KDB Systems

A while back I wrote a blog post com­par­ing com­puter secu­rity to walk­ing in the rain. This morn­ing it was rain­ing pretty hard dur­ing my morn­ing walk. It wasn’t rain­ing quite as hard as when I wrote the pre­vi­ous post but west coast­ers know what “rain­ing pretty hard” means. For the rest of you, it was rain­ing as hard as you’ll prob­a­bly ever expe­ri­ence unless you live in a rain for­est. For some rea­son I decided not to use the same gear as in the blog post. I had the Halti jacket and Tilley hat on. I didn’t take an umbrella, wear gloves, or wear rain pants. I ignored my own advice from this blog post about secu­rity being a marathon where we can never relax. In half a block my pants were soaked through. A few min­utes later my hands were cold. I had to cut my usual walk in half because I was get­ting cold and wet. Com­puter secu­rity is sim­i­lar. Use the appro­pri­ate tools. Don’t take short­cuts. Never relax or get complacent.

Win­dows 7 is about to hit the RTM mile­stone any day now. I’ve been play­ing with it since the pub­lic beta release last fall. I like it. As soon as it hits RTM I plan to install it in on both my lap­top and desk­top. I’ll only run Vista in vir­tual machines for test­ing. That said I can’t believe all the hyper­bole about Win­dows 7. Yes, it has some nice new fea­tures but come on peo­ple it’s really not that dif­fer­ent from Vista. The vast echo cham­ber of the blo­gos­phere which dissed Vista is prais­ing Win­dows 7 like it’s the sec­ond com­ing. I’ve been try­ing to analyse why.

Resis­tance to change and resis­tance to admit­ting you may be wrong is my best guess. Vista was a huge change from XP. I was in on the beta test­ing of Vista quite early. It was still called Long­horn. I knew imme­di­ately there was going to be a lot of resis­tance. It was actu­ally rea­son­ably secure and forced users and pro­gram­mers into a bet­ter secu­rity model. Any­one remotely inter­ested in secu­rity knows that increased secu­rity always means increased incon­ve­nience. How often did we hear new Vista users say­ing things like “I’m the admin­is­tra­tor dammit. I can look after my secu­rity myself.” Well you know what? 99.9% of us can’t. If you’re run­ning XP it’s prob­a­bly impos­si­ble. Amongst other things I enjoy fig­ur­ing out how mal­ware works. I don’t make much money at it but I remove mal­ware for cus­tomers when I have time. I do this so I can see real world infec­tions and fig­ure out how the mal­ware works. I see mal­ware all the time on the com­put­ers of net­work admin­is­tra­tors and highly sophis­ti­cated users. You want to know why this is? It’s because they run an inse­cure OS as admin­is­tra­tor all the time. The pro­grams they use expect to have admin­is­tra­tor rights. The ser­vices and dri­vers run­ning in the back­ground have carte blanche to do what­ever they want. XP is a secu­rity night­mare peo­ple became used to. There was no way to fix it thus Vista came into being. Vista while mit­i­gat­ing a lot of the prob­lems forced every­one to change their habits in a way that wasn’t con­ve­nient. More impor­tantly it took a while to fig­ure out these changes. It took even longer for a mod­er­ately com­pe­tent geek to fig­ure out new ways to bend the OS to their will. Cou­ple this with the fact that Vista required sig­nif­i­cantly more hard­ware than XP and it was a recipe for dis­as­ter. This caused much angst and bad press in the blo­gos­phere. This angst was end­lessly echoed until it was the “truth” that Vista was flawed. Once this “truth” was out there it was impos­si­ble for any blog­ger to argue against it. There is still no bet­ter way to get click throughs than by writ­ing a blog that disses Vista and links to other blogs as proof. Many of the blog­gers and experts over time learned that this “truth” wasn’t really true. They were afraid to say any­thing for fear of admit­ting they’d been wrong. Along comes Win­dows 7. It has a few cool new fea­tures. The UI has been tweaked a bit. It’s been highly opti­mized to appear faster to the user. Most peo­ple now have hard­ware capa­ble of run­ning Vista. Win­dows 7 runs great on this hard­ware. More impor­tantly all the blog­gers and mod­er­ately com­pe­tent geeks can get up to speed very quickly as they already climbed the learn­ing curve with Vista and it’s not Vista. They don’t have to admit they were wrong in order to say they like it. It’s a recipe for good press in the blogosphere.

Don’t get me wrong. I really like Win­dows 7. Some of the new fea­tures are really cool. The new taskbar is a huge improve­ment. Aero peek has become indis­pen­si­ble. The UI really is more intu­itive most of the time. There are a few things I don’t like. The libraries fea­ture is a great idea that isn’t fully imple­mented. It has tremen­dous poten­tial but as it is imple­mented in Win­dows 7 it doesn’t work for me. The Home­group net­work­ing fea­ture is a secu­rity prob­lem. It makes it very hard to share one folder in your pro­file. If you share a folder in your pro­file the whole \USERS tree is auto­mat­i­cally shared. I had a good dis­cus­sion about this with some­one from Microsoft and in the end we agreed to dis­agree. He said the default ACLs and Access Based Enu­mer­a­tion locked down the fold­ers well enough for home use. I felt they didn’t, espe­cially for a very small busi­ness many of which run the Home ver­sion of Windows.

So what’s my con­clu­sion? I’m some­what grumpy about the fact that Vista will go down in his­tory as Win­dows Me the sec­ond. The blo­gos­phere is prais­ing Win­dows 7 which will cause a lot of peo­ple to finally move away from XP. That’s a very good thing. The Inter­net will be a bet­ter place.

I’m at the 2009 Microsoft MVP Sum­mit. Around 2000 MVP’s descend on Microsoft’s Red­mond Cam­pus for four days of ses­sions with var­i­ous prod­uct teams. The ses­sions include a lot of two way feed­back, which can be bru­tal from both sides. It’s a lot of fun. Today I went to sev­eral secu­rity ses­sions. I got to hear Steve Riley talk and then answer ques­tions from an audi­ence that included Jes­per Johans­son. It was amaz­ing. At one ses­sion Ziv Mador and Steve Adeg­bite were talk­ing about the Con­ficker worm and Microsoft’s response to the vul­ner­a­bil­ity the worm ini­tially used to spread itself. It was fas­ci­nat­ing to hear the process they went through to iden­tify the vul­ner­a­bil­ity and patch it then have to wait and see the exploits devel­oped when the bad guys reverse engi­neer the patch. Dur­ing the ses­sion Steve Adeg­bite said some­thing that really res­onated with me. He said “Secu­rity is like a never end­ing marathon.” I think that is one of the best state­ments I’ve heard regard­ing secu­rity. Secu­rity is hard work. You have to give it 100% all the time. There are no short­cuts. You will never be fin­ished. To some that sounds depress­ing. Steve Adeg­bite said it was a chal­lenge he and his team rel­ished. I got the sense that almost every­one in the room agreed. I realised I was sit­ting in room full of the cream of the crop in the Win­dows secu­rity world. It was fun hob­nob­bing with the cream of the crop. Thank you Microsoft.