I like this, the MS head of 'Trustworthy Computing' (o rly? srsly? lol), is trying to shift the responsibility for security onto the users and in part he has a point but there's more to this than meets the eye.
Firstly let's cover that little bit of common ground that we can agree on:
"A system is only as secure as its administrator makes it."
Possibly one of the oldest adages in basic computer security and it's very true. If you knowingly connect an unpatched machine to the internet with lots of bloatware/crapware running pointless services, your ports open and remote logins enabled with your admin password set to 'password' then you're an idiot and you deserve everything you get. However one would sincerely hope that a reasonable OS vendor wouldn't ship a vanilla system with lousy security defaults (we're looking at you MS). Obviously it's the admin (most usually the primary user for a desktop) that has to keep a system patched and bear the lions share of responsibility for the basic security of the system but the vendor also has a responsibility not to ship bad code and to deliver their systems with security as a primary focus.
This is where MS falls down. Microsoft products have been notoriously insecure for as long as anyone can remember and although they have improved somewhat with the arrival of Windows 7 (so I'm told, I've yet to even try it.), we still see serious zero day exploits coming out on a regular basis. Further to that MS doesn't provide immediate patches in a timely fashion unlike Linux vendors who can, and do, patch issues within hours of the exploit being found, for example the MIT Kerberos bug in Ubuntu that was patched before the world even knew about it. Microsoft's patch tuesday is a joke. Users can end up waiting weeks for serious security issues to be patched whilst all around them systems are compromised and their TCO rises faster than a fat mans blood pressure at a strip club.
That isn't to say that Linux is invincible. It isn't but unlike Windows it is built with security in mind from the ground up whereas MS has a long history of compromising security for convenience and subsequently delivering the most insecure OS on the market. Linux vendors also have the advantage in that the vast majority of software that runs on a linux machine is open source and can patched and packaged by the vendor, due to this little convenience they can even patch 3rd party software packages to prevent bugs in them from becoming potential attack vectors. In the closed source propietary world of Microsoft this is simply not possible and thus leads to MS systems being vulnerable to attacks via angles that they cannot control.
Our MS 'Trustworthy Computing' czar even goes on to suggest a scenario in which, in order to use an online banking service, a bank should be allowed to scan the users machine. Excuse me? How exactly do you intend to engender trust whilst proposing measures that require a potential massive invasion of privacy to your users? What about those of us who don't use MS products and who do administrate our systems in a secure and sensible fashion. There's so much wrong to this that it's cringeworthy.
To conclude: although users must share the burden of security with vendors it is perhaps a tad insipid of MS to suggest that it's all the users fault. Perhaps if they didn't ship such a crappy system we wouldn't have this problem.
Archive
