Vulnerability exploited by MSBlast exposes security: MS - News - Security

To print: Select File and then Print from your browser's menu

--------------------------------------------------------------
This story was printed from ZDNet Australia.
--------------------------------------------------------------

Vulnerability exploited by MSBlast exposes security: MS

By Patrick Gray, 0
August 14, 2003
URL: http://www.zdnet.com.au/news/security/soa/Vulnerability-exploited-by-MSBlast-exposes-security-MS/0,130061744,120277213,00.htm

The head of Microsoft's Trustworthy Computing initiative, Scott Charney, says the Windows vulnerability the MSBlast worm is based on is a sign the software heavyweight has "a lot more work to do".

During an interview with ZDNet Australia , Charney said he was disappointed when the software bug, which affected Windows Server 2003, touted as the most secure Microsoft operating system ever, was unearthed.

"We have always said that Windows Server 2003 would not be bullet-proof," he said. "It's disappointing. Is it surprising? No... it just means we have a lot more work to do."

Disappointment seems an appropriate reaction -- the company spent US$200 million in an attempt to secure Windows Server 2003 by standing down 8,500 developers for security training.

However, the security boss defended Microsoft's product security and said the company's products have a disproportionately bad reputation.

"To some extent Windows is as secure, if not more secure, than many other systems, but the fact of the matter is we have market share and with that comes increased responsibility," he told ZDNet Australia . "Even if we're doing better than everyone else, that's great, but we have to do better still."

"Software's complex and it's not likely we'll get the number of bugs to zero but we have to do a better job than we've done to date," he added.

As for the threat of a 'cyber terrorism' attack, Charney says there's a lot of hype out there.

"As difficult and as problematic as an event like Slammer might be, it doesn't compare to the World Trade Centre [attacks]... If you're trying to provoke terror the Internet may not be the best medium for that."

The real threat, he said, will come from a blended, co-ordinated threat, for example an attack on telephone infrastructure prior to a physical attack -- such as the world trade centre disaster -- and would be intended to disrupt emergency response capabilities.

"I think many of us in the field are concerned about the fact that a more co-ordinated terrorist attack could be the problem."