NewsFactor Network | Microsoft Security Efforts Blasted

Microsoft Security Efforts Blasted
By Erika Morphy

July 6, 2004 12:56PM

Digg It!

Security experts are debating Microsoft's efforts to patch vulnerabilities in Internet Explorer that have allowed recent worm attacks. Some say the tech giant is unfairly criticized, since the ubiquity of its software makes it the biggest target for attack. Others say Microsoft is too slow to fix gaping holes.

Latest News

	Angry YouTube Users Pillory Viacom
	DreamWorks, Intel To Develop 3-D Films
	Pioneer Has 400GB Blu-Ray Disc
	Microsoft Offers ActiveX Workaround
	Is Overtime BlackBerry Use Billable?

Microsoft

no doubt is scrambling to release a patch for its loophole-ridden Internet Explorer. The fix it offered last week was basically a disabling of certain features that permitted worm attacks.

In the meantime, the conversation has turned to whether Internet Explorer is worth it for consumers -- a discussion that Microsoft thought it effectively ended when it won its battle with Netscape.

Huge Target

Much of the flack Microsoft has been taking this past week is simply not deserved, Carole Theriault, Security Consultant with Sophos, tells NewsFactor. "Microsoft is one of the biggest operating-system providers in the world," she says, "which means that the sheer numbers are just working against them. It basically is a huge target."

However, part of the warning issued by U.S. government's Computer Emergency Readiness Team, or CERT, was dead on, in Theriault's view. "I definitely agree [that] the homogenous environment makes it easy for hackers to affect everyone with little effort. But I don't necessarily think it automatically follows that Microsoft is less secure because of that." In fact, Theriault thought Microsoft was more secure than most people realized given the huge amount of effort hackers concentrate on their products."

Polarizing Opinions

Not everyone is as sanguine about Microsoft's security path. Russ Cooper, chief scientist for TruSecure told NewsFactor he has been waiting for three years for a patch that would close the vulnerabilities in Internet Explorer that were exploited last week. "A comprehensive patch that would truly fix the problems? God only knows when that will happen," he says.

Then there is Microsoft's security pack, which has been delayed numerous times, but is expected to make an appearance at the end of summer. "It shouldn't be taking that long for Microsoft to put that out," he says.

Theriault does make some points with which most experts agree. One is that users have to be more responsible in maintaining patches.

And two, Microsoft is plowing considerable resources into catching offenders. "I doubt we would have ever caught the Netsky author if it hadn't been for Microsoft's bounty," Theriault said.