Roger Halbheer on Security » Microsoft

10 Years of Trustworthy Computing at Microsoft

Roger Halbheer — Thu, 12 Jan 2012 10:33:15 +0000

Before joining Microsoft a little bit more than 10 years ago, I ran a team at PricewarehoureCoopers on e-Business Risk Management – classical security consulting in the Internet bubble time. When I announced that I will leave PwC and join Microsoft, I got interesting reactions (and remember, this was 2001). Mainly they were along two lines:

Oh, you are joining a desktop company? Why?
A security guy? Joining Microsoft? hmm…

So, these reactions came from the time immediately before we launched Windows XP (you are not on XP today, are you? If you are, read this article). Microsoft was not perceived as an enterprise player and was not seen as secure – they were wrong back then in the first case but right in the second one I guess. I joined being part of the consulting organization but soon met the country manager and I was having a chat with him about the perception on Microsoft’s security in the market. We (say: he ) then decided that we need to work on that and that I shall draw a job description – the job then was called Chief Security Officer and Chief Security Advisor later on. And then Nimda hit! And then Blaster hit! And then Slammer hit! I had the “privilege” back then to run the incident response team in Switzerland and had the privilege to have customers screaming at me, tell me that we fucked up (that was a quote).

Interestingly in the meantime the famous Bill Gates’ Memo hit the streets, saying:

There are many changes Microsoft needs to make as a company to ensure and keep our customers’ trust at every level – from the way we develop software, to our support efforts, to our operational and business practices. As software has become ever more complex, interdependent and interconnected, our reputation as a company has in turn become more vulnerable. Flaws in a single Microsoft product, service or policy not only affect the quality of our platform and services overall, but also our customers’ view of us as a company.

and even more important:

In the past, we’ve made our software and services more compelling for users by adding new features and functionality, and by making our platform richly extensible. We’ve done a terrific job at that, but all those great features won’t matter unless customers trust our software. So now, when we face a choice between adding features and resolving security issues, we need to choose security. Our products should emphasize security right out of the box, and we must constantly refine and improve that security as threats evolve.

This memo led to the creation of Trustworthy Computing with Scot Charney running the organization since it’s beginning and Scott then created the Chief Security Advisor community, the community I was in since the beginning and have the honor to run today globally.

Coming back to the beginning: I remember the first keynote I did for Microsoft was on Trustworthy Computing immediately after this announcement. People approached me in the breaks and asked me whether I really believe what I just said: that Microsoft is going to change. And I confirmed that. I have never seen (not before nor after) a company stopping development for almost four months to address issues and then change the way the company operates – that radically. I would never ever put my name and my credibility at risk if I would not have believed back then and I am still convinced that we did and still do an outstanding job and that we are leading the industry today. Interestingly I do not get these questions anymore…

So, what happened over these 10 years of Trustworthy Computing? What were significant achievements? Well, there are numerous and I have to apologize to the teams I am not mentioning here upfront…

Immediately after SQL Slammer in 2003 we span up a process called Software Security Incident Response Process (SSIRP), a process which is still in place today and we constantly adapt it to new threats and especially new challenges. This was a huge effort as we needed to be able to ramp up an incident organization all across the globe 24*7 – and we still are today.
Probably the biggest and most fundamental change was the way we develop software. We introduced the Security Development Lifecycle (SDL) and constantly keep it updated. Not only did we change the development process internally, we make this information available to the industry for free. Others shall be able to learn from our learning from the past. What concerns me is the slow adoption of such methodologies from a vendor side as well as from a customer side. Who really asks for a process? Typically customers ask for product certification but not for a sound process – something we as an industry need to continue on changing.
Different teams were spun up to address security re-actively like the Microsoft Security Response Center and the Malware Protection Center.
Since 2006 we publish our Security Intelligence Report – the most comprehensive report in the market.
Our Digital Crimes Unit is fighting cybercrime from a legal as well as from a technology perspective. We are working closely with the Council of Europe and other organizations improving the legal situation. We are taking down botnets like Waledac, Rustock and Kelhios in close collaboration with the authorities. We are providing technology to fight sexual exploitation of children like PhotoDNA.

A lot of things happened over the course of the years and there is still a lot to do. These are just some highlights (besides the creation of the Chief Security Advisor community).

