Walking in the Rain Revisited

A while back I wrote a blog post comparing computer security to walking in the rain. This morning it was raining pretty hard during my morning walk. It wasn't raining quite as hard as when I wrote the previous post but west coasters know what "raining pretty hard" means. For the rest of you, it was raining as hard as you'll probably ever experience unless you live in a rain forest. For some reason I decided not to use the same gear as in the blog post. I had the Halti jacket and Tilley hat on. I didn't take an umbrella, wear gloves, or wear rain pants. I ignored my own advice from this blog post about security being a marathon where we can never relax. In half a block my pants were soaked through. A few minutes later my hands were cold. I had to cut my usual walk in half because I was getting cold and wet. Computer security is similar. Use the appropriate tools. Don't take shortcuts. Never relax or get complacent.

Windows 7, Vista, and the Blogoshpere

Windows 7 is about to hit the RTM milestone any day now. I've been playing with it since the public beta release last fall. I like it. As soon as it hits RTM I plan to install it in on both my laptop and desktop. I'll only run Vista in virtual machines for testing. That said I can't believe all the hyperbole about Windows 7. Yes, it has some nice new features but come on people it's really not that different from Vista. The vast echo chamber of the blogosphere which dissed Vista is praising Windows 7 like it's the second coming. I've been trying to analyse why.

Resistance to change and resistance to admitting you may be wrong is my best guess. Vista was a huge change from XP. I was in on the beta testing of Vista quite early. It was still called Longhorn. I knew immediately there was going to be a lot of resistance. It was actually reasonably secure and forced users and programmers into a better security model. Anyone remotely interested in security knows that increased security always means increased inconvenience. How often did we hear new Vista users saying things like "I'm the administrator dammit. I can look after my security myself." Well you know what? 99.9% of us can't. If you're running XP it's probably impossible. Amongst other things I enjoy figuring out how malware works. I don't make much money at it but I remove malware for customers when I have time. I do this so I can see real world infections and figure out how the malware works. I see malware all the time on the computers of network administrators and highly sophisticated users. You want to know why this is? It's because they run an insecure OS as administrator all the time. The programs they use expect to have administrator rights. The services and drivers running in the background have carte blanche to do whatever they want. XP is a security nightmare people became used to. There was no way to fix it thus Vista came into being. Vista while mitigating a lot of the problems forced everyone to change their habits in a way that wasn't convenient. More importantly it took a while to figure out these changes. It took even longer for a moderately competent geek to figure out new ways to bend the OS to their will. Couple this with the fact that Vista required significantly more hardware than XP and it was a recipe for disaster. This caused much angst and bad press in the blogosphere. This angst was endlessly echoed until it was the "truth" that Vista was flawed. Once this "truth" was out there it was impossible for any blogger to argue against it. There is still no better way to get click throughs than by writing a blog that disses Vista and links to other blogs as proof. Many of the bloggers and experts over time learned that this "truth" wasn't really true. They were afraid to say anything for fear of admitting they'd been wrong. Along comes Windows 7. It has a few cool new features. The UI has been tweaked a bit. It's been highly optimized to appear faster to the user. Most people now have hardware capable of running Vista. Windows 7 runs great on this hardware. More importantly all the bloggers and moderately competent geeks can get up to speed very quickly as they already climbed the learning curve with Vista and it's not Vista. They don't have to admit they were wrong in order to say they like it. It's a recipe for good press in the blogosphere.

Don't get me wrong. I really like Windows 7. Some of the new features are really cool. The new taskbar is a huge improvement. Aero peek has become indispensible. The UI really is more intuitive most of the time. There are a few things I don't like. The libraries feature is a great idea that isn't fully implemented. It has tremendous potential but as it is implemented in Windows 7 it doesn't work for me. The Homegroup networking feature is a security problem. It makes it very hard to share one folder in your profile. If you share a folder in your profile the whole \USERS tree is automatically shared. I had a good discussion about this with someone from Microsoft and in the end we agreed to disagree. He said the default ACLs and Access Based Enumeration locked down the folders well enough for home use. I felt they didn't, especially for a very small business many of which run the Home version of Windows.

So what's my conclusion? I'm somewhat grumpy about the fact that Vista will go down in history as Windows Me the second. The blogosphere is praising Windows 7 which will cause a lot of people to finally move away from XP. That's a very good thing. The Internet will be a better place.

