IT Employment

Ask something
Discussion Locked

Who's responsible for security?

0 helpful
96 replies

by discussion

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.
In this week's Security Solutions column, Michael Mullins says that Microsoft produces software, not security. Do you agree with him? How responsible should Microsoft be for the security of its products? What do you think of the idea that admins' failure to patch, rather than Microsoft's flawed software, is to blame for the recent Slammer attacks?

96 replies

by jellimonsta

I think any major software producer should take some responsibility in producing the most secure, stable piece of software they can produce. On the other hand the 'out of the box' secure OS still would not suffice in my opinion. Sure they could makeit secure to the best of their abilities but chances are there is always going to be some area of exploitation for would be hackers. That in mind, leading Admins or uneducated users to believe their system is completely safe out of the box is setting them up for a fall.

by dennisjh

While the attempt to make a "quality" product is admirable, there is not one man-made thing in the universe that is perfect. Even nature has its own issues with perfection. Two words; Duck-billed platypus. While Microsoft is a software company, it is also a business. In order to be profitable, it needs to be 1st to market and thereby may not build the "perfect" code. When consumers start to demand better products, then we may start to get them. I do not blame Microsoft for Security lapses. The people that write worms, bots and other malicious code, are the ones at fault. If the criminal did not exist, there would be no crime. Idealistic? Maybe, but with an excuse. How do you test multiple million lines of code for every possible flaw? You can't and they don't. So live with it and be aware that they do release patches in a very timely manner and allow all users of the product, whether in warranty or out, to download and install the fixes. It then becomes our resposibility to maintain our software. Is it GM or Ford's resposibility to have your oil changed? No it is yours. You own the car.

Dennis

by jellimonsta

I totally agree with you. Hardware is always better than software so if people want security buy a hardware firewall. Not to say there should not be some software firewall solution implemented also, but I still believe hardware is the way to go. I think M$ does do its part in created and making available patches and fixes for known security and operational problems. I also totally agree that there is no way they would go through every line of code for flaws. Imagine when M$ brings out the CRM/ERP solution, there is no way they are going to weed through those millions of lines of code for flaws. That is why I usually wait a year before I implement their 'new' technology :)

by hal 9000

Sure it your responsibily to chance the oil/brake fluid or what ever else on a routine schedule. However if a basic design flaw is discovered it is the responsibility of the manafacture to recall the product and fix it at their cost. Example Ford about 15 years ago recalling a whole bunch of cars that had holly carbs fitted that failed and could result in a fire. Mercedes Benz recently recalled an obsolute model just because they thought that a brake line might give some problems. If a company was to make anything from a car to an eletric jug that proved unsafe it MUST BE RECALLED and repaired/replaced at the companies cost! How does MS get away with their pratices?

by lordinfidel

What came first, the chicken or the egg?

That is really the question when it comes to security.

MS is responsbile to make sure that their source code is secure. Same with other software providers.

The hardware vendor is responsible that their drivers are secure and stable.

The sys admin is repsonsible for making sure that the machines are installed properly and secured.

The fwl admin is responsible for making sure the network is secured.

The ISP's are responsible for effective monitoring and precautions at their borders and within their networks.

But, their has to be a "the buck stops here". It is the responsibility of the security officer to make sure that their network is secure. That includes testing all software installed. Regardless of who it comes from.

As long as the vendor identifies a vulnerability in their software and supports a patch to fix it. Then they have done their job.

It is up to the admins then to apply the fix.
It is also up to the admins to take appropiate security measures prior to a machine being connected to the net.

If an admin does not follow standard security practices and relies solely on the software vendors for their security. Then it is the admins fault.

by support

The patch most not only be posted, but it must also work. By "work" I mean it must solve the problem it is supposed to address and not break anything else.

Case in point - MS just recently pulled an NT patch from their site which caused many servers to crash unpredictably until the patch was removed. Simply publishing a patch is not the limit of the vendor's responsibility. In the meantime, if the relevant vulnerability is exploited on those machines it still is NOT the fault of the admin for not patching.

I lost a test server to this patch (and to others, granted) and have had to make the calculation many-a-time: do I roll it out to production or not? Patching servers is a crap shoot at best, and sometimes you just gotta have faith. But sometimes you just can't afford to leave the fate of a system up to the whims of the server gods.

I have a life, and I don't relish staying late to rebuild a system because the patch won't back out. I don't relish coming in on the weekend either - I've worked hard for the last 5-6 years to make my domain rock-solid reliable so that I can see my wife and kids on a regular basis.

Those of you who have time to burn have your own priorities. My priorities are different. My (production) servers aren't broken, and I want them to stay that way. It takes time to keep up with the latest vulnerabilities and I still take the time to keep up but the truth is I do have other things to do, like trying to make sure our business continues to make money and I continue to draw a salary.

I'm in no rush whatsoever to bring my network crashing down around me. Furthermore, I don't think I *should* be in such a great hurry to do so either.

by lordinfidel

The issue is, who is responsible for security.

It goes without saying that if a vendor publishes a patch that it should work.

But that's not what we are talking about.

The matter at hand is, does the vendor have a resonsibility to hold the admins hand and make sure that their systems are secured.

I say no, because there is different levels of security. No one area can be governed by another.

(I've started on my cissp, so I have a different outlook on the "buck stops here" for responsibility.)

Security of a network rests with the Security Officer. A network just does not consist of the OS. There are lot's of different levels to it. And each level has to be secured.

Which is why "security-in-depth" is preached. Youcan not just rely on the firewall. And you can not just rely on the OS. And you can not just rely on passwords.

But in this "exact" scenario of the sql worm. A properly configured firewall would of have blocked the worm from entering. Regardless of whether or not the system was patched.

by eziots

Let me see if I can sum this all up.

1) Nobody in there right mind loads a patch on a production system, until they have tested it in a test environment, that mirrors production. Being in IT for a while, you basically learn this is the rules of the road.

2) If your company management is serious about security, then you probably have an investment in Update export, Shavlick, Microsoft SUS or other patch management systems. If you dont, right now, would be a very good time to get it in the budget.

3) Just like building a house, it takes alot of planning preparation, and thinking with the end in mind, which means just that, What do you want your security posture which is protecting your companies critical data to be at when you are done building your network. I can assure you if you dont design security into your servers from the begining, you are doing your company its users, and your fellow colleges a disfavor.

4) Security on any system isn't trivial, nor is it easy to convince the non-security knowledge big-wigs that it is needed, and no that on-line game of DOOM, or EverQuest, ( EverCrack as I like to call it) will not be tolerated on the network.

5) The begining of the security setup is policy, which is enforced an recognized by management and supported from the CIO on down. If you dont have this you might as well forget the rest fo your efforts, because you will be fighting an endless battle to secure things.

6) It is your responsibly to secure your systems, and to provide documentation and good solid bussiness reasoning on why things are being locked down and what it does to help address potential problems befoere they become one.

7) Microsoft has been doing what they can to give the administrators of there systems all the tools needed to lock down systems. If you dont want to do the work, or read up on what it takes to make systems secure, that trully is your probl

by zarina

In addition, I made the management aware of the very imperfect IT world especially where Microsoft is concerned (Note this step is very important. Without their cooperation, you'd better worry on your next paycheck.) So, try to take other un-Microsoft precautions like the production server on Linux etc.,at least when the next attack of slammer worm, some of us can still produce.

by generalist

Microsoft and other software vendors should produce software that is as secure as it can be given known vulnerabilities at the time of release. They should then make sure that new vulnerabilities are repaired as soon as possible. Then they need tomake sure that the patches are easy to find and install AND that the patches don't cause additional problems.

