Slashdot Log In
Microsoft's Larry Osterman On Threat Modeling
Posted by
ScuttleMonkey
on Mon Oct 01, 2007 11:42 AM
from the they-threat-model-at-microsoft dept.
from the they-threat-model-at-microsoft dept.
Schneier has pointed out an excellent series of blog posts about threat modeling by Microsoft's Larry Osterman. The series focuses on the PlaySound API as an example. "As you go about filling in the threat model threat list, it's important to consider the consequences of entering threats and mitigations. While it can be easy to find threats, it is important to realize that all threats have real-world consequences for the development team. At the end of the day, this process is about ensuring that our customer's machines aren't compromised. When we're deciding which threats need mitigation, we concentrate our efforts on those where the attacker can cause real damage."
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
Standard Microsoft Threat Modeling Dialog (Score:3, Funny)
Microsoft: You mean you're using an operating system that validates over 450 of our patents?
Consumer: Well, I know that isn't true but
Microsoft: But it'd be a shame if your company was ever engaged with our world class legal team instead of being a 'partner' with the largest software maker ever?
Consumer: But we only have 20 employees.
Microsoft: We know--perhaps you'd be interested in purchasing a copy of our lap dog here, Novell's SUSE?
Consumer: But we already use Red Hat
Microsoft: We heavily suggest you re-evaluate SUSE and when you do your trade study please do note that it's the only Microsoft Certified Genuine Linux. Also, it would be a shame if we had to exercise our patent portfolio on Red Hat and subsequently
Re: (Score:2)
Re: (Score:2, Funny)
Threat: User may play a song without paying for it.
Mitigation: Render the internet useless while playing music.
Threat: User may complain about the network being crippled while playing music.
Mitigation: Blame hardware, blame drivers, then make up some excuse that playing audio requires super-low latency priority for the audio playing app and the network is sacrificed to ensure smooth playback.
Threat: User may notice that the ne
Re: (Score:2)
Microsoft: You obviously are spending too much time on forums, games and caffeine... Did you know Vista..
Slashdotter: I don't live in San Diego [vista.ca.us]...
Microsoft: No, not the town, I mean Vista...
Slashdotter: dewd!!!!!!! I don't even speak Spanish
Microsoft: *gives up*
Re: (Score:2)
Microsoft: ?? [Throws chair...]
That's got to be a hell of a job (Score:5, Insightful)
Put another way, imagine that instead of just setting up a computer for your parents, you had to set one up for *everybody's* parents. All at once.
As much as it's fun to give MS shit for their products, I think I'd last about two hours in that position before I went into the executive washroom and slashed my wrists.
Re: (Score:3, Informative)
Larry started doing this threat modeling bit a while back, as the first article is dated some time ago. He's taken his time, and demonstrated what to do
Re: (Score:3, Informative)
Basically, in a nutshell, a "threat model" is a designers / programmers way of saying "all potential flaws in our application." An example: a 1 meter hole in the side of the Death Star.
Just thought I'd pass that along as I learned it...eh...3 minutes ago.
Re: (Score:2)
--beckerist
I prefer Attack Trees. (Score:3, Insightful)
By Bruce Schneier.
Face it, no matter how secure your little bit of code is, if the SYSTEM is vulnerable, your little bit of code is vulnerable.
Which is where Larry goes wrong in TFA.
You can put all the locks you want on your front door. But if you don't fix the huge hole in the wall next to it, you aren't improving your security at all. No matter what you claim.
Re: (Score:2)
That said, a threat model isn't a panacea. It doesn't replace good coding practices, code reviews, testing, or anyt
Re: (Score:3, Informative)
A threat model is about admitting we have a bad product, saying that fixing it properly is too hard /expensive so we will try and work out what the largest holes are and fix those first.
Nonsense.
Threat modeling is a crucial exercise for any system that wants to be secure. Note that "system" is more than just "software", so just testing your software against all possible inputs is insufficient, even if it were actually possible.
For example, let's suppose the system under consideration is the Windows access control system, responsible for ensuring that only authorized users can read/write files. What are the attack vectors? How many of them can be addressed with input validation tes
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
He may know what he's doing, but here's what he has to say about his colleagues in Microsoft:
"Developers tend to think in terms of what a customer needs. But many times, the things that make things really cool for a customer provide a superhighway for the bad guy to attack your code. "
"It's ad-hoc. M
Re: (Score:2)
Remapping IRQs in the bios didn't fix it....so i sacrificed both cards to the thermite gods.
Re: (Score:2, Insightful)
Re: (Score:2)
Put another way, imagine that instead of just setting up a computer for your parents, you had to set one up for *everybody's* parents. All at once.
As much as it's fun to give MS shit
Re: (Score:2)
He gets to wake up in the morning, hug his kids and then go into work and spend all day trying to figure out the right combination of security defaults that will (a) let people go out and do stuff while (b) protecting them from their own "I'm a average Windows user" level of abject stupidity.
WARNING: This operation may or may not be vital and normal and correct / extremely dangerous and certain to result in fraud. Cancel/Allow?
Indeed, this guy takes his job seriously and is proud of the fact that he has never copped out nor abdicated his responsibilities. We should also respect him for his excellent & highly informative work on theoretical physics titled This Exercise Left To The Reader.
You can't get there from here... (Score:2)
I'd get them a Mac.
Unfortunately, Microsoft can't get there from here.
Re: (Score:3, Interesting)
Because KDE is not an OS. (Score:2)
I can run Linux without KDE. (Score:2)
I have servers running Linux without Konqueror.
I have workstations running Linux without KDE.
Your point will be valid when (and only when) Linus puts a browser into Linux. Until then, I can (and do) run Linux WITHOUT a browser.
