Getting Vulnerabilities Out of Software Mark Pustilnik Security Development Lead Secure Windows Initiative Attack Team Microsoft (also a UW PMP alumnus)

Introductions Who am I and what do I do? A few words about the Secure Windows Initiative team at Microsoft http://www.eweek.com/article2/0,1895,1879502,00.asp What is behind Microsoft’s turnaround in security? Leading a small team of world-class security researchers We are at the center of a large concerted effort by Microsoft to shore up security across the entire product line. Quoting eWeek article: Given the events of the last six years, security experts say that what once was unthinkable may someday come to pass: hackers turning their attention from Microsoft to easier pickings in the software of other companies.   Microsoft's development process and procedures are unique, and uniquely suited to a mammoth software development shop. However, companies that want to make their software more secure will have to take many of the same steps as Microsoft to turn their ship around.

Ongoing Process Conception – avoid the impossible Design – catches bad bugs Implementation – more prescriptive Support – addresses things you miss and emerging threats These are very loaded topics. Conception: Can not commence design unless you know what you are after. Design: Bugs introduced at design level cause biggest grief to software author; interoperating system may prove difficult or impossible to patch if underlying design is flawed. Implementation: causes biggest grief to customers, even if patch is easy to code/install (anyone remember Blaster?). Support: must have part of the process. Because you will NOT get all security bugs out of your software.

Conception Case study: DRM solutions What do you expect DRM to do? What are the challenges? Messaging: promises vs. delivery What can realistically be delivered? DRM does not work because your hardware is not trusted. Teams embarking upon digital rights management need to understand the limitations of computer architecture and structure their goals accordingly. Messaging: make sure you do not overpromise, or that will be perceived as a bug. Microsoft’s DRM promises are around: authentication, integrity and difficulty of circumvention, NOT about guaranteed restriction of distribution Possible solutions all revolve around making cost of success greater than the worth of result. Problem is low cost of replication.

Design It’s all about security guarantees Case study: security guarantees of on-line backup software S.G. - A surprisingly difficult concept to understand. Everything revolves around S.G.’s. S.G. is what your customer expects from your software. Case study: Others won’t access my content; restored files do not compromise security; traffic can not be eavesdropped or tampered with in transit; storage is secure; Can/should unencrypted content ever leave your machine? Threat modeling is important and powerful

Implementation Cookbook analysis (if design is solid) Case study: Aren’t you glad you authenticated? Large, constantly evolving landscape. Very domain specific. Discuss attack on Kerberos authentication in the absence of signing/encryption.

Support Organizational structure (people) Platform support (technology) Customer Expectations (management) Your software will need support. Bugs in existing software New types of vulnerabilities being discovered Must plan for it by having an organization centered around security response (collect reports, monitor community, respond to threats) Technology can help disseminate updates (think Windows Update). Currently a hodgepodge of solutions, but centralized solutions are emerging.