Admins are then responsible for finding and installing these patches AND reporting to the vendors any problems they encounter.

The vendors, in return, must respond to the problems ASAP. If they appear to ignore the responses, admins may not want to do the needed upgrades because they don't want to risk down time due to upgrade side effects.

I suspect that the non-upgrading that made Slammer so effective is the result of admins that have been burned due to other upgrades, admins that need management permission to do upgrades and the occasional lazy admin.

by support

"I suspect that the non-upgrading that made Slammer so effective is the result of admins that have been burned due to other upgrades, admins that need management permission to do upgrades and the occasional lazy admin."

There's another reason too- the patch itself was butt-ugly. I had to apply it several times before it took on one NT server and at no time did it tell me why it was bombing out (the SQL script did not trap for all errors). I suspect that many admins, given less time than I was given, would have bailed out after the first round.

There's no excuse for a patch being that difficult to apply.

by steve.o'neill

Mr. Mullins makes a strong and valid point about the world's sysadmins, but truly misses the other side of the coin, which your comment alludes to.

Overall Software Quality (or lack thereof) cannot be dismissed as just another vendor software practice. MS is notorious throughout the software industry for producing software of questionable quality - even Uncle Bill himself said so in launching his latest security initiatives.

Superman couldn't keep up with all the necessary Windows patches, updates, and maintenance in most large shops - which is why Unix and Linux thrive.

Blaming the sysadmin is like blaming a Yugo owner for a breakdown. Any Honda owner can tell you that excessive maintenance is simply not necessary - just buy a quality product to begin with, and then it's possible to keep up.

It is every bit as incumbent on the vendors to produce high quality software as it is for the sysadmins to maintain it.

by timwalsh

All you have to do is take a look at te BugTraq database maintained by Security Focus Online:

http://online.securityfocus.com/cgi-bin/sfonline/vulns.pl

(remove any embedded spaces from the URL)

You will quickly see that there is NO softwarevendor (of any size) that is immune from security holes.

Why does Microsoft seem to get the most press for "flawed software?" Maybe because of the number of Microsoft products available and the extent to which Microsoft has penetrated the world market??

Vendors face a lose-lose situation. Consumers continuously want newer versions of software with better ways of doing things. If a vendor says that they are developing a new version, consumers want to know when it will be available. If a vendor refuses to give a release date so they can provide quality software, consumers claim the vendor is promising vaporware. If a vendor gives a release date and then has to revise it so that discovered bugs can be fixed, consumers claim the vendor is dragging its feet. If a vendor sticks to a promised delivery date, and the software is discovered to be buggy, consumers claim the vendor is purposely selling flawed software.

Personnally, I wouldn't want to be in the software development business.

If a software flaw is discovered (no matter who discovers it), and the vendor develops and provides a fix, and makes it known the fix is available, the vendor has done everything it can (short of writing totally bug-free software). Ifa sysadmin knows of the fix, fails to apply the fix in a timely manner, and then has problems caused by the flaw, it's the sysadmin's fault, plain and simple.

by oldefar

You have hit on most the points. Of course, blame for security problems most really go to the hackers. Software vendors retain responsibility for bugs.

As for your sympathy to the software vendors, I think the "consumers continuously want newerversions of software" is successful marketing by the vendors. I wouldn't waste my sympathy here.

by generalist

I would heartily agree that "consumers continuously want newer versions of software" is a marketing ploy by the vendors.

While I'm not against new and improved software, I would like the option of being able to stick with older, more reliable versions that I know how to run.

I sometimes wonder if the time 'saved' with newer versions is often wasted due to the training needed to use the improvements.

For that matter, I sometimes wonder what percentage of the population uses the latest and greatest improvements of any given software package. Could it be that vendors are creating a situation where you 'have' to upgrade because 'everybody else' is upgrading and you can't afford to lag behind?

by mrafrohead

But if it weren't for the hackers discovering these vulnerablilities, who would???

We'd be living in a world of holes and be totally blind to it until someone unleashed the megabomb and screwed us all. With no lubrication, I may add.

And remember, the security experts that look for holes, they're still hackers too.

And I'm sure just about all of us have taken a program apart to fix a bug in it, or restore our accounts after we have locked ourselves out of them at one time or another.
Hackers aren't bad. It's just the person that's doing the bad things that's bad.

Mrafrohead

by mrafrohead

First off, I did not read the article. But from what I am reading above in the topic I want to comment.

Michael Mullins is dead WRONG. If Microsoft wants to take on the responsibility of producing software, they also need to take on the responsibility of producing SECURE software! Production and security both go hand in hand.

From the history of software that I have seen, it is impossible to produce a perfectly secure solution as flaws are always able to be reproduced in different ways. Not to mention, different people see different things in different ways. Therefore a handful of people may not be able to see the flaw, but one person may.

Now, once a flaw has been discovered, if is the job of the Admin to secure their network. If they are not able to stay on top of their network security, they should NOT be doing the job.

What happened with Slammer is of no excuse. Patches were available with ample time to install them. There were full disclosures of the flaws andyet maybe a handful of people patched their systems.

Personally, each and every admin that missed that, should have to wear a dunce cap to work for a day that reads, "I am a bad admin and Slammer was partly my fault. I promise I won't do it again, or I will have to wear this stupid hat for a week."

Mrafrohead

by oldefar

The market place should drive what is acceptable and what is not in terms of performance. The bar gets raised as competitors bring out products that consumers prefer.

Based on this, the level of security Microsoft or any other vendor builds intotheir products will be in response to what the decision makers within ICT demand. Want more security? Select a more secure product that Microsoft.

This is important because the alternative is to legislate minimum requirements. Keep in mind, this goes beyond IT and software, so what would such laws impact? Will snacks and treats be banished if they don't meet some minimum nutritional level? No more Dew on those all nighters?!? Alcohol and blood tests required before you can start a car,plus an ID verification? High heels outlawed for women?

by mike mullins

If you're going to comment on something, at least learn "a little about it" before you shout out. For years the auto makers have produced vehicles and announced serious flaws, that we the consumer have to have fixed. Their announcement of the flaw and fix action has become an accepted business practice.

The rest of your comment echoes the column.

by generalist

One of the things that TechRepublic appears to assume is that 'everybody' subscribes to 'all' newsletters. They also appear to assume that 'everybody' knows where the article in question can be found.

It would be nice if they provided a convenient link to the article in question whenever they refer to one. I suspect that most of us don't have time to trace an article down if we don't have it at our fingertips.

On the otherhand, we do have time to make our own assumptions about the article. And I suspect that many of us can do a good job of guessing what is said.

by mrafrohead

As I stated previously in my above post. I am commenting according to the original post.

According to what was originally stated, I think that I knew more than a little about it WHEN I shouted out.

The fact that the rest of the threads coincide with what I say must reflect something there...

Thank you for your time.

by mrafrohead

A GREAT friend of mine always tells me, Low Tech rules.

There are less intrusions, bugs are usually found. You don't have to worry about all of the bloatware.

Not to mention, all of the new stuff, activation and spyware. That crap is just aninsult to us all, and vendors that support/supply this type of stuff need to be publicly stoned. I feel that ones computing habits is their own business. Not the companies that write the software. Once you have paid your dues, you own it. I don't care what any license says.