And that is only ONE of the reasons that Linux more secure than Windows.
NT 3.51 was Shell Only (Score:2)
Back in the day [about 11 or 12 years ago], you could run Windows NT 3.51 as a shell - it looked just like DOS, except that there was a true multi-user, multi-tasking kernel underneath.
To go into Windows, you typed "WIN" [or "WIN.EXE"], just like you would in Windows 3.10/3.11.
It wasn't until NT 4.0 [circa 1996] that you were required to run Windows.
NT 3.51 was a really cool operating system - e.g. everything had to go through the client/server model, which meant that video was really slow, so video
Re: (Score:2, Troll)
Your point will be valid when (and only when) Linus puts a browser into Linux. Until then, I can (and do) run Linux WITHOUT a browser.
Great. Except that was not my point at all.
My point was that the integration of IE into Windows is nothing special, and the security implications of it are nothing special either. It is perfectly possible to run Windows without explorer.exe or IE or any of the dlls that they both share. You won't get any of the integrated goodness (or badness, depending on your view) and you will have to rely instead on third party apps, and glorious command line to do things like file management and administration, but it
Re: (Score:2)
Re: (Score:2, Informative)
If you really wanted to remove Safari from OSX, you would have to remove the entire webkit [webkit.org] framework that it and many other OSX applications rely on, and I really don't think you would want to do that.
Re: (Score:2)
Yes, webkit still remains, but it can also be removed if one so desires, as long as one is aware of how many OS X applications use it just because
Re: (Score:2)
Re: (Score:3, Informative)
When you open "My Computer" or "Windows Explorer" or even "Control Panel" on a Windows box you're opening IE.
No, you are not. Explorer is explorer, not internet explorer. It uses some of the same dlls that Internet explorer uses, but that kind of library sharing is standard practice in any large desktop enviroment, weather it be OSX or KDE or Gnome.
Microsoft *could* reinvent the wheel 20 times in order to make sire every single app has their own libraries tpo use, but that would be stupid.
Re: (Score:2)
Re: (Score:3, Interesting)
Which ones? I just tried unsuccessfully to access the web through Finder, and when I try to access the local file system through Safari it was smart enough to call Finder, but doesn't access the file system itself.
Explorer doesn't "access the web", either, it just loads up the IE components inside the Explorer window (in the same way you can embed an Excel spreadsheet into a Word document and it fires up Excel from within Word).
I mentioned KDE in my original post, which does integrate the browser and UI
I have no words for this statement (Score:2)
This is a poor security model (Score:3, Interesting)
For high reliability code, you write code on the assumption that other code may have problems. You write code defensively. For any kind of complex system, people will make mistakes. Thus you have to continually verify program integrity and security in a multiply redundant manner. You don't wait until a trust barrier is crossed.
For example, if I have an application controlling a power plant, even if the computer is already running "foreign" code at my privilege level, the control application may still b
Re: (Score:2)
I guess the issue at hand is that MS may well have a brilliant threat modelling process, it could be the best in the world for all I know, but it should feed back into all the areas it impacts upon (not saying it doesn't, just addressing your post.). It is not sufficient to have one or even a few great security procedures and practices if you are unable or unwilling to apply them consistently, or if they fail to address any given known or predictable issue. I
Re: (Score:2)
Yup, it's job one. (Score:2)
Little Dutchboy Mode (Score:2)
My kingdom for a properly placed apostrophe (Score:2)
I cried tears of joy when I read about Microsoft dedicating so many of their resources to securing one customer's machines. It just shows how Steve "Big Hearted" Ballmer is steadily filling what was once a cold, impersonal monopolist with people who are willing to go not just an extra mile, but several extra parsecs to ensure that every one of their customers feels loved and cared for. I'm so very, very glad that there's a stil
Mod parent up for sarcasm (Score:2)
We have to be honest here - this IS innovation! Have you ever heard such quality BS from *any*, and I mean *any* other company? I mean, it's been tough since Enron's "I feel you pain" Shilling went the way of the Dodo, but Thank God we still have Microsoft churning out new way of selling complete and utter BS.
I think we will all feel the loss when the EU finally hangs all of them (at least, that's what they make their conviction sound like
A brilliant statement of the obvious, LO0G (Score:2)
I'd like to see their threat model for IE (Score:2)
"Storing a file in the wrong place can lead to complete compromise... that's OK, if you download a file you really meant to run it anyway, so that's the user's fault."
Law #1 is a lie. (Score:2, Interesting)
It's simply wrong, and it's deceptively named.
One of the important jobs of any operating
Improvements (Score:2)
a)The default action for opening a document ( double click ) should not be the same as the default action for executing a binary ( double click ) and installing software ( yep, another double click ).
b)Don't offer the option to execute binaries when you hit a link in the web browser. If the user wants to run a binary it goes: download -> execute ( again, not double click ).
c)Try to avoid a situation which encourages the user to hit "Allow" without thinking.
Oh, and finall
Re: (Score:3, Interesting)
What would you call passing through airport security to fly on a passenger aircraft?
Airplanes typically don't stand up to serious attacks. I'm not sure where you're trying to go with this analogy.
What are the specs for Vista? (Score:2)
Just license some tech from VMWare or such.
Build the NEW system to that it CORRECTLY conforms to security "best practices" and then incorporate "virtual machines" that can run those "legacy" apps under the OS they were designed for.
Microsoft has already sort of tried this with "compatibility mode" and things like that. The problem is NOT the apps (as people claim). The problem is Microsoft'
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
I will introduce you to a new technology for you to research. It is called NT and is over 15years old. Why the introduction, well if you are so stupid to still correlate Windows with 3.1 concepts then you obviously have no freaking idea what NT is.
The argument you mak