If you want to see a condensed version of the “life” of Trustworthy Computing”, here you go:

And the official story on the news center: At 10-Year Milestone, Microsoft’s Trustworthy Computing Initiative More Important than Ever

Sometimes I am asked how many people work at Microsoft on security. And the answer is "everybody” (well, almost ). It is not something we separate and put into a team labeled security. It is part of all our lives to one extent or another and this is the way it should be.

If I would have a wish for 2012, it would be that the industry would stand together much closer to address the issues of today and the future. I do not see that security is something the industry should compete on – rather collaborate to fight the criminals – together with the governments and the governments together with us. I was already fairly vocal about this in the Octopus Conference and will continue to ask for it. To help with this dialogue, we published a model called Cybersecurity Agenda for Governments and will soon publish a book on it as well.

In parallel, the teams internally will continue their great work to bring Trustworthy Computing to the next level. All of this is needed, when we think that there will be a third billion devices added to the Internet in the next five years!

Roger

10 Reasons to migrate off Windows XP

Roger Halbheer — Thu, 22 Dec 2011 10:23:53 +0000

I would like you to sit back, close your eyes and think about the year 2001. Think about how you used technology back then, how you used the Internet. Now, let’s take it a little bit further back in history and think of the year 2000. Just after we realized that the Year-2000-Problem was handled very well by the industry. How you used technology, how you used the Internet, the speed of your Internet connection (I think for me it was ISDN-Dial-Up).

This was the time Windows XP was designed. Windows XP was launched in 2001 and – judging by its success – it was a really great piece of technology. It just runs, rock-solid. Well, it was attacked by a few worms like Blaster, Sasser which led to the development of Service Pack 1, which made us stop development for a few months to look for security vulnerabilities. Over all the years of improvement and learning, this finally led into Windows 7.

If you are still on Windows XP, you probably should re-think your strategy today as the Operating System you are using was not designed to survive in today’s threat landscape. Let me give you 10 reasons why you should definitely move off Windows XP as soon as possible:

First and foremost, Windows XP will go out of support April 8^th, 2014. From then onwards, there will be no more security updates for Windows XP. Even though it is still two years down the road, larger organizations typically need some time to migrate and I am convinced that you need to start now!
Changes in development processes like the introduction of the Security Development Lifecycle (SDL) over the last 10 years within Microsoft significantly reduced the number of vulnerabilities, the likelihood for getting infected by malware and the attack vectors. This can easily be seen when you look at the data from our Security Intelligence Report:
Most probably you are still using Internet Explorer 6, when you are running Windows XP. As the browser is your window to the Internet and the most attacked application you run, running a browser which is three versions behind the latest one is definitely not something you should do for different reasons. One is the point I made above. Development processes have come a long way in the industry to incorporate security into the product from a code level and you would want to leverage this. Additionally, there is a lot of technology built into a modern browser to protect you from current attacks like the Smartscreen filter. So, move off IE6 to Internet Explorer 9 (for Windows Vista and later) or at least Internet Explorer 8 if you stay on Windows XP (which you should not J). To show you the impact, here is a graph published by NSSLabs on how far the browser can protect you from socially engineered malware:
The Security Development Lifecycle is not only about reducing security vulnerabilities at a code level but it is about adding additional protection as well, if there is a vulnerability in the code. It is about Defense in Depth as well – or mainly. As a result we introduced technology like DEP (Data Execution Prevention) and ASLR (Address Space Layout Randomization) into the platform, which makes it much harder to exploit a vulnerability in the code.
Ever tried to run Windows XP without being local Administrator? Yes, you will tell me know that you run it in the enterprise like that. What about changing the time zone when you travel with your notebook? Or adding your home printer? Or, or, or? I have to admit that I tried it more than once and gave up. User Access Control helps greatly. It is a huge improvement and makes the non-admin use of the OS much simpler. Even if you would decide to run as a local admin, you work with the user token until you need admin privileges.
On Windows XP you might be using some third-party disk encryption tool, something which comes for free on Windows 7 – even for USB sticks. It is called Bitlocker and Bitlocker To Go.
Talking of Bitlocker: One of the points which are often forgotten when talking about the OS is that one of the key attack vectors is during the boot process. We have seen successful attacks on Windows XP during the boot processes with rootkits. If you switch on Bitlocker on Windows 7 (and Vista) you get a fairly sound boot protection. If you use a 64-bit version with kernel protection, the risk of getting infected during the boot process is actually fairly low.
Managing Software Restriction Policies in Windows XP was a very hard – close to impossible – task. AppLocker on Windows 7 has improved this greatly.
There are quite some changes on the IP layer: We support IPv6 and there are a lot of improvements in the Windows Firewall.
The last point: Windows XP is just not cool anymore. Windows 7 is just much nicer, cooler to use and just much, much more fun