Mrafrohead

by gubment cheez

I think that Microsoft does software. because once an application is out there is no way for them to rffrctively control it. I mean you can put a backdoor in but that turns users away from a product, so the only thing that Microsoft can do (besides make more secure programs) is to supply patches to the comsumer. they could rebuild the app from the ground up to fix a problem but that would take away from their precious coffers (as if they didnt have enough money in the first place)buty I have nocomplaints. MS does an excellent job of letting me update my XP Pro whenever I want and with whatever I want. I have a very secure system all with MS programs and none of them have been updated (except XP) and I havent had any intrusions, I even had4 people try to hack into my computer when I was running Telent Server and my firewall. none of them got through. only grip I have isnt with MS but with my ISP and their stupid little Dialup connection proggie. but more on that in a different thread
Gubment_"it's the"_Cheez

by ___._

What would you prefer?

A system that upadtes it's self without notofication / validation, with the most recent patches.

Or

You get a list of patches sent to you, to decide if you need to install them.

You Decide?

by generalist

If I could be absolutely sure that the automatic updates were from the proper sources and were reversible, bullet proof and not some sort of spyware, I would consider leaving the 'backdoor' open to such updates.

Of course, the moment the updates fail to meet the above criteria, I'd revert to the gate keeper approach where I decide what goes on my system. And, unfortunately for the vendor, the loss of trust would result in me telling others of my experiences, a form of bad PR that wouldn't do the vendor any good.

by mrafrohead

There is no trust whatsoever that is worth using backdoors.

Because just that ONE time would screw up EVERYTHING.

Remember, if there's a back door in your system for MS to update it, all of us can get in too.

And I would never trust MS to just automatically install software on my box without my knowledge. I want to know exactly what's going on and what it is supposed to do.

Imagine Media Player 9 getting installed on your machine automatically because of a flaw in 7.1. Try readingMP9 EULA and you'll see where I'm coming from.

Mrafrohead

by hal 9000

Simply Microsoft carries all the responsibily for the security of the products it sells or at least licences to end users. Microsoft provide a product and as such they are responsible for any shortcommings of that product. Anybody who argues againstthis would fail to hold the same argument if a car they bought had a design fault that caused it to go out of control and kill someone or injure themselves. If every other company is responsible for the products it makes/sells why should Microsoft be any different? I have yet to use a Microsoft product that actually performs as Microsoft state. Eventually by the third or fourth generation of one of their products they are getting close but they never in my experience have ever produced a product that meets its advertised claims. Also the mega long patches that Microsoft actually release are next to useless unless you have axcess to a broadband internet connection as they can take hours to download over a dial up connection and while I livein a major urban centre the broadband cables end about 300 yards down the road so I can not get axcess to this type of connection. Also these so called patches alter the way the OS works often adverselly and if you are administering even only a 100 computer network it is a few days work just to upgrade all of these computers that is if you download the bits and burn them to CD it takes even longer to download to each computer and adverselly affect work in any company. Just imangin if Mercedes Benz realesed a car with a brake problem and refused to issue a RECALL NOTICE they would be a justifable outcry from the whole community. My question is why should Microsoft be treated any differently? They are accepting our money for their substandard products.

by williamsc

First, comparing software to automobiles is the proverbial 'apples & oranges'. Software development is an ongoing process. It takes a great deal of time and many different people and situations to properly test and debug software. The best way to dothis is to test as best you can before release and then get feedback from your customer base. The old saying 'pioneers get arrows', hold true here. Jumping into the 'latest and greatest' from any software vendor will always get you problems. You also make a statment that is just not true. It does not take days to update the computers on your network no matter how many there are if your network is properly managed. Microsoft offers the SUS which is a outstanding tool. Combined with Group policy settings updateing workstations and servers is virtually automatic. Even with a low bandwidth connection you can have your SUS server syncronize during off hours.

Bottom line, excuses walk. When you put on that network/security administrators hat,YOU are responsible.

by hal 9000

I realise it take many people to develop Software of any sought but the same applies to designing a car you will never fing one engenier who designs/test and builds any form of motor car but you are missing the point entirelly. I only used cars as an example the same applies to any manfactured goods. THEY HAVE TO BE OF SALABLE QUALITY. As far as your other argument goes about what Microsoft supplies that is well and good for some business but I work in the Banking industry where we work 24 hours a day 7 days a week and any down time costs millions of dollars per hour and we can not have this processing being intureppted if at all avoidable. You abviously don't have a whole group of accountants breathing down your neck thinking it is their money you are wasting.

by hal 9000

You seem to be under the mistaken impression that the system I administer was adversly affected by the slammer worm it was not and neither was my 12 station home network. Also for that matter I do not know anybody else in my industry who was affected. So there are no sour grapes here. I am only trying to say that the OS's we are being more or less ordered to use are not the best available and certianlly DO NOT live up to the advertising that Microsoft puts out about their OS's. The slammer wormwas no more hinderance to me than the so called computer death knell the Y2K bug, we continued working without interuption. However this is not the first or will it be the last major invasion of a MS OS my main concern is excatly who wears the blamewhen critical data excapes into the public domain? I have no doubt that my bosses would willingly through the whole IT department to the wolves if it was in their best interests {after all we are the obvious scapegoats} even though we are constantlyrefused the necessary resources that we require. I can not for one minute believe that our CEO would take responsibility if we had been adversly affected even though it is him that constantly refuses our requests and cuts our budgets. Lets face it the poor old IT person is expendable we are simply a dime a dozen in the CEO's eyes and are easly replacable no matter how hard we work. You should have been at my work the Monday morning after the attack all hell broke loose and we where all to blame, it was all our fault and after about one hour of this tirade there was no apology when we explained we where unaffected. So while all the systems that I know of where unaffected we still got SLAMMED by the boss and it did not matter that we had done nothing wrong or for that matter even been affected, we where simply to blame for this bit of malicious code.

by industrial_controller

This is wonderful. Microsoft, by telling customers that security is "their problem", is opening the door wide to competitors. Ironically, Microsoft has insisted on controlling the desktop environment, but when the Microsoft "uber alles" vision comes up short, it is every man/woman for themselves. I believe this kind of arrogance will be rewarded with steadily decreasing market share. The choice of whether to install patches and die or not install patches and die is not choice at all.

by hal 9000

Just for the record about OS security have a good look at MS news Letter to Parteners I found the atrical in the Feb newsletter that has just arrived interesting it is headed WINDOWS XP UPGRADE The FINICIAL BENIFITS. this artical goes on to tell just how much more secure XP is to any other OS. This only came through in the last hour or so. So you lot might like to coment on it.

by blue36

I'm sure that Microsoft has an axiom: "Security doesn't sell products. Features do." I agree with that 100%.

What I find irresponsible on the part of Microsoft is a second axiom: "If a feature can be enabled by default, then enable it."

Yes,Microsoft sells software.

Yes, it is the responsibility of the user, not Microsoft, to protect their assets.

Still, nothing should excuse Microsoft or any other editor from knowingly promoting unsecure products. This is like handing someone a loaded gun with the safety off. It's stupid. But what the heck? It's good marketing, isn't it?

by oz_ollie

Security is feature of Network Operating Systems and Software. Microsoft just hasn't woken up to this fact.

