Security News > 2003 > January > Gates pledges better software security

http://www.nandotimes.com/technology/story/732406p-5342980c.html [Ten weeks of security training for employees is commendable, but security is always evolving; this is akin to the state driving school you take so that speeding ticket isn't on your record. You watch a couple gory traffic movies, a few lectures from the police on the dangers of speeding and sure enough after the course you're driving around town like a total saint. It's only a matter of time before you start falling back into your old habits, and then you're back driving around like Emerson Fittipaldi. If these lessons are going to stick, the security classes have to be held on a regular basis, otherwise there's bound to be another one of those massive pileups and traffic will be backed up for miles. - WK] -=- By TED BRIDIS, Associated Press WASHINGTON (January 23, 2003 9:11 p.m. EST) - Microsoft Chairman Bill Gates promised that his software company will continue improving security in its products, part of a campaign to convince large customers that the Windows operating system is safe for even sensitive businesses. "New security risks have emerged on a scale that few in our industry fully anticipated," Gates wrote in a 1,500-word e-mail distributed late Thursday to about 1 million people. He cited figures showing corporate losses to hackers and other types of electronic attacks exceeded $455 million in 2001. Gates said Microsoft will improve support for "smart cards," devices that can replace or augment computer passwords. A single computer user may need dozens of passwords for e-mail, Web sites and connecting to office systems. Most passwords are easy to guess or difficult to remember. In his e-mail, Gates called passwords "the weak link." Smart cards carried by employees can help authenticate a person's identity when plugged into a computer slot or swiped through an attached reader device. Some cards flash random numbers that an employee must type accurately to access a system. Gates said Microsoft now requires that all its employees use smart cards to access the company's computers from home or while traveling. That policy went into effect after a break-in into Microsoft's internal systems in October 2000. Investigators believe it happened after hackers hijacked an employee's unprotected home computer. Gates did not mention improving support in Microsoft's products for fingerprint or retinal-scan technology. "Over time we expect that most businesses will go to smart card ID systems," he wrote. Gates acknowledged that the technology industry must make significant improvements, adding that, "Microsoft has a responsibility to help its customers address these concerns, so they no longer have to choose between security and usability." Microsoft's products, especially earlier versions of its Windows operating system and Internet server software, have been long derided by experts for problems that put consumers' information at risk from hackers and viruses. As sensitive transactions - from banking to medical filings - increasingly take place online, there has been a new focus on such risks. The Bush administration also has raised concerns that terrorists or foreign governments could launch cyber-attacks against the private networks that operate U.S. water and power systems. Last year, in response to rising concerns, Gates announced a "trustworthy computing" drive at Microsoft and shut down software development for 10 weeks of security training for employees. Gates wrote in his e-mail that the training "taught program managers, architects and testers to think like attackers," and that it helped identify an unspecified number of vulnerabilities in Windows software. Gates also pledged that an upcoming version of Microsoft's flagship server software, called Windows Server 2003, will have many advanced features turned off automatically to improve security. Such features, if used improperly, could make computers vulnerable. Businesses can use the server software to operate their internal company networks and to publish Web sites. - ISN is currently hosted by Attrition.org To unsubscribe email majordomo () attrition org with 'unsubscribe isn' in the BODY of the mail.

News URL

http://www.nandotimes.com/technology/story/732406p-5342980c.html