Besides all the security improvements, which make most sense if they are used in a combination like Bitlocker on Windows 64-bit and Applocker it has to be said that managing such a Windows 7 environment has proofed to be much, much more efficient than Windows XP.

I guess you did not have time to finish reading the post? Started your migration project immediately? Great, go ahead!

Roger

Office 365 Becomes First and Only Major Cloud Productivity Service to Comply With Leading EU and U.S. Standards for Data Protection and Security

Roger Halbheer — Fri, 16 Dec 2011 13:09:09 +0000

A long title but this was the title of the official press statement yesterday. Compliance is always a key question in the public cloud space. Therefore it is very important for us that we now achieved three things:

Office 365 is compliant with EU Model Clauses, Data Processing Agreements and ISO 27001 among other standards.
Office 365 is the first and only major cloud productivity service that enables HIPAA compliance.
The Office 365 Trust Center provides in-depth information about the privacy and security practices for Office 365 and was recently redesigned to be more accessible and easy to understand. The new site can be accessed at http://trust.office365.com.

If you are interested in the official press statement: http://www.microsoft.com/Presspass/press/2011/dec11/12-14O365CloudPR.mspx

Roger

Implementing the Top 4 Defense Strategies

Roger Halbheer — Tue, 13 Dec 2011 13:45:57 +0000

The Australian Defense Signals Directorate maintains a list of the Top 35 Mitigation Strategies against targeted intrusions. This is just a reference to the top strategies:

Patch Applications
Patch the Operating System
Minimize the use of local admin
Application whitelisting
…

Looking at these 35 strategies, the DSD claims that

While no single strategy can prevent this type of malicious activity, the effectiveness of implementing the top four strategies remains unchanged. Implemented as a package, these strategies would have prevented at least 70% of the intrusions that DSD analysed and responded to in 2009, and at least 85% of the intrusions responded to in 2010.

This is pretty much in line with the anecdotal reference I could make where we see successful attacks either coming in through unpatched systems (point 1 and 2), flaws in applications developed in-house (kind of point 2) and social engineering (point 3 and 4). However, these things are not that new, aren’t they? We are talking about patch management since a long time – and patch management not only for the Microsoft environment but the all the applications, being it Microsoft, Adobe, in-house Apps as well as Open Source operating systems.

The DSD even went a step further and developed a really good paper called Implementing DSD’s Top Four for Windows Environments. Something definitely worth reading!

Roger

Finally I have the app: TouchMountain–a “must have” (at least for me)

Roger Halbheer — Tue, 08 Nov 2011 15:13:09 +0000

As I said in one of my recent posts Comparing Windows Phone 7 and iPhone, there are very few apps I am (and now was) missing on my Windows Phone 7 compared to what I know of the iPhone Apps. Actually the one which I was really missing was something like Peaks on the iPhone (even though some friends told me that it did not really work that reliably) – an app, which helps me to name the mountains around me.

Today I heard of TouchMountain – PeakFinder on steroids. These are some screenshots from the marketplace:

You can see the map around you:

But the real cool thing is the real view through the camera:

Including webcams:

And if a peak is missing, there is an interface to add it.

Last but not least: If an app still has five stars in their rating after 10 people submitting, it has to be really, really, really cool

Roger

Connecting with your Windows Phone 7

Roger Halbheer — Fri, 04 Nov 2011 09:34:47 +0000

I tried to convince my wife that using the Windows Phone 7 to keep track of the shopping to do is a cool idea. Well, she is not there (yet). And now I saw the latest commercial…

Probably I should convince my kids, not my wife

Roger

Microsoft Security Compliance Manager 2 ready for download

Roger Halbheer — Tue, 25 Oct 2011 20:20:03 +0000

If you are a regular reader of my blog, you should know the Security Compliance Manager (if you are not, you should become a regular reader of my blog ).

