[ISN] Open source review would aid Windows security: Gartner

From: InfoSec News (isnat_private)
Date: Thu May 16 2002 - 00:14:28 PDT

  • Next message: InfoSec News: "[ISN] Control phreaks"

    http://www.theregister.co.uk/content/4/25291.html
    
    By John Leyden
    Posted: 15/05/2002 at 14:12 GMT
    
    Microsoft should dump security via obscurity, and submit its software 
    to open source review, according to Gartner. 
    
    The open source review bit is something so utterly alien, communist
    and horrible to the mind of Bill Gates that it's almost worth us
    running a competition to find what he'd rather do (Sacrifice of
    firstborn? Auction mother on eBay? Tell Steve Jobs he was right?) -
    but actually, Gartner is perpetrating a small piece of sensationalism
    by saying it agrees with Gates about security, "and believes that open
    source review of Microsoft's code is necessary to meet security
    goals."
    
    Which is not the same as saying this is what Bill believes, but they
    had us going for a moment there.
    
    Gartner contrasts the assertion by Jim Allchin, Microsoft's senior
    vice president for Windows, that Windows boxes would be more
    vulnerable to attack if the company had to disclose technical
    information to rivals with previous pronouncements by his Billness.
    
    But computer hackers have had little difficulty breaking into
    Microsoft's closed-source software, it notes.
    
    Gartner analyst John Pescatore writes : "a strategy of relying on
    security through obscurity (hiding source code) has already proven a
    failure for Microsoft. To make future products more trustworthy,
    Microsoft will have to become more expert at developing code that can
    withstand external review."
    
    Over the long term open documentation and public review of program
    interfaces between OSs and applications will lead to better security
    for Microsoft, Gartner believes, even though it notes some short term
    problems.
    
    "Attackers may exploit the exposed interfaces in the short term as the
    process brings to light existing yet undiscovered vulnerabilities. But
    this approach simply means that insecure code will become secure more
    rapidly," Pescatore writes.
    
    Allchin's belief that security offers a valid reason to reject making
    source code visible is misplaced, the analysts conclude.
    
    The disclosure by Microsoft of technical information to rivals, which
    would allow them to make sure their software works better with
    Windows, is among the remedies put forward by the nine dissenting
    states during the current anti-trust trial.
    
    
    
    -
    ISN is currently hosted by Attrition.org
    
    To unsubscribe email majordomoat_private with 'unsubscribe isn'
    in the BODY of the mail.
    



    This archive was generated by hypermail 2b30 : Thu May 16 2002 - 03:37:02 PDT