Rebecca Norlander - What are the big security improvements in the upcoming Windows XP Service Pack 2

"So we took a look at windows, now what are the MAIN points where attacks come from (something like that), E-mail, Web browsing.."

 Well, solve the HUGE problems first, then ofcourse, aim for the smaller ones, small problems can result in HUGE failures...
 That is the fault of every software company.. The just ignore the small problems.. Well... "When Small Problems Strike Back!"
 
Thank's for the video guys! Good stuff!

By the way, ask her to join the website!!! She can help us out in some of the Service Pack 2 disputes that we have been having..

What's up with the video quality? It's really fuzzy.

/Lars.

Most likely because all 3000 channl9 guys are viewing it! We would like to see more of Rebecca on channel9!

Nice work if you can get it Scobleizer!

Video quality looks normal to me, at least compared to most other videos on channel9.

Then again, my eye sight is in pretty poor shape, so *everything* is fuzzy to me <grin>

Eagle: I didn't shoot this one. More Rebecca coming this week.

She is good.. can't wait to see more.

Very well spoken. 

I am glad to hear that MS has a strategy beyond the "oops and fix" of the last few years.

Rebecca hits the nail on the head as to why some MS updates take ages when vulnerabilities are found. It's not that the dev teams can't find solutions or don't feel it's a priority, it's that the fixes they make will be on millions of systems for 3-10 years to come.

Just releasing something that 'works' isn't good enough, and therefore takes a bit more time to get out the door, especially if they are aware of potential conflicts.

I want to hear more from Rebecca because she is a very reasoned voice in what is a very confusing storm.

I also agree with the other comments, her response is definitelly well thought out and makes sense.  She gives some good insight into what goes on in fixing a bug report. The proactive response by Microsoft is also something good to hear. 

I'm a bit hesitant about the firewall being turned on by default in SP2 though (meaning I'll probably get tons of calls from friends/relatives asking why something's not working...), but if it's implemented properly, I also think it's a good thing.

Also my video quality is ok.

You can put a bubble around it...but...if you've ever seen the movie alien...you know that bugs can get inside and pop out yer tummy.

Where's the intra-bubble protection for the OS?  Where's the built-in proactive defense against malware in general?

Service Pack 2 will be an excellent update to protect "The Smith's next door" from getting the slammer worm and having a system that broadcasts junk packets...however, from my experience it won't do anything to help clean up the mess.

Frankly, I'm ready for integrated anti-virus/anti-malware utilities.  Without such things I don't think it's fair to call SP2 anything more than a "bad press prevention kit".

Have to say I agree with amg in a lot of ways. SP2 is definately a big step in the right direction but Microsoft need to be even more proactive.

One of the things that really impressed me about Mac OS X was not the pretty visuals but the fact that it prompts you to re-authenticate when you're about to do something potentially unwanted.

If Windows could adopt a similar strategy, so that programs couldn't, for example, configure themselves to launch at start up without Windows requesting the users permission then a lot of silly little vunerabilities could be fixed in one go. Admittedly the current architecture doesn't help much but it'd be good to see more of this in Longhorn at least.

Interesting paper about the economics of Penetrate-and-Patch:

Why Information Security is Hard - An Economic Perspective (PDF) by Ross Anderson

/Lars.

AndyC wrote:

One of the things that really impressed me about Mac OS X was not the pretty visuals but the fact that it prompts you to re-authenticate when you're about to do something potentially unwanted.

I somewhat agree with this.  I think that it adds another layer of security, at least for those who know what is going on.  But in most cases the user just gets used to typing in their password whenever they are asked for it.  It really doesn't help the non-tech-savy users much.  Just like prompts asking if they want to install Gator or not have proved to not help enough.

yotaku wrote:

It really doesn't help the non-tech-savy users much.  Just like prompts asking if they want to install Gator or not have proved to not help enough.

Perhaps not, but if you make the prompts informative enough without filling it with too much text it might at least make a few people stop and think.

Having to type a password tends to cause the average user to stop and think at least a little bit. The gator type prompts don't because users are too used to just hitting OK to anything that looks like it might be a EULA prompt that they can't be bothered to read.

AndyC wrote:

One of the things that really impressed me about Mac OS X was not the pretty visuals but the fact that it prompts you to re-authenticate when you're about to do something potentially unwanted.

That's a *really* good idea.  I won't presume to know how difficult it would be to implement...but...I've already come up with a crafty plan...just while drafting this msg...and...I can't code well enough to get the turtle to go where I want him to in LOGO. =)

Hurrah! Looks like Longhorn is going to protect Admin accounts anyway:

http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dnlong/html/leastprivlh.asp

It'd be nice if something like this could be done on XP in the meantime though.

WinFS is now officially the second most exciting thing about Longhorn.

We're starting to get transcripts of the videos now.

Wow, grand.  I don’t know if that’s the word that I would apply to it.  Security has been something that has been more and more in the center of what Microsoft thinks about over the last couple of years. 

Clearly, last summer was a great illustration of—even though we had changed some of our engineering practices and we would have some security pushes and some bug bashes and put code out that had been scrutinized, we were still vulnerable to attack.  Last summer it was a pretty heated summer and our customers were pretty unhappy. 

Time to exploit went from in some cases almost a year down to a very small set of days, which meant that the engineering teams didn’t have a lot of time to think about how to fix the problem and write code that they felt could stand the test of time.  That wasn’t going to be good for the quality of our product, and it wasn’t going to be good for our customers. 

It certainly put us in the reaction mode.  What we decided was that we really needed to think differently about how we did security or how we thought about security within Windows.  It wasn’t enough. 

It was great to have taken some steps to refine our engineering practices, and it was great to think differently and do threat modeling and change a lot of the behaviors or fix a lot of the known bugs, but we really needed to be a lot more holistic about how we thought about the code, and kind of go on the offensive. 

How could we turn this into a chess game where we were able to set up a strategy that would help us long term, cut down on the number of immediate exploits, or at least give us more time in order to patch or fix the software or the holes that are found with safeguards in place? 

We took a look at Windows, and we said, Okay, what are the major attack factors?  There were things around e-mail, around IM, around browsing, network attacks, and memory attacks.  We said, Well, let’s take a look at those, and instead of fixing bugs in those areas, what additional technologies or shields can we apply over top of the operating system, so even though there may be vulnerabilities inside the code, there’s something that prevents you from getting to that vulnerability from the outside?  That was kind of the genesis and the difference of SP2 and why it’s such a big deal, because it graduates from the practices that we put into place and adds another set of protective shields over the top. 

It’s by no means the end-all/be-all; it is a step in a very long journey.  I do liken it to a chess game.  We make a move, the hacker community makes a move, the customers make a move, and the goal is to try and get it to the point where we can at least make moves that are more proactive and less of a reactive kind.