Version 2 of the Microsoft Security Compliance Manager (SCM 2) is now available for download. If you do not know it, this is the way our Solution Accelerator team promotes it:

Security Compliance Manager 2 is a free tool from the Microsoft Solution Accelerators team that enables you to quickly configure and manage your computers, traditional datacenter, and private cloud using Group Policy and Microsoft^® System Center Configuration Manager.

SCM 2 provides ready-to-deploy policies and DCM configuration packs that are tested and fully supported. Our product baselines are based on Microsoft Security Guide recommendations and industry best practices, allowing you to manage configuration drift, address compliance requirements, and reduce security threats.

Easily configure Windows® operating systems, Microsoft® Office applications, and Internet Explorer with industry leading knowledge and fully supported tools.

Take advantage of SCM 2 to import the configuration of a “golden master” reference machine or existing Group Policy. Compare your standards to industry best practices, customize them using rich knowledge, and seamlessly create new policies and DCM configuration packs in the user-friendly UI designed to work with System Center Configuration Manager 2007 R2.

Key Features Include:

Gold master support: Import and take advantage of your existing Group Policy or create a snapshot of a reference machine to kick-start your project!

Configure stand-alone machines: Deploy your configurations to non-domain joined computers using the new GPO Pack feature!

Updated security guides: Take advantage of the deep security expertise and best practices in the updated security guides, and the attack surface reference workbooks to help reduce the security risks that you consider to be the most important!

Compare against industry best practices: Analyze your configurations against prebuilt baselines for the latest Windows client and server operating systems!

This is how it looks like:

and

It is really worth looking at.

For you, this is what you should do:

Download SCM 2.
Help spread the word: tell your friends about Security Compliance Manager 2.
Thoughts? Favorite features? Feedback? Tell it to the dev team.

Want more information on a specific feature? Interested in speaking with the development team? Please contact Venkat Ganti.

Roger

EMET–Protection Against Zero-Days

Roger Halbheer — Sun, 23 Oct 2011 22:27:33 +0000

The Enhanced Mitigation Experience Toolkit is definitely not new but I recently realized that not too many people know about it – and they should. EMET helps you to raise your shields against zero-days and any exploit in the wild. I do not say that it is a silver bullet but it is definitely going into this direction – a little bit.

You can find all the necessary information on EMET here:

That’s the article on our support website: The Enhanced Mitigation Experience Toolkit
Here a TechNet blog post: New version of EMET is now available
To download EMET v 2.1
And a BlueHat session

Before you start, please make sure that you have the Bitlocker recovery key ready (you are running Bitlocker, don’t you?) or that you suspend Bitlocker for the time of the configuration as EMET might change your Data Execution Prevention settings, which change your bootloader, which invalidates the Bitlocker signature, which needs to be proven.

I always love to strengthen my policies and see when something breaks and how. I started to use it and it actually provides you a fairly straight-forward interface with what is running and in which state:

You can then configure your applications and define on which level you want them to be protected. It might then happen that this pops up:

I wont tell you which application it was but I was a little bit scared…

Anyway, if you did not use it yet, I think you should!

Roger

Moving from Linux to Windows

Roger Halbheer — Fri, 21 Oct 2011 19:42:29 +0000

I know, that’s the second time now I am doing this comparison thingy and I promise that I will stop again and deliver you a cool tool as the next post but I read this article: Why I’ve finally had it with my Linux server and I’m moving back to Windows – be sure that you read the comments. To me they are more interesting than the article itself
Roger

Comparing Windows Phone 7 and iPhone

Roger Halbheer — Thu, 20 Oct 2011 16:08:16 +0000

Well, I have to admit – I am biased. I never used an iPhone in my life and based on my experience with my iPod, I hope I never have to, but who knows. I really do not like the UI which – to me – is everything but user friendly and the worst thing with iPhone is iTunes. Whenever iTunes starts to download podcasts and similar things the performance of my notebook just drops significantly – and it is not that slow generally.

