Sometimes I wonder whether I am too paranoid. I just got a call, which went like that:

Caller:	“Hello, we are doing a health insurance survey and have just three questions for you, would you mind to join in? Just 20 seconds. We do it for Health Insurance statistics.”
Me:	Was in a very good mood “Sure, shoot”
Caller:	“What is your health insurer?”
Me:	Gave her the name
Caller:	“In which year were you born?”
Me:	“What exactly do you need this data for?”
Caller:	Slightly upset ”As I said: for Health Insurance statistics!”
Me:	“And what company are your working for?”
Caller:	Hang up

She did not even say goodbye

Am I too paranoid with such things? This is my data and I was fairly surprised that she was unable (or unwilling) to answer the questions

Roger

I really love reading Kim Cameron’s Identity Weblog. Fairly often it is thought provoking…

He recently wrote about his experience with the new iPhone privacy policy: Apple giving out your iPhone fingerprints and location. He was one (probably of the very few) reading the privacy policy and found the following statement:

Collection and Use of Non-Personal Information

We also collect non-personal information - data in a form that does not permit direct association with any specific individual. We may collect, use, transfer, and disclose non-personal information for any purpose. The following are some examples of non-personal information that we collect and how we may use it:

• We may collect information such as occupation, language, zip code, area code, unique device identifier, location, and the time zone where an Apple product is used so that we can better understand customer behavior and improve our products, services, and advertising.

So, basically this says that they might collect everything from you, link it to your device identifier and do whatever they want with it. This is called “Privacy” policy.

What strikes me is, that a lot of people do not really see the challenges and risks behind this as this story shows: Non-Personal Information - like where you live?. If I know your device ID and if I have access to the location data of your device, how hard is it to find out who your are? Not really hard. You will be in certain locations more often than in others. In my case you could at least reduce it to four people living in the same household.

So, there is no such thing like “not being able to link a device ID to a person”. This is simply the price we seem to be willing to pay for our constant eagerness to get the coolest app and the best service. Does the consumer really care about privacy when he/she has to balance privacy vs. functionality? Unfortunately I think the more the less…

Roger

I think I told the story thousands of time and everybody knows it but I will do it the 1001^st time now . When I joined Microsoft and became what is the Chief Security Advisor for Switzerland today, we had an airlift for Windows Server 2003. The Product Manager in Switzerland asked me to keynote the event as security became (and still is) one of the core pillars of our servers. Therefore we decided to talk about a new initiative then called Trustworthy Computing. I talked about it and said that Trustworthy Computing has to be an industry initiative and the Security Development Lifecycle something for everybody developing software. During the break, I was then told that this remark is just a way to put the blame on the others instead of us – I am more convinced than ever: It has to be an industry initiative, no matter which development model you choose.

A few years later, we launched SAFECode in partnership with EMC, Juniper, SAP, and Symantec. The goal of SAFECode was and still is to enable experience sharing on how to develop secure code. There are more partners in the meantime – you can find them here. The strange thing happened during the initial press conference. An analyst spoke up and said: “Well, with these companies coming together and sharing experience and information, don’t you just drive the attackers to the companies not being part of SAFECode?”. Well, so what? Any organization can join and/or leverage what we do as everything on our Security Development Lifecycle is freely available and SAFECode published quite some paper on that subject, too. A lot of the tools, the methodology – everything. Free! Download it, use it, go for it!

The reason why I am writing this, is the latest discussions around the Insecure Library Loading, where we published an advisory Insecure Library Loading Could Allow Remote Code Execution. To me it shows one of the biggest challenges in the industry. It is not about securing the platform. We invested a lot of energy in making Windows the most secure operating system out there. Besides applying SDL and a lot of other processes, we included technology like ASLR, DEP and others to make it harder to exploit vulnerabilities. We have probably the best incident response in the industry. But the applications remain a challenge. This is true on Windows (like this case shows) as well as on other platforms. Securing the OS is one thing. Security the application ecosystem on top is a completely different story.

Therefore, there is a clear call to action: If you are developing software, go ahead and use any methodology to engineer security into your product from the ground up. Use SDL or any other process, which helps you to get there – but do something. If you want to get help to implement it, there is the SDL Pro Network, which can assist you (this is not for free then )

It is simply irresponsible not to do it as soon as you application is used broader than “just” on your own PC.

Roger

Steve Ballmer was once asked by a journalist whether and why he allows blogging by Microsoft employees, without any approval process. His answer was that he lets Microsoft employees talk to customers without approval process as well (at least that’s the story which was told ).

You know that I am a big fan of enabling employees to leverage social networks to increase productivity. However, there are risks one has to be aware of and policies which should be followed as this example shows: Blogger beware: Postings can lead to lawsuits

So, beware what you write

Roger

I just read this article E-crime unit arrests suspected phishing gang, which shows that we are making progress in fighting cybercrime. Very good news

Roger