Subject: [NEXTEL-1] Reliance on Microsoft software threatens national security]

From: [email-masked]
Date: Thu, 25 Sep 2003 15:38:06 -0400

Microsoft Reliance
Threatens National Security

September 25, 2003  

A panel of leading security experts Wednesday blasted Microsoft for
vulnerabilities in its software and warned that reliance on the company's software
is a danger to both business and national security.

Dan Geer, chief technology officer of @Stake, a security-consulting firm, headed
the group, which debuted its report at the first day of a two-day conference
hosted by the Computer & Communications Industry Association (CCIA). 

"As fast as the world's computing infrastructure is growing, vulnerability to
attack is growing faster still," Geer said. "Microsoft's attempts to tightly
integrate myriad applications with its operating system have significantly
contributed to excessive complexity and vulnerability. This deterioration of
security compounds when nearly all computers rely on a single operating system
subject to the same vulnerabilities the world over." 

Ed Black, the CEO and president of CCIA, whose members include Microsoft
competitors such as Sun and Oracle, was even more blunt. "Microsoft's monopoly
threatens consumers in a number of ways," he said. "It's clear it is now also a
threat to our security, our safety, and even our national security." 

According to the report and its seven authors--security consultants and leaders of
several security firms--the biggest problem is the over-reliance by businesses and
governments worldwide on Microsoft's products. 

"The problem is that of monoculture," said Bruce Schneier, one of the authors and
a co-founder of security firm Counterpane. "As long as all computers are running
the same operating system, they're all vulnerable." 

In response to the report, Microsoft security spokesman Sean Sundwall said,
"There's nothing inherently wrong with having a prime vendor of operating system
and other software, but being the leader, we have the responsibility of providing
as secure an environment as possible. We always consider security to be our
absolute top priority." 

In fact, Sundwall agreed with the first sentence of the report, which states that:
"No software is perfect." 

"We recognize that," he said. "Our job is to make our software as close as
possible to perfect to eliminate threats for our customers. We've made some
strides, and admittedly, we have a lot of work ahead to do." 

Using several agricultural analogies of the danger of relying on a single crop--
from attacks of boll weevils on cotton to the Irish potato famine--the report's
authors stressed that reliance on Microsoft dooms IT to a continued plague of
vulnerabilities. 

"We need operating-system diversity," said John Quarterman, another of the
report's authors and the founder of InternetPerils, an Internet risk-management
company. "If there's one thing to take away from this report, it's that a single
attack can take out all the computers running a single operating system." 

The monopoly that Microsoft enjoys--Windows is by far the world's most popular
operating system--insures that attackers will focus their efforts on its software.
More important, these attacks will have rapid and broad effects. 

"Ironically, Microsoft's efforts to deny interoperability of Windows with
legitimate non-Microsoft applications have created an environment in which
Microsoft's program interoperate efficiently only with Internet viruses," Geer
said. 

The complexity of Microsoft's software--the report claims that integrating
applications with Windows results in code 15 to 35 times more complex-- results in
a similar increase in vulnerabilities. And simply patching the vulnerability, as
Microsoft has increasingly had to do on the fly as vulnerabilities are disclosed,
only exacerbates the problem. 

"I don't think that Microsoft can ever fix this," said Geer. 

Businesses, organizations, and government agencies must wake up to the fact that
there are ramifications to their decisions to buy Microsoft, added Schneier.
"Because everyone's buying it, there are security implications to your decision to
buy what everyone else is buying," he said. "You need to take that into
consideration." 

Among its other recommendations, the report, "CyberInsecurity: The Cost Of
Monopoly," urged the federal government to diversify the software it uses, demand
that Microsoft design its products to work well with other companies' software,
and require Microsoft to open its source code to other developers. 

Some of its advice is sure to become controversial, because it hinges on
government stepping in, perhaps on an antitrust basis, to make specific demands of
Microsoft. Among these recommendations: Microsoft should not be allowed to release
Office for any one platform, such as Windows, until it releases comparable Linux
(news - web sites) and Mac OS versions. 

While the report's authors note the seriousness of their recommendations, they
stood by them. "When the government uses a product whose monopoly position
undermines its security," said Geer, "antitrust becomes a national security
issue." 

http://www.crn.com/sections/BreakingNews/dailyarchives.asp?ArticleID=44741

------------------------ Yahoo! Groups Sponsor ---------------------~-->
Buy Ink Cartridges or Refill Kits for your HP, Epson, Canon or Lexmark
Printer at MyInks.com. Free s/h on orders $50 or more to the US & Canada.
http://www.c1tracking.com/l.asp?cid=5511
http://us.click.yahoo.com/mOAaAA/3exGAA/qnsNAA/61FxlB/TM
---------------------------------------------------------------------~->

Your use of Yahoo! Groups is subject to http://docs.yahoo.com/info/terms/