I agree Microsoft should change the way the default settings are configured - you shouldn't have to try to turn off 65,536 ports for TCP/IP and 65,536 ports for UDP to secure a server. I have yet to find a Microsoft document that lists all ports and the required ports for the Windows OS to perform properly.

by hal 9000

Not so long ago {and I hate this analogy} the car industry particuarly the US car industry continually Claimed SAFETY was not important to car buyers it was the features that they made like bigger more powerfull engines {it didn't matter that you only got 1 mile to a gallon}. Anyway they where more concerned with bolting bits on like radios, and other luxouries it was not until Government intervention that seatbelts where even introduced What I am hoping is that the same sisutation does not arise in the OS side of this business as any form of Government Regulation cuts back on creativity. Just look at modern cars without the badge they all look the same. There is no longer a distinct style of indivual makers. Well excatly the same could happen in the OS business if things where to get out of hand and some form of Leglisation was introduced it would not only affect MS but all the Unix/Linux products as well so we could find ourselves in a position where everything looks the same, worksthe same, and the new breakthroughs are never seen. It is about time MS takes their responsibility seriously and really tries to produce a secure product they are currently concerned about the growth of Linux and are talking about dropping their prices {Good thing too}. But the reality of the situation is it is MS that suffers the most harm from any form of attack just look up any anti-virus software providers virus list and see which OS's are affected nearly always MS apple/Unix/Linux are clear and this will continue untill someone actually produces something to rival MS and this is coming as all the latest form of Linux are getting very close so in a hopefully very short time the general public and CEO's will be asking for a form of Linux and leave MS on the scrap heap where it belongs as they do not take us seriously.

by support

Simply unreal. You obviously have no idea what you are talking about and do not work in the real world. Let me tell you a little bit about what it's like.

But first, to quote your article: "If you're interested in having greater control and flexibility in updating all of your Microsoft products from a central point within your own intranet, configure a Web server to host the Microsoft Software Update Services (SUS)."

If life were this simple we'd all have jumped on it by now. But the factis that, if you actually read the white paper (which I assume you haven't - possibly from lack of time like the rest of us mere mortals?) you'd realize that the only updates this product (SUS) applies to are certain (not all) OS patches - you can't push out drivers, software, hotfixes or any of the other things you might be responsible for. It is a great idea but far too limited to be of any real value.

The fact is that this product would not have helped IN THE LEAST to mitigate the SQL Slammer fiasco - SUS does not patch software, meaning no install of MS SQL Server. Have you got that?

The fact is that TIME is the primary limiting factor on taking effective security measures. TIME! Not willingness, not anything else. None of us out here in the real world have the manpower to devote to security, and is a fulltime job.

The fact is that I, like many others like me, spent a LOT of precious TIME investigating this dead-end already, so hopefully I can spare you all the pain and misery of getting your hopes up like I did. TIME that I could have spent searching for the latest vulnerabilities (oh by the way, I am a militant security type myself, so my servers were all patched within days of the patch being released, but I digress...)

Go back to whatever world you live in, Mike, and stay there because you'd never make it out here. Out here blaming the victim is flame-baiting in a great big UGLY way.

by lordinfidel

I will agree, it can't do everything. Nor should it.

Nor should it ever be installed on production servers.

But there *are* lot's of ways to push out software updates to 1000's of users. Without having to manually go to their machines.

While I don't doubt that you are security minded. You are placing blame in the wrong place with the sql worm.

As I have stated many times, and I am backed up by every firewall book and hacking exposed book out there. There is pretty much NO reasonto allow anonymous un-restricted access to your database servers; be it sql, mysql or anything else.

And that is where the *real* problem lies. Not with the patch or the hole in sql.

This was the same problem with IIS and .htr, .ida and .idq exploits. The MS IIS security checklist, which was posted well before the exploit even emerged, clearly says to disable all unused script mappings. Like .htr, .printer etc.

But people did not read it and follow their directions. So guess what ,when they got hit, they whined and cried and blamed it on M$.

Which is what they are doing now.

I say, be a man (or woman) and take responsibility for your network and your actions (or lack of them).

by support

My viewpoint is that it isn't only the SQL vulnerability. If this were the only issue then shame on everybody who got hit. But it's every (business) software product bearing the MS brand that is under assault. And many other products to boot. We areunder assault, and it is NEVER fair or justified to blame the victim, especially when the victim is making any kind of an effort to avoid being victimized.

We have had times (and we will have more) where other things take priority over LOOKING for the latest vulnerabilities. AT other times things take precedence over EVALUATING vulnerabilities. At other times things take precedence over TESTING fixes. At other times things take precedence over ROLLING OUT to the production environment and monitoring for breakage. I am not just responsible for my network, I am also responsible for software (not just vendors' products but my own designs as well) and hardware issues and connectivity issues and ongoing documentation issues and technical training (giving classes and attending seminars) and so on and so forth.

Ask any of my users what is the most important function I perform and NOT ONE will say security. But if anything ever goes wrong, it's my head on a platter. That's the name of the game and I love it now more tyhan ever 'cause it sure isn't dull, but it is never as straight forward and SIMPLISTIC as Mike laid out in his article. I know my opposite numbers at other divisions and in other industires are multitasking at least as much as I am and we all know IT ISN'T EASY.

By the way - I found these during today's stroll through the security landscape - hope they help anyone who is still floundering over dealing with the Slammer vulnerability issue:

http://microsoft.com/downloads/details.aspx?FamilyId=9552D43B-04EB-4AF9-9E24-6CDE4D933600&displaylang=en

by jojoa

I understood exactly what Mike was saying. I didn't see anywhere him saying that SUS was a curall for poor security administration. It looked to me like he was suggesting another way, along with the Security Notification Service to gain GREATER CONTROL not total control. As for pushing out drivers and other software, buy a real network management appilication. What do you expect for FREE!

Lord Infidel was right. The problem really lies the anonymous connections you allow to critical systems and not following standard security practices that are a part of the installation.

As for the victim blaming - You obviously have a problem with taking responsibility for your job and lack the proper training and qualifications to perform in the REAL WORLD.

Good Job Mike!

by steve

Applications accessing udp port 1434 had the abililty
to write to the registry! The only 'public' reason this
port is open and accepting connections is to tell the
application accessing it how to connect to the
database server. This was meant for ease of use,
but is something any admin ought to know without
having the software tell the app - a knowledgeable
admin shouldn't need this handholding. It is this
'ease of use' that makes MS products riddled with
security holes and it will remain that way. This was
not a 'flaw' of the system as much as simply poor
design that Microsoft uses in all their products to
make users think a Windows 95 power user can be
a System Administrator - and MS's strategy to have
software do the work of the admin, leading to sloppy
system maintenance and poor security.

by maejor999

Microsoft itself was unable to patch all of the SQL servers they have running. If the software/fix/patch authors can't (or won't) apply the patches, how can anyone expect the rest of us to do it. My organization was fully insulated from this threat, but we've all applied patches before, to protect against a "possible" attack, only to break the functions we use on a daily basis. Then we wait another week or two to fix a production server that costs us money while it's down. Unacceptable. I like Microsoft, but don't point the finger at some poor Net Admin who's been burned b4, and chosen not to stick his butt in the fire again, until a patch is proven as safe.

by admin

For my users the buck stops here. Even if one of my employees mess something up, I am the responsible party (and then I immediately start the education process). I do appreciate all the help I get through others work, including those at MS, other admins, late night revelations, many web related resources and a whole host of other resources too numerous to mention.

