We, being security professionals, are often "just" looking for the most secure way to implement a certain task. Often we tend to forget the user when we implement these measures. I once visited a customer showing me their ultimately secure solution to do VPN and access mail:

• Boot the computer
• Log on
• Start Virtual PC
• Start the secure OS
• Log on
• Within the secure OS, open VPN
• Within the secure OS, start the mail client

Tell me the average user who understands, what I just described. And the next question is just rising: How do you transfer data from the "secure" VM to your machine? I know that this works but how to tell the average user…

A similar problem is discussed with the banks: The least trustworthy part of Internet banking is outside the control of the bank: The user and the user's PC. So, how to address this? Well in Western Europe two-factor authentication is definitely the standard which addresses at least part of the phishing attacks – but unfortunately they get more and more sophisticated: We see targeted Trojans just attacking a single bank, installing a Browser add-in and doing a Man-in-the-Middle just within the Browser. How to address this? The banks are thinking about virtualization. So, the same scenario as described above – and you will definitely lose my mother as a customer as she will not understand, what to do. Internet Banking is a huge saving for the banks and therefore they are really reluctant to change anything at their systems that would make customers moving back to traditional banking – rather risk losing some money.

So, what are the approaches we see?

• Accept the fraud and live with it
• Make the customers pay for the loss of money as well if they act irresponsibly (today, the banks usually refund the lost money)
• Use virtualization and risk losing some customers
• Use something like Terminal Server Application Mode, where the user just accesses the application sitting on a Terminal Server. In the future he/she will not see a difference between online or offline
• Boot from a special CD

Option 1, is what we are doing today: Close the eyes and make sure the press does not talk too much about it. This is paradise for the bad guys – they will never get prosecuted…

Personally, I think that option 2 will start to come up (in combination with other measures)– at least partially and I think it is right. Why should the Internet Banking users care about PC security if there is nothing in for them? However, this is dangerous. We saw already successful attacks on Windows XP SP2 machines, where one would have to say that the user did everything we told him/her to do: The firewall was on, the machine was patched and AV as up-to-date. The only problem he had: He was local Admin – but who isn't at home? Windows Vista will make it definitely harder to have malware installed but up until then, we should not make these users's pay for getting malware installed. But there are a lot of other users who do not care at all and they shall pay for their negligence!

Option 3 and 4 will have some future as the application is not within the control of the user anymore – but it has to be seamless for the user. My mother shall not see the difference between Microsoft Word on the local PC and the Banking Application remote of virtual.

Option 5: Well, tell me mother that she shall prepare her paying on the PC, then reboot with a special CD to do Internet Banking – and by the way, how does the file with the payings come over to the "Secure OS"? Mount the original disk? How does my mother then find the file? She just goes to "My Documents" normally… There is some research around this: Bootable disc eliminates viruses for safer banking – but in my opinion, we are addressing this problem from the wrong angle…

Roger

Looking at my father's PC I always faced the same problem: I wanted to give him a solution that actually took care of his PC without having me too often involved J. Some time ago, we had some particular solutions:

• Backup (use the backup in Windows)
• Anti-Virus (use a third-party product which often brought a lot of functionality I never wanted)
• Anti-Sypware (hmm, a free-ware that flagged every cookie as spyware)
• Disk Defragmentation (I was not too happy with it on XP but, well, it worked)
• Firewall (I used the one in Windows XP SP2 ad did not have outbound-filtering. Before that I used a freeware that prompted for every application that wanted to access the Internet)
• PC Tuning (he installed a freeware from the Internet - much to my dislike)
• ...

Now, look at my father: A PC-savvy person but he would never, ever be able to configure the machine that way and finally we ended up with me looking at his PC whenever we were invited for dinner - much to the "pleasure" of my wife L

When we launched Windows Live OneCare, I was then often asked about the AV-capabilities as this seemed to draw the most attention as we entered the AV market with this launch. It was mostly missed that we were actually launching PC-care software with much more in it than just AV and by the way we simply moved the whole industry in a more "care"-approach and away from traditional AV.

Today, we announced the availability of Windows Live OneCare 2.0 Beta, the next generation of PC-care. If you want to get some insights, we published an interview today with Gina Narkunas, lead product manager for Windows Live OneCare about v2.