When my parents recently wanted to buy a smartphone, they asked me… I told them fairly simple: “It is your choice but I cannot give you any support on an iPhone as I do not know it”. I guess, it is kind of blackmailing but that’s life . So, they bought a Windows Phone 7 and guess what – they love it but they are under constant pressure by their friends… And then recently a person (owning an iPhone) said: “It is actually fairly simple: If you just want to do simple and easy stuff, iPhone is the right device. If it gets sophisticated, you need a Windows Phone 7” – and I did not even offer this guy a bottle of wine, I probably should have.

The reason for this blog is an article I started to read called Windows Phone 7.5 vs. iOS 5 – you should read it. He kind of stumbles across the same issues as I do with my iPod (and btw, he seems to be an experienced iWhatever user):

But it’s not really the performance that bothers me with iOS 5, and as noted previously I’m sure the iPhone 4S will clear those issues up nicely. It’s the usage model. Apple’s mobile OS, like its desktop OS, is inscrutable. It presents a grid of icons, none of which can offer more than the dumbest heads-up that something has happened: A little red “2″ on the Mail icon suggests you have two unread emails, for example, but that’s all you get.

On Windows Phone, yes, we have these dumb little overlays too. And yes, the Mail tile will indeed display a little “2″ when you have two unread emails. But other tiles are more descriptive, “alive with information” as Microsoft says. The Calendar tile has the title and time of your next appointment, so you can check that information without diving into the app. Third party weather apps actually display the weather forecast, so, again, you don’t have to actually tap anything to find out what’s happening. All across the Windows Phone ecosystem, these more intelligent apps provide you with information right from the Start screen, no navigation required.

Before that, he was actually looking at Apple’s business model (emphasis is by me):

On the 3GS, it’s also dog slow, a situation that will obviously not be the case on the iPhone 4S, which has dramatically faster innards. You tap and then wait, and just when you start to doubt you tapped anything, whatever it is you tapped finally launches. It’s not a good experience, and one suspects that’s completely by design. Apple, after all, has mastered the quickie obsolescence/upgrade model better than any company.

Back to the user interface:

I’ve used photo viewing as a canonical example of why the Windows Phone usage model–which thinks and works the way you do, not vice versa–is superior to that of the iPhone and iOS. And that’s as true today as it was a year ago. If you want to view photos in iOS, you–yes, you, the user–needs to think first where those photos may reside. Are they in the Photos app? Are they in the Facebook app? Are they in the MobileMe Gallery app? The App Store for iOS, after all, is just bursting with apps. It’s the platform’s single biggest selling point, as you know.

In Windows Phone, you just visit the Pictures hub. Here, all of your photos are brought together in one place, whether they’re on the phone (taken with the camera or otherwise saved to the device), on Windows Live (where your camera photos can be automatically backed up, albeit in versions for sharing, not full-sized originals), on Facebook, or on Twitter. Third party photo apps also integrate into the Pictures hub, so while you could do the iOS-style “think, then search for the app” thing, you don’t have to: They’re all in one place.

To be fair, he has quite some nice words for iPhone as well:

Where iOS really excels, of course, is with the devices on which it runs. Apple is, at heart, a mobile devices company, and its iPhone, iPod touch, iPad, and Mac laptop product lines are all highly rated and desirable. I don’t have my iPhone 4S yet, but aside from a concern about the too-small screen, which makes the virtual keyboard hard to use, and the lack of an all-new design, there’s little to genuinely criticize there. The current crop of Windows Phones, which date back a year, are getting long in the tooth.

Looking forward to Nokia…

And the last statement I love:

In the end, iOS 5 is the safe choice, the one you recommend to less experienced users. But it is Windows Phone that occupies the innovation seat that Apple once commanded, back in 2007. If you’re looking for the best aesthetics, the best efficiency, and the best software design, Windows Phone is where it’s at. And that’s something I suspect Apple’s most ardent fans will have difficulty understanding. But look beyond your favorite platform for a moment and you will discover that the outside world is in some ways moving along faster than is Apple. And that what brought you to Apple in the first place is happening elsewhere.

Ah, yes you have more apps in the marketplace on iPhone – I know. But I usually challenge people to give me one single app I really want to use (not the stuff I delete after the second use), which I do not have on Windows Phone 7. There is one (1) – it is called “Peak Finder Alps” and that’s it so far. I know that I am not the ultimate representative sample…

When are you going to get your Windows Phone 7?

Roger