I think there is a difference between being responsible and beating yourself up though. I don't beat myself up, or take it home or out of the office. Blame or self punishment won't help, accepting responsibility is not a bad thing at all and in fact it is the best step forward. When you own a problem, you can work on it's solution and we are all better off when new solutions are developed and shared.

:)

by csb

EVERY time there is a new virus, the industry yells: "we have millions of damage because of this virus ! ".
What I find is that those bad,bad, 'system managers'sould be sacked as quickly as possible and maybe sewd for bad practises!
Than hire a real pro, pay him or her 5 times as much, and never see a virus in your systems again!!
Microsoft makes some great software, also makes some real shit like windows XP, but overall they are trying to make YOUR software as secure as possible after(a few) servicepacks.
You HAVE to implement them, otherwise you really can't blame uncle Bill.
And eeeehhhhh, don't give your most important company server any internet capability...
Safe and easy, whatever your boss tells you.
Remember.... YOU are theSYSTEM MANAGER,

by rod.flakes

I agree with the writer premise. MicroSoft produces software and in not legally responsible for security of its software product. I also believe that MS own SQL server was effected as well to the Denial of Services attack, because they had not installed their own patches.

by hal 9000

Ms produce software well that right at least but then again Windows whatever is not software it is an Operating System and it is in the OS where the problem lie. Just try installing any piece of software on a computer without an OS you simply can't and even it you where to manage it would not work as it relies on the OS to fuction. You are failing to disquingish between the two Yes MS do make software but the other side of the coin they also make Os's as well and it is the OS's where MS is letting us all down. If there had not have been a change of Governmant in the US Ms would now be along way down the path of being two seperate identies one making software and the other producing OS's it was only by good luck at least in MS case that this did not happen. I can't help but wonder just how much MS contributed to the polies for this to happen they can certianly afford it. Anyway is it right for a Government to overturn a Court I read somewhere about seperation of powers in Government but this was never an issue when MS was let off the hook as I never saw any complaints except from those who had worked so had to convict MS in the first place no one else was interested.

by johnn

"... I hope you've managed to maintain your employment status..."

To suggest that avoiding a Slammer worm attack is a simple as "applying a patch" is to ignore reality. Live, Internet-connected production systems, which are obviously the most vulnerable to such attacks, are often the last systems in an enterprise to receive patches, updates, and any other changes to their mission critical setup.

Applying patches, updates, and other changes to such systems in a willy-nilly manner is a recipe for disaster, and a pink slip. Automate the downloading and deployment of Microsoft "fixes" to mission critical systems? Yeah, right.

Best practices for such procedures inolve extensive testing on a test setup identical to the production environment. Getting the budget for the infrastructure and staff time required to take this approach is virtually impossible in many, if not most IT shops.

Therefore, to lay the blame at the feet of the network administrators is, to say the least, naive. If you want to point fingers, point them at the CEO's, CFO's, and other factions that have chosen to avoid paying for the resources that represent the same kind of insurance value that the organization's liability or property damage carriers provide.

by mrafrohead

So six months isn't enough time to sufficiently test a patch???

As stated in the article, which is actually twice as long as I had read in different articles. The patch was released SIX months ago.

That is half a year, just plain gross negligence on EVERY SINGLE ADMIN that did not install it. Plain and simple. And no, not naive.

And I am only referring to the Slammer incident in this post. But yes, I think that every business that did not apply the proper diligence to secure their networks should get the dunce cap.

Mrafrohead

by oz_ollie

I agree if this was the only patch released in six months - but Microsoft release hundreds of patches and upgrades each year. You must test all of them before deploying - and then test the interaction of the next patch. If you can think back a couple of years Microsoft released Service Pack 6.0 for Windows NT 4 Server - two weeks later they released Service Pack 6.0a because 6.0 actually trashed the system.

How very reasuring this would be for those using Microsoft SUS to automate all upgrades.

by lordinfidel

They always think that they are IT's first priority.

While I will agree, in smaller org's it is harder to keep up with security. Especially if you are the only person.

But that just means you have to stay even more focused. I always look at it this way, If I don't keep up with security and my systems get broken into, then the users won't be able to work anyway's. So putting off security to help users and other tasks, does no good when the network goes down.

I tell my staff, the network comes first. Not users whims or wishes. Do nothing that will violate network security. Never install anything that is not on the approved software list, and the user has to have a approved need for it.

If I have to, I *will* (and have) shutdown my network until I clear it. Regardless of what the users (and executives) are doing. If I see a critical security violation, everything get's shutdown.

by admin

MICROSOFT ISN'T RESPONSIBLE FOR SYSTEM SECURITY: YOU ARE

The recent attack by the SQL Slammer worm had disastrous effects on
unpatched SQL servers. The worm caused massive denial of service at the
DNS Root Server level. Saturation at the root of the Internet caused the
denial of service that led to traffic loss and saturation at most ISPs
trying to process valid requests. In a nutshell: no DNS lookup, no e-mail,
no Internet.

Microsoft produces software, not security. Although its products aren't
always secure, Microsoft does, at least, give you the updates for free.
So if you're running Microsoft products on your network and those products
communicate with the Internet, you're practically responsible for
Internet security--try putting that on your next resume.

If your network was the victim of the SQL Slammer worm, I hope you've
managed to maintain your employment status. The patch for this worm was
first released more than six months ago in Microsoft Security Bulletin
MS02-039. Failing to apply patches and updates to publicly connected
servers borders on the criminal when it affects the rest of the Internet.
This failure to patch definitely sends the message that you lack a security
focus.

by admin

It's time to regain that focus. New security flaws for your servers and
clients are discovered almost daily. But don't waste your time scouring
the Internet looking for flaws; instead, let Microsoft send you that
information as it's discovered and patched.

Browse over to Microsoft's TechNet site and sign up for the free
Security Notification Service bulletin. I recommend that you create a
security e-mail inbox (e.g., security@yourdomain.com) on your e-mail server
and direct all newsletters to this box. This way, you won't flood your
personal inbox, and other members of your security team can track and take
action on the items you receive.

If you're interested in having greater control and flexibility in
updating all of your Microsoft products from a central point within your own
intranet, configure a Web server to host the Microsoft Software Update
Services (SUS). This service is designed to run from an intranet Web server,
centralizing and simplifying the process of keeping your Windows-based
systems current with the latest critical updates. SUS enables
administrators to quickly and reliably deploy critical updates to Windows
2000-based servers and desktop computers running Windows 2000 Professional or
Windows XP Professional.

Download this service from Microsoft's Windows 2000 support site. The
download is a 47-MB service that you add to an existing intranet Web
server. (If your domain is large enough, consider dedicating a server solely
for this task.) One server can handle around 15,000 clients in its update
pool. Download the SUS deployment guide and see how easy it is to set up
this service and maintain your systems. The guide is well written and will
walk you through configuration, step by step.
http://www.microsoft.com/windows2000/windowsupdate/sus/susdeployment.asp

by admin

Security patches and fixes exist to stop a previously discovered
exploit. We're supposed to apply these fixes to make our systems more secure.
Software vendors aren't going to secure your systems for you, but they will
let you know when you need to take action. Use the free tools available
to develop a proactive approach to secure your servers and clients.
Network security is a priority, not an option.

Mike Mullins has served as a database administrator and assistant network
administrator for the U.S. Secret Service. He is a Network Security
Administrator for the Defense Information Systems Agency.

