[ISN] Usenix: Experts debate security through diversity

[InfoSec News]

http://www.computerworld.com/securitytopics/security/story/0,10801,94250,00.html

By Tom Krazit
JULY 01, 2004 
IDG NEWS SERVICE

The sheer number of worms and viruses directed at Microsoft Corp.'s
Windows operating system and Internet Explorer browser have many in
the computer industry wondering whether the cyberworld would be more
secure if more users relied on alternatives to Microsoft's products.

That description appeared to fit about two-thirds of the few hundred
system administrators and engineers attending a debate between two
prominent security experts at the Usenix 2004 conference in Boston
yesterday. A show of hands before and after the debate indicated that
most of those in attendance would prefer a more diverse group of
operating system and Web browser software.

A monoculture, whether it be in biological terms or in computing
terms, has been shown to be inherently dangerous to members of that
group, said Dan Geer, chief scientist at Verdasys Inc. Geer was
formerly chief technology officer at security company @stake Inc.  
until he was fired last year for authoring a report critical of
Microsoft's dominance of the computing industry and the insecurity of
its products that stems from that position. Microsoft is an @stake
client.

Operating-system diversity can be a relevant part of a secure network,
but forcing companies to diversify their operating systems is a tough
proposition in a time of declining IT budgets and heavy emphasis on
return on investment, said Scott Charney, chief trustworthy computing
strategist at Microsoft.

Geer likened the evolution of the computing world to the evolution of
life on Earth, putting the computer industry at around "the blue-green
algae" stage of development. Early organisms were forced to evolve and
diversify to deal with threats, and the computer industry must also
diversify if it is to confront the serious threat presented by
professional hackers, he said.

"Nature has shown us that a monoculture is a primitive state, or a
dying gasp," he said.

Not every monoculture leads to strife, Charney countered. He pointed
to Southwest Airlines Co., which uses only Boeing 737 airplanes in its
fleet. This allows Southwest to take any one of its pilots or
maintenance staff and put them to work on any plane in its arsenal,
which saves training costs.

The airline's reliance on the 737 is a bit of a gamble, since any
directive from the U.S. Federal Aviation Administration grounding the
737 would effectively ground all of Southwest Airlines, Charney said.  
But this is a trade-off that Southwest views as acceptable given the
cost savings it realizes from the decision to standardize on the
Boeing 737.

Likewise, enterprises that standardize on Microsoft products take a
risk that if Microsoft products are vulnerable to attack, they could
lose important data, Charney said. However, enterprises using products
from a single vendor find it easier for their IT staffs to roll out
patches and critical updates, and they can save the training and
education costs required to teach those employees how to run other
operating systems, he said.

The problem with that argument is that there will always be a few
companies or individuals that fail to patch their systems against new
threats, and those infected systems can be used to create havoc across
the entire Internet, Geer said. If that's going to happen, the
companies that have chosen to rely on a different operating system or
Web browser will be protected against attacks launched at the
vulnerable products, he said.

"I don't care what you get. I just don't want it," Geer said.

Ultimately, software vendors must stand up and be accountable for
their products, Charney said. In the past, customers haven't been as
concerned about security and didn't demand that vendors secure their
products. But that has changed drastically over the past few years, he
said.

Geer called the vulnerabilities in Microsoft's products "a
national-security issue," claiming that the issue is far too important
to the health of the Internet to leave up to the software vendors
themselves.