Just some high-lights:

• To further redefine and extend the concept of PC care, Microsoft added features to Windows Live OneCare such as multi-PC and home-network management, as well as printer sharing, to help address the modern home environment.
  In addition, this new version establishes a foundation to better address the needs of small businesses that must protect and maintain a number of PCs, but may not have the resources for onsite IT support. To help solve this problem, Microsoft added centralized backup to Windows Live OneCare, so local backup on a small-business network is a simple step instead of a time-consuming hassle.
• Windows Live OneCare 2.0 will include features that are designed to simplify the management and use of multi-PC environments. For example, the new multi-PC and home network management feature will help ease the management of multiple-PC environments by providing a single navigation bar for monitoring the security and maintenance of networked computers. It will also enable one-click actions to resolve issues among computers within a home PC network.

Cool stuff!! As I said: We are brining PC care to a new level (did I already mention the free support calls you get?)!

If you want to have a look at the v2 Beta: http://connect.live.com/

Roger

It is probably the most important and known encryption device ever: The Enigma – the machine that had a strong influence on WWII. Now you can buy your Enigma on e-bay: http://cgi.ebay.com/ws/eBayISAPI.dll?ViewItem&item=270146949978

Roger

I wrote several times already about responsible disclosure and irresponsible disclosure. My point on that is clear: Every vendor has to have transparent and clear processes to handle vulnerabilities. These processes ensure that there will be a timely reaction on responsible disclosed as well as on irresponsible disclosed vulnerabilities causing so called zero-days. These zero-days pose a major risk to all the computer users on the Internet. One could agree now, that not the zero-day is the problem but the vulnerability itself.

Let's take an analogy: My house has certain protection measures against burglars but there are limitations and certainly vulnerabilities. What would you argue there? Is it my fault if the burglar gets in the house or is it a criminal action? It is clear isn't it? How would you think if somebody would pin a piece of paper at the blackboard of the local shop describing in detail how you would be able to break into my house? Not really ethical, isn't it? What would you think if the person would actually sell this information on an Internet auction? Would this be ethical? Criminal?

So, let's come back to the IT industry: I am a firm believer of some facts:

• As stated above: Every company has to have transparency in its processes to handle those vulnerabilities without "zero-daying" itself - meaning making previously responsible disclosed vulnerabilities public.
• Each fixed vulnerability shall be transparent. There are very few exceptions to that rule of the company itself finds the vulnerability and nobody outside knows about it.
• Making vulnerabilities public puts the ecosystem at risk and is definitely unethical - not saying criminal

So recent history showed that there are people who start to look for vulnerabilities for a living - not being paid by the vendors (e.g. I hire somebody to find the problems at my house) but on their own. They wanted then to sell them to the vendors. Our policy here is crystal clear. We do not buy vulnerabilities. We acknowledge the finder in the bulletin. Additionally we bring them together with our Executives and developers at a conference called "Bluehat". As the selling did not work, they sold them on e-Bay. e-Bay acted responsibly and blocked these auctions. The "highlight" now is a new auction site I found, auctioning only vulnerabilities. They have an interesting ethics: "xyz is aiming to a single moving target: to bring the world closer to zero risk.
If the world must become a safer place, the first part of the recipe is simple: to provide a better rewarding for the security researchers, organising an efficient and transparent marketplace, here to maximise the results of their efforts." But going back to the house analogy: If I do not ask anybody to look for vulnerabilities in the concept how I defend my house and somebody finds it and then wants money for that - looks to me like blackmailing.

Coming back to ethics: Why is it always so different on the Internet? Why do people think that selling "vulnerabilities" of my house would be blackmailing but selling software vulnerabilities is making the world a "safer place".

Last but not least, are you sure who is buying the vulnerabilities? Are they criminal? Are they willing to fix the problem? The auctions started around €500 and they actually have bidders already…

At least it seems that I have a different set of values as they do but this might be the reason why I work for Microsoft. If you remember the pillars of Trustworthy Computing: Security, Privacy, Reliability, Business Practices and these practices definitely do not fit to our values

Any thoughts?

Roger

I blogged about three important announcements we made a few months ago (http://blogs.technet.com/rhalbheer/archive/2007/04/25/three-microsoft-announcements.aspx). The different malware teams are ramping up heavily and I am looking forward to working with them. Additionally, v1 of the Malware Protection Portal went live: http://www.microsoft.com/security/portal/default.aspx

Roger