:) You're Welcome!

by mrafrohead

Now maybe after reading that, I'm informed enough to make a comment. ;)

/me grins

Mrafrohead

by generalist

Thanks for the 'reprint' of the article.

I find it all quite logical, although it seems a little heavy handed. On the other hand, Mullins does have security oriented credentials from organizations that should have the highest security on the planet.

I suspect that Mullins doesn't have very many problems convincing his superiors that patches must be applied on a timely basis.

Unfortunately, I know that there are segments of the private sector where convincing management that security updates are important can be a full time job that could easily get you fired if you're too pushy.

Perhaps we need an article on how to convince management that they really need to bite the bullet and accept some down time while essential updates are made, even if it affects the bottom line.

by admin

I usually have to do downtime on weekends when there isn't a big push in one department or another. It would be nice to have more redundancy and be able to switch back and forth, but realistically no-one is paying for that right now.

In the recent attack, it actually gave some IT departments around here that I won't name "permission" to have downtime because of all the media coverage. The actual Slammer problem didn't take up all the time they used to fix it :)

by oz_ollie

In his article Mike says - "I recommend that you create a security e-mail inbox (e.g., security@yourdomain.com) on your e-mail server and direct all newsletters to this box. This way, you won't flood your personal inbox, and other members of your security team can track and take action on the items you receive."

Mike states in his article that you will become swamped by the e-mail regarding security updates from Microsoft. This just helps explain why the SQl Slammer worm caused so much trouble. Microsoft's SQL Server Development Team's were seriously affected by this worm - Microsoft's excuse was that someone just hadn't got around to patching their own servers. If Microsoft can't keep up to date with their own systems how can any otherbusiness/security supervisor/system administrator.

Microsoft have released their first Critical Update of 2003 with revelations that yet another service provides system level (better than admin level) access to the network.

It is time for Microsoft to scrap their entire OS and start from scratch if they want to be taken seriously as a secure software supplier. This is what they promised for Windows 2000 but they are still have bugs that affect systems from Windows NT upwards.

If Microsoft get their way and Palladium (or what ever they have changed the name to for legal reasons) it just means another Microsoft security flaw at system level will be built into every system.

by cs_nelson

Old school -
IBM mainframe decades: all users, all software application(s)developers, terminals, printers, computers - were all located at one physical facility and directly hardwired into one computer room (which was often under glass and secured). Applications interfaces data was read by local programs that edited the data and discarded the junk. And all the software and hardware was IBMs. Everything and everyone worked at the same place. And it was good and secure, but Very inflexible.

New School -
Open systems are just that, OPEN. Very flexible, And by design, open to massive security concerns. And it was good, but sweaty.

By design, IBM was responsible for security as all the software and hardware was theirs.

Today's environment has a cost! And if Microsoft is not the new IBM, I don't know who is. As such, Microsoft must be very responsible for a wide range of security aspects of its products. The computer room admin and app developers have some local securityresponsibility to be sure, but the vendors' products must be robust enough to edit out the junk.

by thamer

... Because I read in Bill Gates's 'Trustworthy Computing' memo which was sent to Microsoft's Employees a year ago ... that ... It is of Microsoft's reponsibility to make their softwares so fundamentally secure that customers never even worry about it.

Quote:
"However, even more important than any of these new capabilities is the fact that it is designed from the ground up to deliver Trustworthy Computing. What I mean by this is that customers will always be able to rely on these systems to be available and to secure their information."

"Trustworthy Computing is computing that is as available, reliable and secure as electricity, water services and telephony."

"Our new design approaches need to dramatically reduce the number of such issues that come up in the software that Microsoft, its partners and its customers create. We need to make it automatic for customers to get the benefits of these fixes. Eventually, our software should be so fundamentally secure that customers never even worry about it."

"Security: The data our software and services store on behalf of our customers should be protected from harm and used or modified only in appropriate ways. Security models should be easy for developers to understand andbuild into their applications."

End Quote

by thamer

"What do you think of the idea that admins' failure to patch, rather than Microsoft's flawed software."

... The thing which keeps the mind (Don't ask!) over here to think ... If Microsoft did not announce this vulnerability they found in their Windows 2000 systems and did not provide any patch for ... WOULD THE SLAMMER BE AROUND?

... The same story with Code Red ... a patch was available and many were not taking advantage of it.

.....

2-edged sowrd (Silly word) ...
If Microsoft speaks about it, it gets slammed ... if they keep quiet ... they will be slammed but this time ... with a blast.

I'm not a Microsofter ... it never was.

by deadly ernest

In every advertising brochure that I see, and on ever operating system box that Microsoft put out is a lot of information about how secure MS software is. Either they delivery on their advertising or admit in all their advertising that they do not have any security and sell it as such. At present I they are providing false advertising.

by gangstaisso

If the car company tell me there is a known problem with my car and I don't fix it who is to balme when it breaks down? Not me I'm a dumb motorist. But IT people are supposed to be intelligent enough that when someone (MS) tells you it's broken you should put on the FREE patch so the system doesn't break down in the middle of the highway. On the other hand if the car company gives me a car full of faults and flaws and then sells me the car knowing that it will break down I should have every right to ask for my money back.

by hal 9000

We all know Microsoft is not going to support Windows 98 for much longer or at least will not be introducing any new patches for any breaches that may occur. However there are quite a few specalised programs which simply will not run on any other Opperating System like what your Doctor uses. So my question is. Who is responsible if someone writes a bit of malicious code that breaches a 98 OS and gains access to confedintial medical records? Will the affected parties sue Microsoft or the Doctor in question? As the doctor is the easiest target I would hazard a guess it would be the doctor as they simply do not have the finicial resources that Microsoft has. In this great new age of constantly changing computer/software there are numerious programs writen for a single purpose and a single application. The companies who write this software are not interested in rewriting their software every few months as they have the opinion if it aint broke dont fix it. But the mighty Microsoft on the other hand is constantly changing their Operating Systems and unfortantly these new versions are not always backward compatable so these specalised suppliers are left in the lurch. Microsoft acknolledges this by their Backward Licence Agrement for XPPro which you supply with a new computer but never install.

by hal 9000

All manfactured goods have to be usable without defects of any kind from motor vechials to the humble eletric jug and if any defect is found even some years latter the manafacturer must recall these items and repair/replace then at their own cost. The legal defination of Software is it is a manafcatured product. It is simply not good enough to post patches on a web site and then expect people to download and install these patches and even if this is done it is far from a FREE repair. Don't get me wrong I am not wipping Microsoft it is just that they are the biggest supplier of Operating Systems and it is the Operating System that comes in for most of the problems that occure, the same applies to any other OS supplier weather it be Apple orLinux although with the Open Source OS's there is less of a problem as so far they are not attacked as often as the Microsoft Alternative however that could all change in the near future as Unix/Linux is becoming more popular and is even being supplied on some low cost computers now. What I am trying to get at is that if any personal data was to escape to a source which it was not intented excatly who would be held legally responsible? Microsoft probably would not as they have the finicial resources to defend against this type of action but the poor end user with a small business does not have this advantage and would in all probability be taken to the cleaners. Remember it was in America where a person with a 20 year old lawn mower who suffered a heart attack trying to statr the mower sued the manafacturer even though he never performed any routine service on it and he won the Law Suit simply because the mower had a sticker on it that said EASY START.

by cactus pete

Wow.

