RE: Your Opinion


FWIW,

My concerns in regard to this do not relate to the fact that Microsoft is
selling products to address security issues in its other products, they,
like all other major players, are in business for the revenue, if people
are prepared to pay for their products they will, if not they'll go
elsewhere for their security solutions, commercial or otherwise.

My concerns relate more to the long standing and excessively common
practice in Microsoft solutions to grant additional (and in regard to
Security issues, excessive) accesses to it's products and/or sites to
enhance the apparent performance of its products, against other products,
AND that most of these additional accesses are "below the covers", so
they are difficult to collate details for, and/or to block/control them.

Developers have/will always (in my experience) emply any mechanisms to
simplify processes and enhance performance, in MANY instances the risk to
the security and integrity of the environment in which it's deployed is
considerably increased by these practices, all the more so when it is
covered up my the operating system processes.

FWIW, this is just the opinion of a long standing security person, who's
been fgighting many vendors for a long time on these issues, not just
Microsoft.

Neale Green

I have heard the comment "It's a huge conflict of interest" for one
company to provide both an operating platform and a security platform"
made by John Thompson (CEO Symantec) many times from many different
people. See article below.

http://www2.csoonline.com/blog_view.html?CID=32554

In my personal opinion, regardless of the vendor, if they create an OS,
why would it be a conflict of interest for them to want to protect their
own OS from attack. One would assume that this is a responsible
approach by the vendor, but one could also argue that their OS should be
coded securely in the first place. If this were to happen then the need
for the Symantec's, McAfee's of the world would some what diminsh.

Anyway I am just curious as to what other people think.

Thanks in advance

Mark


All mail to and from this domain is GFI-scanned.


.....


All mail to and from this domain is GFI-scanned.


Relevant Pages

  • [NT] Cumulative Security Update for Internet Explorer (MS04-025)
    ... Get your security news from a reliable source. ... * Microsoft Windows NT Workstation 4.0 Service Pack 6a ... Navigation Method Cross-Domain Vulnerability ...
    (Securiteam)
  • SecurityFocus Microsoft Newsletter #75
    ... Microsoft's Internet Security & Acceleration Server with fault-tolerance ... The Microsoft UPnP Vulnerability ... Relevant URL: ...
    (Focus-Microsoft)
  • SecurityFocus Microsoft Newsletter #120
    ... Strengthening Network Security: FREE Guide Network security is a ... MICROSOFT VULNERABILITY SUMMARY ... Microsoft Windows File Protection Signed File Replacement... ... PlatinumFTPServer Information Disclosure Vulnerability ...
    (Focus-Microsoft)
  • Re: A 6% fix from Microsoft Security Bulletin MS03-040 - 828750
    ... Now if the geeks over at Microsoft could get "infected" with some of this ... The Internet is already mind blowing in the way it can bring people ... that creates an unacceptable risk of security compromise and we need to shut ... down all Internet browsing with IE. ...
    (microsoft.public.security.virus)
  • Re: A 6% fix from Microsoft Security Bulletin MS03-040 - 828750
    ... Now if the geeks over at Microsoft could get "infected" with some of this ... The Internet is already mind blowing in the way it can bring people ... that creates an unacceptable risk of security compromise and we need to shut ... down all Internet browsing with IE. ...
    (microsoft.public.win2000.security)
Quantcast