Microsoft gleans top 10 basic security errors from thousands of help desk calls

by John McCormick | Feb 07, 2005 8:00:00 AM

Tags: PRODUCTIVITY, John McCormick, help desk, Microsoft Security Response Center, security, computer, bad guy, Microsoft Corp., software, Web

48 comment(s)

Takeaway: Microsoft's Security Response Center gets lots of calls for help with security problems. Here are the top ten laws that you can depend on.

Details

Microsoft's Security Response Center gets lots of calls for help with security problems, and the security experts there say all of the calls fall into one of three categories. First is the one we hear about the most: software flaws resulting in vulnerabilities. Second is the misuse or poor configuration of software. Third are the basic security mistakes that companies and individuals make every day.

That last category is probably the most critical, but it is also the most neglected. At the same time, it is the easiest threat category that we, as individual managers, can address... sometimes at little or no cost.

Vulnerabilities can be patched, but the other two problems can only be addressed through education, either hiring better-trained people to configure software properly or conducting better in-house training.

The last category requires that everyone learn a bit more about the basics of security and that at least one person in the IT department become a real expert. Here are some facts you can depend on:

Law #1: If a bad guy can persuade you to run his program on your computer, it's not your computer anymore.
Law #2: If a bad guy can alter the operating system on your computer, it's not your computer anymore.
Law #3: If a bad guy has unrestricted physical access to your computer, it's not your computer anymore.
Law #4: If you allow a bad guy to upload programs to your Web site, it's not your Web site any more.
Law #5: Weak passwords trump strong security.
Law #6: A computer is only as secure as the administrator is trustworthy.
Law #7: Encrypted data is only as secure as the decryption key.
Law #8: An out of date virus scanner is only marginally better than no virus scanner at all.
Law #9: Absolute anonymity isn't practical, in real life or on the Web.
Law #10: Technology is not a panacea.

If you don't understand why these are important or how they apply to your business, go to the Microsoft Web page where each one is discussed in detail.

Law 1 doesn't just apply to CDs or floppies, or to keeping people away from your computers; it also means not downloading Java or Active-X from untrusted Web sites. Law 6 is vital and often ignored. What kind of security check did you go through before starting your job as an administrator? Law 7, we recently saw violated by the way Microsoft Word and Excel handle edited files.

Probably the one rule that's most often ignored by the people who complain about Microsoft is the last one � "Technology is not a panacea." Relying on Microsoft or any other vendor for 100% of your security needs is a serious mistake.

I've often been called in to assess the damage caused by a software vulnerability that the company thinks may have been exploited. After walking into the server room, sitting down, and flipping on a terminal, I can see that everything is almost within arm's reach from the chair - a terminal that is either not password protected because it's in the server room, or with the password prominently displayed (I kid you not); a handy rack of software, and usually some blank media; one or more sets of backups and a shelf of manuals. Almost always there is also a fairly solid door with a lock (the one I had just come through because it hadn't been locked) so someone could work in complete privacy.

Fix

Don't assume security is simple or obvious. Hire or designate a chief security officer and give him or her authority to enforce basic security procedures at all levels of the business, including the executive suite.

Show this Microsoft list to upper management. No matter how good you are, you can't fix security problems without having them on your side and getting their full cooperation.

Final word

I know, I know, you've heard it all before, but that doesn't make the 10 laws any less true or any less important. If you don't think that they need to be repeated loudly and often, then you aren�t cut out to manage security, because I see all of these rules broken on a regular basis.

Also watch for:

Introduced last week in the Commerce Committee, House Bill HR29 (2005) aims to outlaw hidden spyware. That wasn�t a typo; the bill doesn�t outlaw spyware � instead, it would actually require spyware to be easy to detect and remove, sort of like requiring James Bond to always wear a "Kiss me I�m a SPY" tee-shirt. Only politicians would think that they can require "spyware" to be clearly marked and still be considered spyware.
Vnunet.com reports that malware cost to businesses doubled from 2003 to 2004, reaching an astounding $166 billion last year, or about $300 for each Windows machine, although the malware costs weren�t limited to Windows systems. The estimates came from security firm mi2g.
Secunia reports a "less critical" vulnerability in RealPlayer 10.x.
Apple computers using OSX 10 have a serious vulnerability in the ColorSync utility due to a buffer overrun. This is Security Update 2005-001, the first of the year.
Nine vulnerabilities in FireFox, Mozilla, and Thunderbird are detailed on Secunia.com.