Microsoft's lessons from the desktop

Microsoft's lessons from the desktop

By Joris Evers
Staff writer, CNET News.com
June 27, 2007, 4:00 AM PDT

Editors'= note: This is part three of a four-day series examining th= e state and future of Web security<= /span>.

Pete Boden wants people at Microsoft to think like criminals. That's why the company held its first "Blue Hat" mee= ting in 2005, which invited hackers onto the corporate campus for lectures and meetings intended to expose security employees to the mentality of digital intru= ders.

Although it has become a popular biannual event, Blue Hat can still be an unnerving experience at times as guest hackers occasionally break Microsoft products in front of the people who built them. But studying s= uch simulated attacks--a process k= nown as "threat modeling"--provides invaluable lessons in teaching developers how an application can be attacked and what the security controls should be.

"Often times, we find that developers= are thinking like a developer or like a user," said Boden, senio= r director for MSN and Windows Live security = at Microsoft.

That's the challenge facing Microsoft. Many company developers and executives beli= eve that securing Web applications= is no different from protecting PC desktop software, something the company has learned over the course of three decades. At the same time, Microsoft must acknowledge the crucial differences in pace and scale that are presenting some of the most difficult security challenges ever encountered in digital technology.

<= /p>

For all its successes, Microsoft has in the past reacted slowly to industry change or has underestimated its impact. Case in point: back in the mid-1990s the company misjudged the significance of the Internet and Web-based computing. What fo<= /st1:PersonName>llowed has become equal parts lesson and legend,= a = call to ar= ms from Bill Gates that ultimately sank arch rival Netscape Communications and set the course of Internet histo<= /st1:PersonName>ry. More recently, Gates and CEO S= teve Ballmer have admitted to miscalculating the value of Web search= and digital mu= sic, long after Google and Apple sto= le the show.

It is understandable, therefore, = why Microsoft is determined not to fall behind in Web security. The key, according to many within the company and be= yond, is not treating it like just another = set of desktop bugs.

"The same rules apply. It is not a = new science, it is a different environment to apply the same science,&quo= t; Boden sa= id. However, he stresses, "We have to be very careful not to get complacent about saying we understand the= problem, because it is going to change right in front of our eyes."

The 18-year company veteran unders= tands why many at Microsoft cling to the notion that Web and desktop security = are essentially the same. Although= the types of threats change, Boden sa= ys desktop and server security lessons are equally valid when applied to online applicatio<= /st1:PersonName>ns.

"There are pieces that are different," he said. "But the discipline of understanding what could break, how it could break, the impact of it breaking, how we protect it, how we respond to any event, those are fundament= ally the same."

The main differences--and they are crucial--are speed and size. As Boden sa= ys, securing Web applications is a= ll about scaling; if security doesn't scale, data could be at risk. =

A year ago, Microsoft had about 30,000 servers in its data centers to support its online services. This year that's up to 80,000, and more growth is planned.

"The business stakes are enormous in this area," B= oden said. "If we or anybody in this business violates the users' trust, then we're essentiall= y out of the business."

Learning the hard way
If Microsoft veterans sometimes sound as if they've seen it all before, there's good reason: they've learned the hard way.

Five years ago, Microsoft's customers were getting hammere= d. That's when Gates launched his Trustworthy Computing initiative to make security a priority. Indu= stry analysts have praised the effo= rt, even though there are still pl= enty of vulnerabil= ities found in Microsoft software and attacks still occur.

Inside the MSN and Windows Live secur= ity offices, banners still work to remind employees of the importance of security, and a "Secur= ity Scorecard" keeps track of performance and ties into individual reviews.

3D"Pete

The regimented approach hasn't alw= ays been welcomed by the rank and = file. Like human resources and IT st= affs, the security department of any= company is sometimes viewed like the internal affairs division within the police force--they're paid to keep an eye on you. The 55 members of the MSN and Windows Live secur= ity team set policies, assess risks and respond to security incidents.

Not surprisingly, initial efforts to reach out to other departments and employees were= met with trepidation.

"We had a robotic image on a lot of our awareness campaign materials last year, and it portrayed a very stern, standoffish appr= oach to the team," Boden said. "We went away from = that, specifically because we want to build better relationships wit= h the development teams."<= /o:p>

Things are better now. Boden's department is engaged in an ongoing marketing campaign within the company, which includes hosting regular= happy hours with local brews and chips and salsa.

"Redhook, Mac and Jack's, we're not short on beer here in the Northwest," Boden said.

Despite their unique mission, Boden's = team in many ways represents a cross-s= ection of the company. Members vary from someone who was hired straight out of high school at age 17 to veteran professionals with doctoral degrees in co= mputer science.

Boden's<= /span> backgro= und is equally diverse. Born in the <= st1:country-region w:st=3D"on">United States to British citizens, he grew up in Southport, England, and attended high school in Philadelphia. It was a Tandy TRS-80 that first got him interested in computers. H= e worked for Deloitte Consulting before joining Microsoft, where he managed desktops and servers before falling into security as a pr= oject manager on Windows 2000.

"I found I enjoyed the challenges and pace of the security function much more than deploying software," Boden said.

He's certainly got plenty of what he asked f= or. As Microsoft has grown with Web technology, the threats to the empire have multiplied commensurately.

Vulnerabilities on the Web include cross-site scripting bugs that could leave personal accounts vulnerable t= o hijacking, facilitate data-thieving phishing sc= ams or let hackers plan= t malicious code on a trusted site. Another ould gain control over a database behind a Web application.

And with expansion has come additional risk, including complications raised by new business relationships with other companies that host parts or all of Microsoft-branded Web sites. In 2005, for example, an MSN Korea partner fell victim to cybe= rcriminals who created a nefarious program that recorded user credentials= for an online game onto the PCs of MSN Korea customers.

That same year, Microsoft kicked off its online initiative, proclaiming the "live era" of software. It announced online complements to Office and Windows. Recently, = it unveiled a revamped version of Hotmail, one of its early online applications.

The "live" push is Micro= soft's bid to partake in the online applicat= ions surge. These applications are helped by new development techniques such as Ajax that stretch the abilities of = what Web sites can do, making them = act more like traditio<= /st1:PersonName>nal desktop apps. That, in turn, h= as translated to new opportunities for security breaches as well.=

"It puts stress on our program, but we have been successful in creating a security model that really pushes accountabil= ity back to the business teams,&qu= ot; Boden sa= id.

In sharing responsibility for security across the company, Microsoft is similar to its rivals. As mashups become an increasingly common form of developing, cooperation on security is essential for connecting multiple online applications.

Above all, Boden--like his counterparts at rival companies--says it is crucial to keep in mind why security is so important. As people continue to store their information online, the Web is becoming the equivalent of their personal filing cabinet.

To that end, Boden and his family are no different: they store all their personal data in Web applic= ations.

"We're definitely all in," he said. "So if it fails, it fails for me p= ersonally and professionally."