I was on a bus going past Microsoft and they were flying a flag no one had ever seen before - one for Microsoft embedded systems. On their own website I found case studies by some of their OEMs which were using the embedded product to make alternative system. I've been viscously attacked by some of them over these design issues. In the computer industry our standard for security is to build various security shells. Nothing from the outside should be able to get to the core. So I've got Microsoft now referring to Longhorn as Microsoft new client system. It's all on my weblog. I have one of the oldest weblogs or blogs on the Internet. I've been doing this since we were only in text. I was taught design from the old master at IBM. I knew some of the people at NeXT and that they were working with the CIA. Apple bought NeXT. Now Apple and IBM are working together. Believe me, the people who have harassed me have really screwed up big time. When I managed to finally get Microsoft to put up the security page on their web, I would ask some of the older retired engineers how come they could fix these problems so fast. The reason was because they knew about them all the time. Microsoft is literally going under due to attrition. Gates needs to find 7,000 people this year and he can't find them. He especially can't find the people with Ph.D. in security to work for him. Microsoft has been black balled due to my web. I have an underground like you couldn't believe. Now interview Peter Neumann from SRI. Everyone loves P. LOL I acted as a go between for Gates for years, then in 1999 we got caught. It's all in court document. All of it. Posted by: Joan L. Brewer at February 17, 2005 10:05 PMBruce Schneier wrote in Crypto-Gram We have a situation here that Microsoft will need to deal with. The pirates have won along with Microsoft. The average PC user is less secure. Microsoft is working hard on it. So are the pirates and maybe smarter too. Windows appears very easy to crack. There may be more tools for cracking Windows, than tools for fixing it. It might not be worth fixing, if that is even possible. I would think that Microsoft Passport has been cracked more than once. I don't know and I really don't care much. It's a big problem. Posted by: Jim Dermitt at February 17, 2005 10:22 PMPost a comment
|
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Home | Site Map | About the P-I | Contact Us | P-I Jobs | Home Delivery | |
![]() 101 Elliott Ave. W. Seattle, WA 98119 (206) 448-8000 Home Delivery: (206) 464-2121 or (800) 542-0820 Send comments to newmedia@seattlepi.com ©1996-2005 Seattle Post-Intelligencer Terms of Service/Privacy Policy
| |