Re:Microsoft: Third party apps killing our security
by tptacek on Monday November 03, 2008 @01:37PM
(#352335)
This rings true --- almost obvious --- and I don't think it should surprise anyone here. Some facts:
* Every major product Microsoft ships gets weeks (or, in the case of core OS components, months) of outside security testing. Look at the past 7 years of Black Hat talks, and the majority of the speakers/researchers now work for firms contracting to Microsoft to pen-test their code.
* Every Microsoft developer working on a major project has been trained for secure programming, and the courseware and objectives for those courses were designed by acknowledged experts in security.
* Microsoft is the single most targeted vendor in all of IT; every security company with a research team spends a significant amount of cash to reverse engineer components and attempt to find flaws in them. Microsoft benefits from this by getting first dibs on almost every new bug class.
Compare this to the third-party software developers; none of these things are true. Just in terms of external testing; factor out Adobe, Apple, and Mozilla, and you'd be surprised to find a vendor that did have a policy of third-party assessments.
The Microsoft Insecurity story was a real issue in 2003. Bill Gates got up and said they were going to make security a key focus for the company. Normally, you ignore a statement like that. This time, they meant it, and they had hundreds of millions of dollars to back it up.
Microsoft is the best commercial closed-source vendor in the industry at security.
* Every major product Microsoft ships gets weeks (or, in the case of core OS components, months) of outside security testing. Look at the past 7 years of Black Hat talks, and the majority of the speakers/researchers now work for firms contracting to Microsoft to pen-test their code.
* Every Microsoft developer working on a major project has been trained for secure programming, and the courseware and objectives for those courses were designed by acknowledged experts in security.
* Microsoft is the single most targeted vendor in all of IT; every security company with a research team spends a significant amount of cash to reverse engineer components and attempt to find flaws in them. Microsoft benefits from this by getting first dibs on almost every new bug class.
Compare this to the third-party software developers; none of these things are true. Just in terms of external testing; factor out Adobe, Apple, and Mozilla, and you'd be surprised to find a vendor that did have a policy of third-party assessments.
The Microsoft Insecurity story was a real issue in 2003. Bill Gates got up and said they were going to make security a key focus for the company. Normally, you ignore a statement like that. This time, they meant it, and they had hundreds of millions of dollars to back it up.
Microsoft is the best commercial closed-source vendor in the industry at security.