First, did they win the appeal?

Next, what about you comaprison - Software and cars? Do you think someone should sue GM if they had left the car in an open garage, with the doors unlocked, the keys in the ignition with the damn thing running?

How about if the robber hotwired it? How about if they used a coathanger to unlock the doors? What if they broke a window on to the garage to open get in there in the first place?

Does GM have to retrofit all locks on all cars?

What if you hire a driver, with no training, and he wrecks the thing?

You see what I'm getting at?

by hal 9000

However as you want to compare GM they do at least fit locks engine imoblisers and other security items. If you where to leave a car/ computer out on the footpath with all its various bits like keys or in the case of a computer its power leads/keyboard/mouse and passwords then you deserve wht you get and can hold no one but your self responsible. Today I spent {Actually wasted} my time by going through the archives and getting out all the books from MS from their first version of DOS onwards and in every one of these publications they claim to have increades security. I don't know about you but I really did not have too many problems when we where all running DOS admittelly I used DR DOS but from the time Windows 3.11 came on the scene I have had to place more and more security defences in place all the time being prevented by the EULA from looking at the source code of the product I am using. MS at the very least is guilty of FALSE ADVERTISING altought they will never be charged withthis as the advertising is always in a sealed box when you buy it so it is not really advertising at all in the legal sence. We are prevented legally if you wish to follow the Legal Agreement that you enter into with MS when you install their product without knowing what this actually is unless we open the box and if we don't agree we can not return the product so out of comon sence we use the product and in the real world there is really no alternative as most of the users like the GUI interface and would run miles from the good old comand line prompt. Have a look at the legal action in USA against these software companies for this excat reason.

by jtcooper

Michael Mullins says that Microsoft produces software, not security.

The truth is that Microsoft produces "unsecured software," which diminishes security.

In computer security awareness training, we teach that everyone is responsible for IT security, including managers, IT specialists, and end users. Hardware and software vendors, too, have security responsibilities within their organizations and (certainly) with regard to their products.

Security specialists generally agree that a 100% secure network is practically impossible to achieve. Consequently, we shouldn't expect 100% secure hardware and software solutions, either.

Yes, system administrators must become vigilant and proactive regarding patch management.

However, with 2,500 new software vulnerabilities reported last year (according to Symantec), I do believe that we have the right to expect higher degrees of vigilance and responsibility from vendors than we are currently receiving.

Microsoft has expressed agreement with the assertion that it can and should do more to build security assurance into their products. Their heralded "Trustworthy Computing" initiative is an example of their acknowledgment and their (future) commitment.

In today's "high threat" environment, and with IT budgets slashed and overworked system administrators struggling to keep their networks running, the community could use some help reducing the number of security patches that have to be tested and applied.

by thutchins

As far as Slammer goes, I find it unconsionable (sp?) that ANY company would put out a server product that disables passwords! That was a MAJOR design flaw!!!
As a former programmer, I understand that there is NO program or OS that is comletely bug free, but the creator should still do their best. If I have to patch it later, I can deal with that. But to produce a product that has MAJOR design flaws that create HUMUNGOUS security holes or critical system bugs should not be tolerated. Andthen becaust the EULA says that they are not responsible for said flaws...???!!! UNBELIEVABLE!
If any other business in the world operated the way the software industry does they would be out of business very quickly! Maybe it's time for reform... or open source!

by mrafrohead

The whole community is.

But the community makes it a point to attempt to notify the users that there is a problem and from there they work their asses off to fix the problem as soon as possible and in a working fashion.

I can say when I was trying out RedHat, I received many e-mails from them regarding vulnerabilities and that they strongly recommend upgrading to whatever package.

I've yet to get a note from MS about their flaws. I have to look for them.

Mrafrohead

by cactus pete

But I can't say that MS didn't make each newer version of their software "more secure" in that they made sure to close the holes of the last version.

We are also more computer-centric as a people these days. It's now 'cool' to be a computer geek[I sure hope so, anyway - at least don't argue this point and leave me with my fantasies] and being a 'hacker' can actually gain you some sort of status in certain circles. So finding security flaws is more likely now than it was 20 years ago.

Also, getting back to the car analogy, MS is specializing. You machine is totally secure out of the box so long as you have it as a stand alone behind locked doors. That is the base configuration. If you want to do something else with it - and theycan't predict just what your fancy is - you should then buy and implement [and learn about it] the appropriate add ons.

by mike mullins

I guess everyone reads something and gets a slightly different view. You start with policy and build from there. Use a defense-in-depth approach and either head the warnings from your vendors that something is broken. Or sit on your hands and hope it doesn't fall apart.

by cactus pete

If you want to sign up for MS security bulletins you can be innundated with them quite easily. If you're referring to the Red Hat Network emails, be careful what you wish for.

Think of how large the install base is for MS and then consider how much more insane traffic the internet would have to handle because of all the alerts going out all the time.

My personal firewall is Redhat... I've been getting a lot of mail just from them lately... Seems they, too, have security issues abundant.

by hal 9000

Since you used their name I think I can freely respond again with the companies name and yes Red Hat are sending out quite a bit at the moment but then again they have just realesed a new version. However the real questionis Who is taking advantage of these so called security holes in Red Hat as I have yet to hear of any attacks on the OS over the net? Red Hat are just being precautious and are trying their best to plug any holes that they think they have found. Now wouldn't you like MS to be as viligant?

by jellimonsta

M$ does offer security email notification that is free to sign up for. I think this classifies as a 'note' about flaws do you not think?

by hal 9000

Now just call me silly but on the 13/2/03 I recieved from MS a security update Entitled "Ms Security-MS03-004 Cululative patch for IE 810847" Anyway it whent on to say about a flaw discoverd that was first addressed by a patch on the 5/2/03 then a revision on the 12/2/03 it went with what the threat actually was described it as critical and what could happen. Well I had already got the patch released on the 5/2/03 so in my ingorence I thought they must have produced an improvment so I dutiffly loged onto MS Live Update site only to find out that there where no new critical updates available. Now what is the point of sending out this kind of thing if there is no actuall update available. Sure it did at first cause concern but then it just got me mad because I had wasted my time yet again by first reading the notice then trying to act upon the notice. Sure I prefer to be prewarned but spreading any form of paronida is just a bit too much isn't it? Oh buy the way I always download/install these patches onto a single computer that is not on my network just to make sure that the so called fixes don't do more harm than what they are susposed to fix.

by admin

I want a car that I can't crash. I don't want it to crash into anyone else either. Why can't the automotive mega giants produce a car with sensors so that I can't crash? Someone better take responsibility soon, as the major untimely deaths and injuries in the last 30 years in the US are primarily automotive crash related. If the computer industry was killing this many people, we'd all be threatened with lawsuits!

by jellimonsta

A once thought 'dumb' terminal gets its own back on the data entry clerk who constantly eats over its keyboard and skills coffee on it. Sending harmful rays through its VGA monitor that may one day cause cancer.
Actually!... I do see that now!!... it is happening to me as I type this!?!