Security is a never ending journey

I'm at the 2009 Microsoft MVP Summit. Around 2000 MVP's descend on Microsoft's Redmond Campus for four days of sessions with various product teams. The sessions include a lot of two way feedback, which can be brutal from both sides. It's a lot of fun. Today I went to several security sessions. I got to hear Steve Riley talk and then answer questions from an audience that included Jesper Johansson. It was amazing. At one session Ziv Mador and Steve Adegbite were talking about the Conficker worm and Microsoft's response to the vulnerability the worm initially used to spread itself. It was fascinating to hear the process they went through to identify the vulnerability and patch it then have to wait and see the exploits developed when the bad guys reverse engineer the patch. During the session Steve Adegbite said something that really resonated with me. He said "Security is like a never ending marathon." I think that is one of the best statements I've heard regarding security. Security is hard work. You have to give it 100% all the time. There are no shortcuts. You will never be finished. To some that sounds depressing. Steve Adegbite said it was a challenge he and his team relished. I got the sense that almost everyone in the room agreed. I realised I was sitting in room full of the cream of the crop in the Windows security world. It was fun hobnobbing with the cream of the crop. Thank you Microsoft.

Computer security is like walking in the rain

This morning I was out walking in the rain trying to come up with a good idea for a blog post. I've been thinking a lot about computer security lately. As I was walking I realised that walking in the rain was a good analogy to use when thinking about computer security. I have to deal with a very wet climate. I enjoy spending time outdoors. Sometimes I have things I have to get done that require me to be outdoors. This means I have to come up with a way to deal with rain. I actually have several strategies for dealing with rain depending on what I'm doing, how hard it's raining, and how long I'll be exposed to the rain.

The simplest strategy is to just try to stay out of the rain. This is OK for very short durations in the rain. If I'm quick I stay relatively dry while going from my door to the car, or from the car to a store. In computer terms this would be like running Windows with minimal security enhancements, nothing but what's built in. It's very easy and convenient. Most of the time I won't get too wet. Occasionally I'll get caught in a downpour and get soaked to the skin requiring a full change of clothes. Most of the time I don't use this strategy nor would I recommend it for others as they will inevitably get wet at some point.

The next strategy is to wear a coat. This gives some added protection but when I do get caught in that downpour I may have to change my pants or at the very least my shoes and socks afterwards. If it rains hard enough or I'm outside long enough the coat will eventually soak through. Over time the coat wears out and becomes less effective at keeping the rain out. I have to buy a new coat. There are many different types of coats, some of which give much better protection from the rain than others. There are windbreakers, rain coats, and overcoats. Choosing which coat to use takes experience with the weather and knowing how hard it's likely to rain. This would be like Windows with an antivirus/malware program installed.

This morning while walking it was raining pretty hard. I took an umbrella and wore a rain coat. I was out in the rain for quite a while. I still got a little bit damp but that was mostly because I was too hot while walking up the hills. The problems were mostly internal caused by the protection I was using. Some of the dampness was caused because the umbrella didn't protect against splashes from the rain drops on the sidewalk and for a small period of time it was raining hard enough that some of the drops made it through the umbrella (a Microsoft golf umbrella by the way) in the form of a fine mist. This is like Windows with a hardware firewall (umbrella), antivirus software(coat), and anti-malware software (the coat is a specialised rain coat). All that protection may get in the way and cause it's own problems but in the end it does a pretty good job of protecting me from the rain. If someone was going out in the rain this is what I would recommend, with a warning that it may not be the ultimate in protection. They may get a little damp at times. Some of the dampness may be caused by the protection itself (perspiration).

Last winter I volunteered to work at one of the 2010 Olympic venues (Whistler Olympic Park) for a ski jumping event. One of the perks was a very high tech Halti all weather jacket. This jacket is made of some super high tech material that allows you to work very hard and not get soaked from your own perspiration. At the same time it is completely waterproof even if you are out in the rain for hours on end. I was shovelling snow at the top of the big ski jump in major sleet (mixed rain and snow) for hours. I had a Tilley hat, the Halti coat, similar high tech rain pants, microfibre clothing underneath, rubber boots, and some high tech thinsulate gloves. This would be like running Windows in a virtual machine on a very fast computer that was behind a locked down server class OS that enforced network policies and an enterprise class firewall. I was able to work for several hours in extremely adverse conditions without getting wet at all. I was able to get the work done with no problems caused by either my environment or the gear I was using to protect me from the environment.

What does all this say about computer security? Security is about mitigating risk. You have to assess the risk and come up with a plan to mitigate the risk that is appropriate to your budget and environment. No matter what you do, you will never get the risk down to zero. With enough resources you can get close. The closer you get to zero risk the higher the cost. For most of us the cost/benefit falls somewhere in the middle which means we may have to deal with occasionally getting a little bit damp.