http://www.eweek.com/article2/0,1895,1941316,00.asp By Ryan Naraine March 22, 2006 Apple is getting a lecture on its security response process from the unlikeliest of places. In a classic flipping of the script, a Microsoft program manager who regularly serves as the public face of the software maker's security response process rapped Apple for the way it handles security guidance to customers. In a series of entries on his personal blog at Stepto.com, Microsoft program manager Stephen Toulouse called on the Cupertino, Calif.-based Apple to hire a security czar and revamp the way information is released when Mac OS X updates are shipped. "Look, the only way you can tackle security issues is by getting out ahead of them and clearly communicating to your users the threat, and the clear guidance on how to be safe," Toulouse declared in a reaction to what he described as the "recent trials and tribulations of Apple in the security space." "Here's the reality, for the next couple of years the Mac OS will experience increasing security threats and mark my words, the company will have to seek outside expertise in the form of a head of security communications in the next 12 months," Toulouse added. He said Apple needs a person "steeped in security issues, true technical analysis, and can lead a good security team to get good guidance out there." Toulouse's statements, which were posted on his own blog and reflected only his personal opinions, echoes a growing sentiment—in and outside Redmond - that Microsoft is now the standard by which other vendors are judged when it comes to dealing to security crises. In the aftermath of the Blaster and Slammer worm attacks, Microsoft has made significant changes to the way it fesses up to security vulnerabilities and communicates with hackers in the private research community. Toulouse said the company certainly learned from its own problems. "A lot of the attacks Apple is experiencing today are just like the most prevalent threats on Windows: Attacks that require the user to take an action first. We've learned the lesson of getting out there fast and providing clear prescriptive guidance," he added. In response to an Apple spokesman who was quoted in a BusinessWeek article as saying the company does not need a security figurehead because the entire Apple staff cares about security, Toulouse said: "That's a little like saying the White House shouldn't have a Department of Homeland Security because, DUH, everyone in the government cares about security!" A separate entry on Toulouse's blog also takes issue with statements from Apple that the content in its security advisories are similar to those released by Microsoft. "[I] went to their most recent security update documentation. I note no mitigating factors in Apple's security communication for customers to assess their risk. I note no frequently asked questions in Apple's security communication to cover what an attacker could and could not do or any other information customers might ask about. I note no workarounds in Apple's security communication for people who cannot immediately deploy the update," Toulouse declared. "I note no deployment information for enterprises in Apple's security communication. I note no severity rating for any of the issues again so customers can assess their risk since updating can be disruptive sometimes. I note no file manifests in Apple's security information for customers to check to make sure updates are applied properly if they wish. I note no caveats in Apple's security communication in case changes made in the update cause known application compatibility issues or support issues are discovered," he added. "I note no free support number for trouble with updates in Apple's security information in case customers need help applying the update," Toulouse countered. He stressed that Microsoft's prepatch security alerts and subsequent security bulletins contain all that information because that's what customers demand. When Apple was forced to re-release a security patch because of problems caused by the original update, Toulouse posted a third blog entry with another call for Apple to implement better internal security coordination and highlighted several weaknesses in the way Apple announced the patched patch. "In the original advisory, they note that a new version is available, so that's good. But, there's no RSS feed around it. You can get an RSS feed for ALL support articles, but not just for the ones that apply to security updates. Apple does have a security announce mailing list. But it doesn't seem to cover when there are new versions available when a bug is introduced by the update," he noted. "One might argue that you don't need those things if you are using the built-in auto-update functionality of OS X, but I would argue back that the fact there was an update to the update might mean people turn that off to test updates before deployment because of problems like this. Oh well," Toulouse declared. _________________________________ InfoSec News v2.0 - Coming Soon! http://www.infosecnews.org
This archive was generated by hypermail 2.1.3 : Thu Mar 23 2006 - 01:58:51 PST