by hal 9000

You have the wrong idea blaming the car it is more often than not the drivers responsibility however when it is a basic design fault in the car well the car maker gets sued don't they? However when a medical machine running on silicon techonology malfuctions and results in the death of a patient then the Doctor/Hospital gets sued. Just because there have not been any law suits against computer makers {and I use this term broadly for any silicon based techonology that is in some form microprocessor controlled} does not mean that the computer is safe in some cases it can be downright deadly particually if it is responsible for administering any form of medication. These things do malfuction and deaths result but the piece of machenery is never held responsible the blame is always placed eleswhere. So don't think just because people don't drop dead infront of a terminal/workstation somewhere that computers are safe. Actually in Australia you must fit screen filters on CRT monitors in a business situation or run the risk of being sued for causing eye damage. I also believe that there was a class action siut brought against IBM a few years ago because the keyboards caused RSI. these are just 2 examples of where a computer is dangerious so grow up and live in the real world and stop looking for someone to blame for your own screw ups!

by hal 9000

However you wouldn't be able to offord one and then there is no way of preventing something falling from the sky and killing you in this safe car. So where do you want to draw the line and take responsibility for your own actions. I guess you are one of those people who if a bit of Colimbia had actually hit them as they where driving along would SUE NASA wouldn't you? You have simply got to accept there are things outside our control and get on with life while trying to keep the best level of security and still have a system usable!

by admin

where my meaning may be lost! I hadn't thought of it, but I was using a thing called "Sarcasm" and I'm not sure now if this is universal in countries even where language is derived from the English language! Oh MY! :> I was SOOOO joking when I wrote the above and hope no-one misunderstood or was offended!

Here is the "American" definition of Sarcasm:

sar?casm

Pronunciation: (s?r'kaz-um), [key]
?n.
1. harsh or bitter derision or irony.
2. a sharply ironical taunt; sneering or cutting remark: a review full of sarcasms

I hope that helps!

(Now off to find a piece of the Space Shuttle to hurt myself on- I'll never have to work again! hahahahahahaha!!!!!!) :)

(The above "Space Shuttle" comment was also Sarcasm!)

See, it's pretty fun :) Try it!

by hal 9000

The only way I know to make a computer totally secure is to not have it capable of running in any form but then again its usless. So we all must comprmise however if you are really interested I posted a 3 part bit on another dissucion group about a young Kid who nowdays would probably be called a haker it is on the Are Floppies obsolute and is intitled Yourv'e been working IT too long. Just have a look you will find it interesting but I really don't want to retype it all in here again.

by cactus pete

Well, going that far is pretty far, and probably out of the true scope of this discussion.

As far as your other typing, I just read it - I think it may have been a reply to my post on that topic.

We can always take the security to another level, but that's not really what this thread was supposed to be about, I think.

by hal 9000

The other posting it should be fairly obvious that I come form a trully secure background where everyone is paronid. However saying that in reaility there is never a totally secure network they question we must all ask ourselves is just how secure can we afford to make our systems and still have them friendly to use as it is all well and good for the IT guys to impeliment security but then someone who knows absoultely nothing about security wants to actually work the network either LAN or WAN the end user must find it easy to use so everything about computer security is nothing more than a trade off to what is acceptable for the company to use. Actually I have no problem knowing that all traffic is capable of being moniorted by Government agencies as I am not involved in any activities outside the law however some still think that any form of connection is really secure. I wonder how they would feal if they where to realise that a properly equipted van sitting outside someones home can read a computer screen in that home. But as I don't surcribe to paronia anymore if ever I did because my previous actions have not always been in the best interests of so called security on first glance anyway, at least I have always got the job done and I still can't figure out just how that kid keeps tracking me down let alone how to stop him. The real question that should be addressed here is to what level of security are we all happy with and just settle to that topic. There is no questionif someone really wants to get in they will find a way we just have to block the obvious points of entry while still maintaining access in the event of some form of calamity. We will always need a back door no matter what anybody says because the time will come when we are locked out and have to force our way in we just have to make sure that the back door is hard to find without making it impossible for ourselves to use.

by cactus pete

MS doesn't cause you harm with what they sold you during your normal casual use ... unless someone else outside deliberately tries to harm you.

So, to make your analogy work, someone would have to be delierately taking advantage of the errant carb.

by hal 9000

On the real issue here and thankfully I was not the first to use the car analogy. Lets for argument sake say you have a Hard Drive that you bought twoo weeks ago and it started developing Bad Sectors wouls you simply grin and bear it? Or would you want it replaced? I can gues your answer to that one! Anyway any manfactured good must be of servicable quality and they all have a garantie yes even MS products but here the main culprit is not so much the software but the Operating System. Just why is it acceptiable for MS to put out patches that you have to download and install at your risk when every other manfactured good has to be repaied by the maker for free? The most they can charge you is to pick it up if you don't want to return it to where you bought it from. And yes while it is unlikely that a faulty Operating System will actually kill {unless you have a heart attack when it falls over} it can however do something much worse it can send you broke! While there no real problem in a normal home enviroment as these computers can go weeks without being used in a business enviroment this is a totally different story and every business relieies on their computer to continue to service their customers, send out bills, and make records of every other action undertaken by the business. These business simply can not fuction without their computers and MS do sell manfactured goods namely Operating Systems to these business. So Again exactly what is the difference between a MS product and a product from any other maker? And MS actually do make all the various forms of Windows. And why should MS be treated differently to any other company? Don't you think that there is just a little bit of a double standard here?

by cactus pete

Well, you left a lot to be assumed in your HD analogy. If it was a $50 HD, that was about 20GB and it developed 2% bad sectors and no more, then I would accept it for what it was. If it were intended to be a business critical drive - and for some reason was the only one purchased - I would have made sure to spend more money on a higher quality drive. In which case, if it started losing 5% of its sectors, you're damn right I'd return it.

But things mechanical cannot be directly compared tothings intellectual.

The arguments here flit between being mad at the quality of the product to the quality of the business practice of Microsoft. I propose everyone choses which they argue and stick to it, or even a combination of the two - butstick to it.

Anyway, people need to remember that MS [or anyone else] cannot provide a totally secure and crash-free product that works with all other third party products and future technological developments. And don't forget how everyone whines about backward compatibility.

Accept the fact that all parties involved are responsible for security. It's not like MS has abandoned the idea.

by hal 9000

But its just not the same level of problem with a Linux box as it is with the MS Operating Systems. Yes I am constantly putting patches on my Linux installations but just look up the Virus lists there simply are not anywhere as many Virus/Worms/Trogans or whatever written for Linux.

by hal 9000

Little more. Which are the systems most affected by malicious code and which are the systems most often attacked for the most part they are MS based systems currently there is not the same level of attempted tampering with Unix/Linux installations. Could this be because MS is the biggest and there fore the most well known one that these people try to affect? After all we stick best with what we already know so it is far easier to attempt to find or create a problem in a MS system than in a Unix/Linux sustem but this is only I would hazard as a guess because most of the people out there who are interested in this type of thing are currently using MS systems themselves. Of course all that will change when Linux becomes more popular and accepted by the general community and not remain restricted to the relatively small area it currently resides in. No I don't think for one moment that Linux Boxes as you like to call them are more secure but from experience they are far less prone to outside attack! Would you like to coment on this?

by cactus pete

Well, I'm not going to do the leg work for specific numbers, but yes, look at the install base from Microsoft. Now look at all the others' percentages, either combined or individually, and break out the rate of virus/worms, etc. I would not be surprised to find that MS is about equal to the rest of likely-internet-enabled systems.

by hal 9000

That's exactly what I was trying to get at. And seriously my appoligies to anyone who took offence to my coments but they where intended to be just as sarcastic as the artical above.

This discussion is closed to new replies.